A method, device and electronic equipment for emergency support of 5G private network

Abstract

The present application discloses a method, device and electronic device for emergency support of a 5G private network, which belongs to the field of communication technology. The method includes: deploying a first type of AAA proxy forwarding system, which is composed of an AAA proxy forwarding server and a local storage unit; receiving an authentication message sent by the session management function, and sending the authentication message to the data network AAA server, the authentication message is sent by the terminal; receiving an authentication response message returned by the data network AAA server, the authentication response message carries an authentication result; the first type of AAA proxy forwarding system sends the authentication response message to the terminal, obtains the authentication result carried in the authentication response message, and saves the authentication result to the local storage unit. The present application solves the problem that the terminal in the 5G private network cannot access the enterprise intranet due to a DN‑AAA failure, shortens the terminal waiting time, and improves the user experience.

Description

Technical Field

[0001] The present application belongs to the field of communication technology, and in particular, relates to a method, device and electronic equipment for emergency support of a 5G private network. Background Art

[0002] The 5G private network is a dedicated network channel tailored for industry customers based on 5G network technology, with relatively isolated services, guaranteed quality and enhanced security. Through the 5G private network, enterprise terminals can connect to the enterprise intranet for data transmission.

[0003] Normally, when DN-AAA works normally, the authentication response of the terminal in the 5G private network is authenticated by DN-AAA and the authentication response message is returned. If the authentication is successful, the terminal can access the enterprise intranet. However, when DN-AAA fails, the authentication initiated by the terminal in the 5G private network is returned by AAA-P, and because it has not been authenticated by DN-AAA, the returned authentication response is a failure. The terminal cannot access the enterprise intranet through the 5G private network, resulting in a long wait for the user, affecting the user experience.

[0004] In response to the above problems, the method, device and electronic equipment for 5G private network emergency support in this application are proposed. Summary of the invention

[0005] In order to address the deficiencies of the prior art, the present application provides a 5G private network emergency protection method and electronic device to solve the problem in the prior art that DN-AAA fails and the terminal cannot access the enterprise intranet through the 5G private network, causing the user to wait for a long time and affecting the user experience.

[0006] The technical effects to be achieved by this application are achieved through the following solutions:

[0007] In a first aspect, the present application provides a method for emergency protection of a 5G private network, the method comprising:

[0008] S1. deploying a first type of AAA proxy forwarding system, wherein the first type of AAA proxy forwarding system performs user authentication between a session management function and a data network AAA server, and the first type of AAA proxy forwarding system is composed of an AAA proxy forwarding server and a local storage unit;

[0009] S2. The first type of AAA proxy forwarding system receives the authentication message sent by the session management function, and sends the authentication message to the data network AAA server, wherein the authentication message is sent by the terminal;

[0010] S3. The first type of AAA proxy forwarding system receives an authentication response message returned by the data network AAA server, wherein the authentication response message is obtained by the data network AAA server performing authentication based on the authentication message, and the authentication response message carries an authentication result;

[0011] S4. The first type of AAA proxy forwarding system sends the authentication response message to the terminal through the session management function, obtains the authentication result carried in the authentication response message, and saves the authentication result to the local storage unit.

[0012] In some embodiments, saving the authentication result to the local storage unit includes:

[0013] The authentication result is saved in the local storage unit in the form of a key-value pair, wherein the terminal identifier combined with the data network name identifier is used as the key, and the result information is used as the value, and the result information includes one or more of the following: authentication success, authentication failure, failure reason information, and the assigned dedicated network IP address.

[0014] In some embodiments, after the first type of AAA proxy forwarding system sends the authentication message to the data network AAA server, if the data network AAA server does not respond within a set time, the first type of AAA proxy forwarding system is triggered to timeout, and the first type of AAA proxy forwarding system obtains the latest authentication result associated with the terminal from the local storage unit, forwards the latest authentication result to the terminal, and marks the unresponsive data network AAA server as a fault state.

[0015] In some embodiments, after marking the unresponsive data network AAA server as a failure state, the method includes:

[0016] Initiating a detection operation of the data network AAA server in a fault state;

[0017] A detection operation is performed on the data network AAA server in a fault state at a preset period to confirm whether the data network AAA server in the fault state has recovered to normal.

