Service distribution method based on core network shared UPF, AMF entity and UPF entity

Abstract

The invention discloses a service distribution method based on a core network shared UPF, an AMF entity and an UPF entity. When the method is applied to an AMF entity, the method comprises the following steps: firstly, obtaining a terminal service request; according to the service type of the terminal service request, a shared UPF entity is selected to carry out data forwarding so as to realize service distribution based on a core network shared UPF; wherein if the terminal service request is a local public network service or a local private network service, a local shared UPF entity is selected to carry out data traffic forwarding; if the terminal service request is a roaming type public network service or a roaming type private network service, selecting a roaming place sharing type UPF entity to forward data traffic; the data traffic is traffic carried by the terminal service request. According to the service offloading method, offloading can be achieved only through one shared UPF (one local shared UPF entity or one roaming shared UPF entity), and compared with an existing service offloading scheme, the service offloading efficiency can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of network communication technology, and in particular relates to a service diversion method based on a core network shared UPF, an AMF entity and a UPF entity. Background Art

[0002] In the core network, service offloading is crucial to improving network efficiency and service quality. The common offloading solution is traffic scheduling based on the User Plane Function (UPF).

[0003] Through intelligent traffic identification and control, UPF can accurately allocate data traffic to the appropriate network path according to different service types and user needs, optimize bandwidth utilization and reduce latency. Combining dedicated and universal data network names (DNN) with UPF's uplink control layer (ULCL) technology can achieve flexible and efficient traffic management and effectively distinguish between intranet services and public network services. Therefore, the combination of dedicated / universal DNN and UPF ULCL is becoming a key strategy for core network service diversion.

[0004] The specific implementation plan for the combination of dedicated / general DNN and UPF ULCL includes the following combinations: First, by diverting the intranet and public network services between the general DNN and ULCL, a network architecture is formed, which includes "general DNN (such as 3gnet) + PCF contract + designated TAI area + ULCL auxiliary anchor point + UPF main anchor point"; secondly, the combination of dedicated DNN and ULCL focuses on the campus to realize the diversion of intranet and public network services, and effectively solve the problem of IP address conflicts; finally, when in the city where the intranet is located, the general DNN and the dedicated DNN can work together to realize access diversion through 5G access, and when accessing 4G or roaming, users can manually switch to the dedicated DNN to access the intranet.

[0005] Although the service offloading solution based on DNN and UPF ULCL has many advantages, it also faces some challenges. On the one hand, when data packets need to be forwarded through multiple network nodes, network latency will increase significantly, especially when bandwidth is limited. The processing efficiency is directly related to the data transmission speed, which leads to a decrease in overall network performance. On the other hand, the utilization efficiency of network bandwidth is limited by the processing power of the router and the efficiency of UPF ULCL. If the router cannot handle large traffic efficiently, network congestion will frequently occur, affecting users' access to bandwidth and thus reducing the quality of service. Summary of the invention

[0006] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art and propose a service diversion method based on a core network shared UPF, an AMF entity and a UPF

[0007] This service diversion method only requires one shared UPF (a local shared UPF entity or a roaming shared UPF entity) to achieve diversion. Compared with the existing service diversion solutions, it can effectively improve the service diversion efficiency.

[0008] In the first aspect, the present invention provides a service offloading method based on core network shared UPF, which is applied to AMF (Access and Mobility Management

[0009] Function, access and mobility management function) entity, the method comprises the following steps:

[0010] Get terminal service request;

[0011] According to the service type of the terminal service request, select a shared UPF entity to forward data to achieve service diversion based on the core network shared UPF;

[0012] Among them, if the terminal service request is a local public network service or a local private network service, the local shared UPF entity is selected to forward the data traffic; if the terminal service request is a roaming public network service or a roaming private network service, the roaming shared UPF entity is selected to forward the data traffic; the data traffic is the traffic carried by the terminal service request.

