VPDN-based enterprise intranet security access method, apparatus and device, and medium

Abstract

The invention discloses a VPDN-based enterprise intranet security access method, apparatus and device, and a medium. The method comprises the steps of performing user identity authentication through fingerprint authentication Dongle; establishing a 5G session between the user terminal and a 5G core network through the fingerprint authentication Dongle, and establishing an L2TP tunnel session between the 5G core network and an enterprise LNS; requesting a private network IP address of a target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle; the private network IP address is used as an inner-layer IP address, an L2TP tunnel is used as an outer-layer IP tunnel layer, an enterprise intranet access request is sent to an enterprise LNS through a 5G core network, and tunnel encryption transmission is carried out on the enterprise intranet access request through an IPSec protocol; and forwarding the enterprise intranet access request to a corresponding target enterprise intranet through the enterprise LNS. The method improves the safety and convenience of remote access to the enterprise intranet, and can be widely applied to the technical field of networks.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method, device, equipment and medium for securely accessing an enterprise intranet based on VPDN. Background Art

[0002] When users are away from home, how to remotely access the corporate intranet securely to process internal work and obtain resources is an urgent problem to be solved. In the current solution, a dedicated APP needs to be installed on the user's computer, and the user logs in to the corporate intranet website through the APP to access network resources. However, this method has the following disadvantages. On the one hand, it relies on username and password login. Once the username and password are leaked, the corporate intranet becomes unsafe; on the other hand, it relies on network resources. Remote login access to the corporate network can only be achieved when the device being logged in has network access.

[0003] Terminology explanation:

[0004] L2TP (Layer Two Tunneling Protocol): Layer 2 Tunneling Protocol.

[0005] VPDN (Virtual Private Dial Network): Virtual Private Dial Network.

[0006] IPSec (Internet Protocol Security): Internet security protocol. Summary of the invention

[0007] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0008] Therefore, an object of an embodiment of the present invention is to provide a method for securely accessing an enterprise intranet based on VPDN, which improves the security and convenience of remotely accessing an enterprise intranet.

[0009] Another object of an embodiment of the present invention is to provide a VPDN-based enterprise intranet security access device.

[0010] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0011] On the one hand, an embodiment of the present invention provides a method for securely accessing an enterprise intranet based on a VPDN, comprising the following steps:

[0012] User identity authentication through pre-activated fingerprint authentication Dongle;

[0013] When the user identity authentication is passed, a 5G session is established between the user terminal and the 5G core network through the fingerprint authentication Dongle, and an L2TP tunnel session is established between the 5G core network and the enterprise LNS;

[0014] Request the private IP address of the target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle;

[0015] Using the private network IP address as the inner IP address and the L2TP tunnel as the outer IP tunnel layer, sending an enterprise intranet access request to the enterprise LNS through the 5G core network, and tunnel encrypting and transmitting the enterprise intranet access request through the IPSec protocol;

[0016] The enterprise intranet access request is forwarded to the corresponding target enterprise intranet through the enterprise LNS.

[0017] Further, in one embodiment of the present invention, the fingerprint authentication Dongle is activated by the following steps:

[0018] Bind the user's mobile phone number to the SN number of the fingerprint authentication Dongle, and send the binding information to the security management platform;

[0019] Generate a temporary activation link through the security management platform, and send the temporary activation link to the user terminal;

[0020] The temporary activation link is opened through the user terminal, and the user mobile phone number input by the user is obtained, so that the security management platform verifies the validity according to the time limit of the temporary activation link and the user mobile phone number input by the user, and generates a verification code after the verification is passed and sends it to the user terminal;

[0021] The verification code is displayed through the user terminal, and the verification code input by the user is obtained, so that the security management platform verifies the verification code input by the user, and sends a fingerprint entry reminder to the user terminal after the verification passes;

[0022] The fingerprint information entered by the user is obtained through the user terminal, and the fingerprint information is sent to the security management platform, so that the security management platform binds the fingerprint information, the user's mobile phone number, the SN number and the user key.

[0023] Further, in one embodiment of the present invention, the 5G session between the user terminal and the 5G core network is established through the fingerprint authentication Dongle, and the L2TP tunnel session between the 5G core network and the enterprise LNS is established, which specifically includes:

[0024] Initiate a session establishment request to the 5G core network through the fingerprint authentication Dongle;

[0025] The user's contracted slices and DNN are sent to the core network AMF through the core network UDM, and then sent to the core network SMF through the core network AMF;

[0026] The core network SMF requests the user's contracted domain name, LNS address, and corresponding VPDN account and password from the AAA authentication server based on the DNN, and sends the user's contracted DNN, domain name, LNS address, and corresponding VPDN account and password to the core network UPF;

[0027] The core network UPF completes the APN access of the user terminal according to the DNN and domain name signed by the user, and establishes a 5G session between the user terminal and the 5G core network;

[0028] The core network UPF initiates an L2TP tunnel establishment request to the corresponding enterprise LNS according to the LNS address signed by the user, and sends the VPDN account and password to the enterprise LNS through the L2TP tunnel, so that the enterprise LNS initiates secondary AAA authentication to the security management platform according to the VPDN account and password;

[0029] When the secondary AAA authentication passes, an L2TP tunnel session between the 5G core network and the enterprise LNS is established.

