Terminal mutual access management method and system, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a terminal mutual access management method and system, electronic equipment and a storage medium, and belongs to the technical field of communication. According to the method, mutual access configuration and a code set of an address field in a user address pool are obtained, and the code set comprises a plurality of label codes which are not distributed; determining a mutual access label and a mutual access address field of the address field according to the mutual access configuration of the address field; extracting a label code conforming to the meaning of a mutual access label from the code set according to the mutual access label of the address field, and distributing the label code to the address field and the mutual access address field of the address field; and configuring the address fields of the user address pool and the label codes of the address fields to a service network element, so that the service network element performs routing forwarding on a data packet of the terminal according to a mutual access rule of the label codes. According to the invention, the terminal mutual access configuration management mode can be simplified, and the mutual access security between the terminals is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a terminal mutual access management method, system, electronic device and storage medium. Background Art

[0002] With the popularization of 5G technology, enterprise customers have a large number of terminal devices connected to the network in customized network scenarios. There is a wide range of mutual access needs between terminals, and enterprise customers also need to provide mutual access services for secondary customers. After the core network terminal mutual access function is enabled, the terminal can achieve point-to-point mutual access through the core network gateway. However, to achieve the management of terminal mutual access, it is necessary to configure predefined rules between terminals or configure access policies on the terminals. This approach is prone to complex management problems when facing scenarios with complex customer relationship levels and dynamically changing mutual access needs. It is also prone to the problem that mutual access between terminals in the address pool under DNN cannot be isolated, resulting in security issues for terminal interaction. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to propose a terminal mutual access management method, system, electronic device and storage medium, aiming to simplify the terminal mutual access configuration management method and improve the security of mutual access between terminals.

[0004] To achieve the above purpose, an embodiment of the present application provides a terminal mutual access management method, comprising the following steps:

[0005] Obtaining a mutual access configuration and a coding set of an address segment in a user address pool, wherein the coding set includes a plurality of unallocated label codes;

[0006] Determine the mutual access label and the mutual access address segment of the address segment according to the mutual access configuration of the address segment;

[0007] Extracting a label code that matches the meaning of the mutual visit label from the code set according to the mutual visit label of the address segment, and assigning the label code to the address segment and the mutual visit address segment of the address segment;

[0008] The address segments of the user address pool and the label codes of each address segment are configured on the service network element, so that the service network element routes and forwards the data packets of the terminal according to the mutual access rules of the label codes.

[0009] In some embodiments, the mutual access configuration in the user address pool is obtained by the following steps:

[0010] Acquire a network configuration through a network management platform, wherein the network configuration includes a plurality of networks, each network being defined by at least one address segment in a user address pool;

[0011] The networking configuration is displayed on a customer relationship management platform to obtain the mutual access configuration of each address segment.

[0012] In some embodiments, the code set is updated by:

[0013] Determine the coding configuration status of each address segment, wherein the coding configuration status includes coding allocation, coding change and coding recycling;

[0014] When the encoding configuration state is encoding allocation, the label encoding allocated to the address segment is deleted from the encoding set;

[0015] When the encoding configuration state is encoding change, the label encoding newly allocated to the address segment is deleted from the encoding set, and the label encoding before the address segment is changed is written into the encoding set;

[0016] When the encoding configuration state is encoding recycling, the current tag encoding of the address segment is written into the encoding set.

[0017] In some embodiments, extracting a label code that conforms to the meaning of the mutual visit label from the code set according to the mutual visit label of the address segment, and assigning the label code to the address segment and the mutual visit address segment of the address segment, comprises the following steps:

[0018] Querying a coding label mapping table according to the mutual access label of the address segment to obtain a corresponding coding interval, wherein the coding label mapping table is used to record a mapping relationship between the coding interval and the mutual access label;

[0019] Any label code located in the coding interval is extracted from the coding set, and the extracted label code is allocated to the address segment and the mutual access address segment of the address segment.

[0020] In some embodiments, the mutual access tag includes an intra-address segment and inter-address segment mutual access tag, an inter-address segment mutual access tag, and an address segment mutual access closing tag.

