Software defined network access method, device, equipment and medium

Abstract

The invention provides a software defined network access method and device, equipment and a medium, and effectively solves the problems that the accuracy is reduced, the timeliness is insufficient and the security is reduced when network access is carried out in an existing solution. The method comprises the following steps: the terminal equipment generates a corresponding out-of-group access process based on an out-of-group access request of a user, and pushes the out-of-group access process to the service platform; the service platform responds to the out-of-group access process and generates a modification instruction; the service platform modifies a data network identifier of the terminal device based on the modification instruction to obtain a modification result, and the service platform generates a target security policy based on the modification result and outputs the target security policy to a target security gateway of the target virtual network group, and the target security gateway allows the user to access the target branch mechanism through the terminal equipment.

Description

Technical Field

[0001] The present application relates to the field of network access technology, and more specifically, to a software-defined network access method, apparatus, device and medium. Background Art

[0002] As 5G network access technology matures, 5G private network and 5G local area network technologies are gradually developed based on 5G Internet access, and are gradually expanding to enterprise scenarios such as industrial manufacturing and mobile office in addition to the use scenarios for individual users. Unlike the use scenarios of daily Internet access for individual users, industrial manufacturing and mobile office scenarios have characteristics and requirements such as decentralized access points, dynamic networking between users and devices, and strict isolation of enterprise networking from the Internet. Compared with the use scenarios of individual users, enterprise scenarios often require secure networking architecture, centralized management capabilities, and automatic, autonomous, self-service, and controllable management configuration processes to meet the needs of daily enterprise network operations while investing appropriate network management costs.

[0003] To meet the above needs, existing solutions mainly rely on operators to provide daily management and configuration changes of related 5G equipment and number cards through services, and mainly provide related network services based on specific office locations or specific manufacturing plants. There is no good application precedent for large-scale and geographically dispersed access scenarios. The main difficulty lies in the dynamic changes and frequent changes of network demands in large-scale networking scenarios. The processing delay is large through manual configuration, and timely demand response cannot be obtained. In order to improve the response efficiency, higher backend support team costs are required, and the overall cost increases linearly with the scale of the network. At the same time, manual processing lacks a proper information management mechanism, and as the scale gradually expands, it is easy to make mistakes and cause partial or overall failures of the network system. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a software-defined network access method, device, equipment and medium, which effectively solves the problems of reduced accuracy, lack of timeliness and reduced security in existing solutions when performing network access.

[0005] In a first aspect, an embodiment of the present application provides a software-defined network access method, which is applied to a network access system, wherein the network access system includes a service platform and multiple branches, each branch includes multiple terminal devices, and the method includes:

[0006] The terminal device generates a corresponding out-of-group access process based on the out-of-group access request of the user, and pushes the out-of-group access process to the service platform; the out-of-group access request includes a data network identifier of the terminal device and a target branch; different branches have different data network identifiers;

[0007] The service platform responds to the out-of-group access process, determines the corresponding target virtual network group based on the target branch in the out-of-group access request, and generates a modification instruction;

[0008] The service platform modifies the data network identifier of the terminal device based on the modification instruction to obtain a modification result, so that the data network identifier of the terminal device belongs to the target virtual network group;

[0009] The business platform generates a target security policy based on the modification result, and outputs the target security policy to a target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch office through a terminal device.

[0010] In combination with the first aspect, an embodiment of the present application provides a first possible implementation of the first aspect, wherein the service platform modifies the data network identifier of the terminal device based on the modification instruction to obtain a modification result so that the data network identifier of the terminal device belongs to the target virtual network group, including:

[0011] The service platform calls the target virtual network group identifier of the target virtual network group based on the modification instruction; the target virtual network group identifier is allocated by the service platform;

[0012] The service platform modifies the data network identifier to obtain a modification result, so as to make the data network identifier correspond to the target virtual network group identifier based on the modification result.

[0013] In combination with the first aspect, the embodiment of the present application provides a second possible implementation of the first aspect, wherein the network access system is further connected to an operator-side service system;

[0014] The service platform modifies the data network identifier to obtain a modification result, so as to make the data network identifier correspond to the target virtual network group identifier based on the modification result, including:

[0015] After modifying the data network identifier, the service platform calls the subscription information of the terminal device in the service system on the operator side;

[0016] After the business platform modifies the contract information of the terminal device to the contract information corresponding to the target branch, a modification result is generated.

