Secondary authentication method, electronic equipment and readable storage medium

Abstract

The invention provides a secondary authentication method, electronic equipment and a readable storage medium, which can be applied to the technical field of communication. The method is applied to an enterprise gateway, and comprises the following steps: receiving an XDR ticket sent by a signaling acquisition and analysis device; wherein the XDR call ticket comprises session process information in the interface signaling and a first device identifier of the first user device in the session process information; if the session process information comprises a session establishment process, a session modification process or a session report process, matching the first device identifier with a pre-configured online user list; and if the first equipment identifier is not in the online user list, sending a secondary authentication request to the DN-AAA server. According to the method provided by the invention, the secondary authentication is triggered through the XDR ticket generated by the signaling collection and analysis equipment received by the enterprise gateway, so that the enterprise can manage the authority of the user equipment to access the enterprise intranet, and the safety of the enterprise intranet is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a secondary authentication method, an electronic device and a readable storage medium. Background Art

[0002] Secondary authentication of 5G terminals refers to the authentication process that needs to be performed again when a 5G user device successfully accesses a specific network (such as an enterprise intranet, sensitive business network, etc.) after successfully accessing the 5G network. The main purpose of this authentication mechanism is to ensure the security of special networks and ensure that only users who have passed specific authentication can access sensitive business services.

[0003] In the prior art, secondary authentication is initiated and executed based on the configuration of the SMF (session management function) in the 5G core network. The SMF will configure for each DNN (data network name) whether to initiate secondary authentication and the information of the target DN-AAA server for initiating secondary authentication (IP address, port, etc.). This requires each enterprise user to sign a contract for a dedicated DNN, so as to configure whether to initiate secondary authentication on the SMF according to the needs of different enterprise users.

[0004] However, when enterprise users need to access the public network and the enterprise intranet at the same time, they generally do not sign a contract for a dedicated DNN, but a contract for a universal DNN, that is, they share the same DNN with other enterprise users. At this time, SMF cannot configure different secondary authentication strategies and parameters for different enterprise users for the universal DNN. In other words, if the enterprise user signs a contract for a universal DNN, SMF cannot initiate secondary authentication and cannot meet the enterprise user's needs for controlling the access rights of user devices. Summary of the invention

[0005] The present application provides a secondary authentication method, an electronic device and a readable storage medium to solve the technical problem in the prior art that, when an enterprise user signs a contract for a general DNN to meet the needs of simultaneously accessing the public network and the enterprise intranet, the enterprise user cannot control the user device's access to the enterprise intranet because the secondary authentication cannot be initiated through the session management function SMF in the 5G core network.

[0006] According to the first aspect disclosed in the present application, the present application provides a secondary authentication method, which is applied to an enterprise gateway, and the method includes:

[0007] Receive an XDR call list sent by a signaling collection and analysis device; wherein the XDR call list is generated after the signaling collection and analysis device parses the interface signaling of the N4 interface or the N1 interface in the 5G core network, and the XDR call list includes the session flow information in the interface signaling, and the first device identifier of the first user device in the session flow information;

[0008] If the session process information includes a session establishment process, a session modification process or a session report process, matching the first device identifier with a preconfigured online user list; wherein the online user list is used to record the second device identifier of the second user device that establishes an access connection with the enterprise intranet;

[0009] If the first device identifier is not in the online user list, a secondary authentication request is sent to the DN-AAA server; wherein the secondary authentication request carries the first device identifier.

[0010] In a feasible implementation manner, the method further includes:

[0011] If the first device identifier is in the online user list, the first user device is allowed to access the enterprise intranet.

[0012] In a feasible implementation manner, after sending the secondary authentication request to the DN-AAA server, the method further includes:

[0013] Receiving the request processing result returned by the DN-AAA server;

[0014] If the request processing result includes authentication pass information, the first user device is allowed to access the enterprise intranet, and the first device identifier is added to the online user list.

[0015] In a feasible implementation manner, the method further includes:

[0016] If the request processing result includes authentication failure information, the first user device is prohibited from accessing the enterprise intranet.

[0017] In a feasible implementation manner, the method further includes:

[0018] If the session process information includes a session release process, matching the first device identifier with a preconfigured online user list;

[0019] If the first device identifier is in the online user list, the access connection between the first user device and the enterprise intranet is disconnected, and the first device identifier is deleted from the online user list.

[0020] According to the second aspect disclosed in the present application, the present application provides a secondary authentication method, which is applied to a signaling collection and analysis device, and the method includes:

[0021] Collect interface signaling of N4 interface or N1 interface in 5G core network;

[0022] Parsing the interface signaling to generate an XDR call record; wherein the XDR call record includes the session flow information in the interface signaling and the first device identifier of the first user device in the session flow information;

[0023] Matching the first device identifier with a preconfigured gateway allocation list; wherein the gateway allocation list is used to record the corresponding allocation relationship between the third device identifier of the third user device and the enterprise gateway;

[0024] If the first device identifier is in the gateway allocation list, the XDR call record is sent to the corresponding enterprise gateway.

[0025] According to a third aspect disclosed in the present application, the present application provides a secondary authentication method, which is applied to a DN-AAA server, and the method includes:

[0026] Receiving a secondary authentication request sent by the enterprise gateway; wherein the secondary authentication request carries a first device identifier of the first user device;

[0027] Matching the first device identifier with a preconfigured authorized user list; wherein the authorized user list is used to record a fourth device identifier of a fourth user device that is authorized to access the enterprise intranet;

[0028] If the first device identifier is in the authorized user list, authentication pass information is returned to the enterprise gateway; wherein the authentication pass information is used to indicate that the enterprise gateway allows the first user device to access the enterprise intranet.

[0029] In a feasible implementation manner, the method further includes:

[0030] If the first device identifier is not in the authorized user list, authentication failure information is returned to the enterprise gateway; wherein the authentication failure information is used to instruct the enterprise gateway to prohibit the first user device from accessing the enterprise intranet.

