Private network isolation method and device and medium

Abstract

The invention provides a private network isolation method and device and a medium, and relates to the technical field of communication, and the method comprises the steps that a private network user terminal responds to a detected private PLMN broadcasted by a base station, an access request is sent to a core network through the base station according to the private PLMN, the access request carries a private TAC and an IMSI, the IMSI carries information of the private PLMN, and the information of the private PLMN is sent to the core network through the base station; the core network verifies a private network user terminal according to the private TAC, the base station TAC and the IMSI, establishes isolation of private network user data and agrees an access request, and configures a corresponding relation between the base station TAC and the private PLMN; and in response to the received information of the access agreement request from the core network forwarded by the base station according to the dedicated PLMN, sending private network user data to the core network through the base station according to the dedicated PLMN, the private network user data carrying the IMSI, so that the core network isolates and processes the private network user data according to the IMSI. Through access isolation and data isolation, it is ensured that private network users use private network services.

Description

Technical Field

[0001] The present disclosure relates at least to the field of communication technology, and in particular to a private network isolation method, a private network user terminal, a base station, a core network, a private network isolation system and a computer-readable storage medium. Background Art

[0002] In some scenarios, it is necessary to isolate private network users, including isolating their usage areas and isolating their data. The current isolation solutions may be: 1) On the wireless network side, set the coverage range of different base stations so that only private network base stations can cover the signal in the area where private network users are located. The disadvantage is that the coverage effect of public network base stations is sacrificed, and there is still the possibility that private network users can access public network base stations; 2) Set restricted access on the core network side. The disadvantage is that if a large amount of restricted data is not entered in time, the isolation effect cannot be guaranteed. Summary of the invention

[0003] The technical problem to be solved by the present disclosure is to provide a private network isolation method, a private network user terminal, a base station, a core network, a private network isolation system and a computer-readable storage medium in response to the above-mentioned deficiencies, so as to solve the problem of how to effectively isolate private network users.

[0004] In a first aspect, the present disclosure provides a private network isolation method, the method is applied to a private network user terminal, the private network user terminal is configured with a private network number card, the private network number card is configured with a dedicated PLMN and a dedicated TAC, the method comprising:

[0005] In response to detecting the dedicated PLMN broadcast by the base station, an access request is sent to the core network via the base station according to the dedicated PLMN, the access request carries a dedicated TAC and IMSI, and the IMSI carries information about the dedicated PLMN.

[0006] The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, establishes isolation for private network user data and approves access requests.

[0007] The core network configures the correspondence between base station TAC and dedicated PLMN;

[0008] In response to receiving the access request information forwarded by the base station from the core network according to the dedicated PLMN, the base station sends the private network user data to the core network according to the dedicated PLMN via the base station, the private network user data carries the IMSI,

[0009] This allows the core network to isolate and process private network user data based on IMSI;

[0010] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0011] Furthermore, the private network number card is also configured with a restricted EPLMN, and the method further includes:

[0012] In response to detecting a restricted EPLMN broadcast by a base station, connection to the restricted EPLMN is denied, wherein the EPLMN is an equivalent public land mobile network.

[0013] Furthermore, the dedicated network number card is also configured with a dedicated APN, and the method further includes:

[0014] The access request also carries a dedicated APN, so that the core network can also verify the private network user terminal according to the dedicated APN, establish data isolation for the private network user, and approve the access request, where APN is the access point name.

[0015] In a second aspect, the present disclosure provides a private network isolation method, the method is applied to a base station, the base station is configured with a dedicated PLMN, and a corresponding relationship between the base station TAC and the dedicated PLMN is configured in the core network, the method comprising:

[0016] Broadcasting the dedicated PLMN so that the private network user terminal can detect the dedicated PLMN;

[0017] The dedicated PLMN forwards the access request from the private network user terminal to the core network. The access request carries the dedicated TAC and IMSI. The IMSI carries the information of the dedicated PLMN.

[0018] The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, and establishes isolation of private network user data and approves access requests;

[0019] Forwarding the access request approval information from the core network to the private network user terminal according to the dedicated PLMN, so that the private network user terminal receives the access request approval information;

[0020] The private network user data from the private network user terminal is forwarded to the core network according to the dedicated PLMN. The private network user data carries the IMSI.

[0021] This allows the core network to isolate and process private network user data based on IMSI;

[0022] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0023] Furthermore, the base station includes a private network base station configured with only a dedicated PLMN, and a non-private network base station configured with a dedicated PLMN and a non-dedicated PLMN. The non-dedicated PLMN is used by non-private network user terminals, and the dedicated PLMN and the non-dedicated PLMN use different frequencies.

[0024] In a third aspect, the present disclosure provides a private network isolation method, the method is applied to a core network, the core network configures a correspondence between a base station TAC and a dedicated PLMN, the method comprising:

[0025] The receiving base station forwards the access request from the private network user terminal according to the private PLMN,

[0026] The access request is sent by the private network user terminal in response to detecting the private PLMN broadcast by the base station. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN;

[0027] Verify the private network user terminal based on the dedicated TAC, base station TAC and IMSI, and establish isolation of private network user data and approve access requests;

[0028] The base station sends information of approving the access request to the private network user terminal according to the private PLMN, so that the private network user terminal receives the information of approving the access request.

[0029] The base station receives private network user data from the private network user terminal according to the private PLMN, and the private network user data carries the IMSI;

[0030] Process private network user data based on IMSI isolation;

[0031] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0032] Furthermore, the method further comprises:

[0033] In response to the access request also carrying a dedicated APN, the private network user terminal is verified according to the dedicated APN, and data isolation of the private network user is established and the access request is approved, where APN is the access point name.

[0034] Furthermore, the private network user terminal is verified according to the dedicated TAC, base station TAC and IMSI, and isolation of private network user data is established and access requests are approved, including:

[0035] Obtain the base station TAC, obtain the information of the dedicated PLMN according to the IMSI, and in response to the fact that the dedicated TAC is consistent with the base station TAC and the dedicated TAC corresponds to the information of the dedicated PLMN, the private network user terminal passes the verification;

[0036] The private network user terminals with the same private TAC and private PLMN information are grouped into a private network target user group, and the IMSI is used as a mark that the private network user terminal belongs to the private network target user group, so as to obtain exclusive private network user data processing resources for the private network target user group;

[0037] Agree to the access request and generate information of agreeing to the access request.

[0038] In a fourth aspect, the present disclosure provides a private network user terminal, the private network user terminal is configured with a private network number card, the private network number card is configured with a dedicated PLMN and a dedicated TAC, and the private network user terminal includes:

[0039] A request sending module is used to send an access request to the core network via the base station in response to detecting the dedicated PLMN broadcast by the base station, wherein the access request carries a dedicated TAC and IMSI, and the IMSI carries information about the dedicated PLMN.

[0040] The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, establishes isolation for private network user data and approves access requests.

[0041] The core network configures the correspondence between base station TAC and dedicated PLMN;

[0042] The data sending module is connected to the request sending module, and is used to respond to the information of the access request from the core network forwarded by the base station according to the dedicated PLMN, and send the private network user data to the core network through the base station according to the dedicated PLMN, wherein the private network user data carries the IMSI.

[0043] This allows the core network to isolate and process private network user data based on IMSI;

[0044] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0045] In a fifth aspect, the present disclosure provides a base station, the base station is configured with a dedicated PLMN, and a corresponding relationship between the base station TAC and the dedicated PLMN is configured in the core network, the base station includes:

[0046] A broadcast module, used for broadcasting a dedicated PLMN so that a private network user terminal can detect the dedicated PLMN;

[0047] The forwarding module is connected to the broadcast module and is used to forward the access request from the private network user terminal to the core network according to the private PLMN. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN.

