A private network access control method, device, electronic device and storage medium

Abstract

The present invention discloses a private network access control method, device, electronic device and storage medium, the method comprising: in response to an attachment request of a target object, obtaining an access network message of the target object; locating a first access unit according to the access network message, obtaining a contract slice of the target object from a data service unit through a first access module; when the first access unit is a default access unit and the default access unit cannot serve slice information for the target object, obtaining an access-allowed slice and a target access unit from a slice selection network element through the default access unit; rerouting the target object to the target access unit, obtaining a contract policy of the target object from a policy unit through the target access unit; performing intersection processing on a requested slice, a contract slice and an access-allowed slice, using the result of the intersection processing as a target slice, and accessing the target object to the target slice. The present invention can efficiently perform private network access control and can be widely used in the field of data processing technology.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a private network access control method, device, electronic device and storage medium. Background Art

[0002] With the development of 5G customized network services, more and more enterprises have proposed the deployment requirements of 5GC sinking to the park, especially the mining, power and other industries generally require the lightweight 5G core network including UDM to be sunk to the enterprise park, and the exclusive core network to ensure the security of enterprise production applications in the park, especially authentication and contract-related user data also need to be stored in the park sinking UDM / AUSF. This deployment method will pose a great challenge to the information security of existing user card making keys, including the information security of the card making keys in the untrusted domain network of the enterprise park, such as transmission, storage, and use. Summary of the invention

[0003] The present invention aims to solve one of the technical problems in the related art at least to a certain extent. To this end, the present invention proposes a private network access control method, device, electronic device and storage medium, which can effectively perform private network access control.

[0004] On the one hand, an embodiment of the present invention provides a private network access control method, including:

[0005] In response to the attachment request of the target object, obtaining an access network message of the target object; the access network message includes an access identifier and a request slice;

[0006] Locate the first access unit according to the access network message, and obtain the contracted slice of the target object from the data service unit through the first access module; the first access unit includes any one of a matching access unit, an initial access unit, and a default access unit;

[0007] When the first access unit is a default access unit and the default access unit cannot serve slice information for the target object, obtaining the allowed access slice and the target access unit from the slice selection network element through the default access unit;

[0008] rerouting the target object to the target access unit, and obtaining the contract policy of the target object from the policy unit through the target access unit;

[0009] The requested slice, contracted slice and allowed access slice are subjected to intersection processing, the result of the intersection processing is used as the target slice, and the target object is connected to the target slice.

[0010] Optionally, locating the first access unit according to the access network message includes:

[0011] Access units are matched according to the access identifiers, and when a matching result exists in the access unit matching, the target object is connected to the matching access unit in the matching result;

[0012] When there is no matching result for the access unit matching, the initial access unit is determined according to the requested slice, and the target object is connected to the initial access unit;

[0013] When the requested slice is empty, the target object is connected to the preset default access unit.

[0014] Optionally, the method further comprises:

[0015] Obtain the cryptographic key and the card information file pre-sent to the data service unit; the card information file includes the authentication key and configuration information; the configuration information includes the contract slice;

[0016] Based on the password key, the card information file is encrypted by a triple data encryption algorithm, and the encrypted data result is sent to the data service unit;

[0017] The cryptographic key is imported into the data service unit, the result of data encryption is decrypted based on the cryptographic key, and the decrypted card information file is stored in the data service unit.

[0018] Optionally, obtaining a cryptographic key and a card information file pre-sent to a data service unit includes:

[0019] Obtain the cryptographic key and configuration information from the card production center, and obtain the preset authentication key; the cryptographic key and configuration information are generated by the card production center according to preset requirements.

[0020] Optionally, based on the cryptographic key, the card information file is encrypted by a triple data encryption algorithm, including:

[0021] Performing a first encryption process on the configuration information using the authentication key to obtain an encryption result of the configuration information;

[0022] The encryption result and the authentication key are subjected to a second encryption process by using the password key to obtain the encryption result of the card information file data.

[0023] Optionally, the data service unit includes a large network data service unit and a private network data service unit; storing the decrypted card information file in the data service unit includes:

[0024] The decrypted card information files are stored in the large network data service unit and the private network data service unit respectively, and network isolation is performed by opening the account data in pairs;

[0025] Among them, the large network data service unit is used to adapt to the data acquisition of the default access unit, and the private network data service unit is used to adapt to the data acquisition of the target access unit.

[0026] Optionally, the method further comprises:

[0027] When the result of the intersection processing is empty, the contract data is obtained from the data service unit, and the access unit is reselected based on the contract data.

[0028] On the other hand, an embodiment of the present invention provides a private network access control device, including:

[0029] The first module is used to obtain an access network message of the target object in response to an attachment request of the target object; the access network message includes an access identifier and a request slice;

[0030] The second module is used to locate the first access unit according to the access network message, and obtain the contracted slice of the target object from the data service unit through the first access module; the first access unit includes any one of a matching access unit, an initial access unit and a default access unit;

[0031] The third module is used to obtain the allowed access slice and the target access unit from the slice selection network element through the default access unit when the first access unit is a default access unit and the default access unit cannot serve the slice information of the target object;

[0032] A fourth module is used to reroute the target object to the target access unit, and obtain the signing policy of the target object from the policy unit through the target access unit;

[0033] The fifth module is used to perform intersection processing on the requested slice, the contracted slice and the allowed access slice, use the result of the intersection processing as the target slice, and access the target object to the target slice.

[0034] Optionally, the device further comprises:

[0035] The sixth module is used to obtain the cryptographic key and the card information file pre-sent to the data service unit; the card information file includes the authentication key and configuration information; the configuration information includes the contract slice;

[0036] The seventh module is used to encrypt the card information file through a triple data encryption algorithm based on the password key, and send the encrypted data result to the data service unit;

[0037] The eighth module is used to import the cryptographic key into the data service unit, decrypt the result of data encryption based on the cryptographic key, and store the decrypted card information file into the data service unit.

