Private network access system and method
Through the collaborative work of the public network access module and the private network access auxiliary module, the problem of high cost and general difficulty of access for the private network terminal is solved, and low-cost private network access and efficient User equipment access is adapted to a variety of user equipment and improves network security.
Patent Information
- Application Number
- CN202411455774.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-17
- Publication Date
- 2025-01-10
AI Technical Summary
The existing technology cannot achieve private network access with low implementation costs, and the development of 4/5G private network is limited by the limitations of PLMN resources and UUT re-routing methods, resulting in the inability to achieve universal terminal selection of private network 4G. Access.
Through the interaction between the public network access module and the private network access auxiliary module, receive attachment request messages from the user equipment, build user profiles, send GUTI reallocation instructions, and determine the access point name of the target private network through temporary session establishment requests and GUTI realizes private network access to user equipment.
Selective access to private network terminals is realized under low cost, reducing overall implementation costs, adapting to 3GPP standard user equipment, and improving network security and service confidentiality.
Smart Images
Figure CN119300122A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communication technology, and in particular to a private network access system and method. Background Art
[0002] At present, private networks are generally built in a 4 / 5G converged manner. In particular, industry users with wide-area access needs and high network security requirements often use the operator's 4 / 5G base station sharing + 4 / 5G dedicated core network to deploy and build enterprise private networks. Therefore, it is necessary to consider how to distinguish 4G user devices and send them to 4G private networks under 4G shared base stations.
[0003] To this end, relevant technical personnel have proposed a Figure 1 The flowchart of the private network access method shown in FIG. Figure 1 As shown. First, the private network UE (User Equipment) sends an attachment request message carrying its IMSI (International Mobile Subscriber Identity) to the public network MME (Mobility Management Entity); the public network MME authenticates the private network UE according to its IMSI, and obtains the UUT (UE Usage Type) subscribed by the user equipment from the public network HSS (Home Subscriber Server); then, the public network MME sends the re-routing user attachment request containing the UUT subscribed by the user equipment to the public network 4G base station; then, the public network 4G base station sends an attachment request to the private network EPC network based on the re-routing user attachment request; finally, the private network EPC (Evolved Packet Core) network interacts with the private network UE to complete the attachment, so that the private network UE can access the private network. However, the above solution still has the following problems in the implementation process:
[0004] (1) Due to limited PLMN (Public Land Mobile Network) resources and regulatory restrictions, it is impossible to allocate an independent PLMN to each private network user;
[0005] (2) Based on the existing 3GPP UUT rerouting implementation method, the limited range of available UUT values seriously restricts the development of 4 / 5G private networks. At the same time, this method requires the 4G EPC network to undergo functional transformation, resulting in an overall high implementation cost.
[0006] In general, it is currently difficult to achieve both enterprise 4G wide-area access and the requirements for 4G enterprises to deploy private core networks, and it is impossible to enable general terminals to choose private 4G access.
[0007] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention
[0008] The embodiments of the present application provide a private network access system and method to at least solve the technical problem that related technologies cannot enable private network terminals to select private network access at a low implementation cost.
[0009] According to one aspect of an embodiment of the present application, a private network access system is provided, wherein a public network access module is used to receive a first attachment request message sent by a user device and carrying at least a user identity identifier, and determine the access point name of a target private network to which the user device has signed a contract based on the user identity identifier; send a first temporary session establishment request message carrying at least a user identity identifier and an access point name to a private network access auxiliary module; the private network access auxiliary module is used to build a user profile of the user device based on the first temporary session establishment request message, and send an attachment redirection instruction carrying at least a private network access auxiliary module identifier and a user identity identifier to the public network access module based on the user profile; the public network access module is also used to send a GUTI reallocation instruction to the user device based on the attachment redirection instruction, and receive a GUTI reallocation instruction from the user device based on the GUTI reallocation instruction. A second attachment request message triggered by a reallocation instruction, wherein the second attachment request carries at least a private network access auxiliary module identifier and a user identity identifier; a second temporary session establishment request message carrying at least the user identity identifier is sent to the private network access auxiliary module according to the private network access auxiliary module identifier; the private network access auxiliary module is further used to determine the corresponding user profile according to the second temporary session establishment request message, and determine the target GUTI corresponding to the access point name of the target private network in the user profile, and feed back a second temporary session establishment success response message carrying at least the target GUTI to the public network access module; the public network access module is further used to receive a third attachment request message sent by a user device and carrying at least the target GUTI, and forward the third attachment request message to the target private network, so that the user device can access the target private network.