[0031] According to a fourth aspect disclosed in the present application, the present application provides a secondary authentication device, which is applied to an enterprise gateway, and the device includes:

[0032] An information receiving module, configured to receive an XDR call list sent by a signaling collection and analysis device; wherein the XDR call list is generated after the signaling collection and analysis device parses the interface signaling of the N4 interface or the N1 interface in the 5G core network, and the XDR call list includes the session flow information in the interface signaling, and the first device identifier of the first user device in the session flow information;

[0033] an authentication request module, configured to match the first device identifier with a preconfigured online user list if the session process information includes a session establishment process, a session modification process, or a session report process; wherein the online user list is used to record a second device identifier of a second user device that establishes an access connection with the enterprise intranet; and

[0034] If the first device identifier is not in the online user list, a secondary authentication request is sent to the DN-AAA server; wherein the secondary authentication request carries the first device identifier.

[0035] According to a fifth aspect disclosed in the present application, the present application provides a secondary authentication device, which is applied to a signaling collection and analysis device, and the device includes:

[0036] Signaling collection module, used to collect interface signaling of N4 interface or N1 interface in 5G core network;

[0037] A signaling parsing module, configured to parse the interface signaling to generate an XDR call record; wherein the XDR call record includes the session flow information in the interface signaling and the first device identifier of the first user device in the session flow information;

[0038] an information allocation module, configured to match the first device identifier with a preconfigured gateway allocation list; wherein the gateway allocation list is used to record the corresponding allocation relationship between the third device identifier of the third user device and the enterprise gateway; and

[0039] If the first device identifier is in the gateway allocation list, the XDR call record is sent to the corresponding enterprise gateway.

[0040] According to a sixth aspect disclosed in the present application, the present application provides a secondary authentication device, applied to a DN-AAA server, the device comprising:

[0041] A request receiving module, configured to receive a secondary authentication request sent by an enterprise gateway; wherein the secondary authentication request carries a first device identifier of a first user device;

[0042] The request processing module matches the first device identifier with a preconfigured authorized user list; wherein the authorized user list is used to record the fourth device identifier of the fourth user device that is authorized to access the enterprise intranet; and

[0043] If the first device identifier is in the authorized user list, authentication pass information is returned to the enterprise gateway; wherein the authentication pass information is used to indicate that the enterprise gateway allows the first user device to access the enterprise intranet.

[0044] According to a seventh aspect disclosed in the present application, the present application provides an electronic device, comprising a processor, and a memory communicatively connected to the processor;

[0045] The memory stores computer-executable instructions;

[0046] The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of the first aspect, the second aspect or the third aspect.

[0047] According to the eighth aspect disclosed in the present application, the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed, they are used to implement the method described in any one of the first aspect, the second aspect or the third aspect.

[0048] According to a fifth aspect disclosed in the present application, the present application provides a computer program product, including a computer program, which, when executed, is used to implement the method in any one of the first aspect, the second aspect or the third aspect.

[0049] Compared with the prior art, this application has the following beneficial effects:

[0050] The present application provides a secondary authentication method, electronic device and readable storage medium. By setting up an enterprise gateway and a signaling collection and analysis device, the session flow information in the XDR call sheet generated by parsing the interface signaling of the N4 interface or the N1 interface is used to replace the session management function SMF in the 5G core network to trigger the secondary authentication process to the DN-AAA server. Only when the secondary authentication is successful, the enterprise gateway allows the user equipment UE to access the enterprise intranet. If the authentication fails, the enterprise gateway does not allow the user equipment UE to access the enterprise intranet. This solves the technical problem that when enterprise users sign a contract for a general DNN to meet the needs of accessing the public network and the enterprise intranet at the same time, the secondary authentication cannot be initiated through the session management function SMF in the 5G core network, resulting in the enterprise user being unable to control the user device's access to the enterprise intranet, thereby enhancing the security of the enterprise intranet. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0052] Figure 1 A schematic diagram of the architecture of a secondary authentication system provided in an embodiment of the present application;

[0053] Figure 2 A schematic diagram of a secondary authentication method provided in an embodiment of the present application;

[0054] Figure 3 A flowchart of another secondary authentication method provided in an embodiment of the present application;

[0055] Figure 4 A flowchart of another secondary authentication method provided in an embodiment of the present application;

[0056] Figure 5 A flowchart of another secondary authentication method provided in an embodiment of the present application;

[0057] Figure 6 A schematic diagram of the structure of a secondary authentication device provided in an embodiment of the present application;

[0058] Figure 7 A schematic diagram of the structure of another secondary authentication device provided in an embodiment of the present application;

[0059] Figure 8 A schematic diagram of the structure of another secondary authentication device provided in an embodiment of the present application;

[0060] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0061] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0062] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0063] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations:

[0064] The 5G core network is the core part of the 5G network, responsible for connecting the access network (such as base stations) with other networks and managing and distributing data in the network. It adopts a service-oriented architecture design and is mainly composed of network functions (NFs), such as AMF (access and mobility management function) and SMF (session management function), which can be deployed and expanded according to actual needs.

[0065] UE (User Equipment), in the 5G (NR) wireless communication system, the user equipment is a basic element in the 5G network architecture and is the end-user device that accesses various services and applications with the cellular network. Specifically, UE can include smartphones, tablets, laptops, Internet of Things (IoT) devices, and other terminal devices equipped with 5G functions. In the secondary authentication process, the UE is the terminal that initiates the authentication request and provides the necessary authentication information to the network for verification.

[0066] PDU (Protocol Data Unit), in the context of 5G networks, PDU usually refers to a PDU session, which is a logical connection established between the user equipment (UE) and the network for transmitting user data. In secondary authentication, the establishment and update of the PDU session is part of the authentication process, but the PDU itself does not directly participate in the authentication process.