[0013] Further, the selecting of the local shared UPF entity for data forwarding specifically includes the following steps:

[0014] According to the private network DNN and terminal IP address carried in the terminal service request, a local shared UPF entity is selected so that the local shared UPF entity forwards different data traffic to the IP address to be accessed in the terminal service request according to the user detailed routing table;

[0015] Among them, if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the local shared UPF entity sends the data traffic to the private network; if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the local shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

[0016] Further, the selecting of the roaming shared UPF entity for data forwarding specifically includes the following steps:

[0017] According to the private network DNN and terminal IP address carried in the terminal service request, select the roaming shared UPF entity so that the roaming shared UPF entity forwards different data traffic to the IP address to be accessed in the terminal service request according to the user detailed routing table;

[0018] Among them, if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the roaming shared UPF entity sends the data traffic to the private network; if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the roaming shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

[0019] In a second aspect, the present invention provides a service offloading method based on a core network shared UPF, the method being applied to a UPF entity, the method comprising the following steps:

[0020] Receive terminal service requests forwarded by the AMF entity;

[0021] Determine whether the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table:

[0022] If the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the data traffic is sent to the private network; if the IP address to be accessed in the terminal service request is not a private network segment in the detailed routing table, the data traffic is forwarded to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel, so as to realize service diversion based on the core network shared UPF;

[0023] The data traffic is the traffic carried by the terminal service request, and the detailed routing table is established for the user by the routing selection module.

[0024] In a third aspect, the present invention provides an AMF entity, the AMF entity comprising:

[0025] An acquisition unit, used for acquiring a terminal service request;

[0026] A selection unit, connected to the acquisition unit, configured to select a shared UPF entity for data forwarding according to the service type of the terminal service request, so as to realize service diversion based on the core network shared UPF;

[0027] Among them, if the terminal service request is a local public network service or a local private network service, the local shared UPF entity is selected to forward the data traffic; if the terminal service request is a roaming public network service or a roaming private network service, the roaming shared UPF entity is selected to forward the data traffic; the data traffic is the traffic carried by the terminal service request.

[0028] Further, the selection unit includes a first selection unit;

[0029] The first selection unit is connected to the acquisition unit and is used to select a local shared UPF entity according to the private network DNN and the terminal IP address carried in the terminal service request, so that the local shared UPF entity performs different data traffic forwarding for the IP address to be accessed in the terminal service request according to the user detailed routing table;

[0030] Among them, if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the local shared UPF entity sends the data traffic to the private network; if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the local shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

[0031] Further, the selection unit also includes a second selection unit;

[0032] The second selection unit is connected to the acquisition unit, and is used to select a roaming shared UPF entity according to the private network DNN and the terminal IP address carried in the terminal service request, so that the roaming shared UPF entity performs different data traffic forwarding for the IP address to be accessed in the terminal service request according to the user detailed routing table;

[0033] Among them, if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the roaming shared UPF entity sends the data traffic to the private network; if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the roaming shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

[0034] In a fourth aspect, the present invention provides a UPF entity, wherein the UPF entity comprises:

[0035] A receiving unit, used to receive a terminal service request forwarded by an AMF entity;

[0036] A determination unit, connected to the receiving unit, for determining whether the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table;

[0037] A first forwarding unit, connected to the determination unit, for sending data traffic to the private network when the determination unit determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table;

[0038] A second forwarding unit is connected to the determination unit, and is used for forwarding data traffic to the security policy module when the determination unit determines that the IP address to be accessed in the terminal service request is not a private network segment in the detailed routing table, so that the security policy module translates different IP addresses to be accessed into public network IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel, so as to realize service diversion based on the core network shared UPF;

[0039] The data traffic is the traffic carried by the terminal service request, and the detailed routing table is established for the user by the routing selection module.

[0040] In a fifth aspect, the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the service diversion method based on the core network shared UPF according to the first aspect, or executes the service diversion method based on the core network shared UPF according to the second aspect.

[0041] In a sixth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for service diversion based on a core network shared UPF as described in the first aspect is implemented, or the method for service diversion based on a core network shared UPF as described in the second aspect is implemented.