[0010] Optionally, the public network access module includes: a public network base station, a public network mobility management entity network element, and a public network-affiliated contracted user server network element, wherein the public network base station is used to receive a first attachment request message sent by a user device and carrying at least a user identity identifier, and forward the first attachment request message to the public network mobility management entity network element; the public network mobility management entity network element is used to send a contract information acquisition request message carrying the user identity identifier to the public network-affiliated contracted user server network element; the public network-affiliated contracted user server network element is used to authenticate the user device based on the user identity identifier to obtain an authentication result; when the authentication result is that the authentication is passed, determine the access point name of the target private network that the user device has signed a contract with based on the user identity identifier, and feed back the access point name of the target private network to the public network mobility management entity network element through a contract information acquisition response message.
[0011] Optionally, the private network access auxiliary module includes: a user perception unit and a user attachment management unit, wherein the public network mobility management entity network element is used to send a first temporary session establishment request message to the user perception unit, wherein the first temporary session establishment request message also includes: the IP address of the public network mobility management entity; the user perception unit is used to respond to the first temporary session establishment request and feedback the corresponding first temporary session establishment success response message to the public network mobility management entity network element; the public network mobility management entity network element is also used to feedback a first attachment success response message to the user equipment based on the first temporary session establishment success response message.
[0012] Optionally, the user perception unit is also used to send the user identity, access point name and IP address of the public network mobility management entity carried in the first temporary session establishment request message to the user attachment management unit; the user attachment management unit is used to build a user profile of the user device based on the user identity, access point name and IP address of the public network mobility management entity.
[0013] Optionally, the user perception unit is further used to send an attachment redirection instruction to a public network mobility management entity network element according to the IP address of the public network mobility management entity, wherein at least the private network access auxiliary module identifier carried in the attachment redirection instruction is a user attachment management unit identifier; the public network mobility management entity network element is further used to send a GUTI reallocation instruction to the user equipment according to the attachment redirection instruction; the public network base station is further used to receive a second attachment request message triggered by the user equipment based on the GUTI reallocation instruction, wherein the second attachment request message carries at least a user attachment management unit identifier and a user identity identifier; send a second temporary session establishment request message to the user attachment management unit according to the user attachment management unit identifier, wherein the second temporary session establishment request message carries at least a user identity identifier; the user attachment management unit is further used to determine the corresponding user profile according to the user identity identifier, and use a preset private network GUTI mapping table to determine the target GUTI corresponding to the access point name of the target private network in the user profile; and feed back a second temporary session establishment success response message carrying at least the target GUTI to the user equipment through the public network base station.
[0014] Optionally, the second temporary session establishment success response message also carries a reattachment identifier.
[0015] Optionally, the public network base station includes: a network selection unit, wherein the network selection unit is further configured to receive a third attachment request message sent by the user equipment, and forward the third attachment request to the target private network.
[0016] According to another aspect of an embodiment of the present application, a private network access method is also provided, which is applied to a private network access auxiliary module, including: receiving a first temporary session establishment request message sent by a public network access module and carrying at least a user identity identifier of a user device and an access point name of a target private network that has been signed, wherein the public network access module is used to receive a first attachment request message sent by a user device and carrying at least a user identity identifier, and determine the access point name of the target private network that has been signed by the user device based on the user identity identifier; constructing a user profile of the user device based on the first temporary session request message, and sending an attachment redirection instruction carrying at least a private network access auxiliary module identifier and a user identity identifier to the public network access module based on the user profile, wherein the public network access module is also used to send an attachment redirection instruction to the user based on the attachment redirection instruction The device sends a GUTI reallocation instruction, and receives a second attachment request message triggered by the user device based on the GUTI reallocation instruction, wherein the second attachment request carries at least a private network access auxiliary module identifier and a user identity identifier; determines the corresponding user profile based on a second temporary session establishment request message sent by a public network access module that carries at least the user identity identifier, and determines the target GUTI corresponding to the access point name of the target private network in the user profile, and feeds back a second temporary session establishment success response message carrying at least the target GUTI to the public network access module, wherein the public network access module is further used to receive a third attachment request message sent by the user device that carries at least the GUT of the target private network, and forwards the third attachment request message to the target private network, so that the user device accesses the target private network.