[0030] Further, in one embodiment of the present invention, the requesting the private IP address of the target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle specifically includes:

[0031] Return the secondary AAA authentication pass message to the fingerprint authentication Dongle through the core network UPF;

[0032] Through the fingerprint authentication Dongle, the private network IP address is requested from the enterprise LNS based on the 5G session and the L2TP tunnel session, and the private network IP address issued by the enterprise LNS is accepted.

[0033] Further, in one embodiment of the present invention, the private network IP address is used as the inner IP address, the L2TP tunnel is used as the outer IP tunnel layer, an enterprise intranet access request is sent to the enterprise LNS through the 5G core network, and the enterprise intranet access request is tunnel encrypted and transmitted through the IPSec protocol, which specifically includes:

[0034] Generate private network request data according to the private network IP address through the fingerprint authentication Dongle, and send the private network request data to the core network UPF through the 5G session;

[0035] The core network UPF encapsulates the private network request data in the outer L2TP tunnel to generate the enterprise intranet access request, and encrypts the enterprise intranet access request through the IPSec protocol to obtain encrypted request data, and then sends the encrypted request data to the enterprise LNS through the L2TP tunnel session.

[0036] Further, in an embodiment of the present invention, forwarding the enterprise intranet access request to the corresponding target enterprise intranet through the enterprise LNS specifically includes:

[0037] Decrypting the encrypted request data through the enterprise LNS to obtain the enterprise intranet access request, and removing the outer L2TP tunnel of the enterprise intranet access request to obtain the private network request data;

[0038] The private network request data is parsed to obtain the private network IP address, and the target enterprise intranet is determined according to the private network IP address, and then the private network request data is encapsulated in an Ethernet header and forwarded to the target enterprise intranet.

[0039] Furthermore, the enterprise intranet secure access method further comprises the following steps:

[0040] All data traffic of the user terminal is redirected to the fingerprint authentication Dongle, so that the user terminal no longer accesses the network through other network cards.

[0041] On the other hand, an embodiment of the present invention provides a VPDN-based enterprise intranet security access device, comprising:

[0042] Identity authentication module, used to authenticate users through pre-activated fingerprint authentication dongle;

[0043] A session establishment module is used to establish a 5G session between the user terminal and the 5G core network through the fingerprint authentication Dongle when the user identity authentication is passed, and to establish an L2TP tunnel session between the 5G core network and the enterprise LNS;

[0044] A private network IP request module, used to request the private network IP address of the target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle;

[0045] An access request module is used to use the private network IP address as an inner IP address and the L2TP tunnel as an outer IP tunnel layer, send an enterprise intranet access request to the enterprise LNS through the 5G core network, and perform tunnel encryption transmission on the enterprise intranet access request through the IPSec protocol;

[0046] The request forwarding module is used to forward the enterprise intranet access request to the corresponding target enterprise intranet through the enterprise LNS.

[0047] On the other hand, an embodiment of the present invention provides an electronic device, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the enterprise intranet security access method based on VPDN as described above is realized.

[0048] On the other hand, an embodiment of the present invention further provides a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the VPDN-based enterprise intranet security access method as described above.

[0049] The advantages and beneficial effects of the present invention will be partly given in the following description, partly become apparent from the following description, or be understood through the practice of the present invention:

[0050] The embodiment of the present invention performs user identity authentication through a pre-activated fingerprint authentication Dongle. When the user identity authentication is passed, a 5G session is established between the user terminal and the 5G core network through the fingerprint authentication Dongle, and an L2TP tunnel session is established between the 5G core network and the enterprise LNS. The private network IP address of the target enterprise intranet is requested from the enterprise LNS through the fingerprint authentication Dongle, and the private network IP address is used as the inner IP address, and the L2TP tunnel is used as the outer IP tunnel layer. An enterprise intranet access request is sent to the enterprise LNS through the 5G core network, and the enterprise intranet access request is tunneled and encrypted for transmission through the IPSec protocol, and the enterprise intranet access request is forwarded to the corresponding target enterprise intranet through the enterprise LNS. In the embodiment of the present invention, the user terminal accesses the fingerprint authentication Dongle, and adopts the APN access of the 5G core network to establish a 5G session between the user terminal and the 5G core network, so as to ensure the network transmission security on the core network side, adopt the L2TP tunnel for transmission on the network side, and ensure the security of the L2TP tunnel transmission through the IPSec protocol, and realize the remote access to the enterprise intranet through the wireless transmission of the core network and the wired tunnel transmission on the network side, thereby improving the security and convenience of remote access to the enterprise intranet. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0052] Figure 1 A flow chart of the steps of a method for securely accessing an enterprise intranet based on VPDN provided by an embodiment of the present invention;

