Network communication method based on space-time management and control, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a network communication method based on space-time management and control, electronic equipment and a storage medium. The method comprises the following steps: a private network server receives a secondary authentication request sent by a user terminal through a public network communication line, verifies the secondary authentication request based on a space-time management and control rule corresponding to the user terminal, and sends a verification result to the user terminal through the public network communication line, and after the user terminal receives the verification result, under the condition that the verification result indicates that the user terminal has the access permission, the user terminal accesses a private network server and communicates with the private network server through a private network communication route. According to the method, through the space-time control rule and different private network communication routes corresponding to different parks, network isolation of a public network and a private network is realized, and the requirements of interconnection and intercommunication among multiple office areas in various scenes and trans-provincial roaming remote access are met.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a network communication method, electronic device and storage medium based on time and space control. Background Art

[0002] The development and popularization of Internet technology in various fields such as education, medical care, and finance has, on the one hand, improved work efficiency and production benefits in various fields, and on the other hand, deepened people's understanding of network security and increased the requirements of enterprises in various fields for network security.

[0003] 5G (5th Generation Mobile Communication Technology) private networks carry the office, production and other businesses of enterprises. Considering the security of enterprise information, existing technologies physically isolate the enterprise's 5G private network from the external network. In addition, 5G private networks also achieve public-private network diversion through technologies such as UL CL (Uplink Classifier), DNAI (Data Network Access Identifier), and URSP (User Route Selection Policy). Depending on whether UPF (User Plane Function) is deployed in the enterprise's local data center, it can be divided into virtual private networks and hybrid private networks to meet the different needs of enterprises for network security and security maintenance costs.

[0004] However, although existing technologies can meet the needs of enterprises for physical isolation of public and private networks to a certain extent, they cannot simultaneously meet the needs of interconnection between multiple office areas and cross-provincial roaming remote access in various scenarios. Summary of the invention

[0005] The embodiments of the present application provide a network communication method, electronic device and storage medium based on time and space control, which, on the basis of realizing network isolation between multiple office areas in multiple scenarios, meets the needs of interconnection and intercommunication between multiple office areas in multiple scenarios and cross-provincial roaming remote access.

[0006] In a first aspect, an embodiment of the present application provides a network communication method based on time-space control, which is applied to a private network server, including:

[0007] Receiving a secondary authentication request sent by a user terminal through a public network communication route, wherein the secondary authentication request carries location information of the user terminal;

[0008] Verifying the secondary authentication request according to the time and space control rule corresponding to the user terminal to obtain a verification result, wherein the verification result is used to indicate whether the user terminal has access authority, and there is an association between the location of the user terminal and the time and space control rule;

[0009] The verification result is sent to the user terminal via the public network communication route, and when the verification result indicates that the user terminal has access authority, the communication message sent by the user terminal is received via the private network communication route, wherein the private network communication route is associated with the location of the user terminal.

[0010] In a possible implementation, the spatiotemporal control rule includes an area control rule and a time control rule, the secondary authentication request further includes: a user identity corresponding to the user terminal and a request time of the secondary authentication request, and the secondary authentication request is verified according to the spatiotemporal control rule corresponding to the user terminal to obtain a verification result, including:

[0011] Determine the corresponding time and space control rules according to the user identity identifier;

[0012] Determining whether the location information and the request time satisfy the time-space control rules;

[0013] In a case where the location information and the request time satisfy the time-space control rule, determining that the verification result is a first verification result, where the first verification result is used to indicate that the user terminal has access authority;

[0014] In a case where the location information and the request time do not satisfy the time and space control rule, the verification result is determined to be a second verification result, and the second verification result is used to indicate that the user terminal does not have access authority.

[0015] In a possible implementation manner, the receiving a communication message sent by the user terminal through a private network communication route includes:

[0016] When the location information of the user terminal indicates that the user terminal is in a first park, the communication message is received through a first private network communication route, where the first private network communication route is constructed by a private network base station and a private network element in the first park, and the first park is the park where the private network server is located;

[0017] When the location information of the user terminal indicates that the user terminal is in the second park, a communication message sent by the user terminal is received through a second private network communication route, where the second private network communication route is constructed by a private network base station of the second park, a private network base station of the first park, and a private network element, and the second park includes at least one park in the same city as the first park;

[0018] When the location information of the user terminal indicates that the user terminal is in a third park, a communication message sent by the user terminal is received through a third private network communication route. The third private network communication route is constructed by the base station, intelligent metropolitan area network, and private network base station of the third park. The third park includes a roaming area outside the home location of the first park.

[0019] In a possible implementation manner, before receiving the communication message sent by the user terminal through the second private network communication route, the method further includes:

[0020] Determining the current operating status of the second private network communication route;

[0021] When the current operating state is an abnormal state, the communication message sent by the user terminal in the second park is received through the backup communication route, and the backup communication route includes the base station of the second park, the intelligent metropolitan area network, and the private network base station.

[0022] In a possible implementation manner, the receiving a communication message sent by the user terminal through a private network communication route includes:

[0023] Receiving a charging message sent by the user terminal through the private network communication route, the charging message including current location information and current time information of the user terminal;

[0024] Verify the charging message using the time and space control rule corresponding to the user terminal to obtain a verification result, where the verification result is used to indicate whether the current charging status of the user terminal is normal;

[0025] When the verification result indicates that the current billing state is an abnormal billing state, the current access operation of the user terminal is interrupted.

[0026] In a second aspect, an embodiment of the present application provides a network communication method based on time and space control, which is applied to a user terminal, including:

[0027] Sending a secondary authentication request to the private network server via a public network communication route, wherein the secondary authentication request carries the location information of the user terminal;

[0028] Receiving the verification result sent by the private network service end through the public network communication route;

[0029] If the verification result indicates that the user terminal has access authority, access the private network service end;

[0030] A communication message is sent to the private network server via the private network communication route, wherein the private network communication route is associated with the location of the user terminal.