[0017] In combination with the first aspect, an embodiment of the present application provides a third possible implementation of the first aspect, wherein the service platform generates a target security policy based on the modification result, and outputs the target security policy to a target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch through a terminal device, including:

[0018] The business platform generates a call instruction based on the modification result, so as to call the policy delivery tool based on the call instruction;

[0019] The service platform issues the target security policy to the target security gateway based on the policy issuing tool.

[0020] In combination with the first aspect, an embodiment of the present application provides a fourth possible implementation of the first aspect, wherein the service platform responds to the out-of-group access process, determines the corresponding target virtual network group based on the target branch in the out-of-group access request, and generates a modification instruction before the process includes:

[0021] The service platform controls the relay device in the branch office to detect the target address in the service request sent by the user and determine the type of the target address;

[0022] The service platform confirms a forwarding mode of the service request based on the type of the target address to forward the service request.

[0023] In combination with the first aspect, the embodiment of the present application provides a fifth possible implementation of the first aspect, wherein the network access system further includes a cloud network management module;

[0024] The terminal device generates a corresponding out-group access process based on the out-group access request of the user, and pushes the out-group access process to the service platform, further comprising:

[0025] The cloud network management module counts the network types possessed by the branch offices and generates identification allocation instructions based on the network types;

[0026] The cloud network management module allocates a corresponding number of data network identifiers to the network in the branch based on the identifier allocation instruction.

[0027] In combination with the first aspect, an embodiment of the present application provides a sixth possible implementation of the first aspect, wherein the cloud network management module allocates a corresponding number of data network identifiers to the network in the branch based on the identifier allocation instruction, including:

[0028] The service platform determines the data network identifier to be bound based on the branch's relay equipment and the corresponding branch's organization information;

[0029] The service platform is bound to the relay device based on the data network identifier, so that the relay device has the corresponding data network identifier.

[0030] In a second aspect, an embodiment of the present application provides a software-defined network access device, which is applied to a network access system, wherein the network access system includes a service platform and multiple branches, each branch includes multiple terminal devices, and the device includes:

[0031] A push module, used for the terminal device to generate a corresponding out-group access process based on the user's out-group access request, and push the out-group access process to the service platform; the out-group access request includes the data network identifier of the terminal device and the target branch; different branches have different data network identifiers;

[0032] A response module, used for the service platform to respond to the out-of-group access process, determine the corresponding target virtual network group based on the target branch in the out-of-group access request, and generate a modification instruction;

[0033] A modification module, used for the service platform to modify the data network identifier of the terminal device based on the modification instruction to obtain a modification result, so that the data network identifier of the terminal device belongs to the target virtual network group;

[0034] The access module is used for the business platform to generate a target security policy based on the modification result, and output the target security policy to the target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch office through the terminal device.

[0035] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of any one of the software-defined network access methods are performed.

[0036] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any one of the software-defined network access methods are executed.

[0037] A software-defined network access method provided in an embodiment of the present application is applied to a network access system, wherein the network access system includes a service platform and multiple branches, each branch includes multiple terminal devices, wherein the method first generates a corresponding out-of-group access process based on an out-of-group access request of a user through the terminal device, and pushes the out-of-group access process to the service platform; the out-of-group access request includes a data network identifier of the terminal device and a target branch; different branches have different data network identifiers; secondly, the service platform responds to the out-of-group access process, determines a corresponding target virtual network group based on the target branch in the out-of-group access request, and generates a modification instruction; then the service The platform modifies the data network identifier of the terminal device based on the modification instruction to obtain a modification result, so that the data network identifier of the terminal device belongs to the target virtual network group; finally, the business platform generates a target security policy based on the modification result, and outputs the target security policy to the target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch through the terminal device, thereby realizing fast, safe and efficient access to the target branch and other large-scale and geographically dispersed access scenarios, solving the problems of reduced accuracy, lack of timeliness and reduced security in the prior art, reducing costs, and achieving a relatively good access effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A schematic diagram of a process of a first software-defined network access method provided in an embodiment of the present application is shown;

[0040] Figure 2 An architecture diagram of a network access system provided by an embodiment of the present application is shown;

[0041] Figure 3 A schematic diagram of a process for allocating a data network identifier provided in an embodiment of the present application is shown;