[0018] In some embodiments, if it is confirmed that the data network AAA server in a faulty state has returned to normal, the first type of AAA proxy forwarding system forwards the newly acquired authentication message to the data network AAA server that has returned to normal; if it is confirmed that the data network AAA server in a faulty state has not returned to normal, the first type of AAA proxy forwarding system completes the authentication of the newly acquired authentication message based on the local storage unit.

[0019] In some embodiments, the data network AAA server performs authentication based on the authentication message to obtain the authentication response message, including:

[0020] The data network AAA server receives the authentication message;

[0021] Parsing the authentication message and obtaining authentication information corresponding to the terminal;

[0022] Determine whether to receive authentication of the terminal based on the authentication information, and generate an authentication response message.

[0023] In some embodiments, the set time is 5 seconds; the preset period is 10 seconds.

[0024] In a second aspect, a 5G private network emergency protection device is provided, the device comprising:

[0025] a deployment module, configured to deploy a first type of AAA proxy forwarding system, wherein the first type of AAA proxy forwarding system performs user authentication between a session management function and a data network AAA server, and the first type of AAA proxy forwarding system is composed of an AAA proxy forwarding server and a local storage unit;

[0026] A forwarding module, configured to receive an authentication message sent by the session management function, and send the authentication message to the data network AAA server, wherein the authentication message is sent by the terminal;

[0027] A receiving module, configured to receive an authentication response message returned by the data network AAA server, wherein the authentication response message is obtained by the data network AAA server performing authentication based on the authentication message, and the authentication response message carries an authentication result;

[0028] The response storage module is used to send the authentication response message to the terminal through the session management function, obtain the authentication result carried in the authentication response message, and save the authentication result to the local storage unit.

[0029] In a third aspect, the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any one of the methods described above when executing the computer program.

[0030] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any of the methods described above.

[0031] Through the 5G private network emergency protection method, device and electronic equipment provided by this application, the method can store the authentication results of the data network AAA server (i.e., DN-AAA) by deploying a first type of AAA proxy forwarding system, and in the event of a failure of the data network AAA server, complete the authentication of the terminal in the first type of AAA proxy forwarding system, thereby solving the problem that the terminal in the 5G private network cannot access the enterprise intranet due to a DN-AAA failure, shortening the terminal waiting time and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present application or the existing technical solutions, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0033] Figure 1 The process of the method for emergency protection of 5G private network in one embodiment of this application Figure 1 ;

[0034] Figure 2 This is a network diagram of a method for emergency support of a 5G private network in an embodiment of the present application;

[0035] Figure 3 The process of the method for emergency protection of 5G private network in one embodiment of this application Figure 2 ;

[0036] Figure 4 A schematic diagram of a first type of AAA proxy forwarding system for a method for emergency protection of a 5G private network in an embodiment of the present application;

[0037] Figure 5 This is a schematic diagram of a 5G private network emergency protection device in an embodiment of the present application;

[0038] Figure 6 It is a schematic block diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0040] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present application should be understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in one or more embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0041] This application involves some proprietary abbreviations, which are explained below:

[0042] 5G:5th Generation Mobile Communication Technology, that is, the fifth generation of mobile communication;

[0043] AAA: Authentication, Authorization, Accounting, i.e. authentication, authorization, and accounting servers;

[0044] DN-AAA: Data Network AAA, i.e. data network AAA server;

[0045] AAA-P: AAA Proxy, i.e. AAA proxy forwarding system;

[0046] SMF: Session Management Function, that is, session management function;

[0047] UPF: User Plane Function, i.e. user plane function;

[0048] DNN: Data Network Name, that is, data network name.

[0049] The 5G private network is a dedicated network channel tailored for industry customers based on 5G network technology, with relatively isolated services, guaranteed quality and enhanced security. Through the 5G private network, enterprise terminals can connect to the enterprise intranet for data transmission.

[0050] DN-AAA is defined by 3GPP specifications. The system is used to manage and control 5G private network terminal users' access to the enterprise intranet, enhancing the security of enterprise intranet access.