[0048] so that the core network verifies the private network user terminal according to the dedicated TAC, base station TAC and IMSI, establishes isolation of private network user data and approves access requests; and,

[0049] forwarding the access request approval information from the core network to the private network user terminal according to the dedicated PLMN, so that the private network user terminal receives the access request approval information; and

[0050] The private network user data from the private network user terminal is forwarded to the core network according to the dedicated PLMN. The private network user data carries the IMSI.

[0051] This allows the core network to isolate and process private network user data based on IMSI;

[0052] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0053] In a sixth aspect, the present disclosure provides a core network, the core network configures a correspondence between a base station TAC and a dedicated PLMN, and the core network includes:

[0054] A request receiving module is used to receive an access request from a private network user terminal forwarded by the base station according to the dedicated PLMN,

[0055] The access request is sent by the private network user terminal in response to detecting the private PLMN broadcast by the base station. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN;

[0056] A request processing module, connected to the request receiving module, is used to verify the private network user terminal according to the dedicated TAC, the base station TAC and the IMSI, and to establish isolation of the private network user data and approve the access request;

[0057] The data interaction module is connected to the request processing module and is used to send information of agreeing to the access request to the private network user terminal through the base station according to the dedicated PLMN, so that the private network user terminal receives the information of agreeing to the access request.

[0058] The base station receives private network user data from the private network user terminal according to the private PLMN, and the private network user data carries the IMSI;

[0059] A data processing module, connected to the data interaction module, is used to isolate and process private network user data according to IMSI;

[0060] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0061] In a seventh aspect, the present disclosure provides a private network isolation system, the system comprising:

[0062] A private network user terminal, used to implement the private network isolation method as described in the first aspect above;

[0063] A base station, connected to a private network user terminal, for implementing the private network isolation method as described in the second aspect above;

[0064] The core network is connected to the base station and is used to implement the private network isolation method described in the third aspect above.

[0065] In an eighth aspect, the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the private network isolation method as described above is implemented.

[0066] The present invention provides a private network isolation method, a private network user terminal, a base station, a core network, a private network isolation system and a computer-readable storage medium. A private PLMN is configured and broadcasted at the base station. When the private PLMN configured by the private network user terminal is consistent with the PLMN broadcasted by the base station, the private network user terminal sends an access request to the core network via the base station, and carries a pre-configured private TAC and the IMSI of the terminal. The IMSI is also pre-set with the information of the private PLMN. Therefore, when the access request is sent to the core network via the base station, access isolation is achieved; and isolation of private network user data is set in the core network, and data isolation is achieved when the private network user data is subsequently sent; through the cooperation of the private network user terminal, the base station and the core network, access isolation and data isolation are used to ensure that the private network users can use the private network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 is a flow chart of a private network isolation method according to an embodiment of the present disclosure;

[0068] Figure 2 is a flow chart of another private network isolation method according to an embodiment of the present disclosure;

[0069] Figure 3 is a flow chart of another private network isolation method according to an embodiment of the present disclosure;

[0070] Figure 4 It is a schematic diagram of a relatively isolated solution for wireless resource coverage areas;

[0071] Figure 5 is a schematic diagram of an on-demand sharing isolation solution for a wireless resource coverage area according to an embodiment of the present disclosure;

[0072] Figure 6 It is a schematic diagram of a TAC solution for isolating private network users;

[0073] Figure 7 It is a schematic diagram of a three-party isolation setting of a private network isolation method according to an embodiment of the present disclosure;

[0074] Figure 8 is a schematic diagram of a three-party connection according to an embodiment of the present disclosure;

[0075] Fig. 9 is a schematic diagram of wireless network isolation according to an embodiment of the present disclosure;

[0076] Fig.10 is a schematic diagram of a core network isolation according to an embodiment of the present disclosure;

[0077] Fig.11 is a schematic diagram of card activation data isolation in an embodiment of the present disclosure;

[0078] Fig.12 It is a structural schematic diagram of a private network isolation device according to an embodiment of the present disclosure;

[0079] Fig.13 is a structural schematic diagram of another private network isolation device according to an embodiment of the present disclosure;

[0080] Fig.14 is a structural schematic diagram of another private network isolation device according to an embodiment of the present disclosure;

[0081] Fig.15 It is a structural diagram of a private network isolation system according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0082] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

[0083] It should be understood that the specific embodiments and drawings described herein are only used to explain the present disclosure rather than to limit the present disclosure.

[0084] It can be understood that, in the absence of conflict, the various embodiments of the present disclosure and the various features in the embodiments can be combined with each other.

[0085] It can be understood that, for the convenience of description, the drawings of the present disclosure only show parts related to the present disclosure, while parts irrelevant to the present disclosure are not shown in the drawings.

[0086] It can be understood that each unit or unit involved in the embodiments of the present disclosure may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units or units may be integrated into one physical structure.

[0087] It will be understood that, in the absence of conflict, the functions and steps marked in the flowcharts and block diagrams of the present disclosure may occur in an order different from that marked in the drawings.

[0088] It is understood that the flowcharts and block diagrams of the present disclosure illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present disclosure. Each box in the flowchart or block diagram may represent a unit, unit, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0089] It can be understood that the units and units involved in the embodiments of the present disclosure can be implemented by software or hardware, for example, the units and units can be located in a processor.

[0090] In order to facilitate the understanding of the present disclosure, the main inventive concept of the present disclosure is firstly explained in combination with a specific application scenario.

[0091] The present disclosure aims to provide a method and device for isolating a private network user group, which is mainly used in 5G (fifth generation mobile communication technology) Internet of Things scenarios.

[0092] With the promotion of 5G technology in industrial applications, some high-value industrial production scenarios have begun to introduce 5G Internet of Things technology, leveraging the large bandwidth, wide connection, and low latency characteristics of 5G technology to empower industrial production.

[0093] As applications are further developed, the shortcomings of existing technical solutions are gradually revealed. For example, users deploy local UPF (User Plane Function) in production bases (such as port operation areas, factory parks, etc.) to achieve 24-hour uninterrupted production through 5G networks. IoT cards have a certain probability of accessing non-optimal public network base stations, affecting the service requirements of production data not leaving the park, and the network quality is prone to fluctuations.

[0094] Specifically, in the prior art, there are two main network solutions for isolating private network users:

[0095] 1) Control the coverage of public network base stations, lower the inclination angle and adjust the direction angle of public network base stations, do not cover the areas where private network users are concentrated, sacrifice the coverage effect of public network base stations to reduce the probability of accessing public network base stations. The areas used by public network users and private network users are relatively independent.

[0096] The PLMNs defined by the existing network and China Unicom for the co-construction and sharing of base stations are 46001 (China Unicom) / 46011 (China Telecom). The 5G public network users and private network (IoT) users of the same operator only differ in the type of service, but not in the PLMN. Various users of the same operator can access through the same PLMN. When the private network target user group uses it in a specific area, there is a certain probability that the surrounding base stations will be occupied. The existing solution focuses on controlling the coverage of surrounding public network base stations, including measures such as setting up isolation zones, sacrificing the coverage effect of public network base stations to reduce the probability of accessing non-primary public network base stations, but it cannot completely prevent the private network target user group from accessing non-primary public network base stations. The random access, reselection and switching of the private network target user group have a certain probability of accessing non-primary public network base stations, and the wireless control solution cannot guarantee the isolation effect of the private network target user group.

