Intranet login method and device, electronic equipment, storage medium and program product

Abstract

The present invention relates to the technical field of network communications, and provides an intranet login method and apparatus, an electronic device, a storage medium and a program product, the method comprising: receiving a request of a first terminal to access an intranet through a hotspot connected to a second terminal, the second terminal accessing the intranet through a dual-domain private network and a shunt mode based on an uplink classifier ULCL; performing identity authentication on the second terminal based on the super SIM card information of the second terminal carried in the request; and under the condition that the identity authentication is passed, establishing communication connection between the first terminal and an intranet, so that the first terminal logs in the intranet. According to the intranet login method and device, the electronic equipment, the storage medium and the program product provided by the invention, real-name management of network traffic can be realized, the traffic of each user can be subjected to identity authentication, a specific user account can be traced, and the traceability of network security is improved.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to an intranet login method, device, electronic equipment, storage medium and program product. Background Art

[0002] The dual-domain private network can provide internal users with a more convenient and secure channel to access the enterprise intranet and the Internet. The construction of dual-domain private networks and diversion solutions has difficulties in the security control of terminal access.

[0003] When a computer connects to a whitelisted mobile phone hotspot and directly accesses the intranet production system through the mobile phone's DNN (Data Network Name) + ULCL (Uplink Classifier) ​​diversion solution, malicious computer software may attack the intranet through the fifth-generation mobile communication network (5G) private network. However, the 5G private network cannot provide the mobile phone number corresponding to the attack data packet, and the security prevention and control process cannot be closed. Summary of the invention

[0004] The present invention provides an intranet login method, device, electronic device, storage medium and program product, which are used to solve the defect that the security control process for terminal access cannot be closed-loop in the dual-domain private network diversion solution of the prior art.

[0005] The present invention provides an intranet login method, comprising: Receiving a request from a first terminal to access an intranet through a hotspot connected to a second terminal, wherein the second terminal accesses the intranet through a dual-domain private network and a traffic diversion method based on an uplink classifier ULCL; Performing identity authentication on the second terminal based on the super SIM card information of the second terminal carried in the request; When the identity authentication is passed, a communication connection is established between the first terminal and the intranet, so that the first terminal logs into the intranet.

[0006] According to the intranet login method provided by the present invention, the establishing of a communication connection between the first terminal and the intranet includes: Based on the identity information of the first terminal carried in the request, the super SIM security gateway performs a legitimacy check on the first terminal; When the legality check passes, a communication connection is established between the first terminal and the intranet.

[0007] According to the intranet login method provided by the present invention, the method further includes: The super SIM security gateway records access behavior logs of the first terminal and the second terminal.

[0008] According to the intranet login method provided by the present invention, the method further includes: converting the address distributed to the second terminal through the firewall device so that the converted address is different from the intranet address; and,

[0009] The address of the core system related to the intranet is converted into a legal address of the core network.

[0010] According to the intranet login method provided by the present invention, the second terminal accesses the intranet through the dual-domain private network and the diversion method based on the uplink classifier ULCL, which specifically includes: When the session management function network element SMF senses that the current location of the second terminal is within the campus intranet, the offload user plane function network element UPF is inserted into the user session; The diversion UPF matches the access traffic information of the second terminal with the intranet diversion rules. If the intranet diversion rules are matched, the access traffic information is forwarded to the campus intranet; if the intranet diversion rules are not matched, the access traffic information is forwarded to the Internet.

[0011] According to the intranet login method provided by the present invention, when the session management function network element SMF senses that the current location of the second terminal is in the campus intranet, the offload user plane function network element UPF is inserted into the user session, including: When the SMF senses that the current location of the second terminal is within the campus intranet and confirms that the second terminal is a terminal that has signed a dual-domain private network contract, the diversion UPF is inserted into the user session.

[0012] According to the intranet login method provided by the present invention, the offload UPF includes a primary anchor point UPF, an uplink classifier user plane function network element ULCL-UPF and a secondary anchor point UPF; The deployment mode of the offload UPF includes independent hardware deployment of the main anchor point UPF, or combined deployment of the ULCL-UPF and the auxiliary anchor point UPF.

[0013] The present invention also provides an intranet login device, comprising: A request receiving unit, configured to receive a request from a first terminal to access an intranet through a hotspot connected to a second terminal, wherein the second terminal accesses the intranet through a dual-domain private network and a diversion method based on an uplink classifier ULCL; an identity authentication unit, configured to perform identity authentication on the second terminal based on the super SIM card information of the second terminal carried in the request; The communication establishing unit is used to establish a communication connection between the first terminal and the intranet when the identity authentication is passed, so that the first terminal can log in to the intranet.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the intranet login methods described above is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the intranet login method as described above is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned intranet login methods.