[0017] Optionally, after receiving a first temporary session establishment request message sent by a public network access module and carrying at least a user identity identifier of a user device and an access point name of a contracted target private network, the method further includes: responding to the first temporary session establishment request, and feeding back a corresponding first temporary session establishment success response message to the public network access module, wherein the public network access module is used to feed back a first attachment success response message to the user device based on the first temporary session establishment success response message.
[0018] Optionally, the second temporary session establishment success response message also carries a reattachment identifier.
[0019] According to another aspect of an embodiment of the present application, a network device is further provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned private network access method through the computer program.
[0020] In an embodiment of the present application, a public network access module is used to receive a first attachment request message sent by a user device and carrying at least a user identity identifier, and determine the access point name of the target private network to which the user device has signed a contract based on the user identity identifier; send a first temporary session establishment request message carrying at least the user identity identifier and the access point name to the private network access auxiliary module; the private network access auxiliary module is used to build a user profile of the user device based on the first temporary session establishment request message, and send an attachment redirection instruction carrying at least a private network access auxiliary module identifier and a user identity identifier to the public network access module based on the user profile; the public network access module is also used to send a GUTI reallocation instruction to the user device based on the attachment redirection instruction, and receive a first temporary session establishment request message triggered by the user device based on the GUTI reallocation instruction. Two attachment request messages, wherein the second attachment request carries at least a private network access auxiliary module identifier and a user identity identifier; a second temporary session establishment request message carrying at least a user identity identifier is sent to the private network access auxiliary module according to the private network access auxiliary module identifier; the private network access auxiliary module is also used to determine the corresponding user profile according to the second temporary session establishment request message, and determine the target GUTI corresponding to the access point name of the target private network in the user profile, and feedback to the public network access module a second temporary session establishment success response message carrying at least the target GUTI; the public network access module is also used to receive a third attachment request message sent by a user device carrying at least the target GUTI, and forward the third attachment request message to the target private network, so that the user device can access the target private network. This solves the problem that the related technology cannot realize the private network terminal selection of private network access technology under low implementation cost. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0022] Figure 1 It is a flowchart of a private network access method according to the relevant technology;
[0023] Figure 2 is a schematic diagram of the architecture of an optional private network access system according to an embodiment of the present application;
[0024] Figure 3 is an interactive schematic diagram of an optional private network access system according to an embodiment of the present application;
[0025] Figure 4 It is a flowchart of an optional private network access method according to an embodiment of the present application;
[0026] Figure 5It is a schematic diagram of the structure of an optional network device according to an embodiment of the present application. DETAILED DESCRIPTION
[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.
[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0029] In addition, the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.
[0030] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:
[0031] IMSI is a digital code used to uniquely identify and verify the identity of mobile device users. It usually consists of 15 digits, including: 1 MCC (Mobile Country Code), 1 MNC (Mobile Network Code), 3 LAC (Location Area Code), and 10 or 11 MSIN (Mobile Station Identification Number).
[0032] The EPC network is the core network of the 4G mobile communication network. It has traditional mobile network capabilities such as user contract data storage, mobility management, and data exchange, and can provide users with ultra-high-speed Internet experience. The characteristics of EPC are that it only has a packet domain but no circuit domain. It is based on a full IP structure, with control and bearer separation and a flat network structure. Among them: EPC mainly includes the following three network elements: MME network element, S-GW (Serving Gateway) and P-GW (Packet Data Network Gateway).
[0033] MME is the access node of the 4G core network, responsible for mobility management, bearer management, user authentication, S-GW (Serving Gateway) and P-GW (Packet Data Network Gateway) selection, etc.
[0034] HSS is the evolution and upgrade of the 2G / 3G network element HLR (Home Location Register), and is mainly responsible for managing user subscription data and location information of mobile users.
[0035] GUTI (Globally Unique Temporary Identity): It is assigned by the MME selected by the mobile phone through the e-NB, and it will change with the change of environment. Its specific structure includes the following two parts: GUMMEI (Globally Unique MME Identity) and M-TMSI (Mobile Temporary Mobile Subscriber Identity). Among them: GUMMEI is the ID that uniquely identifies the MME in the network. It consists of MMC (Mobile Country Code), MNC (Mobile Network Code) and MMEI (MME Identity). MMC and MNC constitute the PLMN where this MME is located, and MMEI is composed of MMEGID (MME Group ID) and MMEC (MME Code); M-TMSI is the temporary ID that is uniquely determined in the MME, and it has a total of 32 bits.