[0042] The present invention only requires one shared UPF (a local shared UPF entity or a roaming shared UPF entity) to achieve traffic diversion, which can improve the efficiency of traffic diversion compared with the existing traffic diversion solutions. The specific effective effects are as follows:

[0043] 1. Intelligent selection of UPF entity: The present invention can intelligently select the most appropriate shared UPF entity according to different service request types (such as local public network, private network services or roaming public network, private network services). After receiving the terminal service request, the present invention will analyze the requested service type and quickly determine the best UPF entity for data forwarding. This selection method based on service type optimizes resource allocation and ensures that data flows flow on the best path, thereby improving network response speed and service quality.

[0044] 2. Refined traffic management: The present invention realizes refined management of data traffic by analyzing the private network DNN and IP address in the terminal service request. The local shared UPF entity uses the user detailed routing table to determine the ownership of the IP address to be accessed. When the IP address to be accessed belongs to the private network segment, the traffic will be forwarded directly to the private network to ensure the security of the data flow; if the IP address is not in the private network segment, the traffic will be forwarded to the security policy module and transmitted to the public network through the GRE tunnel after passing through the virtual firewall. This design not only improves the flexibility of data processing, but also enhances the security of the network.

[0045] 3. Flexible handling of roaming services: When handling roaming services, the present invention can intelligently select the roaming shared UPF entity to forward data, thereby improving the user's access experience in different network environments. The roaming shared UPF entity determines the IP address to be accessed based on the user's detailed routing table. If the IP address belongs to the private network segment, the data flow will be forwarded directly to the private network; if it does not, the traffic will be forwarded to the security policy module to ensure the security of public network access. This flexible strategy ensures that users can successfully access the required network resources during roaming and maintain business continuity and stability.

[0046] 4. Enhanced network security: The present invention introduces a security policy module and a virtual firewall, which effectively improves network security. For IP addresses to be accessed that are not in the private network segment, the data stream will be translated through the virtual firewall and then transmitted to the public network through the GRE tunnel. This method can effectively resist potential security threats and ensure the confidentiality and integrity of data communications.

[0047] 5. Optimize bandwidth usage and reduce latency: The present invention optimizes bandwidth usage efficiency and reduces latency through intelligent routing selection. The system can dynamically distribute traffic for different service types and requirements. In local and roaming scenarios, selecting the appropriate shared UPF for data forwarding can effectively shorten the data transmission path, reduce latency, and thus improve user experience.

[0048] 6. Support for diverse business needs: The present invention can flexibly adapt to a variety of business scenarios and support the different needs of local users and roaming users. Based on the business requests of different DNNs, the present invention can flexibly process intranet and public network traffic to meet diverse service needs. This provides network operators with richer service options and further enhances the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 The overall framework diagram of service offloading based on core network shared UPF in an embodiment of the present invention;

[0050] Figure 2 It is a flow chart of a service offloading method based on a core network shared UPF in an embodiment of the present invention;

[0051] Figure 3 This is a specific implementation flow chart of service offloading based on core network shared UPF in an embodiment of the present invention;

[0052] Figure 4 A schematic diagram of a network connection state in an embodiment of the present invention;

[0053] Figure 5 Schematic diagram of UPF comparison in an embodiment of the present invention;

[0054] Figure 6 Schematic diagram of a service offloading device based on a core network shared UPF in an embodiment of the present invention;

[0055] Among them, the figure numbers are: 10, acquisition unit, 20, selection unit. DETAILED DESCRIPTION

[0056] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0057] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0058] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0059] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0060] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0061] It can be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0062] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0063] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0064] Embodiment 1:

[0065] like Figure 1 and Figure 2As shown, this embodiment provides a service diversion method based on core network shared UPF, which is applied to AMF entity. The network access control module of the AMF entity is responsible for managing the access and mobility of user equipment, performing core functions such as user authentication, access authorization and session management to ensure the secure access and service continuity of the equipment in the 5G network, and closely cooperating with other network function modules (such as UDM and UPF) to achieve dynamic network slicing and service quality management. This module is a key component in the 5G network architecture, providing users with an efficient and reliable connection experience. This embodiment provides a service diversion method based on core network shared UPF (user plane function module), which can achieve efficient separation of private network and public network access through a single UPF. In specific operations, the system uses a detailed routing table to accurately determine the user's access target: when the route in the user access request is in the detailed routing table, the data will be directly forwarded to the private network; if the requested route is not in the routing table, the data will be forwarded to the security policy module for processing. In this process, the security policy module is responsible for translating the IP address of the private network and converting it into a public network IP to achieve subsequent public network access. In this way, using only one UPF significantly simplifies the network structure and improves the efficiency of data processing. In addition, this service diversion method is applicable to a variety of scenarios, especially in the internal network and mobile communication environment of the enterprise. In the remote office environment of the enterprise, employees can securely access private network resources by connecting to the private network DNN (data network name), no matter where they are, and at the same time achieve flexible public network access in combination with detailed routing tables. This design ensures the security and convenience of users under different network requirements and improves overall work efficiency. In mobile communication networks, this method provides operators with an efficient resource management solution, allowing users to quickly respond to diverse service needs, thereby enhancing user experience and satisfaction.

[0066] The method comprises the following steps:

[0067] Get terminal service request;

[0068] According to the service type of the terminal service request, select a shared UPF entity to forward data to achieve service diversion based on the core network shared UPF;

[0069] Among them, if the terminal service request is a local public network service or a local private network service, the local shared UPF entity is selected to forward the data traffic; if the terminal service request is a roaming public network service or a roaming private network service, the roaming shared UPF entity is selected to forward the data traffic; the data traffic is the traffic carried by the terminal service request.

[0070] As a specific implementation manner, the selecting of a local shared UPF entity for data forwarding specifically includes the following steps:

[0071] According to the private network DNN and terminal IP address carried in the terminal service request, a local shared UPF entity is selected so that the local shared UPF entity forwards different data traffic to the IP address to be accessed in the terminal service request according to the user detailed routing table;

[0072] Among them, if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the local shared UPF entity sends the data traffic to the private network; if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the local shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

[0073] As a specific implementation manner, the selecting of a roaming shared UPF entity for data forwarding specifically includes the following steps:

[0074] According to the private network DNN and terminal IP address carried in the terminal service request, select the roaming shared UPF entity so that the roaming shared UPF entity forwards different data traffic to the IP address to be accessed in the terminal service request according to the user detailed routing table;

[0075] Among them, if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the roaming shared UPF entity sends the data traffic to the private network; if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the roaming shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

[0076] Finally, a detailed example is given below:

[0077] Assume that at location A, the user needs to access both the public network and the private network, and because of frequent business trips to location B, the user's access scenarios can be divided into four situations: accessing the public network at location A, accessing the private network at location A, accessing the public network at location B, and accessing the private network at location B. When the user accesses at location A, the network access control module can directly and quickly forward its data to the shared UPF (user plane function module). When the user is at location B, the network access control module first forwards the user's data to the access class UPF at location B, and then the access class UPF further passes the data to the shared UPF, ensuring that whether it is local access or roaming access, the user's data can be efficiently and uniformly processed.

[0078] A detailed routing table is configured in the routing module, which contains clear private network address segments. When receiving user data, the routing module makes a judgment based on the user's access address IP. If the IP is in the detailed routing table, it means that the user wants to access the private network, and the data will be forwarded directly to the private network; if the IP is not in the detailed routing table, these addresses are assumed to be public network IPs, and the data will be forwarded to the security policy module (firewall) for further processing. This design ensures that user requests can be correctly identified and processed, while ensuring the security and smoothness of the network.