[0038] Optionally, the device further comprises:

[0039] The ninth module is used to obtain the contract data from the data service unit when the result of the intersection processing is empty, and reselect the access unit based on the contract data.

[0040] On the other hand, an embodiment of the present invention provides an electronic device, including: a processor and a memory; the memory is used to store programs; the processor executes the program to implement the above-mentioned private network access control method.

[0041] On the other hand, an embodiment of the present invention provides a computer storage medium, which stores a program executable by a processor. The program executable by the processor is used to implement the above-mentioned private network access control method when executed by the processor.

[0042] In an embodiment of the present invention, in response to an attachment request of a target object, an access network message of the target object is obtained; the access network message includes an access identifier and a request slice; the first access unit is located according to the access network message, and the contract slice of the target object is obtained from the data service unit through the first access module; the first access unit includes any one of a matching access unit, an initial access unit and a default access unit; when the first access unit is a default access unit and the default access unit cannot serve slice information for the target object, the slice selection network element is obtained from the slice selection network element through the default access unit to allow access and a target access unit; the target object is rerouted to the target access unit, and the contract policy of the target object is obtained from the policy unit through the target access unit; the requested slice, the contract slice and the allowed access slice are processed, and the result of the intersection processing is used as the target slice, and the target object is connected to the target slice. The embodiment of the present invention uses a customized slice solution to achieve that all enterprise data does not leave the park and ensure the information security of the independent private network. Through the method of the embodiment of the present invention, the security of the independent private network of the park can be effectively enhanced, the rapid, agile and secure deployment of customized network services can be guaranteed, and a lightweight, customized, flexible deployment, easy-to-manage and easy-to-control network can be created. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation on the technical solution of the present invention.

[0044] Figure 1 This is a schematic diagram of an implementation environment for private network access control provided by an embodiment of the present invention;

[0045] Figure 2 It is a flowchart of a private network access control method provided by an embodiment of the present invention;

[0046] Figure 3 A schematic diagram of the K4 key decryption process provided by an embodiment of the present invention;

[0047] Figure 4 A schematic diagram of independent K4 and UDM / AUSF authentication for a private network provided in an embodiment of the present invention;

[0048] Figure 5 A schematic diagram of the 5G SA access process and AMF selection provided in an embodiment of the present invention;

[0049] Figure 6 A schematic diagram of a 2B / 2C shared base station and a dedicated network card access process using a customized slice provided in an embodiment of the present invention;

[0050] Figure 7 A schematic diagram of a 2B / 2C shared base station and a dedicated network card access process using an independent PLMN provided in an embodiment of the present invention;

[0051] Figure 8 A schematic diagram of a 2B exclusive base station and a dedicated network card access process using a customized slice provided in an embodiment of the present invention;

[0052] Fig. 9 A schematic diagram of a 2B exclusive base station and a dedicated network card access process using an independent PLMN provided in an embodiment of the present invention;

[0053] Fig.10 A schematic diagram of dual opening of account data provided by an embodiment of the present invention;

[0054] Fig.11 A schematic diagram of the structure of a private network access control device provided by an embodiment of the present invention;

[0055] Fig.12 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0057] It should be noted that, although the functional modules are divided in the system schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first / S100", "second / S200", etc. in the specification, claims and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0058] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0059] To facilitate the understanding of the technical solution of the present invention, the professional and technical terms that may appear in the embodiments of the present invention are first explained:

[0060] The fifth generation of mobile communication technology (5th-Generation, referred to as 5G): is the latest generation of cellular mobile communication technology, and is also an extension of 4G (FDD-LTE, TDD-LTE), 3G (WCDMA, CDMA2000, TD-SCDMA) and 2G (GSM, CDMA1X) systems. The performance goals of 5G are high data rate, reduced latency, energy saving, reduced costs, increased system capacity and large-scale device connections.

[0061] SA (Standalone) independent networking: refers to the use of 5G core network to connect 5G base stations, and has the complete use and control capabilities of 5G base stations. It can combine MEC, slicing and other technical capabilities to enable users to truly enjoy the bandwidth and overall service experience brought by 5G.

[0062] UPF (User Plane Function): It is a basic component of the 5G Core infrastructure system architecture defined by 3GPP. Operators can use UPF to rate limit, charge, and legally intercept user data transmission, and record traffic usage. 5G's UPF can be sunk on demand to reduce network latency, increase transmission rate, access the user's intranet, and keep traffic within the campus, meeting the needs of users at different levels. The ability of UPF to sink is the result of the separation of the 5G control plane and the user plane, and is a reflection of the great progress of 5G compared to 4G.

[0063] PCF (Policy Control function): Similar to PCRF (Policy and Charging Function) in 4G network elements, it is mainly used for billing, dynamic policy control, etc.

[0064] SMF (Session Management Function) is mainly responsible for interacting with the separated data plane, creating, updating and deleting PDU sessions, and managing the session environment with UPF.

[0065] AMF (Access and Mobility Management Function), AMF is the main functional unit of 5GC, completing the access and mobility management of terminal users.

[0066] UDM (Unified Data Manager): By providing a management architecture that can uniformly manage basic IT facilities such as networks, security, and storage, UDM creates a unified management center for IT systems, helping users to more effectively manage, utilize, and protect data assets.

[0067] AUSF (Authentication Server Function): AUSF is used to receive the request from AMF to authenticate the terminal (UE), request the key from UDM, and then forward the key issued by UDM to AMF for authentication.

[0068] DNN (Data Network Name): It is responsible for identifying the 5G network exit for different services in the 5G network. It can be simply understood as a label bound to a specific service, which can guide the transmission of data flow in the network element. It is similar to the APN in the 4G EPC network, which can determine the access method through which the terminal accesses the network.

[0069] PLMN (Public Land Mobile Network) refers to the network established and operated for the purpose of providing land mobile communication services to the public, including wireless and core networks.