[0042] Figure 4 A schematic diagram showing the structure of a first software-defined network access device provided in an embodiment of the present application is shown;

[0043] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0044] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0045] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0046] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0047] In large-scale and geographically dispersed access scenarios, existing solutions mainly rely on operators to provide daily management and configuration changes of related 5G equipment and number cards through services, and mainly provide related network services with specific office locations or specific manufacturing plants as targets. There are no good application precedents for large-scale and geographically dispersed access scenarios. The main difficulty lies in the dynamic changes and frequent changes of network demand in large-scale networking scenarios. The processing delay is large through manual configuration, and timely demand response cannot be obtained. In order to improve the response efficiency, higher backend support team costs are required, and the overall cost increases linearly with the scale of the network. At the same time, manual processing lacks a proper information management mechanism, and as the scale gradually expands, it is easy to make mistakes and cause partial or overall failures of the network system.

[0048] Based on this, the embodiments of the present application provide a software-defined network access method, apparatus, device and medium, which are described below through embodiments.

[0049] Example 1

[0050] To facilitate understanding of this embodiment, a software-defined network access method disclosed in an embodiment of this application is first described in detail. Figure 1 A flowchart of a software-defined network access method is shown in the figure. A software-defined network access method provided by the present application is applied to a network access system, wherein the network access system includes a service platform and multiple branches, each branch includes multiple terminal devices, and the method includes:

[0051] S101, the terminal device generates a corresponding out-group access process based on the out-group access request of the user, and pushes the out-group access process to the service platform; the out-group access request includes a data network identifier of the terminal device and a target branch; different branches have different data network identifiers;

[0052] S102, the service platform responds to the out-group access process, determines the corresponding target virtual network group based on the target branch in the out-group access request, and generates a modification instruction;

[0053] S103, the service platform modifies the data network identifier of the terminal device based on the modification instruction to obtain a modification result, so that the data network identifier of the terminal device belongs to the target virtual network group;

[0054] S104: The business platform generates a target security policy based on the modification result, and outputs the target security policy to a target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch office through a terminal device.

[0055] In this application, the system architecture diagram of the network access system is as follows Figure 2 As shown, the network access system is applied in the enterprise, and the business platform is the software provided to users for use, that is, network access is achieved through the business platform software, and the network access system is responsible for managing the access of various network-based devices in the enterprise, such as office equipment. The network access system includes a business platform and multiple branches, and the branches are similar to or equivalent to the branches of the enterprise in various places. The computers, printers, mobile phones, etc. used by the staff in each branch are terminal devices, and the router, due to its functions, is used as a relay device to meet the use needs of the enterprise. In order to pursue the convenience of the network, the enterprise has established 5G networking in each branch, and the terminal equipment and routers are also accessed through the 5G network.

[0056] In step S101, when the user needs to change the branch to which he / she is connected, the number card included in the terminal device also needs to be replaced, and an out-of-group access request is generated. The out-of-group access request includes the data network identifier DNN of the user's terminal device and the target branch to be replaced and other information, including the branch to which the user currently belongs. The data network identifier DNN is assigned by the business platform, and the business platform assigns a corresponding data network identifier DNN based on each branch, and different branches have different data network identifiers to enable enterprises to better manage; that is, the terminal devices in the branch all have corresponding data network identifiers DNN, the number card of the terminal device is a 5G number card, and the user submits a number card account opening application through the business platform. The business platform includes a number card management module, and the number card management module completes the number card account opening application based on the number card account opening application. The number card management module also realizes the management of the entire life cycle of number cards, such as loss, change, and cancellation, that is, the issuance, activation, loss, and cancellation of number cards in large-scale 5G networking are managed through the application programming interface (API). The business platform also stores relevant information submitted by the user when applying, including the branch where the user is located, etc. The terminal device submits the out-of-group access process on the business platform through the user based on the out-of-group access request, that is, the business platform allows users to complete multiple applications, and each application has a corresponding application process template, which can be called when an application is needed. The terminal device generates the corresponding out-of-group access process based on the user's out-of-group access request through the terminal device held, and pushes the out-of-group access process to the business platform. The business platform then pushes the out-of-group access process to the corresponding reviewer for review.