[0097] In addition, if the target user group card is configured with a special dedicated slice, when accessing other public network base stations, frequent access failures may occur because the base station does not support the special slice function, affecting the performance indicators of the public network base station. To solve this problem, it is necessary to cancel the corresponding network slice on the product side, and at the same time, unbind the user card and network slice on the IoT core network. The problem location and processing process is relatively complicated.

[0098] 2) On the core network side, limit the TAC (Tracking Area Code) accessed by the target user group, set a whitelist TAC to allow the target user group to access, and set a blacklist TAC to prohibit access. Restrict the TAC of the surrounding public base stations, but the operator itself has a large number of TACs, and the scale of TAC after co-construction and sharing is even larger, especially in the co-construction area of ​​the co-construction and sharing area. It is very difficult to produce various black and white list data and the isolation effect of private network users cannot be guaranteed. At the same time, after the public base station prohibits the target user group from accessing, the target user group terminals will still re-access after 12-24 hours, affecting the network KPI (Key Performance Indicator).

[0099] The invention objectives disclosed herein at least include: to achieve, in a co-construction and sharing scenario, with the widespread application of 5G in industrial production, in some centralized production scenarios with high network requirements, through the coordinated cooperation of the wireless side, the core network side and the user's card activation data, to meet the network isolation of 5G private network customers and public network customers, to ensure rapid differentiated access of the target user group numbers on the base station side, to manage the usage areas of the target user group, to ensure the perception of the private network customers, and to avoid affecting the network indicators of the public base station.

[0100] The present disclosure will have the following advantages:

[0101] 1) It can achieve frequency isolation of the use area in the target user cluster, avoid co-frequency interference, reduce the complex collaborative optimization between the public network and the private network, and save investment in optimization resources, so that users can get a better network experience.

[0102] 2) The target user group can quickly achieve differentiated access to the target user group number on the base station side, and directly access the authorized wireless network PLMN (Public Land Mobile Network) base station when turned on, avoiding access to other PLMN base stations of the home operator, co-construction and sharing, and roaming operators. The target user group only accesses the base stations in the optimized authorization list within the specific business area, and the wireless network quality and transmission network quality of the target user group are more guaranteed, and the service commitment of "production data does not leave the park" for the target user group is certain.

[0103] 3) It is possible to manage the usage area of ​​the target user group, and to conveniently define a specific service usage area for the target user group, so as to prevent the target user group from mistakenly accessing unauthorized base stations in a specific service area. It is possible to restrict the target user group from random access, reselection, switching and other network access behaviors in the unauthorized use area, and to avoid abnormal / unauthorized movement of the target user group. It is also possible to prevent the target user group that has customized a special network slice from accessing unauthorized public base stations, and various abnormal network behaviors from affecting the network indicators of the public base stations, and to better guarantee the network quality and network perception of public users.

[0104] 4) The operator's public and private network wireless resources have changed from being relatively isolated to being shared and isolated on demand, which can also improve the utilization rate of the operator's PLMN resources, effectively increase network reuse, and improve network performance.

[0105] 5) It can reduce the chance of telecommunications fraud involving IoT cards.

[0106] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0107] Embodiment 1:

[0108] like Figure 1-11 As shown, the present disclosure provides multiple examples of private network isolation methods, which are based on the same inventive concept and applied to different execution entities, including application to private network user terminals, base stations, core networks, or a private network isolation system composed of the three.

[0109] Example 1:

[0110] like Figure 1 As shown, the present disclosure provides a private network isolation method, which is applied to a private network user terminal, the private network user terminal is configured with a private network number card, the private network number card is configured with a dedicated PLMN and a dedicated TAC, and the method includes:

[0111] S11. In response to detecting the dedicated PLMN broadcasted by the base station, an access request is sent to the core network via the base station according to the dedicated PLMN, the access request carries a dedicated TAC and IMSI, and the IMSI carries information about the dedicated PLMN.

[0112] The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, establishes isolation for private network user data and approves access requests.

[0113] The core network configures the correspondence between base station TAC and dedicated PLMN;

[0114] S12, in response to receiving the access request information forwarded by the base station from the core network according to the dedicated PLMN, sending the private network user data to the core network via the base station according to the dedicated PLMN, the private network user data carrying the IMSI,

[0115] This allows the core network to isolate and process private network user data based on IMSI;

[0116] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0117] In Example 1, a dedicated PLMN is configured and broadcasted at the base station. When the dedicated PLMN configured by the private network user terminal is consistent with the PLMN broadcasted by the base station, the base station sends an access request to the core network, and carries the pre-configured dedicated TAC and the IMSI of the terminal. The IMSI is also pre-set with the information of the dedicated PLMN. Therefore, when the access request is sent to the core network via the base station, access isolation is achieved; and isolation of private network user data is set in the core network, and data isolation is achieved when private network user data is sent subsequently. Through the cooperation of the private network user terminal, the base station and the core network, access isolation and data isolation are used to ensure that private network users can use private network services. Access isolation includes: the private network user terminal will only connect to the base station when the base station PLMN is consistent with the private PLMN configured by the private network user terminal through the private network number card, which avoids the private network user terminal connecting to the PLMN used by public network users, limits the use area of ​​the private network user terminal, avoids the private network service from affecting the public network service, and reduces the burden of subsequent core network verification; after the private network user terminal connects to the base station, it sends an access request to the core network, which must carry the information of the private TAC and private PLMN. The core network obtains the TAC of the base station based on its own pre-configured information, and determines whether the private network user terminal is in the pre-permitted use area based on this information. If it is, it can pass the verification access. After completing the access isolation, the private network user data is transmitted between the private network user terminal, the base station with verified access, and the core network through the dedicated PLMN, ensuring the data isolation during the transmission process. At the same time, data isolation measures are set for users on the core network side to ensure the full security isolation of private network user data. This process can be implemented on the existing core network structure.

[0118] Specifically, the present disclosure may also provide examples of two other private network isolation methods:

[0119] Example 2:

[0120] like Figure 2 As shown, the present disclosure provides another private network isolation method, which is applied to a base station, the base station is configured with a dedicated PLMN, and the corresponding relationship between the base station TAC and the dedicated PLMN is configured in the core network, and the method includes:

[0121] S21, broadcasting the dedicated PLMN so that the private network user terminal detects the dedicated PLMN;

[0122] S22, forwarding the access request from the private network user terminal to the core network according to the private PLMN, the access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN,

[0123] The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, and establishes isolation of private network user data and approves access requests;

[0124] S23, forwarding the access request approval information from the core network to the private network user terminal according to the dedicated PLMN, so that the private network user terminal receives the access request approval information;

[0125] S24, forwarding the private network user data from the private network user terminal to the core network according to the dedicated PLMN, the private network user data carrying the IMSI,

[0126] This allows the core network to isolate and process private network user data based on IMSI;

[0127] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0128] Example 3:

[0129] like Figure 3 As shown, the present disclosure provides another private network isolation method, which is applied to the core network. The core network configures the corresponding relationship between the base station TAC and the dedicated PLMN. The method includes:

[0130] S31, receiving an access request from a private network user terminal forwarded by the base station according to the dedicated PLMN,

[0131] The access request is sent by the private network user terminal in response to detecting the private PLMN broadcast by the base station. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN;

[0132] S32, verifying the private network user terminal according to the dedicated TAC, base station TAC and IMSI, and establishing isolation of private network user data and approving the access request;

[0133] S33, sending information of agreeing to the access request to the private network user terminal through the base station according to the dedicated PLMN, so that the private network user terminal receives the information of agreeing to the access request,

[0134] The base station receives private network user data from the private network user terminal according to the private PLMN, and the private network user data carries the IMSI;

[0135] S34, processing private network user data according to IMSI isolation;

[0136] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0137] In the implementation of Example 1, the private network number card is further configured with a restricted EPLMN, and the method further includes:

[0138] In response to detecting a restricted EPLMN broadcast by a base station, connection to the restricted EPLMN is denied, wherein the EPLMN is an equivalent public land mobile network.