[0067] DNN (Data network name) is equivalent to APN (Access Point Name) in 4G network. DNN is used to identify an external data network, defining which external network the user is connected to and the requested services and other resources. DNN is the identifier of the user equipment (UE) to access a specific data network. By configuring DNN, the UE can connect to different external networks, such as the Internet, corporate intranet or specific business network.

[0068] DN-AAA (Data Network-Authentication, Authorization, and Accounting) server is a network element device defined in the 3GPP 5G standard, and its full name is 5G industry private network access authentication system. This device plays a key role when the terminal accesses the 5G industry private network. The DN-AAA server confirms the identity of the user by verifying the credentials provided by the user (such as username and password), preventing unauthorized users from accessing network resources and improving network security. In the secondary authentication, DN-AAA receives the authentication request from the SMF, verifies the authentication information of the UE, and provides authorization data to the SMF based on the verification results. These authorization data include the UE's IP address, MAC address list, etc., which are used to update the PDU session and allow or deny data transmission.

[0069] AMF (Access and Mobility Management Function) AMF is one of the main functional units of the 5G core network, responsible for registration management, connection management, and mobility management. In secondary authentication, AMF is responsible for selecting the appropriate authentication server function (AUSF) during the registration process and selecting the appropriate session management function (SMF) during PDU session establishment. AMF is also responsible for transmitting session management messages between UE and SMF.

[0070] EAP (Extensible Authentication Protocol) is a protocol used for network authentication and supports multiple authentication methods. In secondary authentication, EAP is used to exchange authentication information between UE and DN-AAA server.

[0071] UPF (User Plane Function) is the anchor point of the session and is responsible for the routing and forwarding of data packets. In the secondary authentication process, although UPF does not directly participate in the authentication process, it provides the necessary user plane support for data transmission after authentication.

[0072] SMF (Session Management Function), SMF is responsible for tunnel maintenance, IP address allocation and management, UPF selection and control, policy implementation and QoS (Quality of Service) control, billing data collection, etc. between UPF (User Plane Function) and RAN (Radio Access Network). In the secondary authentication, SMF acts as an EAP authenticator, receives PDU session establishment requests from UE, and initiates EAP authentication when necessary. SMF is also responsible for forwarding EAP messages to the DN-AAA server and updating the PDU session according to the authorization data of DN-AAA.

[0073] ULCL (Uplink Classifier) ​​is a function supported by UPF (User Plane Function) in 5G network. It is used to forward data packets that meet specific conditions to the specified path according to the data filter rules issued by SMF (Session Management Function). Its function is similar to the routing table in traditional network, but it is more flexible and intelligent.

[0074] gNodeB, also known as gNB, is a base station device used in 5G (NR) wireless networks. It is responsible for key functions such as wireless access, resource management, and network communication. It is a basic component of the 5G radio access network (RAN) and is responsible for communicating with user equipment UE through the air interface. It is a key node in the 5G network architecture.

[0075] The N4 interface is a bridge between SMF (session management function) and UPF (user plane function). It is responsible for the management of PDU (protocol data unit) sessions and the control of traffic. It realizes the further separation of the control function and forwarding function of the 5G core network, thus bringing greater flexibility and higher efficiency to the 5G network.

[0076] The N1 interface is the interface between the UE and the access and AMF (mobility management function). In the 5G core network architecture, the N1 interface is the logical interface between the UE and the AMF, which is mainly used for the transmission of NAS (non-access stratum) layer signaling. As the key interface between the UE and the AMF in the 5G network, it is essential to realize the mobility management, connection management, security and service access functions of the 5G network. Through the N1 interface, the 5G network can efficiently manage a large number of devices (including IoT devices) connected to the network and provide stable, reliable and secure communication services.

[0077] IMSI (International Mobile Subscriber Identity) is a unique identifier assigned to a mobile device that identifies the device and its associated subscription information. IMSI is usually stored on the SIM card and used during initial registration and authentication with the mobile network.

[0078] MSISDN (Mobile Station International Subscriber Directory Number) is a mobile phone number. It is used to identify the user's telephone number in the mobile network and is the basis for call routing, authentication and billing.

[0079] An IP address (Internet Protocol Address) is a numerical label assigned to every device connected to the Internet (such as computers, smartphones, servers, etc.). This label is used to uniquely identify and locate devices in a computer network so that data can be transmitted between these devices.

[0080] XDR call records usually refer to detailed session-level records of the signaling process and service transmission process generated after processing the full amount of Internet data. These records contain all Internet access information of user devices, and therefore contain rich data analysis and mining value. XDR call records contain all key information generated by user devices in the process of using Internet services, such as session establishment, data transmission, session termination, etc., as well as related user behavior data.

[0081] An intranet, also known as a local area network (LAN), is a group of computers connected by multiple computers in a certain area. It is usually used for internal office work, internal resource sharing, file transfer, and database access. An intranet is relatively independent of external networks (such as the Internet) and has a strong closed nature, which helps protect the company's core data and confidential information.

[0082] Secondary authentication of 5G terminals refers to the authentication process that needs to be performed again when a 5G user device needs to access a specific network (such as an enterprise intranet, bank internal system, etc.) after successfully accessing the 5G network. This process is mainly controlled by vertical industry customers (such as enterprises, banks, etc.) to ensure the security of their network access. The main purpose of secondary authentication is to ensure the security of special networks. Through secondary authentication, it can be ensured that only authorized users can access sensitive or specific network resources, thereby preventing security risks such as unauthorized access and data leakage.