[0057] At the same time, the 5G routers in the branch offices are also uniformly opened or registered and managed in the number card management module, the same as the 5G number card, and the relevant information of the 5G routers, such as account opening information, branch office information, etc., are also the same as the 5G number card and stored on the business platform.

[0058] In the specific implementation process of step S101, there is an embodiment: Figure 3 As shown, the network access system also includes a cloud network management module;

[0059] The terminal device generates a corresponding out-group access process based on the out-group access request of the user, and pushes the out-group access process to the service platform, further comprising:

[0060] S1011. The cloud network management module counts the network types of the branch offices and generates an identification allocation instruction based on the network types;

[0061] S1012. The cloud network management module allocates a corresponding number of data network identifiers to the network in the branch based on the identifier allocation instruction.

[0062] In steps S1011-S1012, the cloud network management module is a cloud network management platform, and the cloud network management module counts the network types of the branch offices, and the network types include office equipment network, extranet, and mobile network, wherein the office equipment network includes the Internet, a private network, and a local area network, and the office equipment network is used for office equipment to access the Internet and intranet business needs, and at the same time, it meets the needs of mobile network user terminal devices to access office equipment, the extranet is used to meet the needs of third-party services to connect to the company's business system through a private network, and the mobile network is used to meet the needs of user terminal devices to access the Internet, and at the same time To meet the needs of mobile network user terminal devices to access office equipment, the cloud network management module generates an identification allocation instruction after counting the network types possessed by the branch office. Based on the identification allocation instruction, the cloud network management module allocates a corresponding number of data network identifications to the office equipment network, extranet, and mobile network, respectively. For example, the cloud network management module allocates 3 data network identifications to the office equipment network, 1 data network identification to the extranet, and 2 data network identifications to the mobile network. It also implements functions such as data network identification (DNN) change and access authentication for 5G routers and 5G terminal devices.

[0063] The private network is established by the 5G router in the branch and the data center in the network access system through the data network identifier DNN. The 5G router acts as a DHCP relay device. When terminal devices such as office devices are connected to the 5G router, the DHCP server in the data center allocates IP addresses through the 5G private network and DHCP relay capabilities. The IP addresses of devices under large-scale 5G networking are uniformly managed and allocated through the application programming interface (API) to meet the needs of asset management. They are allocated in a static manner and registered in the business system by administrators in various places to achieve unified management of access device assets and addresses. Data slicing (DNN) and other network configurations are automatically pushed to related devices in large-scale 5G networking through the application programming interface (API).

[0064] In the specific implementation process of step S1012, there is an embodiment in which the cloud network management module allocates a corresponding number of data network identifiers to the network in the branch based on the identifier allocation instruction, including:

[0065] S10121. The service platform determines the data network identifier to be bound based on the branch's relay device and the corresponding branch's organization information;

[0066] S10122. The service platform is bound to the relay device based on the data network identifier, so that the relay device has the corresponding data network identifier.

[0067] In steps S10121-S10122, the relay device is a device with a specific relay function, such as a 5G router. After the 5G router applies for an account opening in the cloud network management module and passes it, the business platform allows the 5G router of the branch to access the mobile network, and the cloud network management module performs basic configuration for the 5G router, and determines the corresponding data network identifier to be bound based on the stored information of the organization to which the 5G router belongs. After the determination, the data network identifier is bound to the relay device so that the relay device has the corresponding data network identifier, that is, the 5G router has the corresponding data network identifier DNN, and is configured to the interface of the branch 5G router to realize the capability of traffic slicing, thereby achieving the effect of branch traffic transmission.

[0068] In step S102, after receiving the out-group access process, the service platform automatically responds to the out-group access process and reads the target branch filled in the out-group access process. The service platform pops up a corresponding window on the user's terminal device to allow the user to confirm the correctness of the target branch, and verifies the target branch to ensure the correctness of the target branch filled in by the user. The service platform calls the target branch based on the target branch in the out-group access request to determine the corresponding target virtual network group. Different branches have corresponding virtual network groups, that is, the enterprise has multiple branches and multiple virtual network groups, and generates a modification instruction, which includes the branch to which the user's terminal device currently belongs, the virtual network group and the corresponding data network identifier, as well as the target branch and the virtual network group and the corresponding data network identifier, as well as modification information such as user's related information.