[0036] Example 1
[0037] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example: Global System of Mobile communication (GSM) system, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service (GPRS), Long Term Evolution (LTE) system, LTE Frequency Division Duplex (FDD) system, LTE Time Division Duplex (TDD), Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) communication system or 5G system, etc.
[0038] For example, the architecture diagram of the private network access system provided in the embodiment of the present application is as follows: Figure 2 The system 20 includes: a public network access module 22 and a private network access auxiliary module 24. The interaction process between the public network access module 22 and the private network access auxiliary module 24 is roughly divided into the following steps:
[0039] Step 1: The public network access module 22 receives a first attachment request message sent by a user device and carries at least a user identity identifier, and determines the access point name of the target private network to which the user device has subscribed based on the user identity identifier; sends a first temporary session establishment request message carrying at least the user identity identifier and the access point name to the private network access auxiliary module 24;
[0040] Step 2: The private network access auxiliary module 24 builds a user profile of the user device according to the first temporary session establishment request message, and sends an attachment redirection instruction carrying at least a private network access auxiliary module identifier and a user identity identifier to the public network access module 22 according to the user profile;
[0041] Step 3: the public network access module 22 sends a GUTI reallocation instruction to the user equipment according to the attachment redirection instruction, and receives a second attachment request message triggered by the user equipment based on the GUTI reallocation instruction, wherein the second attachment request carries at least a private network access auxiliary module identifier and a user identity identifier; sends a second temporary session establishment request message carrying at least the user identity identifier to the private network access auxiliary module 24 according to the private network access auxiliary module identifier;
[0042] Step 4: The private network access auxiliary module 24 determines the corresponding user profile according to the second temporary session establishment request message, and determines the target GUTI corresponding to the access point name of the target private network in the user profile, and feeds back a second temporary session establishment success response message carrying at least the target GUTI to the public network access module 22;
[0043] Step 5: The public network access module 22 receives the third attachment request message sent by the user equipment and carrying at least the GUT of the target private network, and forwards the third attachment request message to the target private network, so that the user equipment accesses the target private network.
[0044] It should be noted that the above Figure 2 The system shown is for illustration only and does not limit the structure of the system. The communication system may include but is not limited to Figure 2 The components shown in .
[0045] The following will be combined Figure 3 The functions and interaction processes of each module in the private network access system are explained.
[0046] Specifically, as used herein, "user equipment" includes but is not limited to connection via a wired line, such as via a Public Switched Telephone Networks (PSTN), a Digital Subscriber Line (DSL), a digital cable, a direct cable connection; and / or another data connection / network; and / or via a wireless interface, such as, for a cellular network, a Wireless Local Area Network (WLAN), a digital television network such as a DVB-H network, a satellite network, an AM-FM broadcast transmitter; and / or a device of another user equipment configured to receive / send communication signals; and / or an Internet of Things (IoT) device. A user equipment configured to communicate via a wireless interface may be referred to as a "wireless communication terminal", "wireless terminal" or "mobile terminal". Examples of mobile terminals include, but are not limited to, satellite or cellular telephones; Personal Communications System (PCS) terminals that may combine cellular radiotelephones with data processing, fax, and data communications capabilities; PDAs that may include radiotelephones, pagers, Internet / Intranet access, Web browsers, notepads, calendars, and / or Global Positioning System (GPS) receivers; and conventional laptop and / or palmtop receivers or other electronic devices that include radiotelephone transceivers. User equipment may refer to access terminals, user equipment (UE), subscriber units, subscriber stations, mobile stations, mobile stations, remote stations, remote terminals, mobile devices, user terminals, terminals, wireless communication devices, user agents, or user devices. The access terminal can be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a user device in a 5G network, or a user device in a future evolved PLMN, etc.
[0047] Optionally, the public network access module 22 includes: a public network base station 221, a public network mobility management entity network element 222, and a public network affiliated subscriber server network element 223, and the private network access auxiliary module 24 (which can be understood as a public network gateway) includes: a user perception unit 241 and a user attachment management unit 242.
