Private network access system, information transmission method, storage medium and program product

Abstract

The invention provides a private network access system, an information transmission method, a storage medium and a program product, and relates to the technical field of communication. The system comprises a card support and a private network security gateway, the card support is connected with a base-level terminal where a base-level client is located, and when an information transmission instruction of the base-level client is received, the card support interacts with the private network security gateway based on DNN subscription information of a built-in state secret card to establish a private network transmission channel; the private network security gateway is deployed in a government affair extranet area and used for verifying identity authentication information and a certificate of the state secret card and forwarding target information to the front-end processor of the government affair extranet area through the private network transmission channel when the verification is passed, and the front-end processor makes an optical disc according to the target information and migrates the target information into the server of the government affair intranet area through the optical disc. According to the invention, by introducing the card holder and the private network security gateway, a multi-protection system is constructed, and the target information is logically isolated from the external network in the transmission process, so that the security and reliability of information transmission are remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a private network access system, an information transmission method, a storage medium and a program product. Background Art

[0002] With the rapid development of communication technology, the demand for information management by relevant departments is increasing, especially in personnel management and material management. Among them, information management system, as an important government application, is widely used to manage and maintain the information of on-the-job personnel.

[0003] In the related art, the information management system usually adopts the client / server (C / S) architecture. Specifically, the client is deployed on the office computers of each grassroots organization, while the server is deployed in a centrally managed location such as a provincial data center. When the personnel relationship of a source grassroots organization changes, its corresponding grassroots client, such as client A, needs to synchronize these change information to the government internal and external network areas and other related grassroots organizations. However, there may be security risks in the process of information transmission. For example, the information may face the risk of being leaked or tampered with during the transmission process, which poses a threat to the integrity and confidentiality of the information.

[0004] Therefore, there is an urgent need to provide a private network access solution to improve the security of information transmission. Summary of the invention

[0005] The present application provides a private network access system, an information transmission method, a storage medium and a program product to improve the security of information transmission.

[0006] In a first aspect, the present application provides a private network access system, including: a card holder and a private network security gateway, wherein:

[0007] Cato is connected to the grassroots terminal where the grassroots client is located. It is used to interact with the private network security gateway to establish a dedicated network transmission channel based on the dedicated data network name (Dedicated Data Network Name, DNN) signing information of the national secret card built into Cato when receiving the information transmission instruction from the grassroots client connected to Cato;

[0008] The private network security gateway is deployed in the government extranet area and is used to verify the national security card based on the private network transmission channel to obtain the verification result. The verification includes verifying the identity authentication information of the national security card and verifying the certificate of the national security card. When the verification result is passed, the target information is forwarded to the front-end machine deployed in the government extranet area via the private network transmission channel. The front-end machine is used to make a CD based on the target information, and migrate the target information to the server in the government intranet area via the CD. The target information is sent by the grassroots client.

[0009] In a possible implementation, the private network access system also includes a user plane function (User Plane Function, referred to as UPF) network element, and the private network security gateway is also used to: when the verification result is passed, determine the target Internet Protocol (Internet Protocol, referred to as IP) address contained in the target information; if the target IP address is the IP address of the front-end machine, forward the target information to the front-end machine; if the target IP address is the IP address of other grassroots terminals, forward the target information to other grassroots clients via the UPF network element.

[0010] In a possible implementation, the private network security gateway is also used to store a routing table containing the network configuration of each grassroots terminal. If the target IP address is the IP address of other grassroots terminals, the target information is forwarded to other grassroots clients via the UPF network element, including: if the target IP address is the IP address of other grassroots terminals, determine the routing information in the routing table that matches the IP address; based on the routing information, forward the target information to other grassroots clients via the UPF network element.

[0011] In a possible implementation, the card holder is connected to a grassroots terminal where the grassroots client is located through a target interface, and the target interface includes a serial bus USB interface and a Type-C interface.

[0012] In a possible implementation, the card tray is also used to: collect physical information of the grassroots terminal and the physical information of the card tray, the physical information including the serial number and the media access control address; compare the physical information of the grassroots terminal and the physical information of the card tray to confirm whether the physical information of the grassroots terminal and the physical information of the card tray match.