[0069] In the specific implementation process of step S102, there is an embodiment in which the service platform responds to the out-group access process, determines the corresponding target virtual network group based on the target branch in the out-group access request, and generates a modification instruction before the process includes:

[0070] S1021, the service platform controls the relay device in the branch office to detect the target address in the service request sent by the user, and determines the type of the target address;

[0071] S1022: The service platform confirms a forwarding method of the service request based on the type of the target address to forward the service request.

[0072] In steps S1021-S1022, the business platform controls the relay device in the branch office to detect the target address in the business request sent by the user. The detection method is pre-set and the specific detection method is not described in detail here. The type of the target address is determined. The type of the business address is the Internet, local area network, and data center intranet. The business platform confirms the forwarding method of the business request based on the type of the target address to forward the business request, that is, different target address types correspond to different forwarding methods. If the target address is detected to be the Internet in the office equipment network, and the corresponding Internet traffic is used for software upgrades of devices such as cameras and printers, the Internet traffic is forwarded through the Internet DNN, and the Internet traffic is forwarded to the Internet through the UPF on the operator side; if the target address is detected to be the data center intranet in the office equipment network, the corresponding traffic is the intranet. The traffic is forwarded through the private network DNN, and the intranet traffic is forwarded to the 5G private network through the UPF on the operator side, and the service request is sent to the data center computer room through a point-to-point dedicated line; if the target address is detected to be the local LAN of the branch office in the office equipment network, the corresponding traffic is the LAN traffic, and it is forwarded through the LAN DNN, and the LAN traffic is forwarded to the data network identifier DNN of the corresponding target through the UPF on the operator side; if the target address is detected to be an extranet, the corresponding traffic is the extranet traffic, and data slicing is performed through the data network identifier DNN corresponding to the private network, and the extranet traffic is forwarded to the 5G private network through the UPF on the operator side, and then the traffic is forwarded to the third-party unit through the point-to-point dedicated line between the data center or provincial companies and the third-party unit; if the target address is detected to be a mobile network, the corresponding traffic is mobile network traffic, and the mobile network refers to all traffic that directly uses 5G The terminal device uses a SIM card to access the operator's 5G network; when the cellular network in the terminal device determines that the target address of its service request is the Internet, the mobile network traffic is forwarded through the Internet data network identifier DNN, and the mobile network traffic is forwarded to the Internet through the UPF on the operator side; when the cellular network determines that the target address of the service request is the LAN office equipment address, it is forwarded through the LAN DNN, and the mobile network traffic is forwarded to the LAN DNN to which the corresponding target address belongs through the UPF on the operator side.

[0073] In step S103, the service platform modifies the data network identifier of the terminal device based on the modification information included in the modification instruction, that is, the data network identifier of the terminal device is modified to the data network identifier of the target branch in the out-of-group access request, so that the data network identifier of the terminal device belongs to the target virtual network group, and obtains the modification result after the modification is completed, so that the terminal device initially accesses the target branch based on the service platform. If the modification result is successful, the data network identifier of the terminal device will change and meet the requirements in the modification instruction. If the modification result is failed, the data network identifier of the terminal device will not change. Then the service platform pops up a failure window on the user's terminal device and informs the specific reason for the failure. When the failure reason is caused by the user and the user needs to apply for the out-of-group access process again, the service platform evaluates the out-of-group access process application based on the failure reason. If the out-of-group access process application has not modified the failure reason, a corresponding reminder window will pop up to remind the user.

[0074] In the specific implementation process of step S103, there is an embodiment in which the service platform modifies the data network identifier of the terminal device based on the modification instruction to obtain a modification result so that the data network identifier of the terminal device belongs to the target virtual network group, including:

[0075] S1031, the service platform calls the target virtual network group identifier of the target virtual network group based on the modification instruction; the target virtual network group identifier is allocated by the service platform;

[0076] S1032: The service platform modifies the data network identifier to obtain a modification result, so as to make the data network identifier correspond to the target virtual network group identifier based on the modification result.