[0053] Figure 2 A schematic diagram of the network architecture of a VPDN-based enterprise intranet security access method provided in an embodiment of the present invention;

[0054] Figure 3 A flowchart of the steps for activating a fingerprint authentication dongle provided in an embodiment of the present invention;

[0055] Figure 4 A step flow chart of step S102 provided in an embodiment of the present invention;

[0056] Figure 5 A step flow chart of step S103 provided in an embodiment of the present invention;

[0057] Figure 6 A step flow chart of step S104 provided in an embodiment of the present invention;

[0058] Figure 7 A schematic diagram of the L2TP data format provided by an embodiment of the present invention;

[0059] Figure 8 A schematic diagram of the IPSec protocol encapsulation format provided by an embodiment of the present invention;

[0060] Fig. 9 A schematic diagram of step S105 provided in an embodiment of the present invention;

[0061] Fig.10 Another step flow chart of the method for securely accessing an enterprise intranet based on VPDN provided by an embodiment of the present invention;

[0062] Fig.11 A schematic diagram of the structure of a VPDN-based enterprise intranet security access device provided in an embodiment of the present invention;

[0063] Fig.12 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention;

[0064] Fig.13A schematic diagram of the structure of a storage medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0065] Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limitations on the present application. It should be noted that, although the functional module division is performed in the system schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described may be performed in a different order from the module division in the system schematic diagram or the flow chart. For the step numbers in the following embodiments, they are only set for the convenience of explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0066] In the description of the present invention, the meaning of "a plurality" is two or more. If there is a description of the first or the second, it is only for the purpose of distinguishing the technical features, and it cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those commonly understood by technicians in the technical field of this application. The terms used in this document are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0067] The enterprise intranet security access method based on VPDN provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a set-top box, etc.; the server side can be configured as an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the enterprise intranet security access method based on VPDN, etc., but is not limited to the above forms.

[0068] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0069] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0070] The present invention proposes a plug-and-play enterprise intranet security access method based on VPDN, a Dongle device based on fingerprint verification, adopts the APN access of the 5G core network to ensure the network transmission security on the core network side, and adopts the L2TP tunnel for transmission on the network side. Through the IPSec transmission mode ESP type encryption, the security of the tunnel transmission is guaranteed, and NAT traversal can be performed. Through the wireless transmission of the core network and the wired tunnel transmission on the network side, the purpose of remote and secure access of enterprise users to the enterprise intranet is achieved.

[0071] The present invention provides customers with 5G L2TP VPDN services, and can provide end-to-end encrypted channel services between servers and devices. The main application scenarios are electricity meter reading, banking business processing, administrative law enforcement, video surveillance, bus card machines, driving school invigilation vehicles, shopping mall POS machines, water quality monitoring, express cabinets and other scenarios. The advantages of the 5G L2TP VPDN service of the present invention are: support for plug-and-play security Dongle; support for Dongle combined with fingerprint and secret key authentication; terminal supports obtaining static IP address; supports plug-and-play; each user maintains a session and can continuously transmit data; ensures the encryption security of data transmission.

[0072] like Figure 1 FIG. 1 is a flow chart showing a method for securely accessing an enterprise intranet based on a VPDN according to an embodiment of the present invention. Figure 1 The embodiment of the present invention provides a method for securely accessing an enterprise intranet based on a VPDN, which specifically includes the following steps:

[0073] S101, user identity authentication is performed through a pre-activated fingerprint authentication Dongle;

[0074] S102. When the user identity authentication is passed, a 5G session is established between the user terminal and the 5G core network through the fingerprint authentication Dongle, and an L2TP tunnel session is established between the 5G core network and the enterprise LNS;

[0075] S103, requesting the private IP address of the target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle;

[0076] S104, using the private network IP address as the inner IP address and the L2TP tunnel as the outer IP tunnel layer, sending an enterprise intranet access request to the enterprise LNS through the 5G core network, and tunnel encrypting the enterprise intranet access request through the IPSec protocol;

[0077] S105. Forward the enterprise intranet access request to the corresponding target enterprise intranet through the enterprise LNS.