[0013] In one possible implementation, before forwarding the target information to the front-end machine deployed in the government extranet area via a dedicated network transmission channel, the dedicated network security gateway is also used to: obtain the locally stored physical information of the target grassroots terminal and the physical information of the target card tray corresponding to the target grassroots terminal; if the physical information of the grassroots terminal does not match the physical information of the target grassroots terminal, and / or if the physical information of the card tray does not match the physical information of the target card tray, restrict the information transmission through the target interface; if the physical information of the grassroots terminal matches the physical information of the target grassroots terminal, and the physical information of the card tray matches the physical information of the target card tray, allow information transmission through the target interface.

[0014] In a second aspect, an embodiment of the present application provides an information transmission method, which is applied to the private network access system described in any one of the first aspects, the private network access system includes a card holder and a private network security gateway, and the information transmission method includes:

[0015] Cato responds to the information transmission instructions of the grassroots client connected to Cato, and based on the DNN signing information of the national encryption card built into Cato, interacts with the private network security gateway to establish a dedicated network transmission channel, and Cato connects to the grassroots terminal where the grassroots client is located;

[0016] The private network security gateway verifies the national security card based on the private network transmission channel to obtain a verification result, which includes verifying the identity authentication information of the national security card and verifying the certificate of the national security card. When the verification result is passed, the target information is forwarded to the front-end processor deployed in the government extranet area via the private network transmission channel. The front-end processor is used to make a CD based on the target information, and migrate the target information to the server in the government intranet area via the CD. The target information is sent by the grassroots client, and the private network security gateway is deployed in the government extranet area.

[0017] In a possible implementation, the private network access system also includes a UPF network element, and the information transmission method also includes: when the verification result is passed, the private network security gateway determines the target IP address contained in the target information; if the target IP address is the IP address of the front-end machine, the private network security gateway forwards the target information to the front-end machine; if the target IP address is the IP address of other grassroots clients, the private network security gateway forwards the target information to other grassroots clients via the UPF network element.

[0018] In a third aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed, they are used to implement any of the methods described in the second aspect.

[0019] In a fourth aspect, the present application provides a computer program product, including a computer program, which implements any method in the second aspect when executed.

[0020] The present application provides a private network access system, information transmission method, storage medium and program product, wherein the system includes Cato and a private network security gateway, wherein Cato is connected to a grassroots terminal where a grassroots client is located, and is used to interact with the private network security gateway to establish a private network transmission channel based on the DNN signing information of the national security card built into Cato when receiving an information transmission instruction from the grassroots client connected to Cato; the private network security gateway is deployed in the government extranet area, and is used to verify the national security card based on the private network transmission channel to obtain a verification result, wherein the verification includes verifying the identity authentication information of the national security card and verifying the certificate of the national security card; and when the verification result is passed, the target information is forwarded to a front-end processor deployed in the government extranet area via the private network transmission channel, and the front-end processor is used to make a CD based on the target information, and migrate the target information to a server in the government intranet area via the CD, and the target information is sent by the grassroots client. This application introduces Cato and a private network security gateway, uses the DNN contract information of the national secret card built into Cato, interacts with the private network security gateway to establish a private network transmission channel, and verifies the identity authentication information and certificate of the national secret card. Only when the verification result passes, the target information is allowed to be transmitted through the private network transmission channel. The construction of this multiple protection system ensures that the target information is logically isolated from the external network during the transmission process and always remains within the private network, thereby significantly improving the security and reliability of information transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0022] Figure 1 It is a schematic diagram of information transmission of an information management system in the related art;

[0023] Figure 2 A structural diagram of a private network access system provided for an exemplary embodiment of the present application;

[0024] Figure 3 A schematic diagram of information transmission of a private network access system provided for an exemplary embodiment of the present application;

[0025] Figure 4 A schematic diagram of the system architecture of a private network access system provided for an exemplary embodiment of the present application;

[0026] Figure 5 An exemplary embodiment of the present application provides a flowchart of an information transmission method.

[0027] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0028] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0029] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable in appropriate circumstances, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein, for example. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, the process, system, product or equipment comprising a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, products or equipment.