[0031] In a possible implementation manner, the communication message includes a charging message, and when the verification result indicates that the user terminal has access authority, after accessing the private network service end, the method further includes:

[0032] Obtaining current location information, and determining whether the current location information is consistent with the location information in the secondary authentication request;

[0033] In the case that the current location information and the location information are inconsistent, a charging message is generated, wherein the charging message includes the current location information and the current time information.

[0034] In a possible implementation manner, sending a communication message to the private network server through the private network communication route includes:

[0035] Determine the current location information and the current time information according to the preset time interval;

[0036] generating a charging message based on the current location information, the current time information and the user identity of the user terminal;

[0037] The billing message is sent to the private network service end via the private network communication route.

[0038] In a third aspect, an embodiment of the present application provides a network communication device based on time and space control, which is applied to a private network server, including:

[0039] A receiving module, configured to receive a secondary authentication request sent by a user terminal through a public network communication route, wherein the secondary authentication request carries location information of the user terminal;

[0040] A verification module, used to verify the secondary authentication request according to the time and space control rules corresponding to the user terminal, and obtain a verification result, wherein the verification result is used to indicate whether the user terminal has access authority, and there is an association between the location of the user terminal and the time and space control rules;

[0041] A sending module, used for sending the verification result to the user terminal via the public network communication route;

[0042] The receiving module is further used to receive a communication message sent by the user terminal through a private network communication route when the verification result indicates that the user terminal has access authority, wherein the private network communication route is associated with the location of the user terminal.

[0043] In a possible implementation, the device further includes: a determination module and a processing module;

[0044] The determination module is used to determine the corresponding time and space control rules according to the user identity;

[0045] The processing module is used to determine whether the location information and the request time meet the time and space control rules;

[0046] The determination module is further configured to, when the location information and the request time satisfy the time-space control rule, determine that the verification result is a first verification result, and the first verification result is used to indicate that the user terminal has access authority;

[0047] The determination module is also used to determine that the verification result is a second verification result when the location information and the request time do not satisfy the time and space control rules, and the second verification result is used to indicate that the user terminal does not have access authority.

[0048] In a possible implementation, the receiving module is specifically configured to receive the communication message through a first private network communication route when the location information of the user terminal indicates that the user terminal is in a first park, the first private network communication route being constructed by a private network base station and a private network element in the first park, and the first park being the park where the private network server is located;

[0049] The receiving module is specifically configured to receive a communication message sent by the user terminal through a second private network communication route when the location information of the user terminal indicates that the user terminal is in a second park, the second private network communication route being constructed by a private network base station in the second park, a private network base station in the first park, and a private network element, and the second park includes at least one park in the same city as the first park;

[0050] The receiving module is specifically used to receive the communication message sent by the user terminal through the third private network communication route when the location information of the user terminal indicates that the user terminal is in the third park. The third private network communication route is constructed by the base station, intelligent metropolitan area network, and the private network base station of the third park. The third park includes a roaming area outside the home location of the first park.

[0051] In a possible implementation manner, the determination module is further used to determine a current operating state of the second private network communication route;

[0052] The receiving module is also used to receive the communication message sent by the user terminal in the second park through the backup communication route when the current operating state is an abnormal state. The backup communication route includes the base station of the second park, the intelligent metropolitan area network, and the private network base station.

[0053] In a possible implementation, the device further includes: a verification module;

[0054] The receiving module is further used to receive a charging message sent by the user terminal through the private network communication route, wherein the charging message includes current location information and current time information of the user terminal;

[0055] The verification module is further used to verify the charging message using the time and space control rules corresponding to the user terminal to obtain a verification result, wherein the verification result is used to indicate whether the current charging status of the user terminal is normal;

[0056] The processing module is further configured to interrupt the current access operation of the user terminal when the verification result indicates that the current billing status is an abnormal billing status.

[0057] In a fourth aspect, an embodiment of the present application provides a network communication device based on time and space control, which is applied to a user terminal, including:

[0058] A sending module, used to send a secondary authentication request to a private network server through a public network communication route, wherein the secondary authentication request carries the location information of the user terminal;

[0059] A receiving module, used for receiving the verification result sent by the private network server through the public network communication route;

[0060] A processing module, configured to access the private network service end if the verification result indicates that the user terminal has access authority;

[0061] The sending module is further used to send a communication message to the private network server through the private network communication route, wherein the private network communication route is associated with the location of the user terminal.

[0062] In a possible implementation, the device further includes: an acquisition module and a generation module;

[0063] The acquisition module is used to acquire current location information;

[0064] The processing module is further used to determine whether the current location information is consistent with the location information in the secondary authentication request;

[0065] The generating module is used to generate a charging message when the current location information and the location information are inconsistent, and the charging message includes the current location information and the current time information.

[0066] In a possible implementation manner, the device further includes: a determination module;

[0067] The determination module is used to determine the current location information and the current time information according to a preset time interval;

[0068] The generating module is further used to generate a charging message based on the current location information, the current time information and the user identity of the user terminal;

[0069] The sending module is specifically used to send the billing message to the private network server through the private network communication route.

[0070] In a fifth aspect, an embodiment of the present application provides a network communication device based on time and space control, including: a memory, a processor;

[0071] The memory stores computer-executable instructions;

[0072] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the network communication method based on time and space control as described in the first aspect and various possible implementation methods of the first aspect, as well as the network communication method based on time and space control as described in the first aspect and various possible implementation methods of the first aspect.

[0073] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the network communication method based on time and space control as described in the first aspect and / or various possible embodiments of the first aspect, as well as the network communication method based on time and space control as described in the first aspect and various possible embodiments of the first aspect.

[0074] In the seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the network communication method based on time and space control as described in the first aspect and / or various possible embodiments of the first aspect, as well as the network communication method based on time and space control as described in the first aspect and various possible embodiments of the first aspect.