[0048] Therefore, when the user equipment initially attaches to the public network, the interaction process between the public network access module 22 and the private network access auxiliary module 24 includes the following steps:
[0049] Step S11: the public network base station 221 receives a first attach request message sent by a user equipment and carrying at least a user identity identifier (such as a TMSI, etc., and the user identity identifier mentioned below is also an IMSI, etc.), and forwards the first attach request message to the public network mobility management entity network element 222;
[0050] Step S12: the public network mobility management entity network element 222 sends a subscription information acquisition request message carrying the user identity identifier to the public network home subscriber server network element 223;
[0051] Step S13: the public network home subscriber server network element 223 performs identity authentication on the user device according to the user identity identifier to obtain an identity authentication result; if the identity authentication result is that the identity authentication is passed, the access point name (i.e., APN) of the target private network to which the user device has subscribed is determined according to the user identity identifier;
[0052] Step S14: Feedback the access point name of the target private network to the public network mobility management entity network element 222 through a subscription information acquisition response message;
[0053] Step S15: the public network mobility management entity network element 222 sends a first temporary session establishment request message to the user perception unit 241, wherein the first temporary session establishment request message carries at least: a user identity of the user equipment, an access point name of the target private network to which the user equipment has subscribed, and an IP address of the public network mobility management entity;
[0054] Step S16: The user sensing unit 241 responds to the first temporary session establishment request, and feeds back a corresponding first temporary session establishment success response message to the public network mobility management entity network element 222 to establish a temporary 4G session for the user;
[0055] Step S17: the public network mobility management entity network element 222 feeds back a first attach success response message to the user equipment according to the first temporary session establishment success response message.
[0056] In the above steps S11-S17, the user sensing unit 241 senses the online status of the private network user, thereby overcoming the problem that the traditional 4G core network does not have a mechanism for sensing the online status of the user.
[0057] Furthermore, in order to eliminate the need for interaction between the public core network and the private core network when the user device accesses the private network, the present application proposes moving the user to the user attachment management unit 242 to avoid the above-mentioned problems, thereby improving the security of the private core network and the public core network.
[0058] Therefore, when the user equipment moves to the user attachment management unit 242, the interaction process between the public network access module 22 and the private network access auxiliary module 24 includes the following steps:
[0059] Step S21: the user sensing unit 241 sends an information synchronization request message carrying the user identity, access point name and IP address of the public network mobility management entity carried in the first temporary session establishment request message to the user attachment management unit 242;
[0060] Step S22: The user attachment management unit 242 constructs a user profile of the user device according to the user identity, the access point name and the IP address of the public network mobility management entity. It should be noted that the user attachment management unit 242 can store user profiles of multiple user devices, so that when the user device is attached to it, the GUTI of the private network that the user device has subscribed to can be quickly fed back to the user device;
[0061] Step S23: the user attachment management unit 242 feeds back a corresponding information synchronization response message to the user perception unit 241;
[0062] Step S24: the user perception unit 241 sends an attachment redirection instruction to the public network mobility management entity network element 222 corresponding to the IP address of the public network mobility management entity stored in the user profile, wherein the attachment redirection instruction carries at least the identifier of the user attachment management unit 242 (that is, the user attachment management unit is the target to be attached at this stage, and the user attachment management unit 242 and the public network mobility management entity network element 222 are in the same pool) and the user identity identifier;
[0063] Step S25: the public network mobility management entity network element 222 sends a GUTI reallocation instruction to the user equipment according to the attachment redirection instruction;
[0064] Step S26: the public network base station 221 receives a second attachment request message triggered by the user equipment based on the GUTI reallocation instruction, wherein the second attachment request carries at least a user attachment management unit identifier and a user identity identifier;
[0065] Step S27: the public network base station 221 sends a second temporary session establishment request message to the user attachment management unit 242 according to the user attachment management unit identifier, wherein the second temporary session establishment request message carries at least the user identity identifier;
[0066] Step S28: the user attachment management unit 242 determines the corresponding user profile according to the user identity identifier, and uses a preset private network GUTI mapping table to determine the target GUTI corresponding to the access point name of the target private network in the user profile, wherein the private network GUTI mapping table stores the correspondence between the access point names of multiple private networks and the GUTI;
[0067] Step S29: the user attachment management unit 242 feeds back a second temporary session establishment success response message carrying at least the target GUTI to the user equipment through the public network base station 221.
[0068] The public network and the target private network accessed by the user equipment belong to different pools.