[0030] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0031] At present, 5G, as a new generation of mobile communication technology, has the characteristics of large bandwidth, low latency and wide connection. It has a wide range of uses in network coverage, mobile access and improving the governance capabilities of relevant departments. For example, based on the operator's 5G network infrastructure, building a 5G dedicated network for the e-government extranet of relevant departments can significantly improve the ubiquitous access capability and mobile access capability of the government extranet, and extend the coverage of the government extranet, thereby meeting network access in scenarios such as mobile office, mobile law enforcement, emergency communication, remote access, IoT perception and private network integration.

[0032] In the related technology, a certain information management system is a typical C / S architecture, in which the client (i.e., Client side) is deployed in the office computers of each grassroots organization, and the server (i.e., Server side) is deployed in, for example, a provincial data center. The system is mainly used to manage the information of in-service personnel within the province. When the personnel relationship of the source grassroots organization changes, such as basic information update, transfer of organizational relationship within the province, transfer out of the province, or transfer in of organizational relationship outside the province, the change information needs to be synchronized to the server corresponding to the provincial organization (such as the provincial dispatch server) through its corresponding grassroots client, such as client A. At the same time, the change information also needs to be synchronized to the grassroots clients corresponding to other target grassroots organizations, such as client B. For example, Figure 1 FIG. 1 is a schematic diagram of information transmission in an information management system in the related art. Figure 1 As shown, client A and client B are located in the Internet area, and the server is located in the government intranet area. Data transfer and exchange are all realized through the government extranet area, in which the government extranet area and the government intranet area are physically isolated by a one-way optical gate. Correspondingly, when the personnel relationship of the source grassroots organization changes, client A transmits the change information in plain text to the data exchange area in the government extranet via the Internet, signs and verifies the account password through the front-end, and then transmits it to the one-way optical gate to burn the change information; the burned CD is sent to the government intranet area by manual ferry, and the change information is migrated to the server in the government intranet area through the CD; when the server in the government intranet area completes the data update, the change information is burned again, and the burned CD is sent to the target grassroots organization by manual ferry, such as migrating to client B, to complete the information update of the target grassroots organization. However, since client A uses an account and password to log in and transmits the change information in plain text through the Internet, there is a great security risk. The information may be at risk of being leaked or tampered with during the transmission process, which poses a threat to the integrity and confidentiality of the information.

[0033] In order to solve the above problems, the embodiment of the present application provides a private network access solution. In order to reduce the security risks of plain text transmission on the Internet, in terms of private network security management, security authentication and data encryption technologies at the network transmission level and the data transmission level are introduced. By introducing customized card holders and private network security gateways, it is ensured that the target information is transmitted through a dedicated network transmission channel and is logically isolated from the external network during the transmission process, so that the authenticity, integrity and confidentiality of the target information are not affected, thereby significantly improving the security and reliability of information transmission.

[0034] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0035] Figure 2 A structural diagram of a private network access system provided by an exemplary embodiment of the present application. Figure 2 As shown, the private network access system 20 includes: a card holder 21 and a private network security gateway 22; wherein:

[0036] Cato 21 is connected to the grassroots terminal where the grassroots client is located. When receiving an information transmission instruction from the grassroots client connected to Cato, it interacts with the private network security gateway to establish a dedicated network transmission channel based on the DNN signing information of the national encryption card built into Cato.

[0037] For example, Figure 3 This is a schematic diagram of information transmission of a private network access system provided by an exemplary embodiment of the present application. Figure 3 As shown, each grassroots terminal, such as the source grassroots computer and the target grassroots computer, is equipped with a card holder, which includes a communication module module and a data transmission module. Among them, a national secret card is inserted into the communication module module, and the national secret card is only signed for the Organization Department's dedicated DNN; a private network security gateway is deployed in the government external network area. Among them, the card holder includes but is not limited to 5G card holders, etc.; the national secret card includes but is not limited to 5G national secret user identification module (Subscriber Identity Module, referred to as SIM) card, etc.; the private network security gateway includes but is not limited to 5G private network security gateway, etc.

[0038] Accordingly, refer to Figure 3 When the personnel relationship of the source grassroots organization changes, its corresponding source grassroots client, such as client A, generates an information transmission instruction and sends the information transmission instruction to the communication module of Cato through the interface; after receiving the information transmission instruction, the communication module of Cato automatically reads the DNN signing information of the built-in national secret card, and communicates with the private network security gateway based on the read DNN signing information, and initiates a request to establish a dedicated network transmission channel to ensure the security and exclusivity of information transmission.