[0070] CRM (Customer Relationship Management): refers to the process by which enterprises use corresponding information technology and Internet technology to coordinate the interaction between enterprises and customers in sales, marketing and services in order to improve their core competitiveness, thereby improving their management methods and providing customers with innovative and personalized customer interactions and services. Its ultimate goal is to attract new customers, retain old customers, and convert existing customers into loyal customers to increase the market.

[0071] OSS (Operation Support Systems): The support platform required for operators to carry out business and operate. OSS is an integrated, information resource sharing support system of a certain operator. It is mainly composed of network management, system management, billing, business, accounting and customer service. The systems are organically integrated through a unified information bus. The operation support system includes the operation and maintenance center and the network management center. It is responsible for the inspection and management of the communication quality and operation of the entire network, and records and collects various data in the operation of the entire network. It has connecting lines between all devices in the entire network and performs monitoring and control functions on each device.

[0072] 5G slicing can be understood as dividing a physical network into different logical networks according to demand. Different logical networks carry services with different characteristics (such as high speed, large connections and low latency, etc.), thereby meeting the different index requirements of network resources for users in different industries.

[0073] It is understandable that the private network access control method provided in the embodiment of the present invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various types of terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal is a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited to this.

[0074] like Figure 1 FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the invention. Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected to a network wirelessly or wired to complete data transmission and exchange.

[0075] Server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0076] In addition, the server 101 can also be a node server in the blockchain network. Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm.

[0077] The terminal 102 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The terminal 102 and the server 101 may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present invention.

[0078] Based on the example Figure 1 In the implementation environment shown, an embodiment of the present invention provides a private network access control method. The private network access control method is applied to the server 101 as an example for explanation below. It can be understood that the private network access control method can also be applied to the terminal 102.

[0079] Reference Figure 2 , Figure 2 The flowchart of the private network access control method applied to the server provided in the embodiment of the present invention, the execution subject of the private network access control method can be any of the aforementioned computer devices (including servers or terminals). Figure 2 , the method comprises the following steps:

[0080] S100, in response to an attachment request of a target object, obtaining a network access message of the target object;

[0081] It should be noted that the access network message includes an access identifier and a requested slice;

[0082] For example, in some specific embodiments, the terminal (UE) initiates an attachment request, and the UE sends an AN Message (Access Network Message) to the wireless side (RAN). In the case of 5G access, the AN parameters in the AN message include GUAMI (AMF's unique identifier, i.e., access identifier), requested NSSAI (i.e., requested slice), etc.

[0083] S200, locating the first access unit according to the access network message, and obtaining the contracted slice of the target object from the data service unit through the first access module;

[0084] It should be noted that the first access unit includes any one of a matching access unit, an initial access unit and a default access unit; in some embodiments, locating the first access unit according to the access network message may include: matching the access unit according to the access identifier, and when there is a matching result for the access unit match, connecting the target object to the matching access unit in the matching result; when there is no matching result for the access unit match, determining the initial access unit according to the requested slice, and connecting the target object to the initial access unit; when the requested slice is empty, connecting the target object to the preset default access unit.

[0085] Exemplarily, in some specific embodiments, the wireless side (RAN) selects AMF (access unit) or directly forwards it to the default AMF (default AMF). RAN preferentially selects AMF based on GUAMI (AMF's unique identifier). If there is no matching information, the initial AMF is selected based on the slice requested by the terminal (Requested NSSAI). If the terminal does not provide the requested slice in the AN message, the registration request is sent to the default AMF (i.e., the default AMF). Then AMF obtains the network slice (Subscribed NSSAI, i.e., the contracted slice) subscribed by the user from UDM (i.e., the data service unit).

[0086] S300: When the first access unit is a default access unit and the default access unit cannot serve slice information for the target object, obtaining the allowed access slice and the target access unit from the slice selection network element through the default access unit;

[0087] Exemplarily, in some specific embodiments, if the default AMF cannot provide the user service slice information corresponding to this terminal, the slice selection network element NSSF is used to obtain the allowed access slice (Allowed NSSAI, i.e. allowed access slice) and the target AMF (target AMF, i.e. target access unit).

[0088] S400, rerouting the target object to the target access unit, and obtaining the subscription policy of the target object from the policy unit through the target access unit;

[0089] Exemplarily, in some specific embodiments, the target AMF is rerouted, and then the AMF obtains the user subscription policy from the PCF (policy unit).

[0090] S500, perform intersection processing on the requested slice, the contracted slice and the allowed access slice, use the result of the intersection processing as the target slice, and access the target object to the target slice.

[0091] For example, in some specific embodiments, according to the previous process, the terminal completes AMF access. Slices include three types: requested slices (expressed as R, optional), contracted slices (expressed as S), and slices allowed to access (expressed as A). The slices accessed by the terminal are the intersection of R (if any), S, and A. If there is no result after the intersection of the three, the user access is denied and the access process fails.

[0092] It should be noted that, in some embodiments, the method may further include: when the result of the intersection processing is empty, obtaining the subscription data from the data service unit, and reselecting the access unit based on the subscription data.

[0093] Exemplarily, in some specific embodiments, when AMF is reselected, the private network AMF (New AMF) and the large network AMF (OldAMF) respectively perform the following operations:

[0094] AMF registers with UDM and obtains contract data. Private network AMF calls UDM's service-oriented interface Nudm_UECM_Registration to register with UDM and subscribe to change notifications.

[0095] AMF calls the UDM service interface Nudm_SDM_Get to obtain the contract data.

[0096] After AMF successfully obtains the contract data, it subscribes to the contract data change notification from UDM through Nudm_SDM_Subscribe.

[0097] After the New AMF successfully registers with the UDM, the UDM sends a Nudm_UECM_DeregistrationNotify notification to the Old AMF, carrying the notification reason value.