[0051] In the field of 5G private networks, DN-AAA is usually deployed on the enterprise side. AAA-P is deployed between SMF and DN-AAA to forward messages between SMF and DN-AAA. When the terminal goes online, the 5G core network SMF network element sends a Radius authentication request (i.e., Access-Request) to AAA-P. The authentication request carries the terminal identity information and access information, such as user name, password, access UPF, access base station, etc. AAA-P forwards the authentication request message to the DN-AAA to which the terminal belongs. DN-AAA verifies whether the terminal identity information is legal, and determines whether the terminal is accessed within the constraints, and returns the authentication result to SMF through AAA-P. If DN-AAA fails (network reasons, DN-AAA server itself, etc.), AAA-P does not receive a response message from DN-AAA within a certain period of time, and will reply to SMF with an authentication rejection message; if the terminal receives an authentication rejection, it will not be able to access the enterprise intranet.

[0052] Therefore, in the case of a DN-AAA failure, the terminal will have to wait too long, and will not be able to complete the authentication and access the enterprise intranet.

[0053] The present application provides a method for controlling private network users' access to the enterprise intranet in the event of a 5G private network DN-AAA service failure, aiming to solve the problem that terminals in the 5G private network cannot access the enterprise intranet due to DN-AAA failure, and the problem that terminals wait for a long time due to the failure of DN-AAA to respond, affecting user experience, and other problems.

[0054] Various non-limiting implementations of the present application are described in detail below in conjunction with the accompanying drawings.

[0055] Figure 1 The process of the method for emergency protection of 5G private network in one embodiment of this application Figure 1 ; Reference below Figure 1 The 5G private network emergency protection method of this application is described in detail.

[0056] like Figure 1 As shown, the present application provides a method for emergency protection of a 5G private network, the method comprising:

[0057] S1. deploying a first type of AAA proxy forwarding system, wherein the first type of AAA proxy forwarding system performs user authentication between a session management function and a data network AAA server, and the first type of AAA proxy forwarding system is composed of an AAA proxy forwarding server and a local storage unit;

[0058] S2. The first type of AAA proxy forwarding system receives the authentication message sent by the session management function, and sends the authentication message to the data network AAA server, wherein the authentication message is sent by the terminal;

[0059] S3. The first type of AAA proxy forwarding system receives an authentication response message returned by the data network AAA server, wherein the authentication response message is obtained by the data network AAA server performing authentication based on the authentication message, and the authentication response message carries an authentication result;

[0060] S4. The first type of AAA proxy forwarding system sends the authentication response message to the terminal through the session management function, obtains the authentication result carried in the authentication response message, and saves the authentication result to the local storage unit.

[0061] Figure 2 This is a networking diagram of the 5G private network emergency protection method in one embodiment of the present application; the 5G private network emergency protection method of the present application is applied in this networking.

[0062] like Figure 2 As shown, the campus includes multiple terminals, each of which is accessed through a base station and then accessed through the enterprise intranet through UPF, thereby realizing data stream transmission from UPF to the enterprise intranet; further, SMF, as a client of DN-AAA, is connected to the DN-AAA system through enhanced AAA-P (i.e., the first type of AAA proxy forwarding system mentioned above), wherein the DN-AAA system includes multiple DN-AAAs, such as DN-AAA1 and DN-AAA2.

[0063] Exemplarily, data transmission between UPF and SMF is achieved through the N4 interface, while data transmission between SMF in the mobile network core network and enhanced AAA-P is achieved through signaling control flow, and data transmission between enhanced AAA-P and DN-AAA system is also achieved through signaling control flow.

[0064] Figure 4 This is a schematic diagram of the first type of AAA proxy forwarding system of the method for emergency support of a 5G private network in an embodiment of the present application; the first type of AAA proxy forwarding system or enhanced AAA-P is an existing AAA-P with a local storage unit added. The first type of AAA proxy forwarding system can realize functions such as forwarding authentication messages, controlling the access to authentication results in authentication response messages, and detecting the status of DN-AAA, wherein the local storage unit is used to store the authentication results carried in the authentication response message fed back by DN-AAA.

[0065] Those skilled in the art will appreciate that, although the examples in this application are all based on 5G private networks, they are also applicable to 4G networks.

[0066] In some embodiments, saving the authentication result to the local storage unit includes:

[0067] The authentication result is saved in the local storage unit in the form of a key-value pair, wherein the terminal identifier combined with the data network name identifier is used as the key, and the result information is used as the value, and the result information includes one or more of the following: authentication success, authentication failure, failure reason information, and the assigned dedicated network IP address.

[0068] Specifically, the enhanced AAA-P updates the authentication result to the local storage unit, so that the local storage unit always stores the latest authentication response record.