[0077] In steps S1031-S1032, the service platform calls the target virtual network group identifier of the target virtual network group based on the modification instruction; the target virtual network group identifier is allocated by the service platform; that is, different target virtual network groups correspond to different target virtual network group identifiers; the target virtual network group identifier is also a data network identifier DNN, that is, the network access system performs global management through the data network identifier DNN, wherein the terminal device is assigned to the public virtual network group VN Group by default, and the service platform modifies the data network identifier of the terminal device to the target virtual network group identifier of the target branch to obtain a modification result. Since the target branch is a local area network, the target virtual network group identifier of the target branch is a local area network data network identifier, so that the data network identifier corresponds to the target virtual network group identifier based on the modification result, so that the data network identifier of the terminal device belongs to the target virtual network group identifier of the target branch.

[0078] In the specific implementation process of step S1032, there is an embodiment in which: the network access system is also connected to the operator-side service system;

[0079] The service platform modifies the data network identifier to obtain a modification result, so as to make the data network identifier correspond to the target virtual network group identifier based on the modification result, including:

[0080] S10321. After modifying the data network identifier, the service platform calls the contract information of the terminal device in the service system on the operator side;

[0081] S10322: After the business platform modifies the contract information of the terminal device to the contract information of the corresponding target branch, it generates a modification result.

[0082] In steps S10321-S10322, after the service platform modifies the data network identifier, it calls the contract information of the terminal device in the service system on the operator side; after receiving the application for opening a number card account, the number card management module performs the number card account opening operation through the connected operator side service system, that is, the contract information of the terminal device is saved at the same time, and the number card management module also completes the change, cancellation and other related operations of the terminal device through the service system on the operator side, that is, the number card management module completes the related process of opening a number card account through the connected operator side service system, and the service platform modifies the user's contract information in the operator side UDM through the number card module capability, modifies the contract information of the terminal device to the contract information of the corresponding target branch, and also divides the virtual network group VN Group to which the user's terminal device belongs to the virtual network group VNGroup where the local area network data network identifier DNN of the corresponding target branch is located, so as to realize the dynamic realization of the 5G local area network, and after the contract information is modified, the terminal device is connected to the target branch, and the modification result is generated, and the virtual network group (VN Group) under the large-scale 5G networking is modified through the application programming interface (API). Group) to meet the dynamic networking requirements of 5G local area networks and adapt to the needs of mobile office.

[0083] In step S104, when the business platform determines that the modification result is successful, a target security policy is generated based on the modification result. The target security policy includes relevant information of the terminal device, the modification result, and instructions for allowing the terminal device to access and the corresponding security policy to be executed. The target security policy is obtained by the branch when the modification result is passed, after the business platform issues a security policy approval process and the approval process passes. The target security policy is output to the target security gateway of the target virtual network group, that is, the target security gateway can be a security tool installed by the network access system itself, such as a firewall. When the firewall does not execute the target security policy, it will regard the terminal device as a potential source of danger and refuse access. Therefore, after receiving the target security policy, the target security gateway executes the target security policy and allows the user to access the target branch through the terminal device, thereby realizing dynamic adjustment of the security policy executed by the target gateway, realizing the principle of minimization of security policies on the premise of meeting user needs, and realizing the ability of large-scale 5G networking to dynamically adapt to business needs in a business-driven form, and also realizing the effect of accessing the branch network through the business platform software.

[0084] In the specific implementation process of step S104, there is an embodiment in which the business platform generates a target security policy based on the modification result, and outputs the target security policy to the target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch through the terminal device, including:

[0085] S1041. The business platform generates a call instruction based on the modification result, so as to call a policy delivery tool based on the call instruction;

[0086] S1042: The service platform issues the target security policy to the target security gateway based on the policy issuing tool.

[0087] In steps S1041-S1042, the business platform generates a calling instruction based on the modification result, and the calling instruction is an instruction for calling a policy issuing tool, so as to call the policy issuing tool based on the calling instruction, thereby issuing the target security policy to the target security gateway after approval. The policy issuing tool can be a RESTAPI / NETCONF method to achieve traffic control between the head office and branches of the enterprise. The business platform issues the target security policy to the target security gateway based on the policy issuing tool, and the target security gateway executes the target security policy based on the policy issuing tool, thereby further enabling the terminal device to access the target virtual network group of the target branch through the business platform software, that is, achieving the effect of accessing the network through software.