[0083] In the prior art, the secondary authentication process is usually initiated by the 5G core network during the establishment of the PDU session, and is carried out with the external DN-AAA server based on the EAP framework. The basic authentication process includes: first, the UE initiates a PDU session establishment request. If the enterprise user is configured on the SMF to require secondary authentication, the SMF will send an authentication request to the DN-AAA server, which carries the UE's identity information. Subsequently, the DN-AAA server and the UE will perform authentication based on the EAP framework, during which multiple signaling interactions will be required. Finally, the DN-AAA server replies to the SMF with an authentication acceptance message, and the SMF finally replies to the UE with a PDU session establishment acceptance message. During this period, if the DN-AAA server returns an authentication failure message to the SMF, the PDU session establishment process will also fail, and the user plane channel from the UE to the enterprise intranet will not be established, and the UE will not be able to access the enterprise intranet.

[0084] In the prior art, the secondary authentication initiated by SMF is executed based on the configuration of SMF. SMF configures whether to initiate secondary authentication for each DNN and the information of the target DN-AAA server for initiating secondary authentication (IP address, port, etc.). This requires each enterprise to sign a contract with a dedicated DNN, so as to configure whether to initiate secondary authentication on SMF according to the needs of different enterprises. However, when enterprise users need to access the public network and the enterprise intranet at the same time, based on ULCL technology, UPF distinguishes whether the application to be accessed by UE is located in the public network or the enterprise intranet according to the application characteristics (destination address, destination URL, etc.) accessed by UE. Based on this, UPF will divert the UE's access request to the public network or the enterprise intranet.

[0085] In this scenario, enterprise users generally do not sign up for a dedicated DNN, but for a universal DNN, that is, they share the same DNN with other enterprise users. In this case, SMF cannot configure different secondary authentication strategies and parameters for different enterprise users for the universal DNN. In other words, if the enterprise user signs up for a universal DNN, SMF cannot initiate secondary authentication and cannot meet the enterprise user's needs for controlling the access rights of the UE.

[0086] In response to the above technical problems, this application proposes a secondary authentication method, which triggers secondary authentication through the XDR call record generated by the signaling collection and parsing device received by the enterprise gateway, thereby realizing the enterprise's management of the user device's access rights to the enterprise intranet, so that only user devices authorized to access the DN-AAA server can pass the authentication and obtain the right to access the enterprise intranet, thereby ensuring the security of the enterprise intranet.

[0087] Next, combine Figure 1 , the architecture of the secondary authentication system involved in this application is explained.

[0088] Figure 1 This is a schematic diagram of the architecture of a secondary authentication system provided in the application embodiment, see Figure 1 In some embodiments, the secondary authentication system includes a user device UE, a signaling collection and analysis device, an enterprise gateway, and a DN-AAA server. The user device accesses the 5G network through the 5G base station gNodeB, and the signaling collection and analysis device is connected to the N4 interface in the 5G core network to collect the interface signaling of the N4 interface. The user device accesses the enterprise gateway on the user plane path, that is, between the UPF and each enterprise intranet. By default, the enterprise gateway intercepts the data traffic from the user device to the enterprise intranet through the UPF. At this time, the user device cannot access the enterprise applications of the enterprise intranet. After the secondary authentication is completed between the enterprise gateway and the DN-AAA server, the traffic from the authenticated user device to the enterprise intranet is released, and the user device can access the enterprise applications of the enterprise intranet.

[0089] Optionally, the signaling collection and analysis device can also be connected to the N1 interface in the 5G core network to collect interface signaling of the N1 interface.

[0090] Specifically, the DN-AAA server is deployed in the enterprise intranet.

[0091] The following is a detailed description of the technical solution of a secondary authentication method provided by the present application through specific embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents may not be repeatedly described in different embodiments.

[0092] Figure 2 A schematic diagram of a secondary authentication method provided in an embodiment of the present application is provided in Figure 2 In some embodiments, the secondary authentication method is applied to an enterprise gateway, and the process includes the following steps:

[0093] S201, receiving an XDR call record sent by a signaling collection and analysis device; wherein, the XDR call record is generated by the signaling collection and analysis device after parsing the interface signaling of the N4 interface or the N1 interface in the 5G core network, and the XDR call record includes the session process information in the interface signaling, and the first device identifier of the first user device in the session process information.

[0094] Among them, when the user equipment UE needs to establish a new data connection (such as accessing the Internet, making a video call, etc.), it will send a PDU session establishment request to the SMF through the access network device. After receiving the request, the SMF will trigger the N4 session establishment process, interact with the UPF, and create a corresponding N4 session context for the UE's PDU session. Therefore, when the user equipment needs to access the enterprise intranet, the N4 session will be triggered, thereby generating interface signaling on the N4 interface.

[0095] When the user equipment UE needs to establish a session with the network, it sends a session establishment request to the AMF through the N1 interface. The AMF allocates corresponding session resources to the UE based on the UE's request and network policy, and sends a session establishment response to the UE through the N1 interface. After the session is established, the UE and AMF will continue to exchange session management signaling through the N1 interface to ensure the normal operation of the session. Therefore, when the user equipment needs to access the enterprise intranet, the N1 session will also be triggered, thereby generating interface signaling on the N1 interface.

[0096] Therefore, the signaling collection and analysis device collects the interface signaling of the N4 interface or the N1 interface in the 5G core network, and parses the interface information to generate an XDR call list. The XDR call list will contain the session flow information in the interface signaling, and the first device identifier of the first user device involved in the session flow information.

[0097] Specifically, the device identifier may use at least one of IMSI, MSISDN, or IP address of the user equipment to identify the user equipment.

[0098] S202, if the session process information includes a session establishment process, a session modification process or a session report process, the first device identifier is matched with a preconfigured online user list; wherein the online user list is used to record the second device identifier of the second user device that establishes an access connection with the enterprise intranet.

[0099] If the session process information includes a session establishment process, a session modification process or a session report process, it indicates that the first user device is trying to establish a data connection with the enterprise intranet, and at this time, the first user identifier is matched with the device identifier on the online user list saved by itself. The online user list is used to record user devices that are establishing access connections with the enterprise intranet. Through the matching results, it can be determined whether the first user device is a user device that is establishing access connections with the enterprise intranet.