[0139] In Example 1, as a private network user terminal, on the one hand, it can specify the PLMN it is allowed to connect to, and on the other hand, it can also specify the PLMN it is not allowed to connect to. These PLMNs are all planned in advance, so it is possible to avoid the private network user terminal connecting to the public network base station and affecting the performance indicators of the public network base station.

[0140] Specifically, in the method of Example 2, the base station includes a private network base station configured with only a dedicated PLMN, and a non-private network base station configured with a dedicated PLMN and a non-dedicated PLMN. The non-dedicated PLMN is used by non-private network user terminals, and the dedicated PLMN and the non-dedicated PLMN use different frequencies.

[0141] Private network base stations achieve geographic isolation of private network services, which is more suitable for production units with fixed areas. If geographic isolation cannot be achieved, frequency isolation can also be used to avoid mutual interference between private network users and public network users. This is achieved by operators planning frequency bands and base stations. Figure 4 As shown in FIG. 1 , the existing private network user use area and the public network user use area are separated by different coverage ranges of base stations. Example 2 can be directly improved on the basis of the existing method. By setting different PLMNs, the coverage range of the public network PLMN is as follows: Figure 5 As shown, although it covers the usage area of ​​private network users, since the private network user terminal only responds to the dedicated PLMN to establish a connection, it is actually in an isolated state, realizing on-demand sharing.

[0142] In the implementation of Example 1, the private network number card is further configured with a dedicated APN, and the method further includes:

[0143] The access request also carries a dedicated APN, so that the core network can also verify the private network user terminal according to the dedicated APN, establish data isolation for the private network user, and approve the access request, where APN is the access point name.

[0144] In Example 1, as a private network user terminal, you can also specify the APN, and the core network can also verify the user identity, service, etc. based on the APN information to improve its isolation effect.

[0145] Specifically, in the method of Example 3, the core network responds to the access request also carrying a dedicated APN, verifies the private network user terminal according to the dedicated APN, establishes data isolation for the private network user, and approves the access request, where APN is the access point name.

[0146] Specifically, in the method of Example 3, step S32, verifying the private network user terminal according to the dedicated TAC, the base station TAC and the IMSI, and establishing isolation of the private network user data and approving the access request, specifically includes:

[0147] Obtain the base station TAC, obtain the information of the dedicated PLMN according to the IMSI, and in response to the fact that the dedicated TAC is consistent with the base station TAC and the dedicated TAC corresponds to the information of the dedicated PLMN, the private network user terminal passes the verification;

[0148] The private network user terminals with the same private TAC and private PLMN information are grouped into a private network target user group, and the IMSI is used as a mark that the private network user terminal belongs to the private network target user group, so as to obtain exclusive private network user data processing resources for the private network target user group;

[0149] Agree to the access request and generate information of agreeing to the access request.

[0150] The existing private network user identity verification in the core network is as follows Figure 6 As shown, it is usually verified whether the IMSI is in the TAC whitelist. The verification content of Example 3 has changed. The detection content adds comparison between the information from the terminal and the base station information and the core network information. The private network user terminal sends the allowed TAC information configured by itself, and the core network verifies whether the information is consistent with the TAC information of the connected base station, and then verifies whether the TAC information corresponds to the PLMN information. There is no need to formulate a whitelist that collects complex user information, but directly verify whether the information carried by the terminal is consistent with the information configured by the operator, which simplifies the verification setting.

[0151] More specifically, the following will combine Figure 7-Figure 11 , the fourth example of the private network isolation method based on the private network user terminal, base station and core network is described in detail:

[0152] Example 4 is implemented in a co-construction and sharing scenario. With the widespread application of 5G in industrial production, in some centralized production scenarios with high network requirements, the coordinated cooperation of the wireless side, the core network side and the user's card activation data can meet the isolation of 5G private network customers and public network customers, avoid co-frequency interference, and ensure that 5G private network customers occupy the authorized base station cells they should occupy, avoid occupying unauthorized base station cells, and restrict the target user group from performing invalid network behaviors in unauthorized areas. This can not only ensure the perception of private network customers, but also avoid affecting the network indicators of public base stations, and improve the utilization rate of network PLMN resources.

[0153] The four solutions in this example include wireless network isolation module, core network isolation module, and card activation data isolation module. The method flow overview and module functions are as follows: Figure 7 As shown, the terminal side card access network isolation is as follows Figure 8As shown, where:

[0154] (1) Wireless network isolation module: This example 4 isolates the wireless network side by geography, frequency, and base station dedicated PLMN. Through triple isolation, the base station signal of the private network is purer, achieving better quality, lower latency, and higher rate of the private network signal. If the networking conditions are limited, such as in a business-intensive area, frequency resources are tight, and it is impossible to sacrifice business perception for frequency clearing, and it is impossible to achieve geographic isolation and frequency isolation of the private network, it is necessary to ensure the isolation of the base station dedicated PLMN data.

[0155] (2) Core network isolation module: Example 4 can be implemented through the core network functions already available in the large network, without the need for additional investment in deploying an independent core network. However, it is not possible to directly implement control data and service data without leaving the park, and data isolation must be set up in the core network. If the data does not leave the park and the network operates independently, it can also be implemented using the newly built exclusive core network for the target user group. On the core network side, the PLMN planned by the operator is used to define a unique dedicated PLMN number (consistent with the PLMN number of the base station in a specific area) for the private network target user group, and other equivalent EPLMNs for the private network target user group are not configured to isolate the private network user data from the public network user data, so as to prevent the private network target user group from being disconnected from the dedicated PLMN network through TMSI (Temporary Mobile Subscriber Identity).

[0156] (3) Card activation data isolation module: The IoT card production center completes the definition of the dedicated PLMN that the private network target user group card can access, and realizes rapid access to the network. Define the TAC (Tracking Area Code) that the private network target user group card can access, and subdivide the usable area of ​​the target user group card. Define the APN (Access Point Name) that the private network target user group card accesses. The APN is configured on demand and has nothing to do with the base station.

[0157] According to the four solutions in this example, taking the networking method of protecting important customer services as an example, the specific implementation steps are provided as follows:

[0158]

Step 1

[0159] 1) Geographic isolation: This link is applicable to industrial production scenarios where the usage scope of the target user group is relatively fixed. Clarify the regional scope of daily production of the target user group, such as outdoor scenes in a specific area, or indoor closed scenes in a specific area, and collect the existing public network coverage base station data through field testing or layer operations. Include the existing public network coverage base stations in the list of dedicated affiliated PLMN sites, and on the basis of the existing public network base station master PLMN, produce slave PLMN data that is different from that used by public network users (dedicated affiliated PLMN for the private network target user group). According to technical specifications, the base station can currently define 6 different PLMNs (1 master and 5 slaves), but the current network actually only defines 1 or 2 (the second one is the requirement for co-construction and sharing). After the definition is completed, the public network base stations in the same geographical area have public network PLMNs and dedicated affiliated PLMNs, which operate without interfering with each other. The results may be shown in Table 1 below:

[0160] Table 1 Base station master and slave PLMN examples

[0161]

[0162] 2) Frequency isolation: Combined with the use of public network frequencies and considering customer business needs, make full use of frequency resources and use frequency isolation to avoid wireless co-frequency interference. After frequency isolation avoids wireless co-frequency interference, the base station signal of the private network can be purer, and the private network signal can achieve better quality, lower latency, higher speed, and higher connection rate. In general, the specific business area of ​​the target user group should be more than 2KM away from other public network co-frequency signals. After superimposing geographical isolation, other areas of the public network can continue to reuse the frequency resources to improve the utilization rate of frequency resources. Achieve continuous coverage of the public network and focus on coverage of specific business areas of the private network. For example, the public network 2100MHz frequency point has good continuous coverage and the customer does not have high requirements for the rate. The 2100MHz with better continuous coverage effect can be used for public network coverage, and the 1800MHz medium-low frequency F1 or F2 frequency point with the second best continuous coverage effect can be considered for frequency isolation. For example, if the contractor of a co-built and shared area uses 3400MHz contiguous networking, and the target user group of the private network has high speed requirements, and medium and low frequencies cannot meet the customers' high-speed needs, then consider using 3500MHz high-frequency networking for frequency isolation for private network users.