[0039] The private network security gateway 22 is deployed in the government extranet area and is used to verify the national security card based on a private network transmission channel to obtain a verification result. The verification includes verifying the identity authentication information of the national security card and verifying the certificate of the national security card. When the verification result is passed, the target information is forwarded to the front-end machine deployed in the government extranet area via the private network transmission channel. The front-end machine is used to make a CD based on the target information, and migrate the target information to the server in the government intranet area via the CD. The target information is sent by the grassroots client.

[0040] For example, still refer to Figure 3The private network security gateway is deployed in the government extranet area and is responsible for ensuring the security and integrity of information transmission. The private network security gateway includes an authentication and authorization module (i.e., DN-AAA module), a national secret encryption module, and a forwarding strategy module; the DN-AAA module verifies the identity authentication information of the national secret card, including the verification of MSISDN and IMSI information. Among them, MSISDN is the mobile user's phone number, and IMSI is the International Mobile Subscriber Identity, which is used to uniquely identify and verify the user's identity. It is determined that only national secret cards that have passed the secondary authentication are allowed to access network resources, thereby enhancing the security of the network. Secondly, the national secret encryption module verifies the certificate pre-installed in the national secret card, and determines that only the national secret card that has passed the two-way authentication is allowed to establish the national secret transport layer security protocol (Transport Layer Security, TLS for short) tunnel; when the verification result is passed, the data transmission module of the card will send the change information in the source grassroots computer through the communication module module, and the forwarding strategy module of the private network security gateway will forward the target information to the front-end machine deployed in the government extranet area. The front-end machine will make a CD based on the target information, and then migrate the target information to the server in the government intranet area through the CD by manual ferrying.

[0041] The private network access system provided in the embodiment of the present application introduces Cato and a private network security gateway, uses the DNN contract information of the national secret card built into Cato, interacts with the private network security gateway to establish a private network transmission channel, and verifies the identity authentication information and certificate of the national secret card. Only when the verification result passes, the target information is allowed to be transmitted through the private network transmission channel. By building a triple protection system of "private network + secondary authentication + national secret encryption", it ensures that the target information is logically isolated from the external network during the transmission process and always remains in the private network, thereby significantly improving the security and reliability of information transmission.

[0042] Considering that in the related technology, due to the physical isolation of the government intranet and intranet, when the change information is transmitted from client A to the server in the government intranet area, the last mile can only be completed by manual ferrying with optical disks; however, when the change information is transmitted from the server to client B, the method of using manual ferrying with optical disks to transmit the change information to the target grassroots organization has the problems of long cycle and high cost, which seriously affects the work efficiency. Therefore, in some embodiments, the private network access system also includes a UPF network element, and the private network security gateway is also used to: when the verification result is passed, determine the target IP address contained in the target information; if the target IP address is the IP address of the front-end machine, forward the target information to the front-end machine; if the target IP address is the IP address of other grassroots terminals, forward the target information to other grassroots clients via the UPF network element.

[0043] For example, still refer to Figure 3, deploy a sinking, exclusive UPF network element in the government extranet data exchange area. Accordingly, when the verification result is passed, the forwarding strategy module of the private network security gateway is activated, which determines which route the personnel change information corresponding to the source grassroots client, such as client A, should be transmitted to based on the target IP address contained in the target information: if the target IP address is the front-end in the government extranet area, the forwarding strategy module directly opens the way and forwards the target information directly to the front-end, and the front-end performs corresponding processing based on the target information, such as making a CD for further transmission; if the target IP address is the IP address of other grassroots terminals, the forwarding strategy module does not retain the data, and forwards the target information to other grassroots clients, such as client B, through the UPF network element. The UPF network element is responsible for efficiently routing and forwarding data packets in the dedicated network transmission channel to ensure that the target information is accurately delivered to the target grassroots client.

[0044] In the embodiment of the present application, when the change information is transmitted from the server to other grassroots clients, it is no longer necessary to manually transfer it through a CD, but it is directly forwarded to the target grassroots client corresponding to the target grassroots organization through a dedicated network, which greatly improves work efficiency and improves the problems of long information transmission cycle and high cost. In addition, by using "dedicated network + card holder" to access the government extranet area, the method of grassroots terminals only being able to access the government extranet area through fixed network cables is improved, thereby better meeting the needs of mobile office in the government industry.