[0100] Specifically, if the enterprise gateway receives an XDR call record generated by analyzing the interface signaling collected by the signaling collection and analysis device from the N4 interface, the process identifier of the session establishment process, session modification process or session report process in the XDR call record will be PFCP Session Establishment, PFCP Session Modification or PFCP SessionReport respectively.

[0101] Specifically, if the enterprise gateway receives an XDR call record generated by parsing the interface signaling collected by the signaling collection and analysis device from the N1 interface, the process identifiers of the session establishment process or the session modification process in the XDR call record will be PDUsession Establishment and PDU session Modification respectively.

[0102] S203: If the first device identifier is not in the online user list, a secondary authentication request is sent to the DN-AAA server; wherein the secondary authentication request carries the first device identifier.

[0103] If the first device identifier is not in the online user list, it indicates that the first user device is not a user device that establishes an access connection with the enterprise intranet, and needs to be re-authenticated to determine whether the first user device is allowed to access the enterprise intranet based on the authentication result of the DN-AAA server. At this time, the enterprise gateway will initiate a re-authentication request to the DN-AAA service.

[0104] Specifically, by default, if a user device is not authenticated, the enterprise gateway will discard the data packets related to the IP address corresponding to the user. After receiving the user plane data packet, the enterprise gateway checks the user device corresponding to the user plane data packet. If the user device corresponding to the data packet is not in the online user list, the data packet is discarded. If the user device corresponding to the data packet is in the online user list, the data packet is forwarded to the enterprise intranet according to the routing configuration.

[0105] In this embodiment, for users who have signed up for the universal DNN, although the SMF cannot initiate secondary authentication, the enterprise gateway can trigger secondary authentication based on the received XDR call record, thereby enabling enterprise users to manage the access rights of user devices to the enterprise intranet. Only users who are authorized to access the DN-AAA server can obtain access rights to the enterprise intranet through authentication, thus ensuring the security of the enterprise intranet.

[0106] In some embodiments, if the first device identifier is in the online user list, the first user device is allowed to access the enterprise intranet.

[0107] If the first device identifier is in the online user list, it indicates that the first user device is a user device that establishes an access connection with the enterprise intranet and does not need to be authenticated again. The enterprise gateway forwards the data packet of the user device according to the routing configuration.

[0108] In some embodiments, after sending a secondary authentication request to the DN-AAA server, a request processing result returned by the DN-AAA server is received; if the request processing result includes authentication pass information, the first user device is allowed to access the enterprise intranet, and the first device identifier is added to the online user list.

[0109] Among them, after the enterprise gateway sends a secondary authentication request to the DN-AAA server, the DN-AAA server will return the processing result of the request. If the secondary authentication is successful, the request processing result will include authentication pass information. At this time, the enterprise gateway will allow the first user device to access the enterprise intranet based on the authentication pass information, release the user face data packet of the user device to access the enterprise intranet, and add the first device identifier to the online user list.

[0110] In some embodiments, if the request processing result includes authentication failure information, the first user device is prohibited from accessing the enterprise intranet.

[0111] If the secondary authentication fails, the request processing result will include authentication failure information. At this time, the enterprise gateway will prohibit the first user device from accessing the enterprise intranet based on the authentication failure information, and the enterprise gateway will discard the data packet of the user device. After receiving it, the enterprise gateway will discard the data packet related to the IP address corresponding to the user's IMSI and MSISDN.

[0112] In some embodiments, if the session process information includes a session release process, the first device identifier is matched with a preconfigured online user list; if the first device identifier is in the online user list, the access connection between the first user device and the enterprise intranet is disconnected, and the first device identifier is deleted from the online user list.

[0113] If the session process information includes a session release process, it indicates that the first user device is trying to disconnect the data connection with the enterprise intranet. At this time, the first user ID is matched with the device ID on the online user list saved by itself. If the first device ID is in the online user list, the enterprise gateway initiates an authentication deregistration process, disconnects the access connection between the first user device and the enterprise intranet, and deletes the first device ID from the online user list. Subsequently, the enterprise gateway will discard the data packet of the user device.

[0114] Specifically, if the enterprise gateway receives an XDR call record generated by parsing the interface signaling collected by the signaling collection and parsing device from the N4 interface, the process identifier of the session release process in the XDR call record is PFCP Session Delete.

[0115] Specifically, if the enterprise gateway receives an XDR call record generated by parsing the interface signaling collected by the signaling collection and parsing device from the N1 interface, the process identifier of the session release process in the XDR call record is PDU session Release.

[0116] Figure 3 A flowchart of another secondary authentication method provided in an embodiment of the present application is shown in FIG. Figure 3 In some embodiments, the secondary authentication method is used for a signaling collection and analysis device, and the process includes the following steps:

[0117] S301, collect interface signaling of the N4 interface or the N1 interface in the 5G core network.

[0118] S302, parse the interface signaling to generate an XDR call record; wherein the XDR call record includes the session flow information in the interface signaling and the first device identifier of the first user equipment in the session flow information.

[0119] Among them, the signaling is taken as input, and the signaling collection and analysis equipment collects the interface signaling by splitting or mirroring, and parses the key information records of the session process from the interface signaling. Each record contains time, process identifier, etc., and the output is an XDR call record, and the device identifier of the user device is extracted from it.

[0120] Specifically, the device identification includes IMSI, MSISDN, and UE IP address information.

[0121] S303, matching the first device identifier with a preconfigured gateway allocation list; wherein the gateway allocation list is used to record the corresponding allocation relationship between the third device identifier of the third user equipment and the enterprise gateway.

[0122] Among them, the gateway allocation list of each user device and the enterprise gateway is pre-configured on the signaling collection and analysis device, so that the XDR call record generated by the first user device is allocated to the corresponding enterprise gateway according to the allocation relationship in the gateway allocation list. By matching the first device identifier with the pre-configured gateway allocation list, it can be determined whether the first user device has a corresponding enterprise gateway, so as to send the XDR call record to the corresponding enterprise gateway.