[0088] Assume that employee A works in Beijing for a long time, his mobile device belongs to local area network DNN1, and printer M in Beijing belongs to DNN2; employee B works in Shanghai for a long time, his mobile device belongs to local area network DNN3, and printer N in Shanghai belongs to DNN4. Since local area networks DNN1 and DNN2 belong to VN Group P on the cloud network management module, employee A can use printer M to print files through the 5G local area network in Beijing. Local area networks DNN1 and DNN2 belong to VN Group Q, so employee B can use printer N to print files through the 5G local area network in Shanghai.

[0089] When employee A temporarily goes on a business trip to Shanghai, if he wants to use printer N in Shanghai to print documents, he can initiate an application process and change the DNN to which his SIM card belongs from LAN DNN1 to LAN DNN3 through the cloud network management platform. Since LANs DNN3 and DNN4 belong to the same VN Group Q, after the DNN is switched, employee A's mobile device can use printer N in Shanghai through the 5G LAN. After returning to Beijing, he can switch the SIM card back to DNN1. This function well meets the needs of employees who can access the LAN at any time when they are on business trips.

[0090] Example 2

[0091] This application also provides a digital management device for enterprise production operations, such as Figure 4 The block diagram of a software-defined network access device is shown. The functions implemented by the software-defined network access device correspond to the steps of executing a software-defined network access method on a terminal device. The device can be understood as a component of a server including a processor, which is applied to a network access system. The network access system includes a service platform and multiple branches, each branch includes multiple terminal devices, and the device includes:

[0092] Push module 401, used for the terminal device to generate a corresponding out-group access process based on the user's out-group access request, and push the out-group access process to the service platform; the out-group access request includes the data network identifier of the terminal device and the target branch; different branches have different data network identifiers;

[0093] A response module 402, configured for the service platform to respond to the out-of-group access process, determine the corresponding target virtual network group based on the target branch in the out-of-group access request, and generate a modification instruction;

[0094] A modification module 403, configured for the service platform to modify the data network identifier of the terminal device based on the modification instruction to obtain a modification result, so that the data network identifier of the terminal device belongs to the target virtual network group;

[0095] The access module 404 is used for the business platform to generate a target security policy based on the modification result, and output the target security policy to the target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch office through the terminal device.

[0096] In a feasible implementation, the modification module includes:

[0097] A first allocation module, used for the service platform to call the target virtual network group identifier of the target virtual network group based on the modification instruction; the target virtual network group identifier is allocated by the service platform;

[0098] The first modification module is used for the service platform to modify the data network identifier to obtain a modification result, so as to make the data network identifier correspond to the target virtual network group identifier based on the modification result.

[0099] In a feasible implementation manner, the modification module further includes:

[0100] A first calling module, used for calling the contract information of the terminal device in the service system on the operator side after the service platform modifies the data network identifier;

[0101] The generating module is used for the business platform to generate a modification result after the contract information of the terminal device is modified to the contract information of the corresponding target branch.

[0102] In a feasible implementation manner, the access module includes:

[0103] A second calling module, configured for the service platform to generate a calling instruction based on the modification result, so as to call a policy delivery tool based on the calling instruction;

[0104] The issuing module is used for the service platform to issue the target security policy to the target security gateway based on the policy issuing tool.

[0105] In a feasible implementation manner, the response module includes:

[0106] A control module, used for the service platform to control the relay device in the branch office to detect the target address in the service request sent by the user and determine the type of the target address;

[0107] The forwarding module is used for the service platform to confirm the forwarding mode of the service request based on the type of the target address to forward the service request.

[0108] In a feasible implementation manner, the push module includes:

[0109] A statistics module, used for the cloud network management module to count the network types of the branch offices and generate identification allocation instructions based on the network types;

[0110] The second allocation module is used for the cloud network management module to allocate a corresponding number of data network identifiers to the network in the branch based on the identifier allocation instruction.

[0111] In a feasible implementation manner, the push module further includes:

[0112] A determination module, used for the service platform to determine the data network identifier to be bound based on the branch's relay equipment and the corresponding branch's organization information;

[0113] A binding module is used for binding the service platform with the relay device based on the data network identifier so that the relay device has the corresponding data network identifier.

[0114] Example 3

[0115] The present application also provides an electronic device, such as Figure 5 As shown, it includes: a processor 501, a memory 502 and a bus 503, the memory 502 stores machine-readable instructions executable by the processor 501, when the electronic device is running, the processor 501 communicates with the memory 502 through the bus 503, and when the machine-readable instructions are executed by the processor 501, any one of the steps of the software-defined network access method is executed.