[0069] In the above steps S21-S29, the user perception management unit 241 performs the dynamic movement of the private network user to the user attachment management unit 242 in the same core network pool based on the real-time online network situation, so as to overcome the disadvantage that the traditional 4G core network can only implement simple functions such as QoS (Quality of Service) control and access restriction based on the user number / number segment. In addition, the user attachment management unit 242 identifies the private network to which the user device belongs based on the private network access point name. Compared with distinguishing the private network to which the user belongs according to the user number segment, this solution avoids the daily operation and maintenance pressure caused by the heavy number segment management.
[0070] It should be noted that the above steps S21-S22 can be executed in this stage, or can be executed at the same time as step S14 in the stage where the user initially attaches to the public network. This application does not make any specific restrictions on this.
[0071] In addition, in order to enable the user to subsequently access the target private network to which he has signed a contract, the second temporary session establishment success response message fed back by the user attachment management unit 242 to the user device also carries a re-attachment identifier (i.e., Re-attach identifier) to disconnect the connection between the user device and the user attachment management unit 242, thereby realizing network switching of the user device.
[0072] It should be noted that the timing of sending the above-mentioned reattachment identifier can be specifically determined in combination with the actual signaling process interaction situation, and the appropriate time point and signaling process point can be logically determined. This application does not impose any specific restrictions on this.
[0073] Furthermore, the public network base station 221 includes a network selection unit 2211. Therefore, when the user equipment attaches to the target private network, the interaction process between the network selection unit 2211 and the target private network includes the following steps:
[0074] Step S30: the network selection unit 2211 receives a third attach request message sent by the user equipment and carrying at least the target GUTI;
[0075] Step S31: the network selection unit 2211 forwards the third attachment request message to the target private network (core network EPC), so that the user equipment accesses the target private network.
[0076] It should be noted that when the user equipment subsequently attaches to the target private network, it can use the target GUTI to directly access the target private network.
[0077] In the above steps S30-S31, the network selection unit 2211 can realize that when the public network base station 221 accesses multiple MMEPools and sets the public network MME as the default MME, when the user equipment carries the attachment request message of its own initial user identity (i.e., IMSI), the message can be directly distributed to the public network MME. If the user carries the target GUTI, the message can be directly distributed to the private network MME to which it belongs.
[0078] In the above-mentioned private network access system provided in the embodiment of the present application, the correct network selection of the user equipment can be realized through the private network access auxiliary module and the network selection unit in the public network base station, and the private network access auxiliary module can serve multiple private networks, and the access mechanism can adapt to all user equipment that complies with the 3GPP specification, without the need for core network element adaptation, with strong network capability compatibility, and can better meet the requirements of private network enterprises for business security and confidentiality. At the same time, in the process of user attachment to the user attachment management unit, the signaling interaction with the server network element of the affiliated contracted user is reduced, making the business signaling controllable, and there is no risk of signaling impact for both the public network and the private network; in addition, the system used in this application has a network architecture that does not require interface interaction between the public network core network and the private network core network, which brings better protection to the communication security of both parties.
[0079] Example 2
[0080] Based on the above embodiment 1, an embodiment of a private network access method is also provided, and the method is applied to the private network access auxiliary module in the above embodiment 1. Figure 4 is a flow chart of an optional private network access method according to an embodiment of the present application, such as Figure 4 As shown, the method at least includes steps S402-S406, wherein:
[0081] Step S402: receiving a first temporary session establishment request message sent by a public network access module, which carries at least a user identity of a user equipment and an access point name of a subscribed target private network.
[0082] Before executing the above step S402, the above public network access module may first receive a first attachment request message sent by the user equipment and carrying at least a user identity, and determine the access point name of the target private network to which the user equipment has subscribed based on the user identity.
[0083] After executing the above step S402, the private network access auxiliary module can respond to the first temporary session establishment request and feedback the corresponding first temporary session establishment success response message to the public network access module; then, the public network access module can feedback the first attachment success response message to the user equipment based on the first temporary session establishment success response message.
[0084] Step S404: construct a user profile of the user equipment according to the first temporary session request message, and send an attachment redirection instruction carrying at least a private network access auxiliary module identifier and a user identity identifier to the public network access module according to the user profile.
[0085] Among them, after executing the above-mentioned step S404, the above-mentioned public network access module can send a GUTI reallocation instruction to the user equipment according to the attachment redirection instruction, and receive a second attachment request message triggered by the user equipment based on the GUTI reallocation instruction, wherein the second attachment request carries at least a private network access auxiliary module identifier and a user identity identifier.