[0021] In some embodiments, the service network element routes and forwards the data packet through the following steps:

[0022] Receive data packets from the terminal;

[0023] Determine a corresponding address segment and a label code of the address segment according to the address information carried by the data packet;

[0024] Determine the corresponding mutual visit tag by querying the code tag mapping table according to the tag code;

[0025] A corresponding mutual access rule is determined according to the mutual access label, and the data packet is routed and forwarded according to the mutual access rule.

[0026] In some embodiments, determining a corresponding mutual access rule according to the mutual access label, and routing and forwarding the data packet according to the mutual access rule, comprises the following steps:

[0027] When the mutual access label of the address segment is an intra-address segment and inter-address segment mutual access label, the first mutual access rule is used to route and forward the data packet, wherein the first mutual access rule is to find an inter-access address segment with the same label code as the address segment, determine the intra-address segment and the inter-access address segment as the allowed forwarding range of the data packet, and route and forward the data packet according to the allowed forwarding range;

[0028] When the mutual access label of the address segment is an inter-address segment mutual access label, a second mutual access rule is used to route and forward the data packet, wherein the second mutual access rule is to find an inter-access address segment with the same label code as the address segment, determine the inter-access address segment as an allowed forwarding range of the data packet, and route and forward the data packet according to the allowed forwarding range;

[0029] When the mutual access label of the address segment is the mutual access closing label of the address segment, the data packet is discarded.

[0030] To achieve the above purpose, another aspect of the embodiment of the present application proposes a terminal mutual access management system, including:

[0031] The first module is used to obtain the mutual access configuration and code set of the address segment in the user address pool, wherein the code set includes a plurality of unallocated label codes;

[0032] The second module is used to determine the mutual access label and the mutual access address segment of the address segment according to the mutual access configuration of the address segment;

[0033] A third module is used to extract a label code that conforms to the meaning of the mutual visit label from the code set according to the mutual visit label of the address segment, and distribute the label code to the address segment and the mutual visit address segment of the address segment;

[0034] The fourth module is used to configure the address segments of the user address pool and the label codes of each address segment to the service network element, so that the service network element routes and forwards the terminal data packets according to the mutual access rules of the label codes.

[0035] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program implements the method described in the above embodiment when executed by the processor.

[0036] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method described in the above embodiment.

[0037] The terminal mutual access management method, system, electronic device and storage medium proposed in the present application obtain the mutual access configuration and coding set of the address segment in the user address pool, the coding set includes multiple unassigned label codes, determines the mutual access label and mutual access address segment of the address segment according to the mutual access configuration of the address segment, extracts the label code that conforms to the meaning of the mutual access label from the coding set according to the mutual access label of the address segment, and assigns the label code to the address segment and the mutual access address segment of the address segment, and then configures the address segment of the user address pool and the label code of each address segment to the service network element, so that the service network element routes and forwards the terminal data packet according to the mutual access rules of the label code. The present application configures mutual access labels for the address segments of the address pool, controls the mutual access of terminals within and between address segments, realizes the management configuration of address mutual access within the address pool, realizes the effective isolation of complex hierarchical terminals, and improves the security of mutual access between terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 is a flow chart of a terminal mutual access management method provided in an embodiment of the present application;

[0039] Figure 2 yes Figure 1 Flow chart of the method for obtaining mutual access configuration in step S101;

[0040] Figure 3 yes Figure 1 Flow chart of the set coding update method in step S101;

[0041] Figure 4 yes Figure 1 Flow chart of step S103 in FIG.

[0042] Figure 5 yes Figure 1 Flow chart of step S104 in FIG.

[0043] Figure 6It is a schematic diagram of a terminal mutual access management system provided by an embodiment of the present application;

[0044] Figure 7 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application;

[0045] Figure 8 It is a schematic diagram of the overall implementation process of the terminal mutual access management method provided in the embodiment of the present application;

[0046] Fig. 9 This is a schematic diagram of the label encoding life cycle provided in an embodiment of the present application;

[0047] Fig.10 It is a schematic diagram of the service gateway routing forwarding control process provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] It should be noted that, although the functional modules are divided in the system and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0051] First, some nouns involved in this application are analyzed:

[0052] 5G (5th Generation Mobile Communication Technology): The full name is the fifth generation mobile communication technology, which is the latest generation of cellular mobile communication technology.

[0053] CRM (Customer Relationship Management): is a customer-centric enterprise management software that covers all strategies, tools and technologies used by organizations to improve customer development and customer relationships.