[0078] like Figure 2 The figure shows a schematic diagram of the networking architecture of the enterprise intranet security access method based on VPDN provided by an embodiment of the present invention, and the related processes are described as follows:

[0079] 1) The administrator configures a fingerprint authentication dongle on the terminal. The fingerprint is uniquely bound to the user's secret key, user mobile number, and device SN number. The user can access the enterprise intranet through fingerprint authentication, eliminating the tedious process of entering a username and password.

[0080] 2) After Dongle is activated, UDM sends the signed default VPDNDNN to SMF during the session establishment process. SMF requests the user's signed domain name and LNS address from AAA based on DNN during the session establishment phase. AAA sends the domain name, LNS address, VPDN account and password to SMF, and SMF sends the domain name, LNS address, VPDN account and password to UPF. In the 5G core network, UPF establishes an L2TP tunnel session with the enterprise LNS based on the authenticated LNS address sent by SMF, and initiates a secondary AAA authentication process in the session interaction process.

[0081] 3) Deploy the telecom LNS device at the internal entrance of the enterprise network. The device receives the tunnel connection request from the UPF and completes the user's two AAA authentications on the security device platform. After the authentication is passed, the LNS sends the private network address to the user's Dongle. Based on the L2TP tunnel, the IPSec transport mode ESP tunnel can be deployed to complete the transmission of L2TP Over IPSec and ensure the security of data transmission. The CN2 line passes over the L2TP tunnel, which is the bearer network L3VPN dedicated line.

[0082] 4) Based on the enterprise private network IP as the inner IP, the user uses the L2TP tunnel as the outer IP address to complete the three-layer access to the enterprise intranet. At the same time, the tunnel encryption transmission of data is completed through IPSec. After the tunnel is stripped on the LNS side, the intranet IP is used to complete the access to the internal resources of the enterprise.

[0083] 5) For some users who need network security restrictions, they can use a personal PC to install a dedicated driver to ensure that traffic can only be transmitted through the Dongle network card, ensuring the security of the enterprise network terminal PC.

[0084] In the embodiment of the present invention, the user terminal accesses the fingerprint authentication Dongle, and adopts the APN access of the 5G core network to establish a 5G session between the user terminal and the 5G core network, so as to ensure the network transmission security on the core network side, adopt the L2TP tunnel for transmission on the network side, and ensure the security of the L2TP tunnel transmission through the IPSec protocol, and realize the remote access to the enterprise intranet through the wireless transmission of the core network and the wired tunnel transmission on the network side, thereby improving the security and convenience of remote access to the enterprise intranet.

[0085] like Figure 3 FIG. 1 is a flowchart of a step of activating a fingerprint authentication Dongle according to an embodiment of the present invention. Figure 3 As an optional implementation, the fingerprint authentication Dongle is activated by the following steps:

[0086] S201, bind the user's mobile phone number with the SN number of the fingerprint authentication Dongle, and send the binding information to the security management platform;

[0087] S202: Generate a temporary activation link through the security management platform, and send the temporary activation link to the user terminal;

[0088] S203, opening the temporary activation link through the user terminal and obtaining the user mobile phone number input by the user, so that the security management platform verifies the validity according to the time limit of the temporary activation link and the user mobile phone number input by the user, and generates a verification code after the verification is passed and sends it to the user terminal;

[0089] S204, displaying the verification code through the user terminal and obtaining the verification code input by the user, so that the security management platform verifies the verification code input by the user, and sends a fingerprint entry reminder to the user terminal after the verification passes;

[0090] S205. Obtain the fingerprint information entered by the user through the user terminal, and send the fingerprint information to the security management platform, so that the security management platform binds the fingerprint information, the user's mobile phone number, SN number and the user key.

[0091] Specifically, the Dongle activation process needs to ensure the security of Dongle access, and the activation authentication process is used to achieve the unique binding of person-dongle-mobile phone number-card-fingerprint. After the activation process, the fingerprint can be verified and the network connection can be made plug-and-play. The entire activation process is as follows:

[0092] 1) The administrator binds the user's mobile phone number and Dongle's SN number on the intranet and sends the binding information to the security management platform.

[0093] 2) After the security management platform receives the Dongle binding, the platform generates a temporary activation link with a limited period and sends it to the user's mobile phone via SMS.

[0094] 3) The user opens the link on the intranet and enters the mobile phone number for verification; the security platform verifies the timeliness of the link. For valid links, after verifying the validity of the mobile phone number, it sends a text message verification code to the user's mobile phone; after the user enters the verification code, the platform verifies the verification code again. If the verification is passed, the next step will be taken.