[0086] Step S406, determine the corresponding user profile based on the second temporary session establishment request message carrying at least the user identity identifier sent by the public network access module, and determine the target GUTI corresponding to the access point name of the target private network in the user profile, and feedback a second temporary session establishment success response message carrying at least the target GUTI to the public network access module.
[0087] The second temporary session establishment success response message also carries a reattachment flag.
[0088] Furthermore, the public network access module may receive a third attachment request message sent by the user equipment and carrying at least the GUT of the target private network, and forward the third attachment request message to the target private network, so that the user equipment can access the target private network.
[0089] Example 3
[0090] According to an embodiment of the present application, a network device is also provided, wherein: Figure 5 is a schematic diagram of the structure of an optional network device according to an embodiment of the present application, such as Figure 5As shown, the network device includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the private network access method in the above-mentioned embodiment 2 when running.
[0091] Optionally, the processor is configured to execute the following steps through a computer program: receiving a first temporary session establishment request message sent by a public network access module that carries at least a user identity of a user device and an access point name of a target private network that has been signed, wherein the public network access module is used to receive a first attachment request message sent by a user device that carries at least a user identity, and determine the access point name of the target private network that has been signed by the user device based on the user identity; constructing a user profile of the user device based on the first temporary session request message, and sending an attachment redirection instruction that carries at least a private network access auxiliary module identifier and a user identity to the public network access module based on the user profile, wherein the public network access module is further used to send a GUTI to the user device based on the attachment redirection instruction. A reallocation instruction is sent, and a second attachment request message is received by the user device based on the GUTI reallocation instruction, wherein the second attachment request carries at least a private network access auxiliary module identifier and a user identity identifier; a corresponding user profile is determined according to a second temporary session establishment request message sent by the public network access module and carrying at least the user identity identifier, and a target GUTI corresponding to the access point name of the target private network in the user profile is determined, and a second temporary session establishment success response message carrying at least the target GUTI is fed back to the public network access module, wherein the public network access module is further used to receive a third attachment request message sent by the user device and carrying at least the GUT of the target private network, and forward the third attachment request message to the target private network, so that the user device can access the target private network.
[0092] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.
[0093] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.
[0094] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.
[0095] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.
[0096] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0097] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or CD-ROM and other media that can store program codes.
[0098] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.
Claims
1. A private network access system, characterized in that: The system includes: a public network access module and a private network access auxiliary module, wherein: The public network access module is configured to receive a first attachment request message sent by a user device and carrying at least a user identity identifier, and determine the access point name of the target private network to which the user device has subscribed based on the user identity identifier; and send a first temporary session establishment request message carrying at least the user identity identifier and the access point name to the private network access auxiliary module; The private network access auxiliary module is used to build a user profile of the user equipment according to the first temporary session establishment request message, and send an attachment redirection instruction carrying at least a private network access auxiliary module identifier and a user identity identifier to the public network access module according to the user profile; The public network access module is further used to send a globally unique temporary identifier GUTI reallocation instruction to the user equipment according to the attachment redirection instruction, and receive a second attachment request message triggered by the user equipment based on the GUTI reallocation instruction, wherein the second attachment request carries at least the private network access auxiliary module identifier and the user identity identifier; and send a second temporary session establishment request message carrying at least the user identity identifier to the private network access auxiliary module according to the private network access auxiliary module identifier; The private network access auxiliary module is further configured to determine the corresponding user profile according to the second temporary session establishment request message, determine the target GUTI corresponding to the access point name of the target private network in the user profile, and feed back a second temporary session establishment success response message carrying at least the target GUTI to the public network access module; The public network access module is further configured to receive a third attachment request message sent by the user equipment and carrying at least the target GUTI, and forward the third attachment request message to the target private network so that the user equipment can access the target private network.
2. The system according to claim 1, characterized in that The public network access module includes: a public network base station, a public network mobility management entity network element, and a public network home subscriber server network element, wherein: The public network base station is configured to receive a first attach request message at least carrying a user identity sent by the user equipment, and forward the first attach request message to the public network mobility management entity network element; The public network mobility management entity network element is used to send a subscription information acquisition request message carrying the user identity identifier to the public network home subscriber server network element; The public network-affiliated contracted user server network element is used to perform identity authentication on the user device based on the user identity identifier to obtain an identity authentication result; when the identity authentication result is that the identity authentication is passed, the access point name of the target private network to which the user device has subscribed is determined based on the user identity identifier, and the access point name of the target private network is fed back to the public network mobility management entity network element through a contract information acquisition response message.