[0116] Example 4

[0117] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the software-defined network access methods are executed.

[0118] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0119] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0120] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0121] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a platform server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0122] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A software defined network access method, characterized in that: Applied to a network access system, the network access system includes a service platform and multiple branches, each branch includes multiple terminal devices, and the method includes: The terminal device generates a corresponding out-of-group access process based on the out-of-group access request of the user, and pushes the out-of-group access process to the service platform; the out-of-group access request includes a data network identifier of the terminal device and a target branch; different branches have different data network identifiers; The service platform responds to the out-of-group access process, determines the corresponding target virtual network group based on the target branch in the out-of-group access request, and generates a modification instruction; The service platform modifies the data network identifier of the terminal device based on the modification instruction to obtain a modification result, so that the data network identifier of the terminal device belongs to the target virtual network group; The business platform generates a target security policy based on the modification result, and outputs the target security policy to a target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch office through a terminal device.

2. The method according to claim 1, characterized in that The service platform modifies the data network identifier of the terminal device based on the modification instruction to obtain a modification result so that the data network identifier of the terminal device belongs to the target virtual network group, including: The service platform calls the target virtual network group identifier of the target virtual network group based on the modification instruction; the target virtual network group identifier is allocated by the service platform; The service platform modifies the data network identifier to obtain a modification result, so as to make the data network identifier correspond to the target virtual network group identifier based on the modification result.

3. The method according to claim 2, characterized in that The network access system is also connected to the operator-side service system; The service platform modifies the data network identifier to obtain a modification result, so as to make the data network identifier correspond to the target virtual network group identifier based on the modification result, including: After modifying the data network identifier, the service platform calls the subscription information of the terminal device in the service system on the operator side; After the business platform modifies the contract information of the terminal device to the contract information corresponding to the target branch, a modification result is generated.

4. The method according to claim 1, characterized in that: The business platform generates a target security policy based on the modification result, and outputs the target security policy to a target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch office through a terminal device, including: The business platform generates a call instruction based on the modification result, so as to call the policy delivery tool based on the call instruction; The service platform issues the target security policy to the target security gateway based on the policy issuing tool.

5. The method according to claim 1, characterized in that The service platform responds to the out-of-group access process, determines the corresponding target virtual network group based on the target branch in the out-of-group access request, and generates a modification instruction, including: The service platform controls the relay device in the branch office to detect the target address in the service request sent by the user and determine the type of the target address; The service platform confirms a forwarding mode of the service request based on the type of the target address to forward the service request.

6. The method according to claim 1, characterized in that The network access system also includes a cloud network management module; The terminal device generates a corresponding out-group access process based on the out-group access request of the user, and pushes the out-group access process to the service platform, further comprising: The cloud network management module counts the network types possessed by the branch offices and generates identification allocation instructions based on the network types; The cloud network management module allocates a corresponding number of data network identifiers to the network in the branch based on the identifier allocation instruction.

7. The method according to claim 6, characterized in that The cloud network management module allocates a corresponding number of data network identifiers to the network in the branch based on the identifier allocation instruction, including: The service platform determines the data network identifier to be bound based on the branch's relay equipment and the corresponding branch's organization information; The service platform is bound to the relay device based on the data network identifier, so that the relay device has the corresponding data network identifier.

8. A software-defined network access device, characterized in that: Applied to a network access system, the network access system includes a service platform and multiple branches, each branch includes multiple terminal devices, and the device includes: A push module, used for the terminal device to generate a corresponding out-group access process based on the user's out-group access request, and push the out-group access process to the service platform; the out-group access request includes the data network identifier of the terminal device and the target branch; different branches have different data network identifiers; A response module, used for the service platform to respond to the out-of-group access process, determine the corresponding target virtual network group based on the target branch in the out-of-group access request, and generate a modification instruction; A modification module, used for the service platform to modify the data network identifier of the terminal device based on the modification instruction to obtain a modification result, so that the data network identifier of the terminal device belongs to the target virtual network group; The access module is used for the business platform to generate a target security policy based on the modification result, and output the target security policy to the target security gateway of the target virtual network group, so that the target security gateway allows the user to access the target branch office through the terminal device.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of a software-defined network access method as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a software-defined network access method as described in any one of claims 1 to 7 are executed.

Images