[0017] The intranet login method, device, electronic device, storage medium and program product provided by the present invention authenticate the second terminal through the super SIM card information carried in the request to access the intranet, build a trusted identity system, and thus improve the credibility and security of the user identity. In addition, super SIM identity authentication can realize the real-name management of network traffic, ensure that the traffic of each user can be authenticated, and can be traced back to the specific user account, thereby increasing the traceability of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is one of the flow charts of the intranet login method provided by the present invention.

[0020] Figure 2 This is a diagram of the ULCL traffic distribution network architecture provided by the present invention.

[0021] Figure 3 It is a schematic diagram of the city-to-city shared deployment model provided by the present invention.

[0022] Figure 4 It is a schematic diagram of the park entry deployment mode provided by the present invention.

[0023] Figure 5 It is a structural schematic diagram of the intranet login device provided by the present invention.

[0024] Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] The campus intranet has special demands for ToB / ToC integration, which requires a standardized solution, namely a dual-domain private network. At present, the current status of 5GToB (i.e., 5G for enterprises) in China is that mobile operators build a separate ToB private network, which is physically isolated from the ToC network. However, with the development of 5G, 5G private networks are gradually developing from pure ToB private networks to ToBToC integrated private networks to solve the problem of public-to-public collaborative access. Based on the common demands of 5G SA terminals accessing the campus intranet and the public network at the same time, and not changing cards or numbers, limiting users and regions, and independent billing, 5G industry private networks need to form a standardized solution, namely a dual-domain private network, to support the rapid upgrading of the industry.

[0027] The dual-domain private network can provide internal users with a more convenient and secure channel to access the enterprise intranet and the Internet. Communication and interaction with the external Internet will increase traffic, so it is necessary to optimize traffic management in the dual-domain private network through diversion to ensure network performance and reliability. The general / special DNN+ULCL diversion solution used in related technologies is a solution based on general or special DNN and ULCL diversion technology to achieve diversion and directional transmission of user traffic.

[0028] The construction of dual-domain private networks and diversion solutions presents difficulties in the security control of terminal access. When a computer connects to a whitelisted mobile phone hotspot and directly accesses the intranet production system through the mobile phone DNN+ULCL diversion, malicious computer software may attack the intranet through the 5G private network, but the 5G private network cannot provide the mobile phone number corresponding to the attack data packet, and the security control process cannot be closed.

[0029] In view of the above problems, an embodiment of the present invention proposes an intranet login method, in which the second terminal is authenticated by the super SIM card information carried in the request to access the intranet, and the mobile phone number is used as a unified account for identity authentication to build a trusted identity system, thereby improving the credibility and security of the user identity. In addition, super SIM identity authentication can realize the real-name management of network traffic, ensure that the traffic of each user can be authenticated, and can be traced back to the specific user account, increasing the traceability of network security.

[0030] The embodiments of the present invention can be applied to scenarios where it is necessary to access the intranet through the hotspot of another terminal, such as a scenario where a computer accesses the intranet through a mobile phone hotspot. The execution subject of the method can be an electronic device such as a terminal device, a computer, a server, a server cluster, or a specially designed intranet login device, or an intranet login device set in the electronic device, and the intranet login device can be implemented by software, hardware, or a combination of the two.

[0031] In the description of the embodiments of the present invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0032] Figure 1 It is one of the flow charts of the intranet login method provided by the present invention, such as Figure 1 As shown, the method comprises the following steps: Step 110, receiving a request from the first terminal to access the intranet through a hotspot connected to the second terminal, and the second terminal accesses the intranet through a dual-domain private network and a diversion method based on an uplink classifier ULCL.

[0033] Specifically, the dual-domain private network is a network architecture that allows user terminals to access the Internet and the enterprise intranet (or campus intranet, government intranet, etc.) at the same time without changing the Subscriber Identity Module (SIM) card or number. The ULCL-based diversion method is the key technology to achieve this function. It can divert the data of the services in the access area to the area according to the characteristics of the user's service flow, and divert the data of the access to the Internet to the public network.

[0034] The first terminal can be a mobile phone, computer or other device, and the second terminal can be a mobile phone. The first terminal connects to the hotspot of the second terminal via Wi-Fi or other wireless methods. Make sure that the hotspot settings of the second terminal allow the first terminal to access, and configure the relevant network parameters (such as SSID, password, etc.).

[0035] The first terminal initiates an access request to the intranet through the hotspot of the second terminal, and the request is forwarded to the second terminal through the Wi-Fi connection. The second terminal forwards the request to access the intranet to the intranet server through the dual-domain private network according to the ULCL diversion strategy, and transmits the response data back to the first terminal.

[0036] Step 120: Authenticate the second terminal based on the super SIM card information of the second terminal carried in the request.