[0079] In order to avoid conflicts in the private network routing table configurations between different users, the security policy module needs to configure a unique virtual firewall for each user to achieve secure isolation and effective management of data. For example, the detailed routing table of user A is MA, and the corresponding virtual firewall is FWA; user B uses the detailed routing table MB and the virtual firewall FWB. When user A accesses an IP address that is not within the private network range, the virtual firewall FWA will translate it into a public network IP; similarly, the virtual firewall FWB will also process user B's public network access. In addition, the terminal device module is responsible for establishing a GRE tunnel to securely transmit the data processed and forwarded from the virtual firewall to the public network, thereby ensuring the security and stability of data flow.

[0080] like Figure 4 As shown, this embodiment implements the virtual firewall (VSYS) technology in the security policy module to achieve efficient isolation of different services. This technology allows multiple virtual firewall instances to be created on the same physical firewall, so that each instance can independently manage its specific traffic and security policies. On this basis, the virtual firewall translates the IP address of the user accessing the public network, thereby ensuring that the services of each user can maintain independence and security while smoothly accessing the public network. This design not only improves the utilization efficiency of network resources, but also enhances the security of the system, ensuring that there will be no interference or leakage between the data of each service.

[0081] like Figure 5 As shown, this embodiment adopts a shared UPF (user plane function module) and its configured detailed flow. The system uses a detailed routing table to accurately identify specific traffic accessing the private network and forward it to the private network. At the same time, all requests that do not belong to specific traffic will be forwarded to the public network through the security policy module. Compared with the traditional UCCL system, this design scheme no longer requires multiple UPFs to achieve traffic diversion, thereby significantly simplifying the network architecture and improving overall efficiency, so that different types of network traffic can be efficiently managed and diverted by relying on only one UPF.

[0082] The user plane function module (shared UPF) of this embodiment can achieve effective separation of private network and public network access through only one UPF. In addition, this embodiment only configures one private network DNN (data network name), which significantly improves the efficiency of business diversion.

[0083] This embodiment supports flexible access in a variety of network environments, and can achieve seamless connection between the intranet and the public network, whether the user is in a 4G or 5G network, or roaming across regions. This design eliminates the restrictions of region and network standards, and provides users with a more convenient network access experience.

[0084] In addition, this embodiment can ensure that the latency and bandwidth indicators on the network side are consistent with those on the public network, thereby significantly improving the user experience. On the network side, there is no need to add new equipment or make additional investments. The existing equipment can give full play to its redundant protection function to ensure that when a failure occurs within the private network, the public network access service can still run stably. This efficient solution not only reduces operating costs, but also enhances the security and reliability of the network, allowing users to obtain high-quality services under any circumstances.

[0085] Embodiment 2:

[0086] like Figure 1 As shown, this embodiment provides a service offloading method based on a core network shared UPF, the method is applied to a UPF entity, and the method includes the following steps:

[0087] Receive terminal service requests forwarded by the AMF entity;

[0088] Determine whether the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table:

[0089] If the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the data traffic is sent to the private network; if the IP address to be accessed in the terminal service request is not a private network segment in the detailed routing table, the data traffic is forwarded to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel, so as to realize service diversion based on the core network shared UPF;

[0090] The data traffic is the traffic carried by the terminal service request, and the detailed routing table is established for the user by the routing selection module.

[0091] The user plane function module of the UPF (User Plane Function) entity is responsible for efficiently managing the forwarding and processing of user data in the 5G network, ensuring smooth data connection between the user equipment (UE) and the external network, while supporting traffic management, session control and service quality assurance. UPF achieves real-time transmission, monitoring and optimization of user data through collaboration with core network functions such as AMF, and efficiently meets diverse network needs.

[0092] The method in this embodiment corresponds to the method in Example 1, and together completes service diversion based on core network shared UPF.