3. The system according to claim 2, characterized in that The private network access auxiliary module includes: a user perception unit and a user attachment management unit, wherein: The public network mobility management entity network element is used to send the first temporary session establishment request message to the user perception unit, wherein the first temporary session establishment request message also includes: the IP address of the public network mobility management entity; The user sensing unit is used to respond to the first temporary session establishment request and feed back a corresponding first temporary session establishment success response message to the public network mobility management entity network element; The public network mobility management entity network element is further configured to feed back a first attachment success response message to the user equipment according to the first temporary session establishment success response message.
4. The system according to claim 3, characterized in that The user sensing unit is further configured to send the user identity, the access point name, and the IP address of the public network mobility management entity carried in the first temporary session establishment request message to the user attachment management unit; The user attachment management unit is used to build a user profile of the user equipment according to the user identity, the access point name and the IP address of the public network mobility management entity.
5. The system according to claim 3, characterized in that The user perception unit is further used to send the attachment redirection instruction to the public network mobility management entity network element according to the IP address of the public network mobility management entity, wherein at least the private network access auxiliary module identifier carried in the attachment redirection instruction is a user attachment management unit identifier; The public network mobility management entity network element is further configured to send the GUTI reallocation instruction to the user equipment according to the attachment redirection instruction; The public network base station is further used to receive a second attachment request message triggered by the user equipment based on the GUTI reallocation instruction, wherein the second attachment request message carries at least the user attachment management unit identifier and the user identity identifier; send a second temporary session establishment request message to the user attachment management unit according to the user attachment management unit identifier, wherein the second temporary session establishment request message carries at least the user identity identifier; The user attachment management unit is also used to determine the corresponding user profile based on the user identity identifier, and use a preset private network GUTI mapping table to determine the target GUTI corresponding to the access point name of the target private network in the user profile; and feed back a second temporary session establishment success response message carrying at least the target GUTI to the user equipment through the public network base station.
6. The system according to claim 5, characterized in that The second temporary session establishment success response message also carries a reattachment identifier.
7. The system according to claim 2, characterized in that The public network base station includes: a network selection unit, wherein: The network selection unit is further configured to receive the third attachment request message sent by the user equipment, and forward the third attachment request to the target private network.
8. A private network access method, characterized in that: Applicable to private network access auxiliary modules, including: A first temporary session establishment request message carrying at least a user identity of a user device and an access point name of a subscribed target private network is received from a public network access module, wherein the public network access module is used to receive a first attachment request message carrying at least a user identity from the user device, and determine the access point name of the subscribed target private network of the user device according to the user identity; Building a user profile of the user equipment according to the first temporary session request message, and sending an attachment redirection instruction carrying at least a private network access auxiliary module identifier and the user identity identifier to the public network access module according to the user profile, wherein the public network access module is further used to send a GUTI reallocation instruction to the user equipment according to the attachment redirection instruction, and receive a second attachment request message triggered by the user equipment based on the GUTI reallocation instruction, wherein the second attachment request carries at least the private network access auxiliary module identifier and the user identity identifier; Determine the corresponding user profile based on the second temporary session establishment request message sent by the public network access module and carrying at least the user identity identifier, and determine the target GUTI corresponding to the access point name of the target private network in the user profile, and feed back a second temporary session establishment success response message carrying at least the target GUTI to the public network access module, wherein the public network access module is also used to receive a third attachment request message sent by the user equipment and carrying at least the GUT of the target private network, and forward the third attachment request message to the target private network, so that the user equipment can access the target private network.
9. The method according to claim 8, characterized in that After receiving a first temporary session establishment request message sent by the public network access module and carrying at least a user identity of the user equipment and an access point name of the subscribed target private network, the method further includes: Respond to the first temporary session establishment request, and feed back a corresponding first temporary session establishment success response message to the public network access module, wherein the public network access module is used to feed back a first attachment success response message to the user equipment according to the first temporary session establishment success response message.
10. The method according to claim 8, characterized in that The second temporary session establishment success response message also carries a reattachment identifier.
11. A network device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the private network access method described in any one of claims 8 to 10 when running.