[0054] CMP (Connectivity Management Platform): is an important application specifically designed to monitor, analyze, configure and modify cellular IoT and machine-to-machine (M2M) deployments. The CMP platform plays a key role in the IoT ecosystem, helping enterprises effectively manage their IoT devices and connections, reduce operating costs and improve operational efficiency.

[0055] OSS (Operational Support System): The operator's operation support system is an integrated, information resource sharing support system for telecommunications operators.

[0056] DNN (Data Network Name): Equivalent to APN (Access Point Name) in 4G networks, it plays an important role in 5G networks and is used to identify an external data network.

[0057] The embodiments of the present application provide a terminal mutual access management method, system, electronic device and storage medium, which aim to simplify the terminal mutual access configuration management method and improve the security of mutual access between terminals.

[0058] The terminal mutual access management method, system, electronic device and storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the terminal mutual access management method in the embodiments of the present application is described.

[0059] The terminal mutual access management method provided in the embodiment of the present application relates to the field of communication technology. The terminal mutual access management method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or it can be configured as a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the terminal mutual access management method, etc., but is not limited to the above forms.

[0060] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0061] According to some embodiments of the present application, the terminal mutual access management method of the embodiment of the present application can be implemented based on the 5G core network, CRM system, 5G connection management platform and networking management platform. The CRM system, 5G connection management platform and networking management platform allocate unique mutual access labels to the address segments, and combine the configuration characteristics supported by the core network UPF (User Plane Function) network element after transformation, and add the address segment mutual access label function to realize address mutual access control. The CRM system and the networking management platform are responsible for the allocation, update and query of the address segment mutual access label, so that the mutual access label is unique between different user address pools. The 5G gateway is responsible for routing and forwarding according to the address mutual access label to realize mutual access between terminals. Furthermore, the terminal mutual access management method of the embodiment of the present application also has a mechanism for updating the mapping relationship between the customer level and the address mutual access configuration, thereby improving the security of terminal communications within the enterprise.

[0062] Figure 1 is an optional flowchart of the terminal mutual access management method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S104.

[0063] Step S101, obtaining the mutual access configuration and code set of the address segment in the user address pool, wherein the code set includes a plurality of unassigned label codes;

[0064] Step S102, determining the mutual access label and the mutual access address segment of the address segment according to the mutual access configuration of the address segment;

[0065] Step S103, extracting a label code that meets the meaning of the mutual visit label from the code set according to the mutual visit label of the address segment, and assigning the label code to the address segment and the mutual visit address segment of the address segment;

[0066] Step S104: configure the address segments of the user address pool and the label codes of each address segment to the service network element, so that the service network element routes and forwards the data packets of the terminal according to the mutual access rules of the label codes.

[0067] In step S101 of some embodiments, in the field of customer customized DNN, an address pool can be customized for the customer, and each user address pool includes an address segment allocated to the customer for use. The customer can allocate an IP address to the customer's IoT terminal according to the address segment allocated to the customer. In actual applications, the terminal mutual access function needs to be enabled in the customer's IoT. This embodiment can provide a terminal mutual access management system and provide a mutual access configuration page for users. Users can enter the mutual access configuration of the address segments in their address pool through the mutual access configuration page. The mutual access configuration defines which address segments can be visited within the segment, which address segments can be visited between segments, and which address segments are prohibited from access. The coding set of this embodiment includes multiple preset label codes, and none of the label codes in the storage coding set have been allocated to any non-inter-access address segment for use.

[0068] See also Figure 2 In some embodiments, the mutual access configuration in the user address pool in step S101 can be obtained through but not limited to steps S201 to S202:

[0069] Step S201, obtaining a network configuration through a network management platform, wherein the network configuration includes a plurality of networks, each network being defined by at least one address segment in a user address pool;

[0070] Step S202: Display the networking configuration on the customer relationship management platform to obtain the mutual access configuration of each address segment.