[0123] Specifically, the corresponding allocation relationship between the device identifier and the enterprise gateway can be based on the correspondence between the IMSI or MSISDN of the device and the IP address of the enterprise gateway.

[0124] S304: If the first device identifier is in the gateway allocation list, the XDR call record is sent to the corresponding enterprise gateway.

[0125] If the first device identifier is in the gateway allocation list, it indicates that the signaling collection and analysis device can send the XDR call record of the user equipment to the enterprise gateway of the corresponding enterprise according to the gateway allocation list.

[0126] In this embodiment, a signaling collection and analysis device is newly added to generate an XDR call record through collection interface signaling analysis, and the XDR call record is sent to the corresponding enterprise gateway to trigger a subsequent secondary authentication process.

[0127] Figure 4 A flowchart of another secondary authentication method provided in the embodiment of the present application is shown in FIG. Figure 4 In some embodiments, the secondary authentication method is applied to a DN-AAA server, and the process includes the following steps:

[0128] S401, receiving a secondary authentication request sent by an enterprise gateway; wherein the secondary authentication request carries a first device identifier of a first user device.

[0129] S402, matching the first device identifier with a preconfigured authorized user list; wherein the authorized user list is used to record a fourth device identifier of a fourth user device that is authorized to access the enterprise intranet.

[0130] The DN-AAA server pre-configures a list of authorized user devices, and determines whether the first user device can be authorized to access the enterprise intranet by matching the first device identifier with the pre-configured authorized user list. If the first user device is in the authorized user list, the DN-AAA server returns an authentication success, otherwise it returns an authentication failure.

[0131] S403: If the first device identifier is in the authorized user list, authentication pass information is returned to the enterprise gateway; wherein the authentication pass information is used to indicate that the enterprise gateway allows the first user device to access the enterprise intranet.

[0132] If the first device identifier is in the authorized user list, it indicates that the DN-AAA server authorizes the first user device to access the enterprise intranet. At this time, authentication information is returned to the enterprise gateway to indicate that the enterprise gateway allows the first user device to access the enterprise intranet.

[0133] In this embodiment, the DN-AAA server determines whether the user device can access the enterprise intranet through a pre-configured authorized user list, so as to implement secondary authentication of the user device.

[0134] In some embodiments, if the first device identifier is not in the authorized user list, authentication failure information is returned to the enterprise gateway; wherein the authentication failure information is used to instruct the enterprise gateway to prohibit the first user device from accessing the enterprise intranet.

[0135] If the first device identifier is not in the authorized user list, it indicates that the DN-AAA server has not authorized the first user device to access the enterprise intranet. At this time, the authentication pass information is returned to the enterprise gateway to instruct the enterprise gateway to prohibit the first user device from accessing the enterprise intranet.

[0136] exist Figure 2 , Figure 3 and Figure 4 Based on the embodiment shown, the following Figure 5 , the technical solution of the above-mentioned secondary authentication method is further introduced.

[0137] Figure 5 A flowchart of another secondary authentication method provided in the embodiment of the present application is shown in FIG. Figure 5 In some embodiments, the process of the secondary authentication method includes the following steps:

[0138] S501, the signaling collection and analysis device collects interface signaling of the N4 interface or the N1 interface in the 5G core network.

[0139] S502, the signaling collection and analysis device analyzes the interface signaling to generate an XDR call record; wherein the XDR call record includes the session flow information in the interface signaling and the first device identifier of the first user equipment in the session flow information.

[0140] S503, the signaling collection and analysis device matches the first device identifier with a preconfigured gateway allocation list; wherein the gateway allocation list is used to record the corresponding allocation relationship between the third device identifier of the third user equipment and the enterprise gateway.

[0141] S504: If the first device identifier is in the gateway allocation list, the signaling collection and analysis device sends the XDR call record to the corresponding enterprise gateway.

[0142] S505: The enterprise gateway receives the XDR call record sent by the signaling collection and analysis device.

[0143] S506, if the session process information includes a session establishment process, a session modification process or a session report process, the enterprise gateway matches the first device identifier with a preconfigured online user list; wherein the online user list is used to record the second device identifier of the second user device that establishes an access connection with the enterprise intranet.

[0144] S507: If the first device identifier is in the online user list, the enterprise gateway allows the first user device to access the enterprise intranet.

[0145] S508: If the first device identifier is not in the online user list, the enterprise gateway sends a secondary authentication request to the DN-AAA server; wherein the secondary authentication request carries the first device identifier.

[0146] S509, the DN-AAA server receives the secondary authentication request sent by the enterprise gateway.

[0147] S510, the DN-AAA server matches the first device identifier with a preconfigured authorized user list; wherein the authorized user list is used to record a fourth device identifier of a fourth user device that is authorized to access the enterprise intranet.

[0148] S511, if the first device identifier is in the authorized user list, the DN-AAA server returns authentication pass information to the enterprise gateway; wherein the authentication pass information is used to indicate that the enterprise gateway allows the first user device to access the enterprise intranet.

[0149] S512, the enterprise gateway receives the authentication success information returned by the DN-AAA server.

[0150] S513: The enterprise gateway allows the first user device to access the enterprise intranet and adds the first device identifier to an online user list.

[0151] S514: If the first device identifier is not in the authorized user list, the DN-AAA server returns authentication failure information to the enterprise gateway; wherein the authentication failure information is used to instruct the enterprise gateway to prohibit the first user device from accessing the enterprise intranet.

[0152] S515, the enterprise gateway receives the authentication failure information returned by the DN-AAA server.

[0153] S516: The enterprise gateway prohibits the first user device from accessing the enterprise intranet.

[0154] S517: If the session process information includes a session release process, the enterprise gateway matches the first device identifier with a preconfigured online user list.