[0093] Embodiment 3:

[0094] like Figure 6 As shown, this embodiment provides an AMF entity, and the AMF entity includes:

[0095] The acquisition unit 10 is used to acquire a terminal service request;

[0096] The selection unit 20 is connected to the acquisition unit 10 and is used to select a shared UPF entity for data forwarding according to the service type of the terminal service request, so as to realize service diversion based on the core network shared UPF;

[0097] Among them, if the terminal service request is a local public network service or a local private network service, the local shared UPF entity is selected to forward the data traffic; if the terminal service request is a roaming public network service or a roaming private network service, the roaming shared UPF entity is selected to forward the data traffic; the data traffic is the traffic carried by the terminal service request.

[0098] As a specific implementation, the selection unit includes a first selection unit;

[0099] The first selection unit is connected to the acquisition unit and is used to select a local shared UPF entity according to the private network DNN and the terminal IP address carried in the terminal service request, so that the local shared UPF entity performs different data traffic forwarding for the IP address to be accessed in the terminal service request according to the user detailed routing table;

[0100] Among them, if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the local shared UPF entity sends the data traffic to the private network; if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the local shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

[0101] As a more specific implementation, the selection unit further includes a second selection unit;

[0102] The second selection unit is connected to the acquisition unit, and is used to select a roaming shared UPF entity according to the private network DNN and the terminal IP address carried in the terminal service request, so that the roaming shared UPF entity performs different data traffic forwarding for the IP address to be accessed in the terminal service request according to the user detailed routing table;

[0103] Among them, if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the roaming shared UPF entity sends the data traffic to the private network; if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the roaming shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

[0104] The AMF entity of this embodiment can execute the method in Example 1.

[0105] Embodiment 4:

[0106] This embodiment provides a UPF entity, and the UPF entity includes:

[0107] A receiving unit, used to receive a terminal service request forwarded by an AMF entity;

[0108] A determination unit, connected to the receiving unit, for determining whether the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table;

[0109] A first forwarding unit, connected to the determination unit, for sending data traffic to the private network when the determination unit determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table;

[0110] A second forwarding unit is connected to the determination unit, and is used for forwarding data traffic to the security policy module when the determination unit determines that the IP address to be accessed in the terminal service request is not a private network segment in the detailed routing table, so that the security policy module translates different IP addresses to be accessed into public network IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel, so as to realize service diversion based on the core network shared UPF;

[0111] The data traffic is the traffic carried by the terminal service request, and the detailed routing table is established for the user by the routing selection module.

[0112] The UPF entity of this embodiment can execute the method in Example 2.

[0113] Embodiment 5:

[0114] This embodiment provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the service diversion method based on the core network shared UPF according to Example 1, or executes the service diversion method based on the core network shared UPF according to Example 2.

[0115] Embodiment 6:

[0116] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the service diversion method based on the core network shared UPF as described in Example 1 is implemented, or the service diversion method based on the core network shared UPF as described in Example 2 is implemented.

[0117] Embodiment 7:

[0118] This embodiment provides a core network shared UPF private network service diversion system, which corresponds to the method in Example 1. The system includes: a network access control module, a user plane function module, a routing selection module, a security policy module and a terminal equipment module.

[0119] Network access control module: This module is responsible for identifying the user's access needs, configuring the private network DNN according to different service types, and selecting the appropriate UPF for data forwarding to ensure the correct distribution of traffic.

[0120] User plane function module: responsible for forwarding and routing of user data packets. Based on the configuration information from the network access control module, this module further implements the business diversion between the intranet and the public network according to the strategy of the routing selection module.

[0121] Routing selection module: This module is responsible for separating the intranet and public network traffic according to the set detailed routing strategy. It provides specific routing information of different data to the user plane function module to ensure that the intranet business traffic is directly delivered to the intranet through the dedicated line, and the public network business traffic is forwarded through the default route.

[0122] Security policy module: The security policy module is responsible for the security control of public network access in the system. By opening the virtual firewall (VSYS), the module can effectively manage the access rights of different business flows and ensure the secure separation of public network traffic.

[0123] Terminal equipment module: This module serves as the entrance to the public network and establishes a secure channel with the virtual firewall through the GRE tunnel to ensure smooth transmission of public network business traffic.