[0098] Old AMF calls the UDM service interface Nudm_SDM_Unsubscribe to cancel the contract data subscription.

[0099] During the registration and access of 5G enterprise private network users, the base station configures the large network AMF as the default AMF and the private network AMF as the target AMF to complete the subsequent session establishment to the SMF and UPF of the enterprise private network.

[0100] It should be noted that, in some embodiments, the method may also include: obtaining a cryptographic key and a card information file pre-sent to the data service unit; the card information file includes an authentication key and configuration information; the configuration information includes a contract slice; based on the cryptographic key, encrypting the card information file through a triple data encryption algorithm, and sending the encrypted data result to the data service unit; importing the cryptographic key into the data service unit, decrypting the encrypted data result based on the cryptographic key, and storing the decrypted card information file in the data service unit.

[0101] Among them, in some embodiments, obtaining the cryptographic key and the card information file pre-sent to the data service unit may include: obtaining the cryptographic key and configuration information from the card making center, and obtaining a preset authentication key; the cryptographic key and configuration information are generated by the card making center according to preset requirements.

[0102] Among them, in some embodiments, based on the cryptographic key, the card information file is encrypted through a triple data encryption algorithm, which can include: performing a first encryption process on the configuration information through an authentication key to obtain an encryption result of the configuration information; performing a second encryption process on the encryption result and the authentication key through the cryptographic key to obtain the result of the card information file data encryption.

[0103] Among them, the data service unit includes a large network data service unit and a private network data service unit; in some embodiments, storing the decrypted card information file in the data service unit may include: storing the decrypted card information file in the large network data service unit and the private network data service unit respectively, and performing network isolation by opening the account data in both directions; wherein the large network data service unit is used to adapt the data acquisition of the default access unit, and the private network data service unit is used to adapt the data acquisition of the target access unit.

[0104] Exemplarily, in some specific embodiments, the embodiments of the present invention adopt a dedicated card-making key solution. Specifically, sensitive data such as keys include OP (operator variable algorithm configuration domain, i.e., configuration information), OPC (the result of encryption calculation performed by OP using Ki as the key), Ki (authentication key) and K4 (cryptographic key, which is the key of Ki and is used to encrypt and decrypt Ki). OPC and Ki are single-user card-making key information, and OP and K4 are global information, of which K4 is pre-configured in the UDM / AUSF device (i.e., the data service unit), and OP is pre-configured by the card-making manufacturer. K4 is the key information for card-making, and K4 is the key of the 3DES symmetric encryption algorithm, which is used to encrypt and decrypt the key information of the card (OPC and Ki). 3DES is a triple data encryption algorithm, abbreviated as TDEA, Triple DEA, or 3DES. Figure 3As shown, the K4 encryption and decryption process is as follows:

[0105] (1) The card production center generates K4 information (key, key serial number) and OP according to the requirements.

[0106] (2) When the card production center produces the card, it uses K4 to encrypt the card information (OPC and Ki) and sends the encrypted card information file to the CRM system.

[0107] (3) UDM imports K4 information (key, key serial number) into UDM. (Including centralized UDM (also called large network UDM) and sinking UDM)

[0108] (4) When a new card is installed, the server will send the card information (OPC and Ki) encrypted by K4 in the CRM system to the UDM through an activation command.

[0109] (5) After receiving the activation instruction, UDM finds the imported corresponding K4 "key" through the "key serial number" field in the activation instruction, decrypts the card information in the activation instruction and stores it in UDM.

[0110] Taking into account the security of card data in the enterprise independent private network mode, especially in the independent UDM / AUSF mode, the isolation of card data is guaranteed to avoid customer data security issues in extreme cases affecting other customers or large network services. The present invention supports customer-level card data production for card making in the enterprise independent private network mode, realizes the isolation of code number resources from the existing network, the isolation of card making OP data, and the customer-level isolation of transmission encryption K4 keys, so as to ensure the security of customer card data during production, transmission and use.

[0111] Exemplarily, in some specific embodiments, the embodiments of the present invention adopt a dual-opening strategy for business account data. Specifically, in the Ruyi mode of the 5G customized network, enterprises can flexibly choose to deploy network elements to meet industry needs and application scenarios. In order to solve the security issues between the client-side network elements in the untrusted domain and the dual elements of the trusted domain large network, and to maximize the security of user authentication and contract data, a data synchronization system is completed. The business account system adopts a dual-opening solution, which is sent to the large network UDM and the enterprise private network UDM respectively. The Ruyi data synchronization center realizes the network isolation of the sinking network elements and the large network 5GC, and adapts to different sinking manufacturer network element activation protocols and instructions, simplifies the peripheral system docking and development process, and helps customers to quickly deliver their services.

[0112] In order to explain the principle of the technical solution of the present invention in detail, the overall process of the present invention is described below in combination with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and cannot be regarded as a limitation of the present invention.

[0113] First of all, it should be explained that 5G slicing can be understood as dividing a physical network into different logical networks according to needs. Different logical networks carry services with different characteristics (such as high speed, large connections and low latency, etc.), thereby meeting the different indicators of network resources required by users in different industries.

[0114] With the development of 5G customized network services, more and more enterprises have proposed the deployment requirements of 5GC sinking to the park, especially the mining, power and other industries generally require the lightweight 5G core network including UDM to be sunk to the enterprise park, and the exclusive core network to ensure the security of enterprise production applications in the park, especially authentication and contract-related user data also need to be stored in the park sinking UDM / AUSF. This deployment method will pose a great challenge to the information security of existing user card making keys, including the information security of the card making keys in the untrusted domain network of the enterprise park, such as transmission, storage, and use.

[0115] In order to ensure the large-scale development of independent private networks of 5G customized networks for enterprises and solve information security risks, the present invention proposes a high-isolation access method based on 5G enterprise private networks that is independent of the operator's large network. Through independent card-making keys, synchronous double opening of accounts, independent PLMN and customized slices, etc., the public network and the enterprise's sinking network can be securely isolated, security risks can be effectively avoided, and the fast, agile and secure deployment of customized network services can be guaranteed.