[0071] In this embodiment, the network management platform relies on a customized network. By connecting to public capability platforms such as IoT CRM, CMP, and AEP, it has the capabilities of multi-regional and multi-channel business acceptance, visual network orchestration, decentralization and domain division, and provides customers with a one-stop self-service platform. The network management platform can achieve customer-level network orchestration capabilities. When customers have network isolation or multi-level network requirements, the platform side can divide the address pool according to networking requirements, and the mutual access attributes of the address segments in the address pool correspond to the network architecture. When a customer's business expansion requires a new address segment, the address segment is added to the corresponding subnet, and all devices that do not need to be divided into subnets inherit the global network attributes. For example, please refer to Figure 8 The address segments of each network can be configured on the network management platform. For example, the customer's network includes network-1 formed by address segment-1, network-2 formed by address segment-2 and address segment-3, network-3 formed by address segment-4, and secondary customer network-1 formed by address segment-n.

[0072] In this embodiment, the customer relationship management platform is also called a CRM system. The CRM system can be used as a customer business entry system and is responsible for the acceptance of customer customized DNN. Customized DNN provides customers with refined business isolation capabilities and can provide customers with customized capabilities such as customized address pools, access methods, and access policies. When the DNN address pool is accepted, the address segment mutual access label code (ID) allocation can be increased through the mutual access configuration entered by the user on the platform. The label code is automatically assigned by the system, and the label codes of different user address pools are unique. The customer relationship management platform can display the networking configuration so that users can refer to the networking configuration for mutual access configuration and configure the address segments of the same network as inter-segment mutual access. Exemplarily, the address segment label codes allocated according to the mutual access configuration in the mutual access label management module of the CRM system are as follows: Figure 8 As shown, the label code 10000 of address segment-1 indicates intra-segment mutual access, the label code 10001 of address segment-2 and address segment-3 indicates intra-segment and inter-segment mutual access, the label code 20000 of address segment-4 and address segment-5 can indicate only inter-segment mutual access, the label code of address segment-6 is empty, indicating that the customer has not configured the address segment, and the address segment can inherit the global mutual access attribute, and the label code 30000 of address segment-n indicates that the address segment mutual access is closed. The meaning of the mutual access label represented by the above label code is only exemplary, and can be determined by the mapping relationship between the label code and the mutual access label in the system.

[0073] For further information, please refer to Figure 8, the OSS side maintains and updates the SMF / UPF information list corresponding to the national customer service to ensure that the national SMF / UPF information is accurate. OSS sends a DNN activation instruction to SMF / UPF, and configures the DNN, address pool, address segment and mutual access label encoding to the service network element. The 5GCMP connection management platform is a management platform that provides object-to-object connection services for IoT customers. Based on the five major capabilities of business operation, application integration, value-added services, security protection, and international business, it helps customers quickly customize and operate their own businesses and manage the entire life cycle of the card. The CMP platform provides the network management platform with connection service management capabilities through open APIs, rule engines, and business orchestration. The UPF (User Plane Function) network element of the 5G core network is an important part of the 5G core network (5GC) system architecture. It is mainly responsible for the routing and forwarding related functions of the 5G core network user plane data packets. Address pool configuration is an important aspect of the 5G network. The address pool part involves configuring the address pool and allocating the IP address of the user equipment (UE). Configuring the address pool involves address pool definition, address allocation method setting, SMF or UPF address pool information configuration, DNN mapping, etc. After the DNN terminal mutual access function is turned on, all terminals in the DNN or terminals between DNNs can access each other. When configuring the address segment, the method of this embodiment adds the label coding configuration of the core network to the address segment configuration. After the terminal goes online, the address is allocated according to the address pool address allocation method (static allocation method, dynamic allocation method), and the terminal data packet is routed and forwarded according to the label coding of the address segment where the terminal allocated address is located, according to the corresponding strategy of the label coding. In addition, the address mutual access label management module assigns the generated label to the address segment and updates the database record for subsequent management and query. The CRM system sends the customer customized network information and address label to the 5G connection management platform and synchronizes it to the networking management platform. As the mutual access address segment and label relationship change, the CMP platform monitors and updates the mutual access label information in real time.

[0074] See also Figure 3 In some embodiments, the encoding set in step S101 may be updated through, but not limited to, steps S301 to S304:

[0075] Step S301, determining the coding configuration status of each address segment, wherein the coding configuration status includes coding allocation, coding change and coding recycling;

[0076] Step S302: when the code configuration state is code allocation, the label code allocated to the address segment is deleted from the code set;

[0077] Step S303, when the coding configuration state is coding change, the label coding newly allocated to the address segment is deleted from the coding set, and the label coding before the address segment is changed is written into the coding set;

[0078] Step S304: When the code configuration state is code recycling, the current tag code of the address segment is written into the code set.