[0069] The local storage unit stores the authentication results carried in the authentication response message in the form of a key-value pair. For example, the combination of the Calling-Station-Id (i.e., the terminal identifier) ​​and the DNN identifier (i.e., the data network name identifier) ​​is used as the unique identifier of the data record, i.e., the key, and the authentication success, authentication failure, failure reason information, and the assigned dedicated network IP address are used as the value, i.e., the value; this key value can uniquely identify different DNNs and adapt to the scenario of multiple DN-AAA.

[0070] In some embodiments, the DNN identifier is the Data Network Name, which can be understood as a called number (but different from a telephone number in the usual sense), or can be understood as an identifier used to identify an access network, expressed in the form of a string, such as ctcc.

[0071] In some embodiments, Calling-Station-Id can be understood as the number of the terminal, and its value is generally the mobile phone number of the terminal, such as 12345678901.

[0072] The key-value storage form of the above example can be expressed as follows:

[0073] key: ctcc&12345678901; this key can uniquely identify a terminal.

[0074] value: authentication success, authentication failure, failure reason information, assigned private network IP address, etc. This is for example only, and other information that can be used to identify the authentication result can also be applied here.

[0075] In some embodiments, after the first type of AAA proxy forwarding system sends the authentication message to the data network AAA server, if the data network AAA server does not respond within a set time, the first type of AAA proxy forwarding system is triggered to timeout, and the first type of AAA proxy forwarding system obtains the latest authentication result associated with the terminal from the local storage unit, forwards the latest authentication result to the terminal, and marks the unresponsive data network AAA server as a fault state.

[0076] Exemplarily, after the first type of AAA proxy forwarding system sends the authentication message to the data network AAA server, if the set time is 5 seconds, if the first type of AAA proxy forwarding system does not receive a response from the data network AAA server after 5 seconds, the first type of AAA proxy forwarding system is triggered to timeout, and the first type of AAA proxy forwarding system will obtain the latest authentication result associated with the terminal from the local storage unit and forward it to the terminal; the latest authentication result refers to the authentication result corresponding to the authentication result in the local storage unit whose time is most recent to the current time.

[0077] In some embodiments, the set time is configurable, specifically, the set time is 5 seconds, 10 seconds, 15 seconds; the set time can be flexibly configured according to actual circumstances; this is exemplary, and other suitable times can be applied here.

[0078] In some embodiments, after marking the unresponsive data network AAA server as a failure state, the method includes:

[0079] Initiating a detection operation of the data network AAA server in a fault state;

[0080] A detection operation is performed on the data network AAA server in a fault state at a preset period to confirm whether the data network AAA server in the fault state has recovered to normal.

[0081] In some embodiments, the preset period is configurable, specifically, the preset period is 5 seconds, 10 seconds, 20 seconds, etc.; the preset period can be flexibly configured according to actual circumstances; this is for exemplary purposes only, and other suitable preset periods can be applied here.

[0082] Exemplarily, after the data network AAA server is in a fault state, a detection operation with a preset period (eg, 10 seconds) as a cycle is performed on the data network AAA server in the fault state, so as to obtain whether the data network AAA server in the fault state has returned to normal.

[0083] In some embodiments, if it is confirmed that the data network AAA server in a faulty state has returned to normal, the first type of AAA proxy forwarding system forwards the newly acquired authentication message to the data network AAA server that has returned to normal; if it is confirmed that the data network AAA server in a faulty state has not returned to normal, the first type of AAA proxy forwarding system completes the authentication of the newly acquired authentication message based on the local storage unit.

[0084] Exemplarily, if it is confirmed that the data network AAA server in a faulty state has not returned to normal, the first type of AAA proxy forwarding system completes the authentication of the newly acquired authentication message based on the local storage unit. The newly acquired authentication message here refers to each authentication message received after the detection operation of the data network AAA server in a faulty state is started; it may also refer to an authentication message that has not been fully authenticated and is received after the last detection is completed; it may also refer to each authentication message that has not been fully authenticated and is received after the data network AAA server does not respond.

[0085] In some embodiments, the data network AAA server performs authentication based on the authentication message to obtain the authentication response message, including:

[0086] The data network AAA server receives the authentication message;

[0087] Parsing the authentication message and obtaining authentication information corresponding to the terminal;

[0088] Determine whether to receive authentication of the terminal based on the authentication information, and generate an authentication response message.