[0075] The network communication method, electronic device and storage medium based on time-space control provided in the embodiment of the present application, the private network server receives the secondary authentication request sent by the user terminal through the public network communication route, and after verifying the secondary authentication request based on the time-space control rules corresponding to the user terminal, sends the verification result to the user terminal through the public network communication route. After the user terminal receives the verification result, if the verification result indicates that the user terminal has access authority, it accesses the dedicated private network server and communicates with the private network server through the private network communication route. This method not only realizes the network isolation of the public and private networks through time-space control rules and different private network communication routes corresponding to different parks, but also meets the needs of interconnection between multiple office areas and cross-provincial roaming remote access in various scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0077] Figure 1 A schematic diagram of a scenario of a network communication method based on time-space control provided in this application;

[0078] Figure 2 An interactive diagram of a network communication method based on time-space control provided by this application Figure 1 ;

[0079] Figure 3 A flowchart of a network communication method based on time-space control provided by this application;

[0080] Figure 4 A schematic diagram of a public network communication route provided for the application;

[0081] Figure 5 An interactive diagram of a network communication method based on time-space control provided by this application Figure 2 ;

[0082] Figure 6 A schematic diagram of the structure of a network communication device based on time and space control provided in this application Figure 1 ;

[0083] Figure 7 A schematic diagram of the structure of a network communication device based on time and space control provided in this application Figure 2 ;

[0084] Figure 8 A schematic diagram of the structure of a network communication device based on time and space control provided in this application.

[0085] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0086] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0087] First, the terms involved in this application are explained:

[0088] Network element: It is the smallest unit that can be monitored and managed in network management and can independently complete tasks such as data transmission and routing selection;

[0089] Campus: It is a basic unit that is usually deployed with one or more base stations and provides coverage and communication services through these base stations.

[0090] As a product of the rapid development of Internet technology, 5G networks are widely used in various industries such as entertainment, finance, and education, and carry the office and production business of enterprises. With the increase in the amount and complexity of information carried by 5G networks, information security issues have become inevitable.

[0091] Confidential enterprises with high security control requirements usually use network gates and optical gates to physically isolate public networks and enterprise private networks to ensure the security of enterprise private networks. However, since the use of public networks cannot be avoided during communication, the physical isolation method cannot meet the enterprise's needs for network security. In addition, existing technologies also use UL CL functions, DNAI, URSP and other technologies to achieve public and private network diversion, and build virtual private networks and hybrid private networks based on whether UPF is deployed in the enterprise's local data center to ensure the security of enterprise information.

[0092] However, neither virtual private networks nor hybrid private networks can directly meet the company's needs for physical isolation of public and private networks. Although exclusive private networks can achieve physical isolation of public and private networks, the cost is too high and cannot simultaneously meet the needs of interconnection between multiple office areas and cross-provincial roaming remote access in various scenarios.

[0093] Based on the above technical problems, the present application provides a network communication method based on time and space control. Figure 1A schematic diagram of a scenario of a network communication method based on time-space control provided in this application, such as Figure 1 As shown, the specific application scenarios of this application include three types of office areas: headquarters office park, office area and family area in the same city, and roaming area. The interactive objects of this application include user terminal S101 in the headquarters office park, user terminal 102 in the office park and family area in the same city, user terminal 103 in the roaming area, and private network service end 104. User terminal 101 establishes a communication connection with private network service end 103 through private network base station 105 in the headquarters office park. User terminal 102 can establish a communication connection with private network service end 103 through intelligent metropolitan area network, and can also establish a communication connection with private network service end 103 through private network communication route. User terminal 105 establishes a communication connection with private network service end 103 through intelligent metropolitan area network. Among them, the private network communication route includes private network network element 108 and communication network element 109 in the office area and family area in the same city.

[0094] In combination with the above scenarios, it can be seen that the network communication method based on time-space control provided by this application determines whether the user terminal has the authority to access the private network server through time-space control rules and secondary authentication requests, and when the user terminal has access rights, through the private network communication routes corresponding to different office parks, it can realize interconnection between multiple office areas in multiple scenarios and cross-provincial roaming remote access. In addition, in this method, the user terminal uploads a secondary authentication request to the private network server through the public network communication route, which prevents unauthenticated user terminals from accessing the private network base station, further meets the enterprise's demand for private network isolation, and ensures the security of private network communication.

[0095] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0096] Figure 2 An interactive diagram of a network communication method based on time-space control provided by this application Figure 1 ,like Figure 2 As shown, the method includes:

[0097] S201. The user terminal sends a secondary authentication request to the private network server via a public network communication route.

[0098] The secondary authentication request carries the location information of the user terminal, and the public network communication route is composed of the communication equipment in the park where the user terminal is located, the smart metropolitan area, and the communication equipment in the park where the private network service end is located. Figure 4 This is a schematic diagram of the public network communication route provided in this embodiment. Figure 4 As shown, the public network communication route can be composed of the public network base station, public network network elements, intelligent metropolitan area network and network elements of the park where the terminal is located. The user terminal sends a secondary authentication request to the public network base station, and the public network base station transmits the secondary authentication request to the intelligent metropolitan area network through the public network network element. The intelligent metropolitan area network sends the secondary authentication request to the private network server through the network elements of the park where the private network server is located.

[0099] It should be noted that the public network elements include but are not limited to MAR, and the network elements of the park where the private network server is located include but are not limited to MAR and UPF. In addition, a firewall can be set on the private network server to further ensure the security of private network communication.

[0100] S202: The private network service end receives a secondary authentication request sent by the user terminal through a public network communication route.

[0101] Optionally, the secondary authentication request is a network access request from a user terminal, and the time and space control system of the private network service end receives the secondary authentication request through the communication network element of the headquarters campus. The time and space control system may be a DN-AAA (datanetwork-authentication authorization accounting) system, and the private network service end may receive the secondary authentication request from the communication network element through the Radius (Remote Authentication Dial In User Service) protocol.

[0102] S203. The private network server verifies the secondary authentication request according to the time and space control rules corresponding to the user terminal to obtain a verification result.