[0079] In some embodiments, the inter-visit tag management module in the CRM system is responsible for the generation, allocation, recovery and change of tag codes for address segments. Fig. 9 As shown, the life cycle of label coding includes generation, distribution, configuration, use, recycling and change. Accordingly, for an address segment, its coding configuration status includes coding allocation, coding change and coding recycling. Coding allocation refers to the process of allocating a label code in the coding set to the address segment, coding change refers to the process of modifying the label code that has been allocated to the address segment, and coding recycling refers to the process of recycling the label code that has been allocated to the address segment without configuring the mutual access attribute of the address segment. The coding set is updated in different coding configuration states. When a certain address segment is undergoing coding allocation, the label code allocated to the address segment needs to be deleted from the coding set to ensure that the coding set stores unallocated label codes; when a certain address segment is undergoing coding change, the label code newly allocated to the address segment is deleted from the coding set to ensure that the coding set stores unallocated label codes, and the label code before the address segment change is written into the coding set to realize the recycling of the old label code; when a certain address segment is undergoing coding recycling, the current label code of the address segment is written into the coding set to realize the recycling of the label code.

[0080] In step S102 of some embodiments, when the user sets the mutual access configuration of the address segment in the user address pool in the interactive interface, the mutual access label of each address segment can be set. The mutual access label can be one of the mutual access label within the address segment and between address segments, the mutual access label between address segments, and the mutual access closing label of the address segment. Further, for the address segment without the mutual access label, the system can default to the global mutual access attribute of its address segment, that is, the data packet of the address segment is routed and forwarded using the preset global routing rule in the subsequent service network element. For the address segment that adopts the mutual access label within the address segment and between address segments, the user can write its mutual access address segment so that the address segment and the mutual access address segment can achieve inter-segment mutual access. If the user does not write the mutual access address segment of the address segment (equivalent to the mutual access address segment being empty), the system considers that the address segment is only for intra-segment mutual access. For the address segment that adopts the mutual access label between address segments, the user can write its mutual access address segment so that the address segment and the mutual access address segment can achieve inter-segment mutual access.

[0081] In step S103 of some embodiments, through the mapping relationship between the label code stored in the system and the meaning of the mutual access label, the label code that meets the mutual access label of the address segment can be extracted from the code set, and the label code is assigned to the address segment. If there is a mutual access address segment in the address segment, the label code is also assigned to the mutual access address segment. For a user address pool, the address segment and the mutual access address segment are the same, which facilitates the subsequent service gateway to realize the inter-segment mutual access between the address segment and its mutual access address segment according to the same label code.

[0082] See also Figure 4 In some embodiments, step S103 may include but is not limited to steps S401 to S403:

[0083] Step S401, querying a coding label mapping table according to the mutual access label of the address segment to obtain a corresponding coding interval, wherein the coding label mapping table is used to record a mapping relationship between the coding interval and the mutual access label;

[0084] Step S402: extract any label code in the coding interval from the coding set, and assign the extracted label code to the address segment and the mutual access address segment of the address segment.

[0085] In this embodiment, the CRM system can perform label coding planning and generate a coding label mapping table, wherein the label coding planning corresponds to the mutual access label attribute, such as the coding interval of 10000-19999 is the mutual access label within the address segment and between address segments, and after the terminal accesses, the service network element (such as the core network) performs mutual access according to the mutual access label corresponding to the coding interval. Exemplarily, the coding label mapping table is shown in Table 1.

[0086]

[0087] Exemplarily, according to the mutual access label of the address segment, which is mutual access between address segments, the corresponding coding interval is 20000-29999, and any label code within the coding interval 20000-29999 is extracted from the coding set, and the extracted label code is assigned to the address segment and the mutual access address segment of the address segment, so that the label code of the address segment can accurately represent the mutual access label and ensure the uniqueness of the label code in other address pools in the entire network.

[0088] In another example, according to the mutual access label of the address segment, the mutual access of the address segment is closed, and the corresponding coding interval is 30000-39999. Any label code in the coding interval 30000-39999 is extracted from the coding set, and the extracted label code is assigned to the address segment. Since there is no mutual access address segment in this address segment, it can be considered that the operation of assigning the extracted label code to the mutual access address segment of the address segment is invalid.