[0116] In the 5G enterprise independent private network scenario, the enterprise private network core network provides access and mobility management, session management, authentication management, user plane data forwarding and other functions, supports data and voice services, and meets customer needs for fast networking, dedicated private network, large bandwidth, stable and low latency. Compared with the public network, it has the following characteristics:

[0117] High isolation: Use dedicated base stations, exclusive wireless resources, and customized dedicated campus-level UPF and other dedicated network equipment. Business-related network elements are completely isolated from the public network and are not affected by external network connection failures, ensuring that enterprise business is not interrupted.

[0118] High bandwidth: Provides dedicated frequency customization and dedicated structure customization, and combines super uplink, exclusive uplink, multi-carrier aggregation and other technical means to enhance the customization capability of uplink and downlink wireless bandwidth.

[0119] Deep coverage: Provide accurate surveys for enterprise parks, customize wireless networks on demand, and prevent mutual interference between public and private wireless signals through professional interference avoidance measures.

[0120] The present invention mainly includes the following technical solutions:

[0121] Different key parameters are used between enterprise private network account cards and public account cards to ensure the data security of enterprise account cards while avoiding the risk of leakage of private network UDM card making keys to public customer card number information;

[0122] Adopt independent PLMN and customized slices, which are completely isolated from the big network and have clear business logic, meeting the enterprise's needs for security and data not leaving the campus;

[0123] By adopting the dual-opening method of account data, user contract data is opened to the large network UDM / AUSF and private network UDM / AUSF through the customized network data synchronization center, avoiding multiple account management and control, establishing real-time monitoring methods for account information, and realizing compliance management and control of independent private networks.

[0124] 1. Dedicated card making key:

[0125] Sensitive data such as keys include OP (operator variable algorithm configuration domain), OPC (the result of encryption calculation performed by OP using Ki as the key), Ki (authentication key) and K4 (cryptographic key, which is the key of Ki and is used to encrypt and decrypt Ki). OPC and Ki are single-user card-making key information, OP and K4 are global information, of which K4 is pre-configured in the UDM / AUSF device (ie, data service unit), and OP is pre-configured by the card-making manufacturer. K4 is the key information for card-making, and K4 is the key for the 3DES symmetric encryption algorithm, which is used to encrypt and decrypt the key information of the card (OPC and Ki). 3DES is a triple data encryption algorithm, abbreviated as TDEA, Triple DEA, or 3DES. For example Figure 3 As shown, the K4 encryption and decryption process is as follows:

[0126] (1) The card production center generates K4 information (key, key serial number) and OP according to the requirements.

[0127] (2) When the card production center produces the card, it uses K4 to encrypt the card information (OPC and Ki) and sends the encrypted card information file to the CRM system.

[0128] (3) UDM imports K4 information (key, key serial number) into UDM (including centralized UDM (also called large network UDM) and sinking UDM).

[0129] (4) When a new card is installed, the server will send the card information (OPC and Ki) encrypted by K4 in the CRM system to the UDM through an activation command.

[0130] (5) After receiving the activation instruction, UDM finds the imported corresponding K4 "key" through the "key serial number" field in the activation instruction, decrypts the card information in the activation instruction and stores it in UDM.

[0131] like Figure 4 As shown, it is a schematic diagram of independent K4 and UDM / AUSF authentication in a private network, which comprehensively considers the security of card data in the enterprise independent private network mode, especially in the independent UDM / AUSF mode, ensures the isolation of card data, and avoids customer data security issues in extreme cases affecting other customers or large network services. The present invention supports customer-level card data production for card making in the enterprise independent private network mode, realizes the isolation of code number resources from the existing network, the isolation of card making OP data, and the customer-level isolation of transmission encryption K4 keys, so as to ensure the security of customer card data during production, transmission and use.

[0132] 2. Dedicated PLMN and customized PLMN:

[0133] like Figure 5 As shown in the figure, the 5G private network user access process and AMF selection process are as follows:

[0134] (1) The terminal (UE) initiates an attachment request and sends an AN Message (Access Network Message) to the wireless side (RAN). In the case of 5G access, the AN parameters in the AN message include GUAMI (AMF unique identifier), requested NSSAI (slice), etc.

[0135] (2) RAN selects AMF or directly forwards it to the default AMF. RAN preferentially selects AMF based on GUAMI (AMF's unique identifier). If there is no matching information, the initial AMF is selected based on the slice requested by the terminal (Requested NSSAI). If the terminal does not provide the requested slice in the AN message, the registration request is sent to the default AMF (i.e., the default AMF).

[0136] (3)AMF obtains the user's subscribed network slice (Subscribed NSSAI) from UDM.

[0137] (4) If the default AMF cannot provide the slice information for this user service, it goes to the slice selection network element NSSF to obtain the allowed access slice (Allowed NSSAI) and the target AMF (target AMF).

[0138] (5) Reroute to the target AMF.

[0139] (6)AMF obtains the user contract policy from PCF.

[0140] In the present invention, when a 5G enterprise private network user registers for access, the base station configures the large network AMF as the default AMF and the private network AMF as the target AMF to complete the subsequent session establishment to the SMF and UPF of the enterprise private network.

[0141] According to the above six processes, the terminal completes AMF access. Slices include three types: requested slices (expressed as R, optional), contracted slices (expressed as S), and slices allowed to access (expressed as A). The slices accessed by the terminal are the intersection of R (if any), S, and A. If there is no result after the intersection of the three, the user access is denied and the access process fails.

[0142] When AMF is re-elected, the private network AMF (New AMF) and the large network AMF (Old AMF) perform the following operations respectively:

[0143] AMF registers with UDM and obtains contract data. Private network AMF calls UDM's service-oriented interface Nudm_UECM_Registration to register with UDM and subscribe to change notifications.