[0089] In some embodiments, the 5G private network emergency protection method of the present application can also be completed in two parts: Figure 3 The process of the method for emergency protection of 5G private network in one embodiment of this application Figure 2 ; Reference below Figure 3 The method of applying for 5G private network emergency protection is explained in detail.

[0090] like Figure 3 As shown, the method can be divided into two stages, the premise is that a local storage unit is deployed on the AAA-P side, the local storage unit and AAA-P constitute an enhanced AAA-P, that is, the first type of AAA proxy forwarding system, the main subjects involved in the method are the terminal, SMF, enhanced AAA-P (including AAA-P and local storage unit), and DN-AAA.

[0091] Normal stage of DN-AAA:

[0092] Step 1: The terminal's authentication message is forwarded to DN-AAA via enhanced AAA-P.

[0093] Step 2: DN-AAA determines whether to accept the authentication of the terminal based on the information provided by the user, and returns an authentication request response message (i.e., the authentication response message mentioned above, which carries the authentication result, acceptance or rejection, acceptance indicates successful authentication, and rejection indicates failed authentication) to the enhanced AAA-P.

[0094] Step 3: The enhanced AAA-P processes the authentication request response message of the DN-AAA;

[0095] Step 3.1, the enhanced AAA-P forwards the response message of the DN-AAA to the terminal;

[0096] Step 3.2, the enhanced AAA-P saves the response message, that is, updates the authentication result carried in the authentication request response message to the local storage unit, so that the local storage unit always saves the latest authentication result; wherein, the local storage unit saves the authentication result carried in the authentication request response message in the form of a key-value pair, wherein the key value can uniquely identify different DN-AAAs, so that it can adapt to the scenario of multiple DN-AAAs, and facilitates forwarding the authentication message to the corresponding DN-AAA in the scenario of multiple DN-AAAs.

[0097] DN-AAA fault stage:

[0098] Step 4: Enhanced AAA-P forwards the terminal authentication message to DN-AAA;

[0099] Step 5: DN-AAA is unavailable, that is, DN-AAA does not respond, which triggers the timeout of enhanced AAA-P;

[0100] Step 5.1, the enhanced AAA-P obtains the previously stored response result, that is, obtains the latest authentication result of the terminal from the local storage unit. Exemplarily, the local storage unit stores the latest authentication result, which refers to the authentication result closest to the current time, or the authentication result in the local storage unit is refreshed each time it is obtained to ensure that the storage unit stores the latest authentication result;

[0101] Specifically, in some embodiments, only one authentication result may be stored in the local storage unit, and the one authentication result is always the latest authentication result, so as to ensure that the latest authentication result of the terminal is obtained from the local storage unit.

[0102] Step 5.2: forward the latest authentication result as an authentication request response message, or carry the latest authentication result in the authentication request response message to the terminal;

[0103] Step 5.3: Mark the fault status of this DN-AAA and start the status detection task of this DN-AAA.

[0104] Step 6: The enhanced AAA-P periodically detects whether the faulty DN-AAA has recovered to normal at a preset period, so as to obtain the status of the DN-AAA in time;

[0105] Step 7, during the DN-AAA failure, the enhanced AAA-P receives the authentication message from the terminal;

[0106] Step 7.1, the enhanced AAA-P obtains the previously stored response result, that is, obtains the previous authentication result from the local storage unit;

[0107] Step 7.2: forward the authentication result obtained from the local storage unit directly to the terminal to reduce the terminal waiting time.

[0108] After DN-AAA is restored, all business processes are restored to the processing mode when DN-AAA is normal.

[0109] In the above example, with the dual protection of local storage and DN-AAA status monitoring added at the proxy forwarding, the number of times the terminal repeatedly initiates authentication requests can be greatly reduced, thereby improving efficiency. In addition, the terminal's authentication response can be responded to in a timely manner, thereby avoiding frequent authentication initiation by the terminal, reducing waiting time, and saving terminal resource consumption (such as battery power, etc.).

[0110] The method of the above embodiment can store the authentication results of the data network AAA server (i.e., DN-AAA) by deploying the first type of AAA proxy forwarding system, and complete the authentication of the terminal in the first type of AAA proxy forwarding system when the data network AAA server fails, thereby solving the problem that the terminal in the 5G private network cannot access the enterprise intranet due to the DN-AAA failure, shortening the terminal waiting time and improving the user experience.