[0155] S518: If the first device identifier is in the online user list, the enterprise gateway disconnects the access connection between the first user device and the enterprise intranet, and deletes the first device identifier from the online user list.

[0156] In this embodiment, by setting up an enterprise gateway and a signaling collection and analysis device, the session flow information in the XDR call sheet generated by parsing the interface signaling of the N4 interface or the N1 interface is used to replace the session management function SMF in the 5G core network to trigger the secondary authentication process to the DN-AAA server. Only when the secondary authentication is successful, the enterprise gateway allows the user equipment UE to access the enterprise intranet. If the authentication fails, the enterprise gateway does not allow the user equipment UE to access the enterprise intranet. This solves the technical problem that when enterprise users sign a contract for a general DNN to meet the needs of accessing the public network and the enterprise intranet at the same time, the secondary authentication cannot be initiated through the session management function SMF in the 5G core network, resulting in the enterprise user being unable to control the user equipment's access to the enterprise intranet, thereby enhancing the security of the enterprise intranet.

[0157] Figure 6 is a schematic diagram of a secondary authentication device provided in an embodiment of the present application, see Figure 6 The secondary authentication device includes various functional modules for implementing the aforementioned secondary authentication method, and any functional module can be implemented by software and / or hardware.

[0158] In some embodiments, the secondary authentication device 600 is applied to an enterprise gateway, and includes an information receiving module 601 and an authentication request module 602. Among them:

[0159] The information receiving module 601 is used to receive an XDR call list sent by a signaling collection and analysis device; wherein the XDR call list is generated after the signaling collection and analysis device analyzes the interface signaling of the N4 interface or the N1 interface in the 5G core network, and the XDR call list includes the session flow information in the interface signaling, and the first device identifier of the first user device in the session flow information;

[0160] The authentication request module 602 is used to match the first device identifier with a preconfigured online user list if the session process information includes a session establishment process, a session modification process, or a session report process; wherein the online user list is used to record the second device identifier of the second user device that establishes an access connection with the enterprise intranet; and

[0161] If the first device identifier is not in the online user list, a secondary authentication request is sent to the DN-AAA server; wherein the secondary authentication request carries the first device identifier.

[0162] In some embodiments, the device 600 further includes a network control module 603, and the network control module 603 is specifically used to:

[0163] If the first device identifier is in the online user list, the first user device is allowed to access the enterprise intranet.

[0164] In some embodiments, the network control module 603 is further used to:

[0165] Receive the request processing result returned by the DN-AAA server;

[0166] If the request processing result includes authentication pass information, the first user device is allowed to access the enterprise intranet, and the first device identifier is added to the online user list.

[0167] In some embodiments, the network control module 603 is further used to:

[0168] If the request processing result includes authentication failure information, the first user device is prohibited from accessing the enterprise intranet.

[0169] In some embodiments, the network control module 603 is further used to:

[0170] If the session process information includes a session release process, matching the first device identifier with a preconfigured online user list;

[0171] If the first device identifier is in the online user list, the access connection between the first user device and the enterprise intranet is disconnected, and the first device identifier is deleted from the online user list.

[0172] The secondary authentication device 600 provided in the embodiment of the present application is used to execute the technical solution provided in the aforementioned secondary authentication method embodiment. Its implementation principle and technical effect are similar to those in the aforementioned method embodiment and will not be repeated here.

[0173] Figure 7 is a schematic diagram of a secondary authentication device provided in an embodiment of the present application, see Figure 7The secondary authentication device includes various functional modules for implementing the aforementioned secondary authentication method, and any functional module can be implemented by software and / or hardware.

[0174] In some embodiments, the secondary authentication device 700 is applied to a signaling collection and analysis device, including a signaling collection module 701, a signaling analysis module 702 and an information distribution module 703. Among them:

[0175] The signaling collection module 701 is used to collect interface signaling of the N4 interface or the N1 interface in the 5G core network;

[0176] The signaling parsing module 702 is used to parse the interface signaling and generate an XDR call record; wherein the XDR call record includes the session flow information in the interface signaling and the first device identifier of the first user device in the session flow information;

[0177] The information allocation module 703 is used to match the first device identifier with a preconfigured gateway allocation list; wherein the gateway allocation list is used to record the corresponding allocation relationship between the third device identifier of the third user device and the enterprise gateway; and

[0178] If the first device identifier is in the gateway allocation list, the XDR call record is sent to the corresponding enterprise gateway.

[0179] The secondary authentication device 700 provided in the embodiment of the present application is used to execute the technical solution provided in the aforementioned secondary authentication method embodiment. Its implementation principle and technical effect are similar to those in the aforementioned method embodiment and will not be repeated here.

[0180] Figure 8 is a schematic diagram of a secondary authentication device provided in an embodiment of the present application, see Figure 8 The secondary authentication device includes various functional modules for implementing the aforementioned secondary authentication method, and any functional module can be implemented by software and / or hardware.

[0181] In some embodiments, the secondary authentication device 800 is applied to a DN-AAA server, and includes a request receiving module 801 and a request processing module 802. Among them:

[0182] According to a sixth aspect disclosed in the present application, the present application provides a secondary authentication device, which is applied to a DN-AAA server, and the device includes:

[0183] The request receiving module 801 is used to receive a secondary authentication request sent by the enterprise gateway; wherein the secondary authentication request carries a first device identifier of a first user device;

[0184] The request processing module 802 user matches the first device identification with a preconfigured authorized user list; wherein the authorized user list is used to record the fourth device identification of the fourth user device that is authorized to access the enterprise intranet; and

[0185] If the first device identifier is in the authorized user list, authentication pass information is returned to the enterprise gateway; wherein the authentication pass information is used to indicate that the enterprise gateway allows the first user device to access the enterprise intranet.

[0186] In some embodiments, the request processing module 802 is further configured to:

[0187] If the first device identifier is not in the authorized user list, authentication failure information is returned to the enterprise gateway; wherein the authentication failure information is used to instruct the enterprise gateway to prohibit the first user device from accessing the enterprise intranet.