[0089] In another example, for address segments without mutual access labels, there is no need to assign label codes to the address segments. In the subsequent service network element routing process, for address segments with empty label codes (Null), they inherit global properties by default and adopt the globally set mutual access forwarding policy.

[0090] In step S104 of some embodiments, the address segments of the user address pool and the label codes of each address segment are configured on the service network element, so that the service network element routes and forwards the data packets of the terminal according to the mutual access rules of the label codes. The service gateway is also configured with a label code and mutual access label mapping table and mutual access rules of different mutual access labels. The service network element can determine the mutual access rules that need to be adopted for the data packet by querying the mapping table, thereby routing and forwarding or discarding the data packet under the corresponding rules to achieve mutual access control.

[0091] See also Figure 5 In some embodiments, the service network element in step S104 may route and forward the data packet through, but not limited to, steps S501 to S504:

[0092] Step S501, receiving a data packet from a terminal;

[0093] Step S502, determining the corresponding address segment and the label code of the address segment according to the address information carried by the data packet;

[0094] Step S503, determining the corresponding mutual visit tag by querying the code tag mapping table according to the tag code;

[0095] Step S504: determine a corresponding mutual access rule according to the mutual access label, and route and forward the data packet according to the mutual access rule.

[0096] In this embodiment, after completing the configuration of the service gateway, in the actual routing process, the service network element receives data packets from various terminals. The data packets carry a source IP address and a destination IP address. Based on the carried IP address, the corresponding address segment of the data packet can be determined, and the label coding of the address segment is determined by the label coding of each address segment configured in advance. Then, the mapping table is queried according to the label coding to determine the mutual access rules that need to be adopted for the data packet, so that the data packet is routed and forwarded under the corresponding rules to achieve mutual access control.

[0097] In some embodiments, step S504 includes but is not limited to steps S601 to S602:

[0098] Step S601, when the mutual access label of the address segment is an intra-segment and inter-segment mutual access label, the first mutual access rule is used to route and forward the data packet, wherein the first mutual access rule is to find an inter-segment address segment with the same label code as the address segment, determine the intra-segment and inter-segment address segments as the allowed forwarding range of the data packet, and route and forward the data packet according to the allowed forwarding range;

[0099] Step S602: When the mutual access label of the address segment is an inter-address segment mutual access label, the second mutual access rule is used to route and forward the data packet, wherein the second mutual access rule is to find an inter-access address segment with the same label code as the address segment, determine the inter-access address segment as the allowed forwarding range of the data packet, and route and forward the data packet according to the allowed forwarding range;

[0100] Step S603: When the mutual access label of the address segment is the mutual access closing label of the address segment, the data packet is discarded.

[0101] Specifically, when the devices in the mutual access group need to communicate with other terminals, the service traffic is directly forwarded from the uplink user plane traffic to the downlink user plane traffic within the UPF according to the label coding. The address segment without label coding inherits the system attributes and is not interoperable with the mutual access label address segment. For example, please refer to Fig.10, taking the data packet received from the terminal as the start request, then determining the label coding of the address segment of the data packet, if the label coding belongs to the coding interval of 10000-19999, then adopting the first mutual access rule (i.e. matching the mutual access strategy within the address segment and between address segments) to route and forward the data packet, wherein the first mutual access rule is to find the mutual access address segment with the same label coding as the address segment, determine the mutual access address segment within the address segment and the mutual access address segment as the allowed forwarding range of the data packet, and route and forward the data packet according to the allowed forwarding range, for example, if the destination IP address is within the allowed forwarding range, forward it, otherwise discard it. If the label coding belongs to the coding interval of 20000-29999, then adopting the second mutual access rule (i.e. matching the mutual access strategy between address segments) to route and forward the data packet, wherein the second mutual access rule is to find the mutual access address segment with the same label coding as the address segment, determine the mutual access address segment as the allowed forwarding range of the data packet, and route and forward the data packet according to the allowed forwarding range. If the label code belongs to the coding interval of 30000-39999, the third mutual access rule (i.e. matching the mutual access closing policy of the address segment) is used to route and forward the data packet, for example, directly discarding the data packet to improve data security. If the label code is empty, the global forwarding policy is matched, and the specific rules of the global forwarding policy can be set according to business needs. Furthermore, the system of this embodiment will continuously collect and analyze information such as the networking status of the networking management platform and the status of the mutual access label management module during operation, and dynamically adjust and optimize the mutual access label management, forwarding strategy, access control, etc. based on this information.