[0124] Specific as Figure 3 As shown, the specific process implemented in this embodiment is as follows:

[0125] S1: The user accesses the network, and the network access control module identifies the service type requested by the user. According to the service requirement type, the network access control module selects the appropriate UPF for data forwarding.

[0126] Specifically, the user only uses the private network DNN to access the network. When the user's service demand is a roaming service, the network control module selects the access class UPF of the roaming area to forward data, and the access class UPF of the roaming area selects the user plane function module to forward data. When the user's service demand is a local service, the network access control module will select the user plane function module for data forwarding.

[0127] S2: The user plane function module receives the service information from the network access control module, and the routing selection module determines the processing method of the user plane function module for the data traffic according to the service type.

[0128] Specifically, the routing module establishes a detailed routing table for the user, determines the IP address that the user wants to access, and if the IP address is in the private network segment in the detailed routing table, the routing module asks the user plane function module to forward the data traffic to the private network. If the IP address does not belong to the private network segment in the detailed routing table, it means that the IP address belongs to the public network segment in the detailed routing table, then the IP address is not processed, it is regarded as the default route, and the data traffic is sent to the security policy module.

[0129] S3: The security policy module opens the virtual firewall, configures traffic access permissions, and establishes a connection with the user plane function module to ensure secure isolation of traffic.

[0130] Specifically, the security policy module opens different virtual firewalls corresponding to different user accesses to ensure the secure isolation of traffic between different users and between private networks and public networks. For example, the corresponding virtual firewalls of users A, B, and C are FWA, FWB, and FWC, respectively, and FWA, FWB, and FWC establish connections with the user plane function module respectively. The security policy module translates the IP addresses that different users want to access on different virtual firewalls into public network IP addresses.

[0131] S4: The security policy module and the terminal device module establish a secure communication channel through the GRE tunnel, and securely transmit the public network service traffic to the public network through the GRE tunnel.

[0132] Specifically, the terminal device module establishes a tunnel to connect with the security policy module, and forwards the received data to the public network.

[0133] The user plane function module (shared UPF) of this embodiment can effectively separate private network access from public network access through only one UPF. The specific implementation method is to manage traffic by configuring a detailed routing table: when the access target route requested by the user is in the detailed routing table, the traffic will be directly forwarded to the private network; if it is not in the routing table, the data will be forwarded to the security policy module, and subsequent public network access will be handled by the security policy module. This design significantly simplifies the network architecture and improves the system operation efficiency, so that only one UPF is needed to complete the effective management of different types of traffic.

[0134] In addition, this embodiment only configures one private network DNN (data network name), and diverts the access request of the public network through the detailed routing of the shared UPF. In order to achieve public network access, the security policy module will translate the private network IP and convert it into a public network IP. By configuring only one private network DNN, the system further optimizes the configuration efficiency, ensures that network resources are fully utilized, simplifies the overall network management, and improves the convenience of configuration and maintenance.

[0135] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A service offloading method based on core network shared UPF, applied to AMF entity, characterized in that: The method comprises the following steps: Get terminal service request; According to the service type of the terminal service request, select a shared UPF entity for data forwarding to achieve service diversion based on the core network shared UPF; Among them, if the terminal service request is a local public network service or a local private network service, the local shared UPF entity is selected to forward the data traffic; if the terminal service request is a roaming public network service or a roaming private network service, the roaming shared UPF entity is selected to forward the data traffic; the data traffic is the traffic carried by the terminal service request.