[0045] Based on the above embodiments, in some embodiments, the private network security gateway is also used to store a routing table containing the network configuration of each grassroots terminal. If the target IP address is the IP address of other grassroots terminals, the target information is forwarded to other grassroots clients via the UPF network element, including: if the target IP address is the IP address of other grassroots terminals, determine the routing information in the routing table that matches the IP address; based on the routing information, forward the target information to other grassroots clients via the UPF network element.

[0046] For example, the forwarding policy module of the private network security gateway also stores a routing table containing the network configuration of all grassroots terminals, and the routing table records the intranet IP addresses of all grassroots terminals and their corresponding routing information; when the private network security gateway receives the target information, the forwarding policy module analyzes the target IP address contained in the target information; if the target IP address is the IP address of other grassroots terminals, the forwarding policy module searches the routing table for routing information that matches the target IP address, and obtains the corresponding forwarding path based on the matching routing information, and further, based on the forwarding path addressing, forwards the target information to other grassroots clients through the UPF network element. In addition, appropriate forwarding policies can be preset in the forwarding policy module to support inter-provincial terminal visits; correspondingly, after obtaining the corresponding forwarding path, the preset forwarding policy is applied to ensure that the information can be transmitted across provinces; the UPF network element is responsible for efficiently routing and forwarding data packets in the private network according to the routing information and policies to ensure that the information is accurately delivered to the target client, regardless of its geographical location.

[0047] The embodiment of the present application not only ensures the security and efficiency of information transmission through a private network security gateway, but also realizes cross-provincial terminal mutual access through appropriate forwarding strategies, thereby breaking the limitation that traditional UPF terminal mutual access is limited to within the province, and significantly improving the flexibility and practicality of the network.

[0048] In some embodiments, the card tray is connected to the grassroots terminal where the grassroots client is located through a target interface, and the target interface includes a serial bus USB interface and a Type-C interface.

[0049] Among them, the USB interface is a widely used interface standard that supports plug-and-play functions, provides power and data transmission capabilities, and is suitable for most computing devices; the Type-C interface is a modern interface standard that supports higher data transmission rates, bidirectional power supply capabilities, and reversible insertion design.

[0050] For example, in one implementation, the connection between the card tray and the grassroots terminal where the grassroots client is located is achieved through a USB interface, that is, a USB cable is inserted into the USB port of the card tray and the terminal.

[0051] In another implementation, the connection between the card tray and the grassroots terminal where the grassroots client is located is achieved through the Type-C interface, that is, the Type-C cable is inserted into the Type-C port of the card tray and the terminal.

[0052] Accordingly, after Cato is connected to the grassroots terminal where the grassroots client is located through the target interface, the operating system of the grassroots terminal automatically recognizes Cato and loads the necessary driver to initialize Cato; after Cato is initialized, data transmission and identity authentication are performed to verify the legitimacy of the grassroots terminal device and user, ensuring that only authorized devices and users can access network resources; once the authentication is passed, Cato provides secure network access for the grassroots terminal, and the grassroots terminal can access network resources through Cato and perform data communication and business operations.

[0053] The embodiment of the present application adopts USB and Type-C interfaces to connect the card tray and the grassroots terminal, which not only improves the compatibility and performance of the system, but also simplifies user operations and enhances the flexibility and adaptability of the device.

[0054] In some embodiments, the card tray is also used to: collect physical information of the base terminal and the physical information of the card tray, the physical information including the serial number and the media access control address; compare the physical information of the base terminal and the physical information of the card tray to confirm whether the physical information of the base terminal and the physical information of the card tray match.