[0102] In some embodiments, the method of the embodiments of the present application can realize the mutual visit function between secondary customers, that is, the mutual visit between secondary customers under the primary customer. The mutual visit label management module generates a unique label code for the address segment corresponding to the secondary customer subnet under the primary customer. The label code is corresponded and bound to the address segment information that needs to be mutually visited in the address pool under the DNN. The core network determines whether mutual visit is possible based on whether the labels configured in the address segment where the terminal address is located are consistent.

[0103] The method combined with the embodiment of the present application can also realize mutual visits between first-level customers, that is, mutual visits between customers. Customized network customers use customized DNNs. For mutual visits between customers, the mutual visit function of the customized DNN needs to be enabled, and the address segments that need to be visited in the two DNNs need to be configured with consistent mutual visit label encoding. The label is corresponding and bound to the address segment information that needs to be visited in the address pool under the DNN. The core network determines whether mutual visits can be made based on whether the DNN where the terminal address is located has enabled mutual visits and whether the labels configured for the address segments are consistent.

[0104] According to some embodiments of the present application, the method of the embodiment of the present application has the following beneficial effects:

[0105] The DNN address pool address segment is configured with mutual access labels. The label attribute application can realize point-to-multipoint and multi-point-to-multipoint network access control, and solve the problem that addresses in the address pool can access each other arbitrarily. Since labels are used to achieve user isolation, the use of core network directional access rules is reduced, and a mechanism for terminal address isolation within the address pool is provided.

[0106] The address segment is associated with the customer subnet through the address mutual access label, reducing the complexity of the customer's self-organizing network platform. The mutually accessible address segment uses a unique mutual access label encoding to improve the flexibility of network expansion.

[0107] Implement DNN subnet isolation on the core network UPF, reduce networking and network usage costs, and accelerate the large-scale development of 5G customized networks. Inter-terminal access control is implemented on the core network, reducing customer network construction and operation costs. Since the DNN logic is divided into several subnets using labels, the number of customer-level customized DNN configurations in the 5G network is reduced.

[0108] See also Figure 6 The present application also provides a terminal mutual access management system, including:

[0109] The first module is used to obtain the mutual access configuration and code set of the address segment in the user address pool, wherein the code set includes multiple unallocated label codes;

[0110] The second module is used to determine the mutual access label and mutual access address segment of the address segment according to the mutual access configuration of the address segment;

[0111] The third module is used to extract the label code that meets the meaning of the mutual visit label from the code set according to the mutual visit label of the address segment, and distribute the label code to the address segment and the mutual visit address segment of the address segment;

[0112] The fourth module is used to configure the address segments of the user address pool and the label codes of each address segment to the service network element, so that the service network element routes and forwards the data packets of the terminal according to the mutual access rules of the label code.

[0113] It can be understood that the contents of the above-mentioned terminal mutual visit management method embodiment are applicable to the present system embodiment, the functions specifically implemented by the present system embodiment are the same as those in the above-mentioned terminal mutual visit management method embodiment, and the beneficial effects achieved are also the same as those achieved by the above-mentioned terminal mutual visit management method embodiment.

[0114] The embodiment of the present application also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned terminal mutual access management method. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0115] See also Figure 7 , Figure 7 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0116] The processor 701 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0117] The memory 702 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 702 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 702, and the processor 701 calls and executes the terminal mutual access management method of the embodiment of the present application;

[0118] Input / output interface 703, used to implement information input and output;

[0119] Communication interface 704, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0120] A bus 705 that transmits information between the various components of the device (e.g., the processor 701, the memory 702, the input / output interface 703, and the communication interface 704);

[0121] The processor 701 , the memory 702 , the input / output interface 703 and the communication interface 704 are connected to each other in communication within the device via a bus 705 .

[0122] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned terminal mutual access management method.