2. The service offloading method based on core network shared UPF according to claim 1 is characterized in that: The selecting of the local shared UPF entity for data forwarding specifically includes the following steps: According to the private network DNN and terminal IP address carried in the terminal service request, a local shared UPF entity is selected so that the local shared UPF entity forwards different data traffic to the IP address to be accessed in the terminal service request according to the user detailed routing table; Among them, if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the local shared UPF entity sends the data traffic to the private network; if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the local shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

3. The service offloading method based on core network shared UPF according to claim 1 or 2, characterized in that: The step of selecting a roaming shared UPF entity for data forwarding specifically includes the following steps: According to the private network DNN and terminal IP address carried in the terminal service request, select the roaming shared UPF entity so that the roaming shared UPF entity forwards different data traffic to the IP address to be accessed in the terminal service request according to the user detailed routing table; Among them, if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the roaming shared UPF entity sends the data traffic to the private network; if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the roaming shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

4. A service offloading method based on core network shared UPF, applied to UPF entity, characterized in that: The method comprises the following steps: Receive terminal service requests forwarded by the AMF entity; Determine whether the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table: If the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the data traffic is sent to the private network; if the IP address to be accessed in the terminal service request is not a private network segment in the detailed routing table, the data traffic is forwarded to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel, so as to realize service diversion based on the core network shared UPF; The data traffic is the traffic carried by the terminal service request, and the detailed routing table is established for the user by the routing selection module.

5. An AMF entity, characterized in that: The AMF entity includes: An acquisition unit, used for acquiring a terminal service request; A selection unit, connected to the acquisition unit, configured to select a shared UPF entity for data forwarding according to the service type of the terminal service request, so as to realize service diversion based on the core network shared UPF; Among them, if the terminal service request is a local public network service or a local private network service, the local shared UPF entity is selected to forward the data traffic; if the terminal service request is a roaming public network service or a roaming private network service, the roaming shared UPF entity is selected to forward the data traffic; the data traffic is the traffic carried by the terminal service request.

6. The AMF entity according to claim 5, characterized in that The selection unit includes a first selection unit; The first selection unit is connected to the acquisition unit and is used to select a local shared UPF entity according to the private network DNN and the terminal IP address carried in the terminal service request, so that the local shared UPF entity performs different data traffic forwarding for the IP address to be accessed in the terminal service request according to the user detailed routing table; Among them, if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the local shared UPF entity sends the data traffic to the private network; if the local shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the local shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

7. The AMF entity according to claim 6, characterized in that The selection unit further includes a second selection unit; The second selection unit is connected to the acquisition unit, and is used to select a roaming shared UPF entity according to the private network DNN and the terminal IP address carried in the terminal service request, so that the roaming shared UPF entity performs different data traffic forwarding for the IP address to be accessed in the terminal service request according to the user detailed routing table; Among them, if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table, the roaming shared UPF entity sends the data traffic to the private network; if the roaming shared UPF entity determines that the IP address to be accessed in the terminal service request is not a private network segment in the user's detailed routing table, the roaming shared UPF entity forwards the data traffic to the security policy module, so that the security policy module translates different IP addresses to be accessed into public IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel.

8. A UPF entity, characterized in that: The UPF entity includes: A receiving unit, used to receive a terminal service request forwarded by an AMF entity; A determination unit, connected to the receiving unit, for determining whether the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table; A first forwarding unit, connected to the determination unit, for sending data traffic to the private network when the determination unit determines that the IP address to be accessed in the terminal service request is a private network segment in the detailed routing table; A second forwarding unit is connected to the determination unit, and is used for forwarding data traffic to the security policy module when the determination unit determines that the IP address to be accessed in the terminal service request is not a private network segment in the detailed routing table, so that the security policy module translates different IP addresses to be accessed into public network IP addresses on different virtual firewalls, and transmits the data traffic to the public network through the GRE tunnel, so as to realize service diversion based on the core network shared UPF; The data traffic is the traffic carried by the terminal service request, and the detailed routing table is established for the user by the routing selection module.

9. An electronic device, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory. When the processor runs the computer program stored in the memory, the processor executes the service diversion method based on the core network shared UPF according to any one of claims 1 to 3, or executes the service diversion method based on the core network shared UPF according to claim 4.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the service diversion method based on the core network shared UPF as described in any one of claims 1 to 3, or implements the service diversion method based on the core network shared UPF as described in claim 4.

Images