[0037] Considering that in this scenario, malicious computer software may attack the intranet through the 5G private network, and the 5G private network cannot provide the mobile phone number corresponding to the attack data packet, the security prevention and control process cannot be closed. Therefore, in this implementation, by adding the super SIM authentication function of the second terminal, the real-name management of network traffic is realized, ensuring that the traffic of each user can be authenticated and traced back to the specific user account, increasing the traceability of network security.

[0038] Specifically, the request to access the intranet carries relevant information about the super SIM card. This information may be transmitted in the form of a specific request header, request parameter, or encrypted token. The server or authentication system needs to parse the request and extract key information related to the super SIM card. For example, it may include the International Mobile Subscriber Identity (IMSI), the serial number of the SIM card, the public key certificate, the encryption key, etc.

[0039] The server first queries the operator's authentication center (AuC) for the validity of the SIM card through the IMSI. The authentication center returns the authentication result to confirm the legitimacy of the SIM card.

[0040] If the request contains encrypted data or encrypted tokens, the server will use the public key or secret key stored in the super SIM card to decrypt or verify the encrypted data. Based on the decryption result or verification signature, it is determined whether the request comes from a legitimate super SIM card.

[0041] If the system supports multi-factor authentication, in addition to SIM card information, other authentication factors (such as fingerprint recognition, facial recognition, PIN code, etc.) can also be combined for identity authentication.

[0042] Step 130: When the identity authentication is successful, a communication connection is established between the first terminal and the intranet so that the first terminal can log in to the intranet.

[0043] Specifically, if the super SIM card information verification is passed, that is, the identity authentication is passed, the server will allow the second terminal to access corresponding network resources or perform specific operations, and can allocate corresponding permissions and resources to the successfully authenticated terminal according to business needs.

[0044] Since the first terminal is connected to the hotspot of the second terminal, a communication connection between the first terminal and the intranet is established at the same time, so that the first terminal logs into the intranet.

[0045] It is understandable that if the super SIM card information verification fails, that is, the identity authentication fails, the server will reject the access request of the second terminal and may return a corresponding error message. If necessary, the log information of the authentication failure can be recorded for subsequent security audit and troubleshooting.

[0046] The method provided by the embodiment of the present invention authenticates the second terminal through the super SIM card information carried in the request for accessing the intranet, builds a trusted identity system, and thus improves the credibility and security of the user identity. In addition, super SIM identity authentication can realize the real-name management of network traffic, ensure that the traffic of each user can be authenticated, and can be traced back to the specific user account, thereby increasing the traceability of network security.

[0047] Based on any of the above embodiments, establishing a communication connection between the first terminal and the intranet in step 130 includes: Based on the identity information of the first terminal carried in the request, the super SIM security gateway performs a legitimacy check on the first terminal; When the legality check passes, a communication connection is established between the first terminal and the intranet.

[0048] Specifically, in order to further control the access to hotspot sharing, a super SIM security gateway is added between the 5G private network and the ToB enterprise network in the embodiment of the present invention. By adding a super SIM security gateway to the network, comprehensive coverage of mobile phones and PCs in different network environments can be achieved. In this way, access to hotspot sharing can be controlled to ensure the real-name registration of network traffic.

[0049] The super SIM security gateway first receives an access request from the first terminal and parses the identity information in the request, which may include the MAC address, IP address, user account, digital certificate or super SIM card-related encryption token of the first terminal.

[0050] The legitimacy check includes identity verification, which verifies whether the first terminal is a legitimate device through communication between the super gateway and the super SIM card of the second terminal. It is understandable that the communication connection between the first terminal and the intranet is established only when the legitimacy check of the first terminal passes. That is, the first terminal can connect to the hotspot of the second terminal and access the intranet through the hotspot of the second terminal.

[0051] The method provided by the embodiment of the present invention controls and manages hotspot sharing through a super SIM security gateway, restricts access of illegal devices, and ensures that only legal devices can access the intranet through mobile phone hotspots, thereby reducing security risks.

[0052] Based on any of the above embodiments, the method further includes: The super SIM security gateway records the access behavior logs of the first terminal and the second terminal.

[0053] Specifically, the devices and systems that need to be monitored to collect access behavior logs include the first terminal and the second terminal, as well as the network devices and security devices (such as routers, switches, firewalls, etc.) connected to them.

[0054] Leverage agentless and agent-based mechanisms to collect log data from primary and secondary endpoints, as well as other critical devices and systems in the network. Agentless approaches typically extract logs directly from network traffic, while agent-based approaches require agent software to be installed on devices to capture logs.

[0055] Aggregate the collected log data into the log management system of the Super SIM security gateway. This may involve formatting and standardizing the data to ensure that log data from different sources can be uniformly processed and analyzed on the same platform.