[0163] 3) Base station PLMN data isolation: The PLMNs defined by the co-built and shared base stations of the existing network are 46001 (China Unicom) / 46011 (China Telecom). For example, a certain existing public network base station only defines these two PLMNs. According to the current base station version, the base station can be configured with 6 different PLMNs. The public network users and IoT users of the construction party, and the public network users and IoT users of the sharing party are all accessed through their respective equivalent EPLMNs (Equivalent PLMNs). The base station side will not read user data and will not distinguish users. PLMN (Public Land Mobile Network), PLMN = MCC (Mobile Country Code) + MNC (Mobile Network Code). According to the MNCs allocated by the state, China Unicom and China Telecom can legally use MNCs 6 / 9 / 10 / 3 / 5 / 12 in addition to the MNCs (01 / 11) currently in use in the network. There are also multiple MNCs that are not used. The idle and unused MNCs can be used for this patent.

[0164] By applying the base station dedicated affiliated PLMN data isolation solution of Example 4 and defining a dedicated PLMN on the side of the base station used by the target user group, the differentiated access of the target user group number can be quickly realized on the side of the base station used by the target user group, which is convenient for defining specific service usage areas for the target user group and preventing the target user group from mistakenly accessing unauthorized base stations. Public network users who are not in the target user group are authenticated by the core network to access the network according to the original public network rules and are not affected by the newly defined slave PLMN of the public network base station. The operator's public network and private network wireless resources are shared by the original public network base stations, and the private network base stations are exclusive to each other. The relative isolation of the network is changed to on-demand sharing, which effectively improves network reuse and network efficiency. In special cases, if a specific base station is only for the target user group, public network users who are not in the target user group cannot access the authorized base station.

[0165] The target user group can only access the base stations in the optimized authorization list within the specific service area, and will not access unauthorized public network base stations. The wireless network quality and transmission network quality of the target user group are more guaranteed, and the service commitment of "production data does not leave the park" for the target user group is certain. It can also improve the utilization rate of existing network PLMN resources, increase network reuse, and improve network efficiency. If the actual networking conditions are limited and the above-mentioned geographical isolation and frequency isolation of private network base stations cannot be strictly achieved, it is necessary to ensure the isolation of base station PLMN data.

[0166] PLMN is a network established and operated by the government or its approved operators for the purpose of providing land mobile communication services to the public. The network is usually connected to the public switched telephone network (PSTN) to form a communication network for the entire region or country. PLMN is the core part of the network, which is responsible for managing and controlling the communications of all mobile users. Each base station in the PLMN is assigned a unique identification code, called the PLMN identification code. This identification code is used to distinguish different PLMNs and base stations so that mobile users can connect to the correct network. If a mobile user is in an area but is not correctly identified as a user of the PLMN, they will not be able to connect to the network. PLMN is also responsible for managing and controlling the movement of users, ensuring that they can switch seamlessly between different base stations. This is very important to ensure the continuity and stability of communications. In addition, PLMN is also responsible for providing encryption and authentication services to mobile users to protect their communications from external interference.

[0167] 4) Define base station TAC: This example 4 requires that an independent TAC (Tracking Area Code) be assigned to the dedicated PLMN base station. According to the technical specifications, there is no problem of limited TAC quantity on the base station side, and the private network dedicated PLMN base station and the public network PLMN base station must belong to different TALs (Tracking Area Lists). The same base station can correspond to multiple different PLMN network numbers and TAC numbers. TAC in mobile networks was introduced in the 4G era. Similar to LAC and RAC in 2G and 3G, it is used by the network side to track and grasp the location information of mobile terminals UE. The network side determines the location of the UE by maintaining TAList, and can configure a dedicated TAC for a specific area to facilitate location distinction.

[0168] After the configuration is completed, the target user group card can be used for testing and verification. If only the base station that has been authorized and configured with a dedicated PLMN can be accessed, it means that the base station side, the core network, and the SIM (Subscriber Identity Module) card side have been configured successfully. Later, the authorized base station list can be changed as needed according to the changes in the customer's usage scope or the construction and access of new base stations in the customer's original usage area. Generally, the update of the authorized base station list needs to be triggered by the customer's business usage needs.

[0169] 5) Partial operations (configure base station and core network target addresses as needed)

[0170] MOD ENODEBSHARINGMODE:ENODEBSHARINGMODE=SHARED_FREQ;

[0171] ADD CNOPERATOR:CNOPERATORID=1,CNOPERATORNAME="UNICOM",CNOPERATORTYPE=CNOPERATOR_SECONDARY,MCC="460",MNC="09",OPERATORFUNSWIT CH=CELL_TRAFFIC_TRACE_MSG_SWITCH-0&DCN_SUPPORT_SWITCH-0&MME_STRICT_SELECTION_SWITCH-0&CMAS_BROADCAST_SWITCH-1;

[0172] ADD CNOPERATORTA:TRACKINGAREAID=x,CNOPERATORID=y,TAC=9xx;

[0173] 6) Functional configuration verification and improvement of the authorized base station list: After the target user group has prepared the core network, wireless network, and card activation data, they can access the authorized area network normally. For example, when the target user group authorized to use in the port terminal or a specific factory area tries to access the network after leaving the authorized area, the core network of the operator, co-built and shared, and roaming operator network will reject the target user group's access request and will not allow the target user group to stay because the equivalent EPLMN access of the dedicated affiliated PLMN number is not defined. When the target user group expands the new service usage area, the operator's business department will initiate a formal demand, which will be confirmed by the operator's network support department and the corresponding coverage base station list will be added to the authorized PLMN to ensure that customers can use the service normally. For example, if a customer deploys a business application to a new area, the company needs to apply to the operator to open a dedicated affiliated PLMN in this area.

[0174] [Step 2] Core network isolation module: Fig.10As shown, this example four can be implemented through the existing core network functions of the large network, and there is no need to make additional investments to deploy an independent core network. If the data does not leave the park and the network operates independently, it can also be implemented using a newly built exclusive core network for the target user group. On the core network side, the PLMN planned by the operator (corresponding to the dedicated PLMN of the base station) is used to define a dedicated PLMN number (HPLMN, Home PLMN, which is the PLMN to which the terminal user belongs) for the target user group of the private network. In other words, the MCC and MNC contained in the IMSI (International Mobile Subscriber Identity) number on the terminal USIM card are consistent with the MCC and MNC on the dedicated PLMN. For a certain user, there is only one PLMN. Define a unique dedicated PLMN number for the private network target user group (consistent with the dedicated PLMN number of the base station in a specific area), do not configure other equivalent EPLMNs for the private network target user group, to achieve isolation of private network user data from public network user data, and prevent the dedicated PLMN network of the private network target user group from being disconnected from the network. Access to the public network base station of the home operator, co-built and shared operator, and roaming operator through TMSI (Temporary Mobile Subscriber Identity) is prohibited.