[0103] Among them, the verification result is used to indicate whether the user terminal has access authority, and there is a correlation between the location of the user terminal and the time and space control rules, and the time and space control rules include area control rules and time control rules.

[0104] Optionally, the secondary authentication request also includes the identity information of the user terminal, and the corresponding time and space control rules are determined according to the identity information of the user terminal in the secondary authentication request, and then the time and space control rules are used to verify the information carried by the secondary authentication request to generate a verification result. The time and space control rules can be obtained from the local database of the time and space control system, or from the user management system of the enterprise.

[0105] It should be noted that enterprises can set user terminals that are allowed to access the private network service end in office parks and office hours based on office parks and office hours, and can also configure the area and time period allowed for a certain user terminal to access the private network service end. In addition, enterprises can also request operators to configure regional control rules and time control rules for user terminals in batches through the operator's platform.

[0106] S204. The private network service end sends the verification result to the user terminal via the public network communication route.

[0107] Specifically, after completing the verification of the secondary authentication request, the time-space control system sends the verification result to the intelligent metropolitan area network through the public network element, and the intelligent metropolitan area network sends the verification result to the user terminal. For example, the time-space control system DN-AAA can send the verification result to the UPF or SMF through the Radius message, and the UPF or SMF sends the verification result to the intelligent metropolitan area network, and then sends the verification result to the user terminal through the intelligent metropolitan area network.

[0108] S205. The user terminal receives the verification result sent by the private network server through the public network communication route.

[0109] Specifically, the user terminal receives the verification result sent by the private network service end through the base station in the office park. Optionally, during the information transmission process, the verification result can be encrypted to further ensure the security of information transmission.

[0110] S206. When the verification result indicates that the user terminal has access authority, the user terminal accesses the private network service end.

[0111] Specifically, after the user terminal receives the verification result of the secondary authentication request, if the verification result indicates that the user terminal has access authority, the user terminal can access the private network through the private network base station. Figure 1 In the communication scenario shown, the user terminal 101 has the authority to access the private network, so the user terminal 101 can access the private network server 104 through the private network base station 105, and then access the private network.

[0112] S207. The user terminal sends a communication message to the private network server through the private network communication route.

[0113] There is a correlation between the private network communication route and the location of the user terminal, and different office parks correspond to different private network communication routes.

[0114] Optionally, the private network communication route includes the private network base station and private network network element of the private network server, and the private network base station in the park where the user terminal is located. After the secondary authentication request of the user terminal is verified, a communication connection is established with the private network server through the private network communication route, thereby isolating the public network, which not only meets the enterprise's needs for private network isolation, but also ensures the security of private network communications.

[0115] S208. The private network server receives the communication message sent by the user terminal through the private network communication route.

[0116] Optionally, when the verification result of the secondary authentication request of the user terminal indicates that the user terminal has access authority, the private network service end allows the user terminal to access the private network through the private network communication route, and receives the communication message sent by the user terminal through the private network communication route, thereby realizing interconnection and intercommunication between multiple office areas in multiple scenarios through the private network communication route. In addition, this method prevents unauthenticated user terminals from accessing the private network base station, further ensuring the security of private network communications.

[0117] The embodiment of the present application provides a network communication method based on time-space control, which receives a secondary authentication request sent by a user terminal through a public network communication route through a private network service end, and after verifying the secondary authentication request based on the time-space control rules corresponding to the user terminal, sends the verification result to the user terminal through the public network communication route. After the user terminal receives the verification result, if the verification result indicates that the user terminal has access authority, it accesses the dedicated private network service end and communicates with the private network service end through the private network communication route, which not only realizes the interconnection between multiple office areas in multiple scenarios through private network communication routes, but also allows user terminals to meet the needs of cross-provincial roaming remote access. In addition, this method meets the needs of enterprises for network isolation through time-space control rules and different private network communication routes corresponding to different parks.

[0118] Figure 3 The present application provides a flow chart of a network communication method based on time and space control, which is applied to a private network server. Figure 3 As shown, in this embodiment Figure 2 Based on the embodiment, a network communication method based on time and space control is described in detail, and the method includes:

[0119] S301. Receive a secondary authentication request sent by a user terminal via a public network communication route.

[0120] This step is similar to the explanation of the above step S202 and will not be repeated here.

[0121] S302: Determine corresponding time and space control rules according to the user identity identifier.

[0122] Among them, the secondary authentication request includes the location information of the user terminal sending the secondary request, the user identity corresponding to the user terminal and the request time of the secondary authentication request, the user identity includes the terminal identification code of the user terminal and the user's identity code, and the time and space control rules are used to control the area and time of the user terminal's access to the private network.

[0123] Optionally, based on the user identity in the secondary authentication request, determine whether the user terminal has access rights to the private network, and if the user terminal has access rights to the private network, determine the time and space control rules associated with the identity, and the time and space control rules include time verification information and location verification information. Among them, the location verification information limits the user terminal's access address to the private network, which is used to verify the location information of the user terminal sending the secondary request, and the time verification information limits the user terminal's access period to the private network, which is used to verify the request time of the secondary authentication request.

[0124] Exemplarily, the time-space control rules are stored in the local database of the time-space control system in the form of a table, and according to the user identity in the secondary authentication request, the location verification information and time verification information corresponding to the user identity are queried in the table. The location verification information may be, for example, the enterprise park dedicated tracking area code and the enterprise park base station sector code, and the time verification information may be, for example, the opening hours of the enterprise private network.

[0125] It should be noted that the user identity identifier can be the mobile phone number of an enterprise employee, the enterprise IoT device number, or the enterprise IoT device serial number. This application does not impose any restrictions on this.

[0126] S303: Determine whether the location information and the request time satisfy the time and space control rules.

[0127] Optionally, based on the location verification information and time verification information in the time and space control rules determined in the above step S302, the location information and request time in the secondary authentication request are verified to determine whether the user terminal accesses the private network within the area and time period specified by the time and space control. This method uses a secondary authentication request, which not only determines the user terminal's access rights to the private network, and avoids user terminals that have not been authenticated by the private network server from accessing the private network, but also determines the compliance of the location and time when the user terminal accesses the private network through regional control and time control, further strengthening the security of private network communications.