[0056] Furthermore, log processing and analysis can be performed. Aggregated log data can be cleaned to remove duplicate, invalid or noisy data to improve data quality and accuracy. The cleaned log data can be parsed to extract useful information, such as access time, access IP, access URL, request type, return status code, etc.

[0057] Based on historical log data, a normal access behavior model is established for the first terminal and the second terminal. Then, abnormal access behavior is detected by comparing the actual access behavior with the behavior predicted by the model in real time. These abnormal behaviors may include unauthorized access, sensitive data leakage, malware activities, etc.

[0058] It can also conduct in-depth analysis of detected abnormal behaviors to determine the type, severity, and scope of threat they may pose. At the same time, it can use technical means such as threat intelligence libraries and machine learning algorithms to improve the accuracy and efficiency of threat analysis.

[0059] The method provided in the embodiment of the present invention records the access behavior log through the super SIM security gateway, including the user's access time, access content, access source, etc. This can provide auditing and monitoring of access behavior, timely discover abnormal behavior and take corresponding security measures.

[0060] Based on any of the above embodiments, the intranet login method further includes: Converting the address distributed to the second terminal through the firewall device so that the converted address is different from the intranet address; and,

[0061] Convert the addresses of the core systems related to the intranet into legal addresses of the core network.

[0062] Specifically, when users are diverted through DNN+ULCL, UPF will distribute IP addresses to users for accessing the ToB enterprise intranet. The distributed IP addresses may conflict with the ToB enterprise intranet. When facing many ToB enterprises, since the private IP address range is defined by the Internet Assigned Numbers Authority (IANA), including the following three address segments: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, 192.168.0.0 to 192.168.255.255, each enterprise intranet can use it at will, and it is inevitable that different enterprises will use the same intranet address.

[0063] In order to avoid address conflicts between ULCL and ToB enterprise intranet, the method provided in the embodiment of the present invention adds a firewall device in the network. The firewall device can realize one-to-one bidirectional address conversion between user terminal address and ToB enterprise intranet address.

[0064] When a user wants to access the enterprise intranet, the firewall device will convert the address distributed by UPF to the user terminal into an address that does not conflict with the enterprise intranet. At the same time, the firewall device will also convert the address of the core system related to the enterprise intranet accordingly, converting it into a legal address for the 5G private network. This avoids the problem of address conflicts. By adding firewall devices and implementing address conversion technology, normal communication between 5G private network user terminals and ToB enterprise intranets can be ensured, while solving the problems caused by address conflicts. Such security prevention and control measures can effectively protect the security of the network and guarantee user access to the enterprise intranet.

[0065] The method provided by the embodiment of the present invention makes the IP address unique through address conversion, thereby avoiding conflicts that may cause communication failures.

[0066] Based on any of the above embodiments, the second terminal accesses the intranet through the dual-domain private network and the diversion method based on the uplink classifier ULCL, specifically including: When the session management function network element SMF senses that the current location of the second terminal is within the campus intranet, the offload user plane function network element UPF is inserted into the user session; The diversion UPF matches the access traffic information of the second terminal with the intranet diversion rules. If the intranet diversion rules are matched, the access traffic information is forwarded to the campus intranet; if the intranet diversion rules are not matched, the access traffic information is forwarded to the Internet.

[0067] Specifically, mobile operators build a separate ToB private network, which is physically isolated from the ToC network. Most of them use VPN to achieve the development of ToBToC integrated private networks to solve the problem of public-to-public collaborative access. However, the traditional intranet login method of intranet access through VPN is prone to large bandwidth congestion, usage lag, VPN circling, and the risk of intranet production data being exposed to the public network through VPN. The technology of dual-domain private networks requires a diversion solution as a basic support, but the existing diversion solution lacks authentication links, which may cause unauthorized users to obtain sensitive information or abuse network resources, thus posing security risks.

[0068] In this embodiment, legitimate users are identified on the network side and network capabilities are used to allow "whitelist" users to legally access. At the same time, intranet access traffic does not need to be exposed through the public network and is diverted nearby to ensure intranet data security. At the same time, the overall solution is not limited by VPN bandwidth and the number of users, and the advantages of 5G are maximized to achieve large-bandwidth and high-speed access.

[0069] This embodiment is based on the ULCL diversion method, using the "white list" and legal access area restrictions to ensure the security of intranet access services, wherein the ULCL diversion technical solution is as follows: 1. ULCL Main Process

[0070] 1. User policy signing: BOSS (Business and Operation Support System) defines the package name ABC, and PCF (Point Coordination Function) configures a policy name ABC. When a user signs up for this package, BOSS sends the user's IMSI (International Mobile Subscriber Identity) and package name ABC to PCF, and PCF signs the user's IMSI to this ABC policy.

[0071] 2. PCF policy delivery: PCF delivers the policy name to the SMF (Session Management Function) unit through the N7 interface based on the triggering conditions (such as the TAC, Tracking Area Code, of the wireless area).