[0111] Figure 5 Schematic diagram of a 5G private network emergency protection device in an embodiment of the present application; Figure 5 As shown, a 5G private network emergency protection device, the device comprising:

[0112] a deployment module, configured to deploy a first type of AAA proxy forwarding system, wherein the first type of AAA proxy forwarding system performs user authentication between a session management function and a data network AAA server, and the first type of AAA proxy forwarding system is composed of an AAA proxy forwarding server and a local storage unit;

[0113] A forwarding module, configured to receive an authentication message sent by the session management function, and send the authentication message to the data network AAA server, wherein the authentication message is sent by the terminal;

[0114] A receiving module, configured to receive an authentication response message returned by the data network AAA server, wherein the authentication response message is obtained by the data network AAA server performing authentication based on the authentication message, and the authentication response message carries an authentication result;

[0115] The response storage module is used to send the authentication response message to the terminal through the session management function, obtain the authentication result carried in the authentication response message, and save the authentication result to the local storage unit.

[0116] In some embodiments, saving the authentication result to the local storage unit includes:

[0117] The authentication result is saved in the local storage unit in the form of a key-value pair, wherein the terminal identifier combined with the data network name identifier is used as the key, and the result information is used as the value, and the result information includes one or more of the following: authentication success, authentication failure, failure reason information, and the assigned dedicated network IP address.

[0118] In some embodiments, after the first type of AAA proxy forwarding system sends the authentication message to the data network AAA server, if the data network AAA server does not respond within a set time, the first type of AAA proxy forwarding system is triggered to timeout, and the first type of AAA proxy forwarding system obtains the latest authentication result associated with the terminal from the local storage unit, forwards the latest authentication result to the terminal, and marks the unresponsive data network AAA server as a fault state.

[0119] In some embodiments, after marking the unresponsive data network AAA server as a failure state, the method includes:

[0120] Initiating a detection operation of the data network AAA server in a fault state;

[0121] A detection operation is performed on the data network AAA server in a fault state at a preset period to confirm whether the data network AAA server in the fault state has recovered to normal.

[0122] In some embodiments, if it is confirmed that the data network AAA server in a faulty state has returned to normal, the first type of AAA proxy forwarding system forwards the newly acquired authentication message to the data network AAA server that has returned to normal; if it is confirmed that the data network AAA server in a faulty state has not returned to normal, the first type of AAA proxy forwarding system completes the authentication of the newly acquired authentication message based on the local storage unit.

[0123] In some embodiments, the data network AAA server performs authentication based on the authentication message to obtain the authentication response message, including:

[0124] The data network AAA server receives the authentication message;

[0125] Parsing the authentication message and obtaining authentication information corresponding to the terminal;

[0126] Determine whether to receive authentication of the terminal based on the authentication information, and generate an authentication response message.

[0127] In some embodiments, the set time is 5 seconds; the preset period is 10 seconds.

[0128] The above-mentioned 5G private network emergency protection device can achieve all the technical effects of the 5G private network emergency protection method, which will not be repeated here.

[0129] The existing mechanism for forwarding terminal authentication messages based on AAA-P is that as long as there is no response from DN-AAA, AAA-P will respond with an Access-Reject message according to the timeout period. The terminal cannot access the enterprise intranet, and each time the terminal re-initiates an authentication request, it will not be informed of the authentication failure until the response times out, which seriously affects the efficiency of business processing.

[0130] This application proposes a method and device for emergency protection of 5G private network, which solves the problem that the terminal cannot access the enterprise intranet when DN-AAA fails; it can not only ensure the access security management and control of 5G private network, but also avoid the problem that the terminal cannot access the enterprise intranet due to DN-AAA failure.

[0131] It should be noted that the method of one or more embodiments of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of one or more embodiments of the present application, and the multiple devices will interact with each other to complete the described method.

[0132] It should be noted that the above describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0133] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also discloses an electronic device;

[0134] Specifically, Figure 6 A hardware structure diagram of an electronic device for a method of emergency support for a 5G private network provided in this embodiment is shown, and the device may include: a processor 410, a memory 420, an input / output interface 430, a communication interface 440, and a bus 450. Among them, the processor 410, the memory 420, the input / output interface 430, and the communication interface 440 are connected to each other in communication within the device through the bus 450.

[0135] The processor 410 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0136] The memory 420 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 420 may store an operating system and other application programs. When the technical solution provided in the embodiment of the present application is implemented by software or firmware, the relevant program code is stored in the memory 420 and is called and executed by the processor 410.