[0128] S304: When the location information and the request time satisfy the time-space control rule, determine that the verification result is a first verification result.

[0129] The first verification result is used to indicate that the user terminal has access authority.

[0130] Optionally, when the location information and the request time of the user terminal are within the range of the location verification information and the time verification information in the time and space control rules, it is determined that the user terminal has the right to access the private network, that is, the user terminal is allowed to access the private network through the private network base station, and a first verification result is generated. The first verification result includes an identification that the user terminal has access authority and a base station identification code of the private network base station, so that the user terminal can access the private network base station and then access the private network.

[0131] S305: When the location information and the request time do not satisfy the time and space control rule, determine that the verification result is a second verification result.

[0132] The second verification result is used to indicate that the user terminal does not have access authority.

[0133] Optionally, when the location information and the request time of the user terminal are not within the range of the location verification information and the time verification information in the time and space control rules, it is determined that the user terminal does not have the authority to access the private network, that is, the user terminal is denied access to the private network through the private network base station, and a second verification result is generated. The second verification result includes an indication that the user terminal does not have access authority.

[0134] It should be noted that the second verification result may also include more detailed verification information and data, such as the reason why the user terminal does not have access authority, which includes but is not limited to an access address error and an access time that is not within the permitted access period.

[0135] S306: Send the verification result to the user terminal via the public network communication route.

[0136] The explanation of this step is similar to that of the above step S204.

[0137] Optionally, when the verification result is sent to the user terminal and no feedback information indicating that the verification result has been successfully received is received from the user terminal within a preset time interval, a confirmation message is sent to the user terminal to determine whether the user terminal has received the verification result, and confirm whether the verification result needs to be resent, or perform other operations.

[0138] S307: When the verification result indicates that the user terminal has access authority, receive a communication message sent by the user terminal through a private network communication route.

[0139] The explanation of this step is similar to that of the above step S206 and will not be repeated here.

[0140] S308. When the location information of the user terminal indicates that the user terminal is in the first park, receiving the communication message through the first private network communication route.

[0141] Among them, the first private network communication route is constructed by a private network base station and a private network network element of a first park, and the first park is the park where the private network server is located.

[0142] Optionally, after the user terminal in the first park passes the verification of the secondary authentication request, the user terminal establishes a communication connection with the private network server through the first private network communication route, and the private network server receives the communication message sent by the user terminal through the first private network communication route. Figure 1 As shown, the user terminal 101 is located in the headquarters office park. After passing the secondary authentication, the user terminal communicates with the private network server through the first private network communication route formed by the private network base station 105 and the private network network element 108.

[0143] S309. When the location information of the user terminal indicates that the user terminal is in the second campus, receiving a communication message sent by the user terminal through a second private network communication route.

[0144] Among them, the second private network communication route is constructed by the private network base station of the second park, the private network base station of the first park, and the private network network element, and the second park includes at least one park in the same city as the first park.

[0145] Optionally, after the user terminal of the second park passes the secondary authentication, the private network service end establishes a communication connection with the user terminal through the second private network communication route, such as Figure 1 As shown, the second private network communication route, i.e., the illustrated private network communication route, includes the private network base station 106 and private network network element 109 in the office park and family area in the same city, as well as the private network network element 108 in the headquarters office park. The user terminal 102 and the private network server 104 establish a communication connection through the illustrated private network communication route.

[0146] Optionally, before receiving the communication message sent by the user terminal through the second private network communication route, the second private network communication route can also be monitored to obtain the operating status of the second private network communication route, and determine whether to enable the backup communication route according to the operating status to ensure smooth communication between the user terminal and the private network in the second park. Exemplarily, a communication method between the user terminal and the private network server when the second communication route is in an abnormal state is described in detail here. The method includes:

[0147] Determine the current operating status of the second private network communication route; when the current operating status is an abnormal state, receive the communication message sent by the user terminal in the second park through the backup communication route.

[0148] Among them, the backup communication route includes the base station of the second park, the intelligent metropolitan area network, and the private network base station, and the current operating status includes an abnormal state and a normal state. The abnormal state may be, for example, a congested communication route or a damaged communication route.

[0149] Optionally, monitor the current operating status of the second private network communication route. When the current operating status of the second private network communication route is abnormal, select a backup communication route to receive communication messages sent by user terminals to ensure communication between user terminals in the second park and the private network service end, thereby avoiding immeasurable losses caused by the abnormal status of the second private network communication route.

[0150] It should be noted that in disaster recovery situations, you can also choose to activate backup communication routes and establish reliable emergency communication routes in advance to ensure smooth communication in emergency situations and avoid more serious consequences caused by communication anomalies.

[0151] S310. When the location information of the user terminal indicates that the user terminal is in a third park, receiving a communication message sent by the user terminal through a third private network communication route.

[0152] Among them, the third private network communication route is constructed by the base station of the third park, the intelligent metropolitan area network, and the private network base station, and the third park includes a roaming area outside the home location of the first park.

[0153] Optionally, after the user terminal in the third park passes the verification of the secondary authentication request, the user terminal can access the private network service end through the private network element base station in the first park, and then receive the communication message sent by the user terminal through the third private network communication route with the private network service end. Figure 1 As shown, the user terminal 103 is in a roaming area. The third private network communication route corresponding to the roaming area includes a public network base station 107, an intelligent metropolitan area network and a private network element 108. In the process of using the third private network communication route to transmit communication messages, the enterprise private network service data flow can be, for example: the 5G terminal sends the service data to the 5G public network base station, flows to the public network MAR through the 5G public network base station, and is transmitted to the private network MAR and private network UPF of the first park through the intelligent metropolitan area network, and then flows to the enterprise intranet through the firewall of the private network service end.