[0072] 3. SMF policy configuration: The SMF policy contains two pieces of information: one is when to execute the policy, such as TAC determination based on the wireless area, and the other is the content of the policy to be executed.

[0073] 4. SMF policy execution, insert diversion UPF: When the user's location changes and SMF senses that the user has entered a TAC that meets the trigger conditions, it executes the diversion policy that matches the policy name and inserts the diversion UPF into the user session. The diversion UPF diverts user traffic based on the network name (DNN) of the terminal, the wireless tracking area identifier (TAI), the network access identifier (DNAI) bound to the policy name, and other information.

[0074] 5. Diversion UPF policy configuration: Diversion UPF determines the specific diversion action based on the configuration information of the policy name. For example, the intranet IP / domain name is diverted to the campus intranet, and the remaining traffic is sent to the main anchor point (responsible for forwarding public network traffic, that is, the ordinary large network 2CUPF).

[0075] 6. Diversion UPF forwards intranet traffic: When the user inserts the diversion UPF and enters the intranet IP / domain name to access the intranet service, the data packet is sent to the diversion UPF. The diversion UPF identifies the intranet service flow based on the locally configured traffic filtering rules. If it matches the intranet diversion rules, the traffic is sent to the campus through the local N6 port of the diversion UPF.

[0076] 7. Diversion UPF forwards public network traffic: If the data packet does not match the intranet diversion rule, the diversion UPF will send the traffic to the main anchor point UPF in the core room through the N9 interface between the main anchor point, and then forward the traffic to the Internet through the N6 interface of the main anchor point.

[0077] The ULCL process implements policy management and traffic diversion to divert user traffic to different networks (intranet or public network), thereby meeting user access requirements for different network resources. It can provide flexible traffic control and management while ensuring network security and performance.

[0078] Among them, UPF (User Plane Function) is a key component in 5G networks, responsible for handling data transmission and distribution. ULCL offloading is a traffic processing technology performed on UPF. Figure 2is a diagram of the ULCL shunting network architecture provided by the present invention, such as Figure 2 As shown, the offload UPF includes a primary anchor point UPF, an uplink classifier user plane function network element ULCL-UPF and an auxiliary anchor point UPF.

[0079] Among them, the primary anchor point UPF is the UPF that allocates the user plane IP to the UE when the UE is activated, and is also the session anchor point for the UE to access the Internet.

[0080] ULCL-UPF: The full name is Uplink Classifier-UPF. ULCL-UPF is a data processing node that splits uplink service data and aggregates the split downlink data.

[0081] Auxiliary anchor point UPF: It is the PDU session anchor point when the UE accesses the local network.

[0082] The ULCL and auxiliary anchor insertion trigger conditions include: whether the user is located in the campus (mandatory) and whether the user has signed a campus package (optional).

[0083] Based on the above trigger conditions, two ULCL shunting technology solutions can be used: 1) Location-based: Qualified business traffic is diverted according to the user’s location.

[0084] 2) Based on location + contract: In addition to considering the user's location, it is also necessary to confirm whether the user has signed a contract for the specified campus package, so as to perform diversion based on these two conditions. That is, when the SMF senses that the current location of the second terminal is within the campus intranet and confirms that the second terminal is a terminal that has signed a contract for a dual-domain private network, the diversion UPF is inserted into the user session to achieve diversion.

[0085] The deployment modes of the offload UPF include independent hardware deployment of the primary anchor UPF, or combined deployment of the ULCL-UPF and the auxiliary anchor UPF.

[0086] 1) Main anchor UPF independent hardware deployment: In this deployment mode, the main anchor UPF is an independent hardware device that is deployed and operated separately. The main anchor UPF is responsible for processing user data traffic, including allocating user plane IP when users activate it and serving as a session anchor for users to access the Internet. This deployment mode provides flexibility and independence and is suitable for scenarios with high demands, such as scenarios with high requirements for processing power and performance.

[0087] 2) ULCL-UPF and auxiliary anchor UPF are deployed in hardware together: In this deployment mode, ULCL-UPF and auxiliary anchor UPF are deployed together on the same hardware device. ULCL-UPF is responsible for the diversion of uplink service data and aggregation of downlink data, while the auxiliary anchor UPF is responsible for serving as the PDU (packet data unit) session anchor when the UE (user equipment) accesses the local network. This deployment mode can save equipment cost and space and provide higher equipment utilization. It is suitable for scenarios with limited resources or the need for reasonable equipment utilization.

[0088] In the hardware deployment mode of ULCL-UPF and auxiliary anchor point UPF, it can include shared deployment in cities and deployment in industrial parks.