[0055] For example, the Cato also includes an interface management module (i.e., an APP module), which automatically collects information such as the serial number (Serial Number, S / N for short), the media access control (Media Access Control, MAC for short) address of the grassroots terminal, and information such as the S / N and MAC address of the Cato; and matches and compares the S / N and MAC address of the grassroots terminal with the S / N and MAC address of the Cato itself, checks whether the S / N of the grassroots terminal is consistent with the S / N of the Cato, and checks whether the MAC address of the grassroots terminal is consistent with the MAC address of the Cato. Correspondingly, if the S / N of the grassroots terminal is consistent with the S / N of the Cato, and the MAC address of the grassroots terminal is consistent with the MAC address of the Cato, it is confirmed that the physical information of the grassroots terminal matches the physical information of the Cato, and the system can continue with subsequent configuration or operation; if the S / N of the grassroots terminal is inconsistent with the S / N of the Cato, and / or the MAC address of the grassroots terminal is inconsistent with the MAC address of the Cato, it is confirmed that the physical information of the grassroots terminal does not match the physical information of the Cato, and the system generates relevant alarms or prompt information to notify the user to perform further inspection and verification.

[0056] The embodiment of the present application can effectively reduce the possibility of the card tray being mixed with other terminals by verifying the consistency of the physical information of the base terminal and the card tray. This is especially important for systems that require strict configuration management. It can prevent security risks, configuration errors or communication problems caused by information mismatch, thereby improving the security of the overall network.

[0057] In some embodiments, before forwarding the target information to the front-end machine deployed in the government extranet area via a dedicated network transmission channel, the dedicated network security gateway is also used to: obtain the locally stored physical information of the target grassroots terminal and the physical information of the target card tray corresponding to the target grassroots terminal; if the physical information of the grassroots terminal does not match the physical information of the target grassroots terminal, and / or, if the physical information of the card tray does not match the physical information of the target card tray, restrict the information transmission through the target interface; if the physical information of the grassroots terminal matches the physical information of the target grassroots terminal, and the physical information of the card tray matches the physical information of the target card tray, allow information transmission through the target interface.

[0058] For example, the private network security gateway also includes a binding verification module. Accordingly, before forwarding the target information to the front-end deployed in the government extranet area via the dedicated network transmission channel, the binding verification module is also used to obtain the physical information of the target grassroots terminal stored locally and the physical information of the target card tray corresponding to the target grassroots terminal; the binding verification module compares the physical information of the grassroots terminal uploaded by the card tray interface management module with the physical information of the target grassroots terminal pre-stored in the system, and compares the physical information of the card tray with the physical information of the target card tray pre-stored in the system. Correspondingly, if the physical information of the grassroots terminal does not match the physical information of the target grassroots terminal, and / or if the physical information of the card tray does not match the physical information of the target card tray, the information transmission through the target interface is restricted, that is, the information transmission through the U / C port such as the USB interface or the Type-C interface is restricted; if the physical information of the grassroots terminal matches the physical information of the target grassroots terminal, and the physical information of the card tray matches the physical information of the target card tray, the information transmission through the target interface is allowed, that is, the U / C port such as the USB interface or the Type-C interface is opened to transmit information, so that the target information can be transmitted to the front-end through the target interface.

[0059] In the embodiment of the present application, by verifying the physical information of the grassroots terminal and the card tray, if the physical information is detected to be mismatched, the information transmission is restricted. This mechanism helps prevent sensitive information from being leaked through unauthorized devices and ensures that only authorized devices can transmit information. Through this multi-level security verification mechanism that combines the network transmission level, data transmission level, and device management level, it can effectively prevent unauthorized devices from accessing the network, significantly improving the security and reliability of the information transmission process. In addition, through the automated physical information verification process, the need for manual intervention is reduced, operational efficiency is improved, and the risk of human error is reduced.

[0060] For example, Figure 4 The system architecture diagram of the private network access system provided by the exemplary embodiment of the present application is as follows. Figure 4As shown, the source grassroots terminal, such as the source grassroots computer, is connected to Cato A via a USB interface or a Type-C interface, and the target grassroots terminal, such as the target grassroots computer, is connected to Cato B via a USB interface or a Type-C interface; Cato A and Cato B both include an interface management module (i.e., an APP module), a 5G module module, and a data transmission module, wherein the 5G module module is an example of a communication module module; a private network security gateway, such as a 5G private network security gateway, includes a forwarding strategy module, an authentication and authorization module (i.e., a DN-AAA module), a national secret encryption module, and a binding verification module.