[0123] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0124] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0125] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0126] The system embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0127] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0128] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0129] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0130] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0131] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0132] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0133] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0134] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A terminal mutual access management method, characterized in that: The following steps are involved: Obtaining a mutual access configuration and a coding set of an address segment in a user address pool, wherein the coding set includes a plurality of unallocated label codes; Determine the mutual access label and the mutual access address segment of the address segment according to the mutual access configuration of the address segment; Extracting a label code that matches the meaning of the mutual visit label from the code set according to the mutual visit label of the address segment, and assigning the label code to the address segment and the mutual visit address segment of the address segment; The address segments of the user address pool and the label codes of each address segment are configured on the service network element, so that the service network element routes and forwards the data packets of the terminal according to the mutual access rules of the label codes.

2. The terminal mutual access management method according to claim 1, characterized in that: The mutual access configuration in the user address pool is obtained by the following steps: Acquire a network configuration through a network management platform, wherein the network configuration includes a plurality of networks, each network being defined by at least one address segment in a user address pool; The networking configuration is displayed on a customer relationship management platform to obtain the mutual access configuration of each address segment.

3. The terminal mutual access management method according to claim 1, characterized in that: The code set is updated by the following steps: Determine the coding configuration status of each address segment, wherein the coding configuration status includes coding allocation, coding change and coding recycling; When the encoding configuration state is encoding allocation, the label encoding allocated to the address segment is deleted from the encoding set; When the encoding configuration state is encoding change, the label encoding newly allocated to the address segment is deleted from the encoding set, and the label encoding before the address segment is changed is written into the encoding set; When the encoding configuration state is encoding recycling, the current tag encoding of the address segment is written into the encoding set.

4. The terminal mutual access management method according to claim 1, characterized in that: The step of extracting a label code that conforms to the meaning of the mutual visit label from the code set according to the mutual visit label of the address segment, and allocating the label code to the address segment and the mutual visit address segment of the address segment includes the following steps: Querying a coding label mapping table according to the mutual access label of the address segment to obtain a corresponding coding interval, wherein the coding label mapping table is used to record a mapping relationship between the coding interval and the mutual access label; Any label code located in the coding interval is extracted from the coding set, and the extracted label code is allocated to the address segment and the mutual access address segment of the address segment.

5. The terminal mutual access management method according to claim 4, characterized in that: The mutual access labels include intra-address segment and inter-address segment mutual access labels, inter-address segment mutual access labels, and address segment mutual access closing labels.

6. The terminal mutual access management method according to claim 5, characterized in that: The service network element routes and forwards the data packet through the following steps: Receive data packets from the terminal; Determine a corresponding address segment and a label code of the address segment according to the address information carried by the data packet; Determine the corresponding mutual visit tag by querying the code tag mapping table according to the tag code; A corresponding mutual access rule is determined according to the mutual access label, and the data packet is routed and forwarded according to the mutual access rule.

7. The terminal mutual access management method according to claim 6, characterized in that: Determining a corresponding mutual access rule according to the mutual access label, and routing and forwarding the data packet according to the mutual access rule, comprises the following steps: When the mutual access label of the address segment is an intra-address segment and inter-address segment mutual access label, the first mutual access rule is used to route and forward the data packet, wherein the first mutual access rule is to find an inter-access address segment with the same label code as the address segment, determine the intra-address segment and the inter-access address segment as the allowed forwarding range of the data packet, and route and forward the data packet according to the allowed forwarding range; When the mutual access label of the address segment is an inter-address segment mutual access label, a second mutual access rule is used to route and forward the data packet, wherein the second mutual access rule is to find an inter-access address segment with the same label code as the address segment, determine the inter-access address segment as an allowed forwarding range of the data packet, and route and forward the data packet according to the allowed forwarding range; When the mutual access label of the address segment is the mutual access closing label of the address segment, the data packet is discarded.

8. A terminal mutual access management system, characterized in that: include: The first module is used to obtain the mutual access configuration and code set of the address segment in the user address pool, wherein the code set includes a plurality of unallocated label codes; The second module is used to determine the mutual access label and the mutual access address segment of the address segment according to the mutual access configuration of the address segment; A third module is used to extract a label code that conforms to the meaning of the mutual visit label from the code set according to the mutual visit label of the address segment, and distribute the label code to the address segment and the mutual visit address segment of the address segment; The fourth module is used to configure the address segments of the user address pool and the label codes of each address segment to the service network element, so that the service network element routes and forwards the terminal data packets according to the mutual access rules of the label codes.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the method described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of any one of claims 1 to 7.

Images