[0175] In mobile communications, IMSI is used to uniquely identify a mobile user worldwide. IMSI is stored in the HLR (Home Location Register), VLR (Visitor Location Register) and SIM card, and can be transmitted in wireless networks and core networks. An IMSI uniquely identifies a mobile user and is valid worldwide. TMSI (Temporary Mobile Subscriber Identity). TMSI is a temporary user identification number assigned to a user in the VLR to ensure the security of the IMSI in mobile communications. It is used to temporarily replace the IMSI number for transmission over the air interface.

[0176] 1) Operator PLMN Overall Planning: PLMN = MCC + MNC. In addition to MNC 01 currently in use, China Unicom can also legally use MNCs 6 / 9 / 10. In addition to MNC 11 currently in use, China Telecom can also legally use MNCs 3 / 5 / 12. In addition to the allocated MNCs, the MNCs that are shared and activated on demand by both parties according to national policies include 3X / 5X / 1X, etc., and there are still many MNCs that are not used. At present, the utilization rate of operators' MNC resources is low. Operators can make overall planning and use of existing MNC resources, and allocate different MNCs according to the usage attributes and service level requirements of private network users.

[0177] For example, the Unicom private network user number card used in a fixed area such as a port terminal, factory park, and mine can use MNC 09, and the Unicom private network user number card used in different areas such as power room monitoring can use MNC 06. MNC 06 / 09 can be defined on the same base station according to business needs, facilitating direct and rapid access to target user groups with different business characteristics.

[0178] At present, there is no case of domestic operators re-planning PLMN. This example 4 recommends that important target user groups be divided according to the large regions where the core network is deployed and PLMNs be divided according to operators, such as the use rules of PLMNs divided according to seven major regions: South China, Northeast China, East China, North China, Central China, Southwest China, and Northwest China. If cross-regional mobile use services are involved and applications with low requirements for network isolation, such as ordinary IoT cards, it is recommended to continue to access the equivalent EPLMN (46001 / 46011) defined in the existing network. Table 2 shows the current domestic MNC allocation:

[0179] Table 2 Distribution of domestic MNCs

[0180]

[0181]

[0182] 2) The core network defines a dedicated PLMN for the target user group: The core network side needs to define a dedicated PLMN for the corresponding target user group based on the overall planning of PLMN. The dedicated PLMN is isolated from the public PLMN, and the private network user data is isolated from the public network. That is, the core network side (including HSS home subscriber server, UDM unified data management function, etc.) cannot define the target user group number stuck in the public network contract information to ensure isolation. When the dedicated PLMN network of the private network target user group is disconnected, the TMSI is used to access the public network base station of the home operator, co-construction and sharing, and roaming operators.

[0183] For example, the target user group operating in the port terminal can only access the coverage base station of the authorized PLMN in the port terminal (PLMN = MCC + MNC, such as PLMN = 46009, then MNC = 09), and cannot access the co-located base station or neighboring base station of other unauthorized PLMNs, thereby ensuring the certainty of the target user group's production operation base station and activity range. Dividing the dedicated home PLMN can manage the use area of ​​the target user group, facilitate the demarcation of specific service use areas for the target user group, and avoid the target user group from mistakenly accessing unauthorized base stations in specific service areas, or the non-target user group from mistakenly accessing authorized base stations. Limit the target user group's random access, reselection, and switching in the unauthorized use area, avoid abnormal / unauthorized movement of the target user group, and ensure the use perception of the target user group. At the same time, it can also prevent the target user group that has customized special network slices from mistakenly accessing unauthorized public network base stations, and various abnormal network behaviors affect the network indicators of public network base stations, and the network quality and network perception of public network users are also more guaranteed.

[0184] 3) Functional configuration verification: After the target user group has completed the core network, wireless network, and card activation data, they can access the authorized area network normally. For example, when the target user group authorized to use the port terminal tries to access the network after leaving the authorized area, the home operator, co-construction and sharing, and roaming operator networks reject the target user group's access request and do not allow the target user group to stay.

[0185] [Step 3] Open the card data isolation module: Fig.11 As shown in the figure, this module completes the definition of the dedicated home PLMN that the private network target user group card can access, and realizes fast access to the network. Define the TAC that the private network target user group card can access, and subdivide the usable area. Define the APN that the private network target user group card can access (on demand).

[0186] 1) Define the PLMN that the number card can access: When the card is activated, the PLMN selector data controlled by the user is written on the USIM card when the number is registered to allow the user to choose the network. At the same time, the core network side (including HSS home subscriber server, UDM unified data management function, etc.) cannot define the contract information of the target user group number card on the public network to ensure isolation. The IoT card production center defines the PLMN (for example, 46009) corresponding to the target user group number card and the core network side. The card manufacturer confirms that the card activation data of the target user group number card is only configured with a dedicated home PLMN, and has restricted access to other equivalent EPLMNs (such as public network 46001 / 46011 / 46010, etc.). The number card is not allowed to access other PLMNs of the home operator, co-construction and sharing, and roaming operators in the network state and offline state. The number card SIM / USIM does not store the PLMN information of unsuccessful registration. If the registration on the PLMN is successful, the UE should indicate that the PLMN is a "registered PLMN" and can make calls and receive paging on it. The identity of the registered PLMN shall be stored on the SIM / USIM.

[0187] 2) Define TACs that can be accessed by the number card: TAC in mobile networks was introduced in the 4G era. Similar to LAC and RAC in 2G and 3G, it is used by the network to track the location information of mobile terminals UE. The network side determines the location of the UE by maintaining TAList so that the UE can be found when needed and the network can contact the UE for paging. 5G TAC information is included in the system information SIB1. When TAC is included in SIB1, at least SA is supported, that is, NSA+SA can be supported.

[0188] 3) Function configuration verification: When the UE is turned on, the last registered dedicated PLMN information is stored in the SIM / USIM card. When the UE detects that the operator's wireless base station broadcasts the dedicated PLMN information, the UE will directly connect to the authorized network for fast access. Other unauthorized PLMNs are "Forbidden PLMNs" and do not have access rights. If the target user group card is successfully registered in other unauthorized PLMNs, it is necessary to check the core network and card activation data. The card manufacturer needs to confirm that the target user group card has been restricted from accessing other equivalent EPLMNs, and the core network side needs to confirm that the contract data of other PLMNs has been deleted.

[0189] 4) Other notes: This example 4 requires the definition of an independent PLMN on the core network side, and the user card activation data must also be defined accordingly. It is recommended to be applied to private network users with a clear scope of use and high service level requirements. Ordinary IoT cards without clear service requirements can be directly connected to the existing equivalent EPLMN46001 / 46011. The corresponding dedicated APN can be configured to restrict the use of logistics network users.

[0190] 5) Expanded application: In recent years, in order to combat telecommunications network fraud crimes, operators, as large-scale telecommunications enterprises, provide both telecommunications and Internet services, and are important participants in the fight against telecommunications network fraud, and bear the key responsibility for preventing and controlling telecommunications network fraud. Operators use the isolation method of Example 4 to isolate the PLMN of the Internet of Things card, which can manage the usage area of ​​the target user group, avoid unauthorized resale of the Internet of Things card, reduce the probability of telecommunications fraud involving the Internet of Things card, and better perform the operator's responsibility to prevent telecommunications network fraud.

[0191] This example 4 includes implementing data isolation solutions at multiple key network nodes such as network wireless, core network, and card activation data. For example, the wireless side uses existing network base station resources for geographical, frequency, and PLMN isolation, and the core network side uses the existing core network functions of the large network for isolation. In the card activation stage, the dedicated PLMN that can be accessed by the private network target user group number card is defined to manage the service usage area of ​​the specific target user group. The co-construction and sharing parties divide the PLMN according to the large area deployed by the core network and by the operator, which can be expanded to prevent telecommunications network fraud, etc.