[0061] Correspondingly, when the personnel relationship of the source grassroots organization changes, the source grassroots client corresponding to the source grassroots computer, such as client A, generates an information transmission instruction, and sends the information transmission instruction to the 5G module of Cato through the USB interface or Type-C interface; after receiving the information transmission instruction, the 5G module of Cato automatically reads the DNN signing information of the built-in national secret card, and communicates with the private network security gateway based on the read DNN signing information, and initiates a request to establish a dedicated network transmission channel to ensure the security and exclusivity of information transmission. Furthermore, the DN-AAA module verifies the identity authentication information of the national secret card, including the verification of MSISDN and IMSI information, and determines that only the national secret card that has passed the secondary authentication is allowed to access network resources; the national secret encryption module verifies the certificate preset in the national secret card, and determines that only the national secret card that has passed the two-way authentication is allowed to establish an encrypted tunnel such as a national secret TLS tunnel; and when the verification result is passed, the data transmission module of Card A sends the target information (such as changed personnel information) in the source grassroots computer through the 5G communication module module, and at the same time the forwarding strategy module of the private network security gateway is activated, and the forwarding strategy module sends the target information (such as changed personnel information) in the source grassroots computer through the 5G communication module module. The target IP address determines which route the personnel change information corresponding to the source grassroots client, such as client A, should be transmitted to; if the target IP address is the front-end processor in the government extranet area, the forwarding strategy module directly opens the way and forwards the target information directly to the front-end processor, which performs corresponding processing based on the target information, such as making a CD for further transmission; if the target IP address is the IP address of other grassroots computers, the forwarding strategy module does not retain the data and forwards the target information to other grassroots clients, such as client B, through the UPF network element. The UPF network element is responsible for efficiently routing and forwarding data packets in the dedicated network transmission channel to ensure that the target information is accurately delivered to the target grassroots client.

[0062] It should be noted that Figure 4 The source grassroots computer and the target grassroots computer are just examples of grassroots terminals. The number of source grassroots computers and the number of target grassroots computers can be multiple, and are not limited here.

[0063] The above embodiments introduce the implementation method of the private network access system. Next, the application in information transmission will be introduced through specific embodiments.

[0064] Figure 5 A flow chart of an information transmission method provided by an exemplary embodiment of the present application. The information transmission method provided by the embodiment of the present application is applied to the private network access system in the above embodiment, and the private network access system includes a card holder and a private network security gateway. Figure 5 As shown, the information transmission method includes:

[0065] S501. Cato responds to the information transmission instruction of the grassroots client connected to Cato, and based on the DNN signing information of the national encryption card built into Cato, interacts with the private network security gateway to establish a dedicated network transmission channel. Cato is connected to the grassroots terminal where the grassroots client is located.

[0066] For example, Cato is connected to the grassroots terminal where the grassroots client is located through a target interface, and the target interface includes a serial bus USB interface and a Type-C interface. Correspondingly, when the personnel relationship of the source grassroots organization changes, its corresponding source grassroots client, such as client A, generates an information transmission instruction and sends the information transmission instruction to Cato's communication module through the interface; after receiving the information transmission instruction, Cato's communication module automatically reads the DNN signing information of the built-in national secret card, and communicates with the private network security gateway based on the read DNN signing information, and initiates a request to establish a dedicated network transmission channel to ensure the security and exclusivity of information transmission.

[0067] S501. The private network security gateway verifies the national security card based on the private network transmission channel to obtain a verification result, wherein the verification includes verifying the identity authentication information of the national security card and verifying the certificate of the national security card; when the verification result is passed, the target information is forwarded to the front-end processor deployed in the government extranet area via the private network transmission channel, and the front-end processor is used to make a CD based on the target information, and migrate the target information to the server in the government intranet area via the CD. The target information is sent by the grassroots client, and the private network security gateway is deployed in the government extranet area.

[0068] For example, the private network security gateway includes an authentication and authorization module (i.e., a DN-AAA module), a national secret encryption module, and a forwarding strategy module; wherein, the DN-AAA module verifies the identity authentication information of the national secret card, specifically including the verification of information such as MSISDN and IMSI, and determines that only the national secret card that has passed the secondary authentication is allowed to access network resources, thereby enhancing the security of the network. Secondly, the national secret encryption module verifies the certificate pre-installed in the national secret card, and determines that only the national secret card that has passed the two-way authentication is allowed to establish a national secret TLS tunnel; and when the verification result is passed, the data transmission module of the card holder sends the change information in the source grassroots computer through the communication module module, and the forwarding strategy module of the private network security gateway forwards the target information to the front-end machine deployed in the government external network area. The front-end machine makes a CD according to the target information, and then migrates the target information to the server in the government internal network area through the CD by manual ferrying.