[0144] AMF calls the UDM service interface Nudm_SDM_Get to obtain the contract data.

[0145] After AMF successfully obtains the contract data, it subscribes to the contract data change notification from UDM through Nudm_SDM_Subscribe.

[0146] After the New AMF successfully registers with the UDM, the UDM sends a Nudm_UECM_DeregistrationNotify notification to the Old AMF, carrying the notification reason value.

[0147] Old AMF calls the UDM service interface Nudm_SDM_Unsubscribe to cancel the contract data subscription.

[0148] In the registration access of 5G enterprise private network users, the base station configures the large network AMF as the default AMF and the private network AMF as the target AMF to complete the subsequent session establishment to the SMF and UPF of the enterprise private network. Therefore, the present invention proposes a method of using independent PLMN and customized slices in two scenarios to achieve the shortest signaling path access to the enterprise private network.

[0149] Scenario 1: Figure 6 As shown in the figure, a flowchart of using a 2B / 2C shared base station and a dedicated network card to access using a customized slice is shown. For enterprises with both material and human needs within the park, the base stations within the park are provided for use by two types of users: 2B / 2C. 2B users access the private network of the park enterprise, and 2C users access the public network.

[0150] Using customized slices + large network PLMN, the service process is as follows:

[0151] (1) When the UE goes online for the first time, it does not request a slice and goes to the provincial AMF by default, and then to the 2B UDM for authentication. After authentication, the 2BUDM reply to the AMF message carries the customer slice;

[0152] (2) Slice Y is not configured on the provincial AMF. When redirecting, the provincial AMF queries the provincial NSSF to obtain the C-IWF information, and then queries the provincial NRF (Network Repository Function) to obtain the business address of the C-IWF.

[0153] (3) C-IWF receives a redirection request from the provincial AMF network, which contains information such as the user's slice and location.

[0154] (4) C-IWF forwards the request to the correct C-AMF based on the mapping relationship between the AMF configured in itself and the slice and location, and accesses the customer 5GC;

[0155] (5) The UE goes online for the second time and carries the slice, directly accessing the Ruyi AMF;

[0156] like Figure 7 As shown in the figure, it is a flowchart of applying 2B / 2C shared base station and using independent PLMN access flow for private network card; after adopting the dedicated private network PLMN, the service process is: UE carries the dedicated PLMN in the online request, the base station accesses C-AMF according to the correspondence between PLMN and AMF, and then goes to C-UDM for authentication, after the authentication is passed, a session is established and the customer platform is accessed; it has the following advantages: the service logic of independent PLMN is clear, the dedicated PLMN that needs to be set on the SIM card is the accessible PLMN, the signaling access of the large network and the private network card is completely isolated, and the large network card service is not affected within the range of the independent base station, which is suitable for use in scenarios with high isolation and security requirements.

[0157] Scenario 2: Figure 8 As shown in the figure, it is a flowchart for using a 2B exclusive base station and a private network card using a customized slice access. For scenarios where there are only 2B services in the park, the base station in the park is exclusively used by 2B users and accesses the private network of the park enterprise. The business process using customized slices is as follows:

[0158] (1) For the first registration, users access through a dedicated base station and access Ruyi AMF by default.

[0159] (2) Ruyi AMF obtains user authentication information, subscription data, etc. (such as the user's subscribed slice) from 2B AUSF / UDM through C-IWF, completes authentication and registration, and the UE can obtain the subscribed slice.

[0160] (3) During subsequent access, the UE carries the slice access and accesses the Wing AMF for registration.

[0161] like Fig. 9 As shown in the figure, the application of 2B exclusive base station, the private network card uses an independent PLMN access flow chart. The business process of using an independent PLMN is as follows:

[0162] (1) For the first registration, the user accesses through a dedicated base station and accesses Ruyi AMF based on the PLMN.

[0163] (2) Ruyi AMF obtains user authentication information, contract data, etc. (such as the user's contracted slice) from 2B AUSF / UDM through C-IWF to complete authentication and registration. It has the following advantages: clear business logic, high degree of isolation between the big network and Ruyi card; in the range of independent base stations: the big network card business is not affected.

[0164] Customized slices are quickly deployed based on the existing network architecture and isolated through the signaling gateway C-IWF to solve the problem of access to untrusted areas. However, due to the shared large network frequency band + PLMN, there will be a situation where large network users access independent base stations, and when 2B / 2C share base stations, the large network AMF and private network AMF need to be connected, which cannot meet the company's high security needs. The business logic of superimposing an independent PLMN is clear, and the SIM card needs to set the dedicated PLMN as an accessible PLMN. The signaling access of the large network and the private network card is completely isolated, and the large network card business is not affected within the scope of the independent base station. It is suitable for use in scenarios with high isolation and security requirements.

[0165] 3. Double opening of account data:

[0166] like Fig.10 As shown in the figure, in the 5G customized network Ruyi mode, enterprises can flexibly choose to deploy network elements to meet industry needs and application scenarios. In order to solve the security issues between the client-side network elements in the untrusted domain and the dual elements of the trusted domain large network, the security of user authentication and contract data is guaranteed to the greatest extent, and the data synchronization system is completed. The accounting system adopts a dual-opening solution, which is sent to the large network UDM and the enterprise private network UDM respectively. The Ruyi data synchronization center realizes the network isolation of the sinking network elements and the large network 5GC, and adapts to the opening protocols and instructions of network elements of different sinking manufacturers, simplifies the docking and development process of peripheral systems, and helps customers to quickly deliver their services.