[0095] 4) The user inserts the Dongle on the PC. After the verification code is verified, the platform notifies the Dongle via SMS, lights up (green light stays on) to indicate the fingerprint entry process, and at the same time jumps to the Dongle fingerprint entry reminder on the user link web interface;

[0096] 5) The user starts to enter the fingerprint. After the entry is completed, the Dongle notifies the platform of the completion of the entry through a text message and reminds the user of the entry result by changing the light. The security platform refreshes the web link interface to remind the user of the entry result.

[0097] The above five steps complete the activation of the Dongle, and the activated Dongle has the ability to connect to the network.

[0098] The Dongle login and logout process is as follows:

[0099] 1) The terminal is plugged into the dongle and powered on, and the platform is requested to obtain the device status. If the device is not activated, the activation authentication process is entered. If the device is activated, the dongle fingerprint recognition module is started.

[0100] 2) After successful fingerprint recognition, customers can flexibly select further authentication methods (account password or mobile phone verification code), and the tunnel will be established after authentication;

[0101] 3) When the dongle is unplugged or the internal and external network switches are switched actively, the platform notifies the authentication service to disconnect the tunnel and initialize the APP display.

[0102] like Figure 4 FIG. 1 is a flow chart of step S102 provided in an embodiment of the present invention, referring to FIG. Figure 4 As an optional implementation, a 5G session between the user terminal and the 5G core network is established through a fingerprint authentication Dongle, and an L2TP tunnel session between the 5G core network and the enterprise LNS is established, which specifically includes:

[0103] S1021. Initiate a session establishment request to the 5G core network through the fingerprint authentication Dongle;

[0104] S1022. Send the user's contracted slice and DNN to the core network AMF through the core network UDM, and then send them to the core network SMF through the core network AMF;

[0105] S1023, request the user's contracted domain name, LNS address, and corresponding VPDN account and password from the AAA authentication server based on the DNN through the core network SMF, and send the user's contracted DNN, domain name, LNS address, and corresponding VPDN account and password to the core network UPF;

[0106] S1024. Complete the APN access of the user terminal according to the DNN and domain name signed by the user through the core network UPF, and establish a 5G session between the user terminal and the 5G core network;

[0107] S1025. Initiate an L2TP tunnel establishment request to the corresponding enterprise LNS through the core network UPF according to the LNS address signed by the user, and send the VPDN account and password to the enterprise LNS through the L2TP tunnel, so that the enterprise LNS initiates secondary AAA authentication to the security management platform according to the VPDN account and password;

[0108] S1026. When the secondary AAA authentication passes, an L2TP tunnel session is established between the 5G core network and the enterprise LNS.

[0109] Specifically, after the Dongle passes the fingerprint authentication, it opens the SIM card network wireless interface, initiates a session connection, and enters the 5G core network to start processing. The 5G core network mainly completes the user's APN access. According to the key features of the APN access, it completes one AAA authentication and the issuance of key features. The main process is as follows:

[0110] 1) The security platform notifies the AAA server once of the validity of the DNN accessed by the APN.

[0111] 2) After Dongle fingerprint verification, UE initiates session establishment request without carrying username and password information. This access information triggers the selection of directional SMF and directional UPF.

[0112] 3) UDM sends the contracted slice and DNN to AMF during the session establishment process. AMF selects SMF based on the user session information and sends the relevant data rules to SMF. SMF requests the user's contracted domain name and LNS address from AAA based on DNN during the session establishment phase; AAA sends the domain name, LNS address, VPDN account and password to SMF. SMF selects the corresponding UPF based on the APN location and other information and sends DNN, domain name, LNS address, VPDN account and password to UPF.

[0113] 4) UPF initiates the establishment of L2TP tunnel according to the LNS address issued. The two parties complete the tunnel legitimacy verification and tunnel establishment through the interaction of three messages: SCCRQ, SCCRP, and SCCCN.

[0114] 5) After the tunnel is successfully established, UPF starts to establish the L2TP tunnel session. UPF sends key information such as username and password to the LNS device through the session message, initiates secondary AAA, and starts waiting for the AAA authentication result.

[0115] 6) After receiving the two AAA authentication success messages from LNS, UPF sends them to Dongle, triggering Dongle to interact with LNS to apply for a private IP address.

[0116] like Figure 5FIG. 1 is a flow chart of step S103 provided in an embodiment of the present invention, referring to FIG. Figure 5 As an optional implementation, the private IP address of the target enterprise intranet is requested from the enterprise LNS through the fingerprint authentication Dongle, which specifically includes:

[0117] S1031. Return the secondary AAA authentication pass message to the fingerprint authentication Dongle through the core network UPF;

[0118] S1032. Request a private IP address from the enterprise LNS based on the 5G session and L2TP tunnel session through the fingerprint authentication Dongle, and accept the private IP address issued by the enterprise LNS.