[0188] The secondary authentication device 800 provided in the embodiment of the present application is used to execute the technical solution provided in the aforementioned secondary authentication method embodiment. Its implementation principle and technical effect are similar to those in the aforementioned method embodiment and will not be repeated here.

[0189] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, all or part of them can be integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements, or all in the form of hardware, or some modules can be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the request processing module 802 can be a separately established processing element, or it can be integrated in a certain chip of the above device to be implemented. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a certain processing element of the above device. The function of the request processing module 802. The implementation of other modules is similar. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed by the hardware integrated logic circuit in the processor element or the instruction in the form of software.

[0190] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, see Fig. 9 The electronic device 900 includes a processor 901 and a memory 02 communicatively connected to the processor 901;

[0191] Memory 902 stores computer executable instructions;

[0192] The processor 901 executes the computer execution instructions stored in the memory 902 to implement the technical solution of the aforementioned secondary authentication method.

[0193] In the above-mentioned electronic device 900, the memory 902 and the processor 901 are electrically connected directly or indirectly to realize data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines, such as through a bus connection. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc., but it does not mean that there is only one bus or one type of bus. The memory 902 stores computer execution instructions for implementing the aforementioned secondary authentication method, including at least one software function module that can be stored in the memory 902 in the form of software or firmware. The processor 901 executes various functional applications and data processing by running software programs and modules stored in the memory 902.

[0194] The memory 902 includes at least one type of readable storage medium, including but not limited to random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), and electrically erasable read-only memory (EEPROM). The memory 902 is used to store programs, and the processor 901 executes the programs after receiving the execution instruction. Furthermore, the software programs and modules in the above-mentioned memory 902 may also include an operating system, which may include various software components and / or drivers for managing system tasks (such as memory management, storage device control, power management, etc.), and may communicate with various hardware or software components to provide an operating environment for other software components.

[0195] The processor 901 may be an integrated circuit chip having signal processing capability. The processor 901 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), etc. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor, or the processor 901 may be any conventional processor, etc.

[0196] The electronic device 900 is used to execute the technical solution provided by the aforementioned secondary authentication method embodiment. Its implementation principle and technical effect are similar to those in the aforementioned method embodiment and will not be repeated here.

[0197] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed, they are used to implement the technical solution of the aforementioned secondary authentication method.

[0198] The computer-readable storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The computer-readable storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0199] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the control device of the secondary authentication device.

[0200] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed, is used to implement the technical solution of the aforementioned secondary authentication method.

[0201] In the above embodiments, it will be appreciated by those skilled in the art that the above-mentioned various method embodiments can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless network, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that contains one or more available media integrations. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0202] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0203] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the appended claims.

[0204] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A secondary authentication method, characterized in that: Applied to an enterprise gateway, the method includes: Receive an XDR call list sent by a signaling collection and analysis device; wherein the XDR call list is generated after the signaling collection and analysis device parses the interface signaling of the N4 interface or the N1 interface in the 5G core network, and the XDR call list includes the session flow information in the interface signaling, and the first device identifier of the first user device in the session flow information; If the session process information includes a session establishment process, a session modification process or a session report process, matching the first device identifier with a preconfigured online user list; wherein the online user list is used to record the second device identifier of the second user device that establishes an access connection with the enterprise intranet; If the first device identifier is not in the online user list, a secondary authentication request is sent to the DN-AAA server; wherein the secondary authentication request carries the first device identifier.

2. The method according to claim 1, characterized in that The method further comprises: If the first device identifier is in the online user list, the first user device is allowed to access the enterprise intranet.

3. The method according to claim 1, characterized in that After sending the secondary authentication request to the DN-AAA server, the method further includes: Receiving the request processing result returned by the DN-AAA server; If the request processing result includes authentication pass information, the first user device is allowed to access the enterprise intranet, and the first device identifier is added to the online user list.

4. The method according to claim 3, characterized in that The method further comprises: If the request processing result includes authentication failure information, the first user device is prohibited from accessing the enterprise intranet.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If the session process information includes a session release process, matching the first device identifier with a preconfigured online user list; If the first device identifier is in the online user list, the access connection between the first user device and the enterprise intranet is disconnected, and the first device identifier is deleted from the online user list.

6. A secondary authentication method, characterized in that: Applied to a signaling collection and analysis device, the method comprises: Collect interface signaling of N4 interface or N1 interface in 5G core network; Parsing the interface signaling to generate an XDR call record; wherein the XDR call record includes the session flow information in the interface signaling and the first device identifier of the first user device in the session flow information; Matching the first device identifier with a preconfigured gateway allocation list; wherein the gateway allocation list is used to record the corresponding allocation relationship between the third device identifier of the third user device and the enterprise gateway; If the first device identifier is in the gateway allocation list, the XDR call record is sent to the corresponding enterprise gateway.

7. A secondary authentication method, characterized in that: Applied to a DN-AAA server, the method comprises: Receiving a secondary authentication request sent by the enterprise gateway; wherein the secondary authentication request carries a first device identifier of the first user device; Matching the first device identifier with a preconfigured authorized user list; wherein the authorized user list is used to record a fourth device identifier of a fourth user device that is authorized to access the enterprise intranet; If the first device identifier is in the authorized user list, authentication pass information is returned to the enterprise gateway; wherein the authentication pass information is used to indicate that the enterprise gateway allows the first user device to access the enterprise intranet.

8. The method according to claim 7, characterized in that The method further comprises: If the first device identifier is not in the authorized user list, authentication failure information is returned to the enterprise gateway; wherein the authentication failure information is used to instruct the enterprise gateway to prohibit the first user device from accessing the enterprise intranet.

9. An electronic device, characterized in that: comprising a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed, are used to implement the method according to any one of claims 1 to 8.

Images