[0167] The IT system adopts a dual-opening solution, which is sent to the large-scale centralized UDM and the enterprise private network UDM respectively. The Ruyi Data Synchronization Center implements the network isolation between the sinking network elements and the large-scale 5GC network, and adapts to the network element activation protocols and instructions of different sinking manufacturers, simplifies the peripheral system docking and development process, and helps to quickly deliver the business. The IT system private network data synchronization center is connected to the enterprise UDM through VPN. The UDM business data activation is uniformly issued by the operator to synchronize the large-scale UDM business contract data and the enterprise UDM business contract data, and avoid the problem of bypassing the operator's control to produce and forge card data. The functions of each system are introduced as follows:

[0168] CRM: Responsible for customizing slices, accepting network configuration services, and accepting private network number contracts, and generating orders and instance data.

[0169] Billing: After activation, the billing data will be synchronized to the billing system. The data synchronization center can collect the call record files and report them to the billing center to complete the billing, or charge corporate customers according to periodic fees or one-time fees.

[0170] Private network data synchronization center: realize network isolation between the downlink network elements and the large-scale 5G core network elements, and adapt to the activation protocols and instructions of the downlink network elements of different manufacturers.

[0171] In summary, in the existing 5G campus private network access technology, if only the user plane UPF and some control plane network elements, such as AMF and SMF, are sunk, the contract and authentication data are still stored in the large network UDM / AUSF, and the data plane of the customized network can be issued at the local UPF nearby, but the signaling interaction still needs to be connected with the large network. The use of the large network PLMN will lead to the situation where large network users access independent base stations, increasing the base station access failure rate. In addition, after the UDM / AUSF is sunk to the customer campus, when the card-making secret key is shared, in extreme cases, the customer private network data security issues will affect the large network business.

[0172] In view of this, the present invention proposes a highly isolated access control method based on 5G enterprise private network that is independent of the operator's large network. Through the independence of number card making key data and the safe use in untrusted domain networks, the account acceptance dual opening, independent PLMN and customized slices, all enterprise data can be kept within the park and the information security of the independent private network can be guaranteed. Through the above method, the security of the independent private network in the park is effectively strengthened, the rapid, agile and secure deployment of customized network services is guaranteed, and a lightweight, customized, flexible deployment, easy-to-manage and easy-to-control network is created.

[0173] Specifically, the present invention supports customer-level card data production for card making in an enterprise independent private network mode, realizes isolation of code number resources from the existing network, isolation of card making OP data, and customer-level isolation of transmission encryption K4 keys, thereby ensuring the security of customer card data during production, transmission and use.

[0174] Compared with the prior art, the present invention has at least the following beneficial effects:

[0175] 1. Different key parameters are used between private network account cards and public account cards to ensure the data security of enterprise account cards;

[0176] 2. Avoid the risk of leakage of UDM card-making keys on private networks to public customer card information;

[0177] 3. Adopt independent PLMN, which is completely isolated from the big network and has clear business logic, meeting the enterprise's needs for security and data not leaving the park;

[0178] 4. Reduce reselection interactions with the big network AMF, and all enterprise data will not leave the park;

[0179] 5. Use dual-opening of account data to avoid multiple management and control of accounts and achieve compliance management and control of independent private networks.

[0180] 6. Use dedicated base stations and exclusive wireless resources. Business-related network elements are completely isolated from the public network and are not affected by external network connection failures, ensuring that enterprise business is not interrupted;

[0181] 7. Establish real-time monitoring means for accounting information through the private network data synchronization center to achieve compliance control of independent private networks.

[0182] Exemplarily, the embodiments of the present invention can be used in the scenario of operator 5G customized network, and the complete 5GC needs to be sunk to the scenario where the user's park is located; at the same time, it can be used in scenarios involving customers with specific industry attributes, such as the energy industry (five major power generation groups and China National Nuclear Corporation, etc.), super-large mining, closed factories, the military and other special demand scenarios. Specifically, the present invention is aimed at smart parks and intelligent manufacturing: when collecting and controlling production data, the production control data does not leave the park, ensuring the safety of the equipment, and it is unavailable outside the park; the independent card making and billing mode adopted by the present invention: a separate key is used to make the card, and data is configured in a specific area, limiting the sinking users to use it only within a certain range, bringing a new tariff system to users and increasing the customer stickiness of the DICT project.

[0183] On the other hand, Fig.11As shown, an embodiment of the present invention provides a private network access control device 1100, including: a first module 1110, used to respond to the attachment request of the target object and obtain an access network message of the target object; the access network message includes an access identifier and a request slice; a second module 1120, used to locate the first access unit according to the access network message, and obtain the contracted slice of the target object from the data service unit through the first access module; the first access unit includes any one of a matching access unit, an initial access unit and a default access unit; a third module 1130, used to obtain an allowed access slice and a target access unit from a slice selection network element through the default access unit when the first access unit is a default access unit and the default access unit cannot serve slice information for the target object; a fourth module 1140, used to reroute the target object to the target access unit, and obtain the contract policy of the target object from the policy unit through the target access unit; a fifth module 1150, used to perform intersection processing on the requested slice, the contracted slice and the allowed access slice, use the result of the intersection processing as the target slice, and access the target object to the target slice.

[0184] In some embodiments, the device may also include: a sixth module, used to obtain a cryptographic key and a card information file pre-sent to a data service unit; the card information file includes an authentication key and configuration information; the configuration information includes a contract slice; a seventh module, used to encrypt the card information file based on the cryptographic key through a triple data encryption algorithm, and send the result of the data encryption to the data service unit; an eighth module, used to import the cryptographic key into the data service unit, decrypt the result of the data encryption based on the cryptographic key, and store the decrypted card information file in the data service unit.

[0185] In some embodiments, the device may further include: a ninth module, configured to obtain contract data from the data service unit when the result of the intersection processing is empty, and reselect the access unit based on the contract data.

[0186] The contents of the method embodiments of the present invention are all applicable to the device embodiments. The functions specifically implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0187] On the other hand, Fig.12 As shown, an embodiment of the present invention further provides an electronic device 1200, which includes at least one processor 1210 and at least one memory 1220 for storing at least one program; taking one processor 1210 and one memory 1220 as an example.