[0119] Specifically, LNS is the endpoint of the L2TP tunnel and is responsible for the stripping of the outer tunnel of the sent and received packets, the secondary AAA authentication of the user, and the communication with the security management platform. LNS communicates with UPF through the L3VPN dedicated line of the telecommunications bearer network. The main tasks of LNS are as follows:

[0120] 1) LNS receives the tunnel establishment and session establishment requests from UPF, and initiates authentication to the AAA server based on the secret key in the user session message.

[0121] 2) After receiving the authentication success message from AAA, LNS indicates that the authentication is successful, that is, an L2TP session with UPF is established, and UPF is notified of the successful establishment message.

[0122] 3) Exchange IPCP messages with end users through the established L2TP tunnel to provide users with private IP addresses.

[0123] like Figure 6 FIG. 1 is a flowchart of step S104 provided in an embodiment of the present invention, referring to FIG. Figure 6 As an optional implementation, the private network IP address is used as the inner IP address, the L2TP tunnel is used as the outer IP tunnel layer, the enterprise intranet access request is sent to the enterprise LNS through the 5G core network, and the enterprise intranet access request is tunnel encrypted and transmitted through the IPSec protocol, which specifically includes:

[0124] S1041. Generate private network request data according to the private network IP address through the fingerprint authentication Dongle, and send the private network request data to the core network UPF through the 5G session;

[0125] S1042. Encapsulate the private network request data in the outer L2TP tunnel through the core network UPF, generate an enterprise intranet access request, and encrypt the enterprise intranet access request through the IPSec protocol to obtain encrypted request data, and then send the encrypted request data to the enterprise LNS through the L2TP tunnel session.

[0126] Specifically, the entire transmission process of the present invention adopts the form of wireless side + wired side tunnel combination transmission. APN access is used on the wireless side to ensure the transmission directionality and security of data, and L2TP overIPSec is used on the tunnel side to ensure data transmission security. The specific transmission process is as follows:

[0127] 1) For data accessed by a directional APN, SMF selects the directional private network UPF to carry the data transmission. The entire network is carried under the public network + private network of the telecommunications wireless side to ensure data security.

[0128] 2) The messages forwarded from the private network UPF are transmitted in the form of L2TP tunnel to ensure the isolation of the public network and the private network. Figure 7 The figure shows a schematic diagram of the L2TP data format provided by an embodiment of the present invention, wherein the UPF encapsulates the private network data in the outer L2TP tunnel; the LNS device, as the termination point of L2TP, strips off the L2TP tunnel header and forwards the private network layer data to the enterprise intranet gateway.

[0129] 3) As in the second step above, the data is not encrypted. To ensure the security of data transmission, deploy L2TP over IPSec mode for network transmission. Figure 8 The figure shows a schematic diagram of the IPSec protocol encapsulation format provided by an embodiment of the present invention, in which the entire network data is encrypted as the data part of the ESP of IPSec, so that the entire L2TP tunnel and data are protected in the ESP Data encrypted data.

[0130] like Fig. 9 FIG. 1 is a flow chart of step S105 provided in an embodiment of the present invention, referring to FIG. Fig. 9 As an optional implementation, the enterprise intranet access request is forwarded to the corresponding target enterprise intranet through the enterprise LNS, which specifically includes:

[0131] S1051. Decrypt the encrypted request data through the enterprise LNS to obtain the enterprise intranet access request, and remove the outer L2TP tunnel of the enterprise intranet access request to obtain the private network request data;

[0132] S1052, parsing the private network request data to obtain the private network IP address, and determining the target enterprise intranet according to the private network IP address, and then encapsulating the private network request data with an Ethernet header and forwarding it to the target enterprise intranet.

[0133] Specifically, at the LNS receiving end, after the data is decrypted according to the decryption key, it is sent to the L2TP module to strip off the L2TP tunnel layer, and after searching for the route according to the intranet destination IP address, it is encapsulated in the Ethernet header and forwarded to the intranet network management.

[0134] like Fig.10 FIG. 1 is another flow chart of the steps of the method for securely accessing an enterprise intranet based on VPDN provided by an embodiment of the present invention, referring to FIG. Fig.10 As an optional implementation, the enterprise intranet security access method further includes the following steps:

[0135] S106: redirect all data traffic of the user terminal to the fingerprint authentication Dongle, so that the user terminal no longer accesses the network through other network cards.