[0089] Figure 3 It is a schematic diagram of the shared deployment mode for cities and counties provided by the present invention. In the shared deployment mode for cities and counties, the 5G user terminal is turned on, the main anchor point UPF allocates an IP address to the terminal, the user completes activation, establishes a session, and can access the Internet; when the user terminal is at a specific location, the terminal reports the location information to the PCF. After receiving the location information, the PCF will issue a diversion strategy to the SMF according to a pre-set strategy. After receiving the diversion strategy, the SMF selects the ULCL-UPF and the auxiliary anchor point UPF based on the diversion strategy and inserts them into the session; the ULCL diverts the traffic that needs to access the local intranet to the auxiliary anchor point UPF based on the destination IP or DNS and other messages, while the traffic that needs to access the enterprise intranet will be diverted to the main anchor point UPF through N9 for processing, thereby accessing the Internet.

[0090] Through this deployment method and process, specific business traffic can be diverted to the auxiliary anchor point UPF for local intranet access based on the user's location information, and other business traffic can be diverted to the main anchor point UPF for public network access. This deployment model can improve the utilization efficiency of network resources, meet users' access requirements for different networks, and ensure network performance and security. At the same time, through resource sharing and reasonable deployment, it can also reduce equipment costs and optimize network architecture.

[0091] Figure 4 It is a schematic diagram of the campus deployment mode provided by the present invention. In the campus deployment mode, two campus users are configured on the PCF to trigger ULCL to insert a designated area (TAI list) into the user session and the binding relationship between the service packages subscribed by the campus users and the predefined rule names profile-A and profile-B.

[0092] Configure the binding relationship between profile-A, profile-B and DNAI-A, DNAI-B on SMF. SMF selects the auxiliary anchor point + ULCL UPF based on DNN (data network name) + DNAI (network access identifier) ​​+ TAI (radio tracking area identifier) ​​from the user profile configuration, and inserts them into the user session (DNN+DNAI+TAI selects the auxiliary anchor point, and the auxiliary anchor point and ULCL are set together).

[0093] The auxiliary anchor point UPF allocates different VPNs (virtual private networks) based on different DNAIs. For example, DNAI-A corresponds to VPN-A, and DNAI-B corresponds to VPN-B. VPN isolation between different campuses is achieved through the auxiliary anchor point N6 port.

[0094] Through the above configuration, ULCL diversion of users in different campuses is realized. According to the user's TAI, service package, DNAI and other attributes, SMF selects the appropriate auxiliary anchor point and ULCL-UPF to insert the user session, and the auxiliary anchor point UPF allocates the corresponding VPN for isolation according to DNAI. This can ensure network isolation and data security between users in different campuses. The campus deployment solution is suitable for scenarios where multiple campuses are settled in the same network operator. It can support the specific network access requirements of users in different campuses and achieve the purpose of optimizing network resource utilization and data isolation.

[0095] The intranet login method provided by the present invention, by constructing a ToB / ToC integrated dual-domain private network solution and diverting traffic based on ULCL, identifies legitimate users on the network side, adds authentication links, and uses network capabilities to allow "whitelist" users to legally access, thereby ensuring security and being applicable to more access scenarios. Intranet access traffic does not need to be exposed through the public network, and is diverted nearby to ensure the security of intranet data. At the same time, the overall solution is not limited by VPN bandwidth and the number of users, and makes the most of the advantages of 5G to achieve high-speed access with large bandwidth. It also corresponds to adding a firewall device to the network to convert addresses to resolve address conflicts, access intranet security control, solve the difficulty of address conflicts, and enable all private network users to access at the same time, making the solution more complete and more widely and comprehensively applicable. Specifically, the advantages include the following: 1. Experience optimization: 5G can achieve continuous coverage without dead spots indoors and outdoors, with greater capacity, strong anti-interference, good mobility, and provide a better user experience.

[0096] 2. O&M trusteeship: Operators centrally operate and maintain private networks, so the park does not need to build its own O&M platform and maintenance team. Operator-level network O&M guarantees can quickly respond to network failures.

[0097] 3. Senseless traffic diversion: Users can access the public network and private network at the same time, realizing the convenience of one card for multiple uses. The network is responsible for traffic diversion, and users do not need to perceive or switch manually.

[0098] 4. Location controllable: Operators identify user locations and allow access based on school requirements to ensure data security. This allows devices in the legal area to access private network resources.

[0099] 5. Independent billing: Public network traffic and private network traffic are billed separately, making the customization of traffic packages more flexible and personalized.

[0100] 6. Security enhancement: The dual-domain private network solution can provide higher security, ensuring that only authorized devices or users can access internal resources through whitelists and legal access zone restrictions. This helps prevent security threats such as unauthorized access, malicious attacks and data leaks.

[0101] The method provided by the present invention can be applied to 5G ToBToC converged service scenarios: 1) Government-specific network: 5G private network can replace mobile network VPN and provide a secure channel for government offices and data transmission.