[0192] This example 4 can be actually applied in the application of the Internet of Things, such as the management of important specific target user groups, including differentiating network access, limiting user usage areas, etc. In terms of network benefits, it can save investment in optimized support resources, bring users a better network experience, and ensure the network perception of private and public network users. In terms of social benefits, it can achieve the certainty of the service commitment of "production data does not leave the park" for specific target user groups.

[0193] Embodiment 2:

[0194] like Fig.12 As shown, the present disclosure provides a private network user terminal, the private network user terminal is configured with a private network number card, the private network number card is configured with a dedicated PLMN and a dedicated TAC, and the private network user terminal includes:

[0195] The request sending module 11 is used for sending an access request to the core network via the base station according to the dedicated PLMN in response to detecting the dedicated PLMN broadcast by the base station, wherein the access request carries a dedicated TAC and IMSI, and the IMSI carries information of the dedicated PLMN.

[0196] The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, establishes isolation for private network user data and approves access requests.

[0197] The core network configures the correspondence between base station TAC and dedicated PLMN;

[0198] The data sending module 12 is connected to the request sending module 11, and is used to respond to the information of the access approval request forwarded by the base station from the core network according to the dedicated PLMN, and send the private network user data to the core network through the base station according to the dedicated PLMN, wherein the private network user data carries the IMSI.

[0199] This allows the core network to isolate and process private network user data based on IMSI;

[0200] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0201] In one implementation, the private network number card is further configured with a restricted EPLMN, and the private network user terminal further includes:

[0202] The connection rejection module is configured to reject the connection to the restricted EPLMN in response to detecting the restricted EPLMN broadcasted by the base station, wherein the EPLMN is an equivalent public land mobile network.

[0203] In one embodiment, the private network card is further configured with a dedicated APN, and the request sending module 11 is further used to:

[0204] The access request also carries a dedicated APN, so that the core network can also verify the private network user terminal according to the dedicated APN, establish data isolation for the private network user, and approve the access request, where APN is the access point name.

[0205] Embodiment 3:

[0206] like Fig.13 As shown, the present disclosure provides a base station, the base station is configured with a dedicated PLMN, and a corresponding relationship between the base station TAC and the dedicated PLMN is configured in the core network, and the base station includes:

[0207] A broadcast module 21, used for broadcasting a dedicated PLMN so that a private network user terminal can detect the dedicated PLMN;

[0208] The forwarding module 22 is connected to the broadcast module 21 and is used to forward the access request from the private network user terminal to the core network according to the private PLMN. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN.

[0209] so that the core network verifies the private network user terminal according to the dedicated TAC, base station TAC and IMSI, establishes isolation of private network user data and approves access requests; and,

[0210] forwarding the access request approval information from the core network to the private network user terminal according to the dedicated PLMN, so that the private network user terminal receives the access request approval information; and

[0211] The private network user data from the private network user terminal is forwarded to the core network according to the dedicated PLMN. The private network user data carries the IMSI.

[0212] This allows the core network to isolate and process private network user data based on IMSI;

[0213] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0214] In one embodiment, the base station includes a private network base station configured with only a dedicated PLMN, and a non-private network base station configured with a dedicated PLMN and a non-dedicated PLMN. The non-dedicated PLMN is used by non-private network user terminals, and the dedicated PLMN and the non-dedicated PLMN use different frequencies.

[0215] Embodiment 4:

[0216] like Fig.14 As shown, the present disclosure provides a core network, the core network configures the correspondence between the base station TAC and the dedicated PLMN, and the core network includes:

[0217] The request receiving module 31 is used to receive the access request from the private network user terminal forwarded by the base station according to the dedicated PLMN,

[0218] The access request is sent by the private network user terminal in response to detecting the private PLMN broadcast by the base station. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN;

[0219] The request processing module 32 is connected to the request receiving module 31 and is used to verify the private network user terminal according to the dedicated TAC, the base station TAC and the IMSI, and to establish isolation of the private network user data and approve the access request;

[0220] The data interaction module 33 is connected to the request processing module 32 and is used to send information of agreeing to the access request to the private network user terminal through the base station according to the dedicated PLMN, so that the private network user terminal receives the information of agreeing to the access request.

[0221] The base station receives private network user data from the private network user terminal according to the private PLMN, and the private network user data carries the IMSI;

[0222] The data processing module 34 is connected to the data interaction module 33 and is used to isolate and process the private network user data according to the IMSI;

[0223] Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

[0224] In one embodiment, the request processing module 32 is further configured to:

[0225] In response to the access request also carrying a dedicated APN, the private network user terminal is verified according to the dedicated APN, and data isolation of the private network user is established and the access request is approved, where APN is the access point name.

[0226] In one embodiment, the request processing module 32 specifically includes:

[0227] A verification unit, used to obtain a base station TAC, obtain information of a dedicated PLMN according to the IMSI, and in response to the private TAC being consistent with the base station TAC and the private TAC corresponding to the information of the private PLMN, the private network user terminal passes the verification;

[0228] The isolation unit is connected to the verification unit and is used to form a private network target user group with private network user terminals having the same private TAC and private PLMN information, use the IMSI as a mark that the private network user terminal belongs to the private network target user group, and obtain exclusive private network user data processing resources for the private network target user group;

[0229] The consent unit is connected to the isolation unit and is used for consenting to the access request and generating information of consenting to the access request.

[0230] Embodiment 5:

[0231] like Fig.15 As shown, Embodiment 5 of the present disclosure provides a private network isolation system, the system comprising:

[0232] A private network user terminal 1, used to implement the private network isolation method applied to the private network user terminal 1 as described in Example 1, that is, the private network user terminal 1 as described in Example 2;

[0233] Base station 2, connected to private network user terminal 1, is used to implement the private network isolation method applied to base station 2 as described in Example 1, that is, base station 2 as described in Example 3;

[0234] The core network 3 is connected to the base station 2 and is used to implement the private network isolation method applied to the core network 3 as described in Example 1, that is, the core network 3 described in Example 4.

[0235] Embodiment 6:

[0236] Embodiment 6 of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the private network isolation method as described in Embodiment 1 is implemented, or the private network isolation device as described in Embodiments 2, 3, 4, and 5 is implemented.

[0237] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program elements or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0238] In addition, the present disclosure may also provide a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor runs the computer program stored in the memory, the processor executes the private network isolation method as described in Example 1. The computer device may be the private network isolation device as described in Examples 2, 3, 4, and 5.

[0239] The memory is connected to the processor, the memory may be a flash memory or a read-only memory or other memory, and the processor may be a central processing unit or a single-chip microcomputer.

[0240] Embodiments 1-6 of the present disclosure provide a variety of private network isolation methods, which are respectively applied to private network user terminals, base stations, core networks or private network isolation systems composed of the three; provide a variety of private network isolation devices, including private network user terminals, base stations, core networks and private network isolation systems composed of the three; and computer-readable storage media that can implement the above methods or devices, by configuring a dedicated PLMN at the base station and broadcasting it, and when the private network user terminal sends an access request to the core network via the base station when the dedicated PLMN configured by itself is consistent with the PLMN broadcast by the base station, the access request carries a pre-configured dedicated TAC and the IMSI of the terminal, and the IMSI is also pre-set with the information of the dedicated PLMN, so that when the access request is sent to the core network via the base station, access isolation is achieved; and isolation of private network user data is set in the core network, and data isolation is achieved when the private network user data is subsequently sent; through the cooperation of the private network user terminal, the base station and the core network, access isolation and data isolation are used to ensure that the private network users can use the private network services.