[0136] Specifically, the above process ensures that users can access the enterprise intranet securely after inserting the Dongle, but some enterprise users need an exclusive network, that is, after inserting the Dongle on the user's personal PC, they can no longer access the network through other network cards. In this case, a dedicated driver software needs to be installed on the personal PC, which completes the work of redirecting all user data traffic to the Dongle network card.

[0137] The above is a description of the method steps of the embodiment of the present invention. It can be recognized that in the embodiment of the present invention, when the user terminal accesses the fingerprint authentication Dongle, the APN access of the 5G core network is used to establish a 5G session between the user terminal and the 5G core network, to ensure the network transmission security on the core network side, and the L2TP tunnel is used for transmission on the network side. The security of the L2TP tunnel transmission is guaranteed by the IPSec protocol, and remote access to the enterprise intranet is realized through wireless transmission of the core network and wired tunnel transmission on the network side, thereby improving the security and convenience of remote access to the enterprise intranet.

[0138] like Fig.11 FIG. 1 is a schematic diagram of the structure of a VPDN-based enterprise intranet security access device provided by an embodiment of the present invention, referring to FIG. Fig.11 The embodiment of the present invention provides a VPDN-based enterprise intranet security access device, including:

[0139] Identity authentication module, used to authenticate users through pre-activated fingerprint authentication dongle;

[0140] The session establishment module is used to establish a 5G session between the user terminal and the 5G core network through the fingerprint authentication Dongle when the user identity authentication is passed, and to establish an L2TP tunnel session between the 5G core network and the enterprise LNS;

[0141] The private IP request module is used to request the private IP address of the target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle;

[0142] The access request module is used to use the private network IP address as the inner IP address and the L2TP tunnel as the outer IP tunnel layer, send the enterprise intranet access request to the enterprise LNS through the 5G core network, and perform tunnel encryption transmission on the enterprise intranet access request through the IPSec protocol;

[0143] The request forwarding module is used to forward the enterprise intranet access request to the corresponding target enterprise intranet through the enterprise LNS.

[0144] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0145] The embodiment of the present invention also provides an electronic device, which includes: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and when the program is executed by the processor, the above-mentioned method for secure access to the enterprise intranet based on VPDN is realized. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0146] like Fig.12 FIG. 1 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Fig.12 , an embodiment of the present invention provides an electronic device, including:

[0147] The processor 1201 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention;

[0148] The memory 1202 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1202 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1202, and the processor 1201 calls and executes the enterprise intranet security access method based on VPDN in the embodiment of the present invention;

[0149] Input / output interface 1203, used to implement information input and output;

[0150] The communication interface 1204 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0151] A bus 1205 that transmits information between various components of the device (e.g., the processor 1201, the memory 1202, the input / output interface 1203, and the communication interface 1204);

[0152] The processor 1201 , the memory 1202 , the input / output interface 1203 and the communication interface 1204 are connected to each other in communication within the device via the bus 1205 .

[0153] like Fig.13 FIG. 1 is a schematic diagram of a storage medium according to an embodiment of the present invention. Fig.13 The embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs 1301, and the one or more programs 1301 can be executed by one or more processors to implement the above-mentioned VPDN-based enterprise intranet security access method.

[0154] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0155] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0156] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0157] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0158] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0159] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0160] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0161] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0162] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0163] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0164] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for secure access to an enterprise intranet based on VPDN, characterized in that: The following steps are involved: User identity authentication through pre-activated fingerprint authentication Dongle; When the user identity authentication is passed, a 5G session is established between the user terminal and the 5G core network through the fingerprint authentication Dongle, and an L2TP tunnel session is established between the 5G core network and the enterprise LNS; Request the private IP address of the target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle; Using the private network IP address as the inner IP address and the L2TP tunnel as the outer IP tunnel layer, sending an enterprise intranet access request to the enterprise LNS through the 5G core network, and tunnel encrypting and transmitting the enterprise intranet access request through the IPSec protocol; The enterprise intranet access request is forwarded to the corresponding target enterprise intranet through the enterprise LNS.

2. According to claim 1, a method for secure access to an enterprise intranet based on VPDN is characterized in that: The fingerprint authentication Dongle is activated by the following steps: Bind the user's mobile phone number to the SN number of the fingerprint authentication Dongle, and send the binding information to the security management platform; Generate a temporary activation link through the security management platform, and send the temporary activation link to the user terminal; The temporary activation link is opened through the user terminal, and the user mobile phone number input by the user is obtained, so that the security management platform verifies the validity according to the time limit of the temporary activation link and the user mobile phone number input by the user, and generates a verification code after the verification is passed and sends it to the user terminal; The verification code is displayed through the user terminal, and the verification code input by the user is obtained, so that the security management platform verifies the verification code input by the user, and sends a fingerprint entry reminder to the user terminal after the verification passes; The fingerprint information entered by the user is obtained through the user terminal, and the fingerprint information is sent to the security management platform, so that the security management platform binds the fingerprint information, the user's mobile phone number, the SN number and the user key.