[0102] 2) Campus network: 5G private network can replace WLAN, providing more stable and high-speed campus network coverage, and can also supplement outdoor network coverage.

[0103] 3) Police network: The 5G private network can inherit the 4G industry gateway to provide more efficient and secure communication and data transmission for the police department.

[0104] 4) Industrial site network: 5G private network can achieve the isolation of three flows: production, office and life, and provide network services that meet the needs of industrial sites.

[0105] Production, office and life three-way isolation

[0106] Common requirements: 1) In scenarios such as government, large enterprises, hospitals, and campuses, there is a widespread demand for ToC terminals to access both the enterprise intranet and the Internet at the same time; 2) ToC terminal users use 5G terminals to access the enterprise intranet and the Internet without changing cards or numbers; 3) Access to the corporate intranet is billed independently according to the intranet traffic fee, and access to the public network traffic is billed according to the public network fee.

[0107] With the expansion of 5G private network services, sub-industries such as education, government affairs, culture and tourism, medical care, large enterprises, and police services have generally put forward the demand for ToBToC dual-domain private networks, that is, to provide a ToBToC dual-domain network model that serves 5G public users based on 5G private networks, strengthen user stickiness, enhance service value, and help expand the scale of 5G users and revenue.

[0108] Three types of demand scenarios: 1) Fixed users access private network services locally, such as campus scenarios: students access the campus network in the school area.

[0109] 2) Fixed users access private network services in other places, such as government affairs scenarios: public officials visit the government affairs network when they are on business trips.

[0110] 3) Non-fixed users access private network services locally, such as in cultural and tourism scenarios: non-fixed tourists access the intranet in scenic spots.

[0111] Three basic needs

[0112] 1) Public users can use personal 5G terminals to access corporate intranets and the Internet without changing cards or numbers; 2) Campuses, governments, large enterprises, hospitals, police, cultural tourism and other customers have a widespread demand for isolated access to internal and external networks; 3) Access to corporate intranets is billed independently and paid for by ToB customers, while access to the public network is paid for by ToC users themselves.

[0113] Three basic principles

[0114] 1) 5G dual-domain private network services do not affect the existing services of ToC users; 2) Solutions that limit terminal types and have special requirements for terminals are not considered; 3) The construction rhythm is first local area and then wide area, and private network users first access the local area and then the wide area.

[0115] The intranet login device provided by the present invention is described below. The intranet login device described below and the intranet login method described above can be referenced to each other.

[0116] Figure 5 Schematic diagram of the structure of the intranet login device provided by the present invention. Figure 5 As shown, an intranet login device is provided, comprising: The request receiving unit 510 is used to receive a request from a first terminal to access an intranet through a hotspot connected to a second terminal, wherein the second terminal accesses the intranet through a dual-domain private network and a diversion method based on an uplink classifier ULCL; The identity authentication unit 520 is used to perform identity authentication on the second terminal based on the super SIM card information of the second terminal carried in the request; The communication establishing unit 530 is used to establish a communication connection between the first terminal and the intranet when the identity authentication is passed, so that the first terminal can log in to the intranet.

[0117] The device provided by the embodiment of the present invention authenticates the second terminal through the super SIM card information carried in the request to access the intranet, builds a trusted identity system, and thus improves the credibility and security of the user identity. In addition, super SIM identity authentication can realize the real-name management of network traffic, ensure that the traffic of each user can be authenticated and can be traced back to the specific user account, thereby increasing the traceability of network security.

[0118] Based on any of the above embodiments, the communication establishing unit is further used for: Based on the identity information of the first terminal carried in the request, the super SIM security gateway performs a legitimacy check on the first terminal; When the legality check passes, a communication connection is established between the first terminal and the intranet.

[0119] Based on any of the above embodiments, it also includes a log recording unit, which is used to: The super SIM security gateway records access behavior logs of the first terminal and the second terminal.

[0120] Based on any of the above embodiments, it further includes an address conversion unit, which is used to: converting the address distributed to the second terminal through the firewall device so that the converted address is different from the intranet address; and,

[0121] The address of the core system related to the intranet is converted into a legal address of the core network.

[0122] Based on any of the above embodiments, it further includes a flow dividing unit, which is used for: When the session management function network element SMF senses that the current location of the second terminal is within the campus intranet, the offload user plane function network element UPF is inserted into the user session; The diversion UPF matches the access traffic information of the second terminal with the intranet diversion rules. If the intranet diversion rules are matched, the access traffic information is forwarded to the campus intranet; if the intranet diversion rules are not matched, the access traffic information is forwarded to the Internet.

[0123] Based on any of the above embodiments, the diversion unit is further used for: When the SMF senses that the current location of the second terminal is within the campus intranet and confirms that the second terminal is a terminal that has signed a dual-domain private network contract, the diversion UPF is inserted into the user session.