[0137] The input / output interface 430 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0138] The communication interface 440 is used to connect a communication module (not shown in the figure) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (for example, USB, network cable, etc.) or a wireless mode (for example, mobile network, WIFI, Bluetooth, etc.).

[0139] The bus 450 includes a path that transmits information between the various components of the device (eg, the processor 410 , the memory 420 , the input / output interface 430 , and the communication interface 440 ).

[0140] It should be noted that, although the above device only shows the processor 410, the memory 420, the input / output interface 430, the communication interface 440 and the bus 450, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiment of the present application, and does not necessarily include all the components shown in the figure.

[0141] The electronic device of the above-mentioned embodiment is used to implement the corresponding 5G private network emergency protection method in any of the aforementioned embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0142] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, one or more embodiments of the present application also provide a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the 5G private network emergency support method as described in any of the above embodiments.

[0143] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0144] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the method of 5G private network emergency protection as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0145] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0146] In addition, to simplify the description and discussion, and in order not to make one or more embodiments of the present application difficult to understand, the well-known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the provided figures. In addition, the device may be shown in the form of a block diagram to avoid making one or more embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which one or more embodiments of the present application will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that one or more embodiments of the present application can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0147] Although the present application has been described in conjunction with specific embodiments of the present application, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the discussed embodiments.

[0148] One or more embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for emergency support of a 5G private network, characterized in that: The method comprises: S1. deploying a first type of AAA proxy forwarding system, wherein the first type of AAA proxy forwarding system performs user authentication between a session management function and a data network AAA server, and the first type of AAA proxy forwarding system is composed of an AAA proxy forwarding server and a local storage unit; S2. The first type of AAA proxy forwarding system receives the authentication message sent by the session management function, and sends the authentication message to the data network AAA server, wherein the authentication message is sent by the terminal; S3. The first type of AAA proxy forwarding system receives an authentication response message returned by the data network AAA server, wherein the authentication response message is obtained by the data network AAA server performing authentication based on the authentication message, and the authentication response message carries an authentication result; S4. The first type of AAA proxy forwarding system sends the authentication response message to the terminal through the session management function, obtains the authentication result carried in the authentication response message, and saves the authentication result to the local storage unit; The step of saving the authentication result to the local storage unit comprises: The authentication result is saved in the local storage unit in the form of a key-value pair, wherein the terminal identifier combined with the identifier of the data network name is used as the key, and the result information is used as the value, wherein the result information includes one or more of the following: authentication success, authentication failure, failure reason information, and the allocated dedicated network IP address; After the first type of AAA proxy forwarding system sends the authentication message to the data network AAA server, if the data network AAA server does not respond within a set time, the first type of AAA proxy forwarding system is triggered to timeout, and the first type of AAA proxy forwarding system obtains the latest authentication result associated with the terminal from the local storage unit, forwards the latest authentication result to the terminal, and marks the unresponsive data network AAA server as a fault state.

2. The method for emergency support of 5G private network according to claim 1, characterized in that: After marking the data network AAA server that is unresponsive as being in a fault state, the method includes: Initiating a detection operation of the data network AAA server in a fault state; A detection operation is performed on the data network AAA server in a fault state at a preset period to confirm whether the data network AAA server in the fault state has recovered to normal.

3. The method for emergency support of 5G private network according to claim 2, characterized in that: If it is confirmed that the data network AAA server in the fault state has returned to normal, the first type of AAA proxy forwarding system forwards the newly acquired authentication message to the data network AAA server that has returned to normal; If it is confirmed that the data network AAA server in the fault state has not recovered to normal, the first type of AAA proxy forwarding system completes the authentication for the newly acquired authentication message based on the local storage unit.

4. The method for emergency support of a 5G private network according to claim 1, characterized in that: The data network AAA server performs authentication based on the authentication message to obtain the authentication response message, including: The data network AAA server receives the authentication message; Parsing the authentication message and obtaining authentication information corresponding to the terminal; Determine whether to receive authentication of the terminal based on the authentication information, and generate an authentication response message.

5. The method for emergency support of 5G private network according to claim 3, characterized in that: The set time is 5 seconds; the preset period is 10 seconds.

6. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 5 when executing the computer program.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method according to any one of claims 1 to 5.

Images