[0188] The processor 1210 and the memory 1220 may be connected via a bus or in other ways.

[0189] The memory 1220, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory 1220 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory 1220 may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0190] The electronic device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0191] Another aspect of an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the above method.

[0192] The contents of the method embodiments of the present invention are all applicable to the computer-readable storage medium embodiments. The functions specifically implemented by the computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0193] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the above method.

[0194] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0195] It should be noted that, although several modules of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0196] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present invention.

[0197] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0198] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0199] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0200] The logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution device, apparatus or device (such as a computer-based device, a device including a processor, or other device that can fetch instructions from an instruction execution device, apparatus or device and execute the instructions), or in conjunction with such instruction execution device, apparatus or device. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution device, apparatus or device, or in conjunction with such instruction execution device, apparatus or device.

[0201] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0202] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0203] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0204] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0205] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A private network access control method, characterized in that: include: In response to an attachment request of a target object, obtaining an access network message of the target object; The access network message includes an access identifier and a requested slice; Locate a first access unit according to the access network message, and obtain the contracted slice of the target object from the data service unit through the first access unit; the first access unit includes any one of a matching access unit, an initial access unit, and a default access unit; When the first access unit is the default access unit and the default access unit cannot serve slice information for the target object, obtaining the allowed access slice and the target access unit from the slice selection network element through the default access unit; rerouting the target object to the target access unit, and obtaining the subscription policy of the target object from the policy unit through the target access unit; Performing intersection processing on the requested slice, the contracted slice, and the access-allowed slice, taking the result of the intersection processing as a target slice, and accessing the target object to the target slice; Wherein, the method further comprises: Obtaining a cryptographic key and a card information file pre-sent to the data service unit; the card information file includes an authentication key and configuration information; the configuration information includes the contracted slice; Based on the password key, encrypt the card information file by a triple data encryption algorithm, and send the encrypted data result to the data service unit; importing the cryptographic key into the data service unit, decrypting the data encryption result based on the cryptographic key, and storing the decrypted card information file in the data service unit; The step of obtaining the cryptographic key and pre-sending the card information file to the data service unit includes: Obtaining a cryptographic key and configuration information from a card production center, and obtaining a preset authentication key; the cryptographic key and the configuration information are generated by the card production center according to preset requirements; The step of encrypting the card information file based on the password key by a triple data encryption algorithm includes: Performing a first encryption process on the configuration information by using the authentication key to obtain an encryption result of the configuration information; Performing a second encryption process on the encryption result and the authentication key by using the cryptographic key to obtain the encryption result of the data in the card information file; The data service unit includes a large network data service unit and a private network data service unit; the decrypted card information file is stored in the data service unit, including: The decrypted card information file is stored in the large network data service unit and the private network data service unit respectively, and network isolation is performed by opening both account data; The large network data service unit is used to adapt the data acquisition of the default access unit, and the private network data service unit is used to adapt the data acquisition of the target access unit.

2. The private network access control method according to claim 1, characterized in that: The locating the first access unit according to the access network message comprises: Performing access unit matching according to the access identifier, and when a matching result exists in the access unit matching, connecting the target object to a matching access unit in the matching result; When there is no matching result in the access unit matching, determining an initial access unit according to the requested slice, and accessing the target object to the initial access unit; When the requested slice is empty, the target object is connected to the preset default access unit.

3. The private network access control method according to claim 1, characterized in that: The method further comprises: When the result of the intersection processing is empty, the subscription data is obtained from the data service unit, and the access unit is reselected based on the subscription data.

4. A private network access control device, characterized in that: include: The first module is configured to obtain an access network message of the target object in response to an attachment request of the target object; The access network message includes an access identifier and a requested slice; The second module is used to locate the first access unit according to the access network message, and obtain the contracted slice of the target object from the data service unit through the first access unit; the first access unit includes any one of a matching access unit, an initial access unit and a default access unit; The third module is used to obtain the allowed access slice and the target access unit from the slice selection network element through the default access unit when the first access unit is the default access unit and the default access unit cannot serve the slice information of the target object; A fourth module is used to reroute the target object to the target access unit, and obtain the subscription policy of the target object from the policy unit through the target access unit; A fifth module is configured to perform intersection processing on the requested slice, the contracted slice, and the access-allowed slice, use the result of the intersection processing as a target slice, and access the target object to the target slice; Wherein, the device further comprises: The sixth module is used to obtain a cryptographic key and a card information file pre-sent to the data service unit; the card information file includes an authentication key and configuration information; the configuration information includes the contracted slice; The step of obtaining the cryptographic key and pre-sending the card information file to the data service unit includes: Obtaining a cryptographic key and configuration information from a card production center, and obtaining a preset authentication key; the cryptographic key and the configuration information are generated by the card production center according to preset requirements; A seventh module is used to encrypt the card information file based on the password key by a triple data encryption algorithm, and send the encrypted data result to the data service unit; The step of encrypting the card information file based on the password key by a triple data encryption algorithm includes: Performing a first encryption process on the configuration information by using the authentication key to obtain an encryption result of the configuration information; Performing a second encryption process on the encryption result and the authentication key by using the cryptographic key to obtain the encryption result of the data in the card information file; An eighth module is used to import the cryptographic key into the data service unit, decrypt the result of the data encryption based on the cryptographic key, and store the decrypted card information file into the data service unit; The data service unit includes a large network data service unit and a private network data service unit; the decrypted card information file is stored in the data service unit, including: The decrypted card information file is stored in the large network data service unit and the private network data service unit respectively, and network isolation is performed by opening both account data; The large network data service unit is used to adapt the data acquisition of the default access unit, and the private network data service unit is used to adapt the data acquisition of the target access unit.

5. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 3.

6. A computer storage medium storing a program executable by a processor, characterized in that: The program executable by the processor is used to implement the method according to any one of claims 1 to 3 when executed by the processor.

Images