[0124] Based on any of the above embodiments, the offload UPF includes a primary anchor point UPF, an uplink classifier user plane function network element ULCL-UPF and a secondary anchor point UPF; The deployment mode of the offload UPF includes independent hardware deployment of the main anchor point UPF, or combined deployment of the ULCL-UPF and the auxiliary anchor point UPF.

[0125] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 complete mutual communication through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the intranet login method, the method comprising: receiving a request from a first terminal to access the intranet through a hotspot connected to a second terminal, the second terminal accessing the intranet through a dual-domain private network and a diversion method based on an uplink classifier ULCL; performing identity authentication on the second terminal based on the super SIM card information of the second terminal carried in the request; and establishing a communication connection between the first terminal and the intranet when the identity authentication passes, so that the first terminal logs into the intranet.

[0126] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0127] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the intranet login method provided by the above methods, which includes: receiving a request from a first terminal to access the intranet through a hotspot connected to a second terminal, and the second terminal accesses the intranet through a dual-domain private network and a diversion method based on an uplink classifier ULCL; based on the super SIM card information of the second terminal carried in the request, authenticating the second terminal; and if the identity authentication is passed, establishing a communication connection between the first terminal and the intranet to enable the first terminal to log in to the intranet.

[0128] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the intranet login method provided by the above-mentioned methods, the method comprising: receiving a request from a first terminal to access the intranet through a hotspot connected to a second terminal, the second terminal accessing the intranet through a dual-domain private network and a diversion method based on an uplink classifier ULCL; performing identity authentication on the second terminal based on the super SIM card information of the second terminal carried in the request; and when the identity authentication is passed, establishing a communication connection between the first terminal and the intranet so that the first terminal logs in to the intranet.

[0129] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0130] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intranet login method, characterized in that: include: Receiving a request from a first terminal to access an intranet through a hotspot connected to a second terminal, wherein the second terminal accesses the intranet through a dual-domain private network and a traffic diversion method based on an uplink classifier ULCL; Performing identity authentication on the second terminal based on the super SIM card information of the second terminal carried in the request; When the identity authentication is passed, a communication connection is established between the first terminal and the intranet, so that the first terminal logs into the intranet.

2. The intranet login method according to claim 1, characterized in that: The establishing of a communication connection between the first terminal and the intranet includes: Based on the identity information of the first terminal carried in the request, the super SIM security gateway performs a legitimacy check on the first terminal; When the legality check passes, a communication connection is established between the first terminal and the intranet.

3. The intranet login method according to claim 2, characterized in that: The method further comprises: The super SIM security gateway records access behavior logs of the first terminal and the second terminal.

4. The intranet login method according to claim 1, characterized in that: The method further comprises: converting the address distributed to the second terminal through the firewall device so that the converted address is different from the intranet address; and, The address of the core system related to the intranet is converted into a legal address of the core network.

5. The intranet login method according to claim 1, characterized in that: The second terminal accesses the intranet through the dual-domain private network and the diversion method based on the uplink classifier ULCL, specifically including: When the session management function network element SMF senses that the current location of the second terminal is within the campus intranet, the offload user plane function network element UPF is inserted into the user session; The diversion UPF matches the access traffic information of the second terminal with the intranet diversion rules. If the intranet diversion rules are matched, the access traffic information is forwarded to the campus intranet; if the intranet diversion rules are not matched, the access traffic information is forwarded to the Internet.

6. The intranet login method according to claim 5, characterized in that: When the session management function network element SMF senses that the current location of the second terminal is within the campus intranet, the offload user plane function network element UPF is inserted into the user session, including: When the SMF senses that the current location of the second terminal is within the campus intranet and confirms that the second terminal is a terminal that has signed a dual-domain private network contract, the diversion UPF is inserted into the user session.

7. The intranet login method according to claim 5, characterized in that: The offload UPF includes a primary anchor point UPF, an uplink classifier user plane function network element ULCL-UPF and a secondary anchor point UPF; The deployment mode of the offload UPF includes independent hardware deployment of the main anchor point UPF, or combined deployment of the ULCL-UPF and the auxiliary anchor point UPF.

8. An intranet login device, characterized in that: include: A request receiving unit, configured to receive a request from a first terminal to access an intranet through a hotspot connected to a second terminal, wherein the second terminal accesses the intranet through a dual-domain private network and a diversion method based on an uplink classifier ULCL; an identity authentication unit, configured to perform identity authentication on the second terminal based on the super SIM card information of the second terminal carried in the request; The communication establishing unit is used to establish a communication connection between the first terminal and the intranet when the identity authentication is passed, so that the first terminal can log in to the intranet.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the intranet login method as described in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the intranet login method as described in any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the intranet login method as described in any one of claims 1 to 7 is implemented.

Images