[0154] The embodiment of the present application provides a network communication method based on time-space control, which receives a secondary authentication request sent by a user terminal using a public network communication route, and verifies the user identity information, location information and request time in the secondary authentication request using time-space control rules, determines the access rights of the user terminal, and whether the location and time when the user terminal accesses the private network conform to the time-space control rules, and allows the user terminal to establish a communication connection with the private network server through the private network communication route when the location information and request time of the user terminal conform to the time-space control rules. The private network communication route is associated with the location of the user terminal, and different office parks correspond to different private network communication routes. In addition, when the second private network communication route is in an abnormal state, a backup communication route is selected to establish a communication connection between the second park and the private network server. The method verifies the access rights, access location and access time of the user terminal through the time-space control rules, which not only verifies the access rights of the user terminal to the private network, but also ensures that the access location and access time of the user terminal conform to the time-space control rules, further ensuring the communication security of the private network. In addition, in the method, different office parks correspond to different private network communication routes, and when the second private network communication route is abnormal, the backup communication route is activated to ensure smooth communication between the user terminal in the second park and the private network server. This not only meets the company's demand for private network isolation, but also realizes interconnection between multiple office areas in various scenarios and cross-provincial roaming remote access. It also ensures that in the unlikely event that the second private network communication route is abnormal, the user terminal in the second park can communicate with the private network server smoothly, avoiding immeasurable losses caused by the abnormality of the communication route.

[0155] Figure 5 An interactive diagram of a network communication method based on time-space control provided by this application Figure 2 ,like Figure 5 As shown, in this embodiment Figure 2-3 Based on the embodiment, a network communication method based on time and space control is described in detail, and the method includes:

[0156] S501. The user terminal obtains current location information, and determines whether the current location information is consistent with the location information in the secondary authentication request.

[0157] Optionally, the current location information of the user terminal is monitored, and the current location information is compared with the location information in the secondary authentication request to determine whether the current location information is consistent with the location information in the secondary authentication request, so as to determine whether the access location of the user terminal after passing the secondary authentication is within the range specified by the time and space control rules, thereby preventing the user terminal from accessing the private network outside the area specified by the time and space control rules, and ensuring the communication security of the private network.

[0158] It should be noted that the above current location information can be obtained in real time, or can be obtained based on a preset time interval or a preset acquisition time. This application does not limit the method for obtaining the current location information.

[0159] S502: When the current location information and the location information are inconsistent, the user terminal generates a charging message.

[0160] The charging message includes the current location information and current time information of the user terminal.

[0161] Optionally, when the current location information of the user terminal is inconsistent with the location information in the secondary authentication request, a billing message is generated based on the current location information and current time information of the user terminal. This method generates a billing message based on the current location information when the user terminal leaves the location where the secondary authentication is passed by comparing the current location information of the user terminal with the location information in the secondary authentication request, so that the private network service end updates the current access operation of the user terminal based on the billing message.

[0162] It should be noted that the charging message may also include the time when the user terminal leaves the location in the secondary authentication request and the duration of the user terminal's access to the private network at the location in the secondary authentication request. This application does not limit the content of the charging message.

[0163] S503: The user terminal sends a billing message to the private network server through the private network communication route.

[0164] Optionally, the user terminal sends the billing message to the private network server through the private network communication route of the park where the user terminal is located. The private network communication route used is different depending on the park where the user terminal is located. In addition, before sending the billing message to the private network server, the user terminal can encrypt the billing message to reduce the risk of leakage of the billing message during transmission.

[0165] S504. The private network service end receives the billing message sent by the user terminal through the private network communication route.

[0166] Optionally, the private network service end receives the billing message sent by the user terminal through the private network network element of the park where it is located, and the billing message is specifically received by the time and space control system deployed in the private network, so as to verify the billing message based on the time and space control rules. For example, the billing message can be transmitted to the time and space control system DN-AAA through the private network UPF or SMF agent in the form of Radius message, and then the billing message is verified based on the time and space control rules pre-stored in DN-AAA.

[0167] S505. The private network service end verifies the billing message using the time and space control rules corresponding to the user terminal to obtain a verification result.

[0168] The verification result is used to indicate whether the current charging status of the user terminal is normal.

[0169] Optionally, the billing message also includes the identity information of the user terminal, and the location verification information and time verification information associated with the identity information are determined in the time-space control rules based on the identity information, and then the current location information and the current time information in the billing message are verified based on the location verification information and the time verification information to obtain a verification result. The verification result includes a first verification result and a second verification result, the first verification result is used to indicate that the user terminal is in a normal billing state, and the second verification result is used to indicate that the user terminal is in an abnormal billing state. Among them, when the user terminal is in the first verification result, the private network service end can only back up the current location information and current time information of the user terminal, and allow the user terminal to continue to perform the current access operation; when the user terminal is in the second verification result, the private network service end can generate a warning based on the cause of the abnormal billing state, and warn the user terminal of the abnormal billing state.

[0170] S506: When the verification result indicates that the current billing status is an abnormal billing status, the private network service end interrupts the current access operation of the user terminal.

[0171] Optionally, when the verification result indicates that the current billing state is an abnormal billing state, an interruption instruction is generated to interrupt the current access operation of the user terminal. The abnormal billing state includes but is not limited to the current location information of the user terminal not meeting the regional control rules, and the current time information of the user terminal not meeting the time control rules.

[0172] An embodiment of the present application provides a network communication method based on time and space control, which verifies the location in the billing message through time and space control rules, and interrupts the current access operation of the user terminal when the verification result indicates that the current billing status of the user terminal is an abnormal billing status, thereby achieving real-time and accurate regional control and time period control, and further ensuring the security of private network communications.

[0173] Optionally, in the above Figure 2-5 Based on the embodiment, the communication message between the user terminal and the private network server can be a billing message. This implementation is applied to the user terminal, and a possible implementation method for generating a billing message based on a preset time interval is specifically described. The method includes:

[0174] Determine the current location information and the current time information according to a preset time interval; generate a billing message based on the current location information, the current time information and the user identity of the user terminal; and send the billing message to the private network server through the private network communication route.