[0241] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present disclosure, but the present disclosure is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and substance of the present disclosure, and these modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A private network isolation method, characterized in that: The method is applied to a private network user terminal, the private network user terminal is configured with a private network number card, the private network number card is configured with a dedicated PLMN and a dedicated TAC, and the method includes: In response to detecting the dedicated PLMN broadcast by the base station, an access request is sent to the core network via the base station according to the dedicated PLMN, the access request carries a dedicated TAC and IMSI, and the IMSI carries information about the dedicated PLMN. The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, establishes isolation for private network user data and approves access requests. The core network configures the correspondence between base station TAC and dedicated PLMN; In response to receiving the access request information forwarded by the base station from the core network according to the dedicated PLMN, the base station sends the private network user data to the core network according to the dedicated PLMN via the base station, the private network user data carries the IMSI, This allows the core network to isolate and process private network user data based on IMSI; Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

2. The method according to claim 1, characterized in that The private network number card is also configured with a restricted EPLMN, and the method further includes: In response to detecting a restricted EPLMN broadcast by a base station, connection to the restricted EPLMN is denied, wherein the EPLMN is an equivalent public land mobile network.

3. The method according to claim 1 or 2, characterized in that: The dedicated network number card is also configured with a dedicated APN, and the method further includes: The access request also carries a dedicated APN, so that the core network can also verify the private network user terminal according to the dedicated APN, establish data isolation for the private network user, and approve the access request, where APN is the access point name.

4. A private network isolation method, characterized in that: The method is applied to a base station, the base station is configured with a dedicated PLMN, and a corresponding relationship between the base station TAC and the dedicated PLMN is configured in a core network, and the method includes: Broadcasting the dedicated PLMN so that the private network user terminal can detect the dedicated PLMN; The dedicated PLMN forwards the access request from the private network user terminal to the core network. The access request carries the dedicated TAC and IMSI. The IMSI carries the information of the dedicated PLMN. The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, and establishes isolation of private network user data and approves access requests; Forwarding the access request approval information from the core network to the private network user terminal according to the dedicated PLMN, so that the private network user terminal receives the access request approval information; The private network user data from the private network user terminal is forwarded to the core network according to the dedicated PLMN. The private network user data carries the IMSI. This allows the core network to isolate and process private network user data based on IMSI; Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

5. The method according to claim 4, characterized in that The base station includes a private network base station configured with only a dedicated PLMN, and a non-private network base station configured with a dedicated PLMN and a non-dedicated PLMN. The non-dedicated PLMN is used by non-private network user terminals, and the dedicated PLMN and the non-dedicated PLMN use different frequencies.

6. A private network isolation method, characterized in that: The method is applied to a core network, and the core network configures a correspondence between a base station TAC and a dedicated PLMN. The method includes: The receiving base station forwards the access request from the private network user terminal according to the private PLMN, The access request is sent by the private network user terminal in response to detecting the private PLMN broadcast by the base station. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN; Verify the private network user terminal based on the dedicated TAC, base station TAC and IMSI, and establish isolation of private network user data and approve access requests; The base station sends information of approving the access request to the private network user terminal according to the private PLMN, so that the private network user terminal receives the information of approving the access request. The base station receives private network user data from the private network user terminal according to the private PLMN, and the private network user data carries the IMSI; Process private network user data based on IMSI isolation; Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

7. The method according to claim 6, characterized in that The method further comprises: In response to the access request also carrying a dedicated APN, the private network user terminal is verified according to the dedicated APN, and data isolation of the private network user is established and the access request is approved, where APN is the access point name.

8. The method according to claim 6 or 7, characterized in that: Verify the private network user terminal based on the dedicated TAC, base station TAC and IMSI, establish isolation for private network user data and approve access requests, including: Obtain the base station TAC, obtain the information of the dedicated PLMN according to the IMSI, and in response to the fact that the dedicated TAC is consistent with the base station TAC and the dedicated TAC corresponds to the information of the dedicated PLMN, the private network user terminal passes the verification; The private network user terminals with the same private TAC and private PLMN information are grouped into a private network target user group, and the IMSI is used as a mark that the private network user terminal belongs to the private network target user group, so as to obtain exclusive private network user data processing resources for the private network target user group; Agree to the access request and generate information of agreeing to the access request.

9. A private network user terminal, characterized in that: The private network user terminal is configured with a private network number card, which is configured with a dedicated PLMN and a dedicated TAC. The private network user terminal includes: A request sending module is used to send an access request to the core network via the base station in response to detecting the dedicated PLMN broadcast by the base station, wherein the access request carries a dedicated TAC and IMSI, and the IMSI carries information about the dedicated PLMN. The core network verifies the private network user terminal based on the dedicated TAC, base station TAC and IMSI, establishes isolation for private network user data and approves access requests. The core network configures the correspondence between base station TAC and dedicated PLMN; The data sending module is connected to the request sending module, and is used to respond to the information of the access request from the core network forwarded by the base station according to the dedicated PLMN, and send the private network user data to the core network through the base station according to the dedicated PLMN, wherein the private network user data carries the IMSI. This allows the core network to isolate and process private network user data based on IMSI; Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

10. A base station, characterized in that: The base station is configured with a dedicated PLMN, and the corresponding relationship between the base station TAC and the dedicated PLMN is configured in the core network. The base station includes: A broadcast module, used for broadcasting a dedicated PLMN so that a private network user terminal can detect the dedicated PLMN; The forwarding module is connected to the broadcast module and is used to forward the access request from the private network user terminal to the core network according to the private PLMN. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN. so that the core network verifies the private network user terminal according to the dedicated TAC, base station TAC and IMSI, establishes isolation of private network user data and approves access requests; and, forwarding the access request approval information from the core network to the private network user terminal according to the dedicated PLMN, so that the private network user terminal receives the access request approval information; and The private network user data from the private network user terminal is forwarded to the core network according to the dedicated PLMN. The private network user data carries the IMSI. This allows the core network to isolate and process private network user data based on IMSI; Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

11. A core network, characterized in that: The core network configures the correspondence between the base station TAC and the dedicated PLMN. The core network includes: A request receiving module is used to receive an access request from a private network user terminal forwarded by the base station according to the dedicated PLMN, The access request is sent by the private network user terminal in response to detecting the private PLMN broadcast by the base station. The access request carries the private TAC and IMSI, and the IMSI carries the information of the private PLMN; A request processing module, connected to the request receiving module, is used to verify the private network user terminal according to the dedicated TAC, the base station TAC and the IMSI, and to establish isolation of the private network user data and approve the access request; The data interaction module is connected to the request processing module and is used to send information of agreeing to the access request to the private network user terminal through the base station according to the dedicated PLMN, so that the private network user terminal receives the information of agreeing to the access request. The base station receives private network user data from the private network user terminal according to the private PLMN, and the private network user data carries the IMSI; A data processing module, connected to the data interaction module, is used to isolate and process private network user data according to IMSI; Among them, PLMN is the public land mobile network, TAC is the tracking area code, and IMSI is the international mobile subscriber identity.

12. A private network isolation system, characterized in that: The system comprises: A private network user terminal, used to implement the private network isolation method according to any one of claims 1 to 3; A base station, connected to a private network user terminal, for implementing the private network isolation method according to any one of claims 4 to 5; The core network is connected to the base station and is used to implement the private network isolation method as described in any one of claims 6 to 8.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the private network isolation method as described in any one of claims 1-3, 4-5 or 6-8 is implemented.

Images