3. The method for securely accessing an enterprise intranet based on VPDN according to claim 1, characterized in that: The 5G session between the user terminal and the 5G core network is established through the fingerprint authentication Dongle, and the L2TP tunnel session between the 5G core network and the enterprise LNS is established, which specifically includes: Initiate a session establishment request to the 5G core network through the fingerprint authentication Dongle; The user's contracted slices and DNN are sent to the core network AMF through the core network UDM, and then sent to the core network SMF through the core network AMF; The core network SMF requests the user's contracted domain name, LNS address, and corresponding VPDN account and password from the AAA authentication server based on the DNN, and sends the user's contracted DNN, domain name, LNS address, and corresponding VPDN account and password to the core network UPF; The core network UPF completes the APN access of the user terminal according to the DNN and domain name signed by the user, and establishes a 5G session between the user terminal and the 5G core network; The core network UPF initiates an L2TP tunnel establishment request to the corresponding enterprise LNS according to the LNS address signed by the user, and sends the VPDN account and password to the enterprise LNS through the L2TP tunnel, so that the enterprise LNS initiates secondary AAA authentication to the security management platform according to the VPDN account and password; When the secondary AAA authentication passes, an L2TP tunnel session between the 5G core network and the enterprise LNS is established.

4. The method for securely accessing an enterprise intranet based on VPDN according to claim 3, characterized in that: The step of requesting the private IP address of the target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle specifically includes: Return the secondary AAA authentication pass message to the fingerprint authentication Dongle through the core network UPF; Through the fingerprint authentication Dongle, the private network IP address is requested from the enterprise LNS based on the 5G session and the L2TP tunnel session, and the private network IP address issued by the enterprise LNS is accepted.

5. The method for securely accessing an enterprise intranet based on VPDN according to claim 1, characterized in that: The method uses the private network IP address as the inner IP address, uses the L2TP tunnel as the outer IP tunnel layer, sends an enterprise intranet access request to the enterprise LNS through the 5G core network, and performs tunnel encryption transmission on the enterprise intranet access request through the IPSec protocol, which specifically includes: Generate private network request data according to the private network IP address through the fingerprint authentication Dongle, and send the private network request data to the core network UPF through the 5G session; The core network UPF encapsulates the private network request data in the outer L2TP tunnel to generate the enterprise intranet access request, and encrypts the enterprise intranet access request through the IPSec protocol to obtain encrypted request data, and then sends the encrypted request data to the enterprise LNS through the L2TP tunnel session.

6. The method for securely accessing an enterprise intranet based on VPDN according to claim 5, characterized in that: The step of forwarding the enterprise intranet access request to the corresponding target enterprise intranet through the enterprise LNS specifically includes: Decrypting the encrypted request data through the enterprise LNS to obtain the enterprise intranet access request, and removing the outer L2TP tunnel of the enterprise intranet access request to obtain the private network request data; The private network request data is parsed to obtain the private network IP address, and the target enterprise intranet is determined according to the private network IP address, and then the private network request data is encapsulated in an Ethernet header and forwarded to the target enterprise intranet.

7. A method for securely accessing an enterprise intranet based on VPDN according to any one of claims 1 to 6, characterized in that: The enterprise intranet secure access method further comprises the following steps: All data traffic of the user terminal is redirected to the fingerprint authentication Dongle, so that the user terminal no longer accesses the network through other network cards.

8. A VPDN-based enterprise intranet security access device, characterized in that: include: Identity authentication module, used to authenticate users through pre-activated fingerprint authentication dongle; A session establishment module is used to establish a 5G session between the user terminal and the 5G core network through the fingerprint authentication Dongle when the user identity authentication is passed, and to establish an L2TP tunnel session between the 5G core network and the enterprise LNS; A private network IP request module, used to request the private network IP address of the target enterprise intranet from the enterprise LNS through the fingerprint authentication Dongle; An access request module is used to use the private network IP address as an inner IP address and the L2TP tunnel as an outer IP tunnel layer, send an enterprise intranet access request to the enterprise LNS through the 5G core network, and perform tunnel encryption transmission on the enterprise intranet access request through the IPSec protocol; The request forwarding module is used to forward the enterprise intranet access request to the corresponding target enterprise intranet through the enterprise LNS.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the VPDN-based enterprise intranet security access method are realized as described in any one of claims 1 to 7.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the VPDN-based enterprise intranet security access method as described in any one of claims 1 to 7.

Images