[0175] Optionally, based on a preset time interval, the current location information and current time information of the user terminal are obtained, and based on the current location information, current time information, and the user identity of the user terminal, a billing message is generated, and then the billing message is sent to the private network service end via the private network communication route of the campus where the user terminal is located.

[0176] It should be noted that the user identity identifier may be, for example, a mobile phone number or employee number of an enterprise employee, or a terminal code or serial number of a user terminal.

[0177] The embodiment of the present application provides a network communication method based on time-space control, which obtains the current access location and current access time of a user terminal based on a preset time interval, generates a billing message based on the current access location and the current access time, and then sends the billing message to a private network service end through a private network communication route, thereby realizing timely monitoring of the access location and access time of the user terminal, and facilitating real-time and accurate regional control and time control of the user terminal.

[0178] Figure 6 A schematic diagram of the structure of a network communication device based on time and space control provided in this application Figure 1 , the device is used in the private network service end. Figure 6 As shown, a network communication device 60 based on time-space control provided in this embodiment includes:

[0179] The receiving module 601 is used to receive a secondary authentication request sent by a user terminal through a public network communication route, wherein the secondary authentication request carries the location information of the user terminal;

[0180] A verification module 602 is used to verify the secondary authentication request according to the time and space control rules corresponding to the user terminal to obtain a verification result, wherein the verification result is used to indicate whether the user terminal has access authority, and there is an association between the location of the user terminal and the time and space control rules;

[0181] A sending module 603, configured to send the verification result to the user terminal via the public network communication route;

[0182] The receiving module 601 is further used to receive a communication message sent by the user terminal through a private network communication route when the verification result indicates that the user terminal has access authority, wherein the private network communication route is associated with the location of the user terminal.

[0183] In a possible implementation, the device further includes: a determination module 604 and a processing module 605;

[0184] The determination module 604 is used to determine the corresponding time and space control rules according to the user identity;

[0185] The processing module is used to determine whether the location information and the request time meet the time and space control rules;

[0186] The determination module 604 is further configured to determine, when the location information and the request time satisfy the time-space control rule, that the verification result is a first verification result, and the first verification result is used to indicate that the user terminal has access authority;

[0187] The determination module 604 is further used to determine that the verification result is a second verification result when the location information and the request time do not satisfy the time and space control rules, and the second verification result is used to indicate that the user terminal does not have access authority.

[0188] In a possible implementation, the receiving module 601 is specifically configured to receive the communication message through a first private network communication route when the location information of the user terminal indicates that the user terminal is in a first park, the first private network communication route being constructed by a private network base station and a private network element of the first park, and the first park being the park where the private network server is located;

[0189] The receiving module 601 is specifically configured to receive a communication message sent by the user terminal through a second private network communication route when the location information of the user terminal indicates that the user terminal is in a second park, the second private network communication route being constructed by a private network base station in the second park, a private network base station in the first park, and a private network element, and the second park includes at least one park in the same city as the first park;

[0190] The receiving module 601 is specifically used to receive the communication message sent by the user terminal through the third private network communication route when the location information of the user terminal indicates that the user terminal is in the third park. The third private network communication route is constructed by the base station, intelligent metropolitan area network, and the private network base station of the third park. The third park includes a roaming area outside the home area of ​​the first park.

[0191] In a possible implementation, the determination module 604 is further configured to determine a current operating state of the second private network communication route;

[0192] The receiving module 601 is also used to receive the communication message sent by the user terminal in the second park through the backup communication route when the current operating state is an abnormal state. The backup communication route includes the base station of the second park, the smart metropolitan area network, and the private network base station.

[0193] In a possible implementation, the device further includes: a verification module 606;

[0194] The receiving module 601 is further configured to receive a charging message sent by the user terminal through the private network communication route, wherein the charging message includes current location information and current time information of the user terminal;

[0195] The verification module 606 is further used to verify the charging message using the time and space control rules corresponding to the user terminal to obtain a verification result, and the verification result is used to indicate whether the current charging status of the user terminal is normal;

[0196] The processing module 605 is further configured to interrupt the current access operation of the user terminal when the verification result indicates that the current billing state is an abnormal billing state.

[0197] This embodiment provides a network communication device based on time and space control, which can execute the method provided by the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0198] Figure 7 A schematic diagram of the structure of a network communication device based on time and space control provided in this application Figure 2 , the device is applied to the user terminal. Figure 7 As shown, a network communication device 70 based on time-space control provided in this embodiment includes:

[0199] A sending module 701 is used to send a secondary authentication request to a private network server through a public network communication route, wherein the secondary authentication request carries the location information of the user terminal;

[0200] The receiving module 702 is used to receive the verification result sent by the private network server through the public network communication route;

[0201] Processing module 703, configured to access the private network service end if the verification result indicates that the user terminal has access authority;

[0202] The sending module 701 is further used to send a communication message to the private network server through the private network communication route, wherein the private network communication route is associated with the location of the user terminal.

[0203] In a possible implementation, the device further includes: an acquisition module 704 and a generation module 705;

[0204] The acquisition module 704 is used to acquire current location information;

[0205] The processing module 703 is further configured to determine whether the current location information is consistent with the location information in the secondary authentication request;

[0206] The generating module 705 is used to generate a charging message when the current location information and the location information are inconsistent, and the charging message includes the current location information and the current time information.

[0207] In a possible implementation manner, the apparatus further includes: a determination module 706;

[0208] The determination module 706 is used to determine the current location information and the current time information according to a preset time interval;

[0209] The generating module 705 is further configured to generate a charging message based on the current location information, the current time information and the user identity of the user terminal;

[0210] The sending module 701 is specifically used to send the billing message to the private network server through the private network communication route.

[0211] This embodiment provides a network communication device based on time and space control, which can execute the method provided by the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0212] Figure 8 This is a schematic diagram of the structure of a network communication device based on time and space control provided by this application. Figure 8 As shown, the electronic device 80 provided in this embodiment includes: at least one processor 801 and a memory 802. Optionally, the device 80 also includes a communication component 803. The processor 801, the memory 802 and the communication component 803 are connected via a bus 804.

[0213] In a specific implementation process, at least one processor 801 executes the computer-executable instructions stored in the memory 802, so that at least one processor 801 executes the above method.

[0214] The specific implementation process of the processor 801 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0215] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0216] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk storage.

[0217] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0218] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0219] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0220] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0221] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0222] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0223] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0224] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0225] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0226] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0227] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A network communication method based on time and space control, It is characterized in that Applied to private network servers, including: Receiving a secondary authentication request sent by a user terminal through a public network communication route, wherein the secondary authentication request carries location information of the user terminal; Verifying the secondary authentication request according to the time and space control rule corresponding to the user terminal to obtain a verification result, wherein the verification result is used to indicate whether the user terminal has access authority, and there is an association between the location of the user terminal and the time and space control rule; The verification result is sent to the user terminal via the public network communication route, and when the verification result indicates that the user terminal has access authority, the communication message sent by the user terminal is received via the private network communication route, wherein the private network communication route is associated with the location of the user terminal.

2. The method according to claim 1, It is characterized in that The spatiotemporal control rule includes an area control rule and a time control rule, the secondary authentication request also includes: a user identity corresponding to the user terminal and a request time of the secondary authentication request, and the secondary authentication request is verified according to the spatiotemporal control rule corresponding to the user terminal to obtain a verification result, including: Determine the corresponding time and space control rules according to the user identity identifier; Determining whether the location information and the request time satisfy the time-space control rules; In a case where the location information and the request time satisfy the time-space control rule, determining that the verification result is a first verification result, where the first verification result is used to indicate that the user terminal has access authority; In a case where the location information and the request time do not satisfy the time and space control rule, the verification result is determined to be a second verification result, and the second verification result is used to indicate that the user terminal does not have access authority.

3. The method according to claim 1, It is characterized in that The receiving the communication message sent by the user terminal through the private network communication route includes: When the location information of the user terminal indicates that the user terminal is in a first park, the communication message is received through a first private network communication route, where the first private network communication route is constructed by a private network base station and a private network element in the first park, and the first park is the park where the private network server is located; When the location information of the user terminal indicates that the user terminal is in the second park, a communication message sent by the user terminal is received through a second private network communication route, where the second private network communication route is constructed by a private network base station of the second park, a private network base station of the first park, and a private network element, and the second park includes at least one park in the same city as the first park; When the location information of the user terminal indicates that the user terminal is in a third park, a communication message sent by the user terminal is received through a third private network communication route. The third private network communication route is constructed by the base station, intelligent metropolitan area network, and private network base station of the third park. The third park includes a roaming area outside the home location of the first park.

4. The method according to claim 3, It is characterized in that Before receiving the communication message sent by the user terminal through the second private network communication route, the method further includes: Determining the current operating status of the second private network communication route; When the current operating state is an abnormal state, the communication message sent by the user terminal in the second park is received through the backup communication route, and the backup communication route includes the base station of the second park, the intelligent metropolitan area network, and the private network base station.

5. The method according to claim 1, It is characterized in that The receiving the communication message sent by the user terminal through the private network communication route includes: Receiving a charging message sent by the user terminal through the private network communication route, the charging message including current location information and current time information of the user terminal; Verify the charging message using the time and space control rule corresponding to the user terminal to obtain a verification result, where the verification result is used to indicate whether the current charging status of the user terminal is normal; When the verification result indicates that the current billing state is an abnormal billing state, the current access operation of the user terminal is interrupted.

6. A network communication method based on time and space control, It is characterized in that Applied to user terminals, including: Sending a secondary authentication request to the private network server via a public network communication route, wherein the secondary authentication request carries the location information of the user terminal; Receiving the verification result sent by the private network service end through the public network communication route; If the verification result indicates that the user terminal has access authority, access the private network service end; A communication message is sent to the private network server via the private network communication route, wherein the private network communication route is associated with the location of the user terminal.

7. The method according to claim 6, It is characterized in that The communication message includes a charging message. When the verification result indicates that the user terminal has access authority, after accessing the private network service end, the method further includes: Obtaining current location information, and determining whether the current location information is consistent with the location information in the secondary authentication request; In the case that the current location information and the location information are inconsistent, a charging message is generated, wherein the charging message includes the current location information and the current time information.

8. The method according to claim 6, It is characterized in that The sending of a communication message to the private network server through the private network communication route includes: Determine the current location information and the current time information according to the preset time interval; generating a charging message based on the current location information, the current time information and the user identity of the user terminal; The billing message is sent to the private network service end via the private network communication route.

9. A network communication device based on time and space control, It is characterized in that Applications to private network servers include: A receiving module, configured to receive a secondary authentication request sent by a user terminal through a public network communication route, wherein the secondary authentication request carries location information of the user terminal; A verification module, used to verify the secondary authentication request according to the time and space control rules corresponding to the user terminal, and obtain a verification result, wherein the verification result is used to indicate whether the user terminal has access authority, and there is an association between the location of the user terminal and the time and space control rules; A sending module, used for sending the verification result to the user terminal via the public network communication route; The receiving module is further used to receive a communication message sent by the user terminal through a private network communication route when the verification result indicates that the user terminal has access authority, wherein the private network communication route is associated with the location of the user terminal.

10. A network communication device based on time and space control, It is characterized in that Applied to user terminals, including: A sending module, used to send a secondary authentication request to a private network server through a public network communication route, wherein the secondary authentication request carries the location information of the user terminal; A receiving module, used for receiving the verification result sent by the private network server through the public network communication route; A processing module, configured to access the private network service end if the verification result indicates that the user terminal has access authority; The sending module is further used to send a communication message to the private network server through the private network communication route, wherein the private network communication route is associated with the location of the user terminal.

11. A network communication device based on time and space control, It is characterized in that include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 8.

12. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 8 when executed by a processor.

Images