[0069] On the basis of the above embodiments, in some embodiments, the private network access system also includes a UPF network element, and the information transmission method also includes: when the verification result is passed, the private network security gateway determines the target IP address contained in the target information; if the target IP address is the IP address of the front-end machine, the private network security gateway forwards the target information to the front-end machine; if the target IP address is the IP address of other grassroots clients, the private network security gateway forwards the target information to other grassroots clients via the UPF network element.

[0070] For example, the private network security gateway also includes a forwarding strategy module, which stores a routing table containing the network configuration of all grassroots terminals, and the routing table records the intranet IP addresses of all grassroots terminals and their corresponding routing information; when the verification result is passed, the forwarding strategy module of the private network security gateway is activated, and the forwarding strategy module analyzes the target IP address contained in the target information; if the target IP address is the IP address of other grassroots terminals, the forwarding strategy module searches for routing information matching the target IP address in the routing table, and obtains the corresponding forwarding path based on the matching routing information, and further, based on the forwarding path, forwards the target information to other grassroots clients through the UPF network element; if the target IP address is a front-end in the government external network area, the forwarding strategy module directly opens the way and forwards the target information directly to the front-end, and the front-end performs corresponding processing according to the target information, such as making a CD for further transmission. In addition, a suitable forwarding strategy can also be preset in the forwarding strategy module to support inter-provincial terminal visits; accordingly, after obtaining the corresponding forwarding path, the forwarding strategy module can also forward the target information to other inter-provincial grassroots terminals through the UPF network element according to the preset forwarding strategy.

[0071] In summary, this application has at least the following advantages:

[0072] 1. By introducing Cato and private network security gateway, using the DNN contract information of the national secret card built into Cato, interacting with the private network security gateway to establish a private network transmission channel, and verifying the identity authentication information and certificate of the national secret card, the target information is allowed to be transmitted through the private network transmission channel only if the verification result passes. By building a triple protection system of "private network + secondary authentication + national secret encryption", it ensures that the target information is logically isolated from the external network during the transmission process and always remains in the private network, thereby significantly improving the security and reliability of information transmission.

[0073] Second, when the change information is transmitted from the server to other grassroots clients, it is no longer necessary to manually transfer it through CDs. Instead, it is directly forwarded to the target grassroots client corresponding to the target grassroots organization through a dedicated network, which greatly improves work efficiency and improves the problems of long information transmission cycles and high costs. In addition, by using "dedicated network + card holder" to access the government extranet area, the method of grassroots terminals only being able to access the government extranet area through fixed cables has been improved, thereby better meeting the needs of mobile office in the government industry.

[0074] Third, by introducing card holders and private network security gateways, multiple authentication processes such as secondary authentication, national secret authentication encryption, and card machine binding verification are integrated, and appropriate forwarding strategies are pre-set to achieve mutual access between grassroots terminals. This solution breaks the limitation that the UPF terminal mutual access function is limited to the province and realizes the ability of cross-provincial mutual access.

[0075] The embodiment of the present application also provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed, they are used to implement the method steps in the above method embodiment. The specific implementation method and technical effect are similar and will not be repeated here.

[0076] The above-mentioned computer readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0077] An exemplary readable storage medium is coupled to the processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in a dedicated integrated circuit. Of course, the processor and the readable storage medium can also exist as discrete components in the private network access system.

[0078] The embodiment of the present application also provides a computer program product, including a computer program. When the computer program is executed, the method steps in the above method embodiment are implemented. The specific implementation method and technical effect are similar and will not be repeated here.

[0079] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0080] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A private network access system, characterized in that: include: Cato and private network security gateway, including: The card holder is connected to the grassroots terminal where the grassroots client is located, and is used to interact with the private network security gateway to establish a dedicated network transmission channel based on the dedicated data network name DNN signing information of the national secret card built into the card holder when receiving the information transmission instruction of the grassroots client connected to the card holder; The private network security gateway is deployed in the government extranet area, and is used to verify the national security card based on the private network transmission channel to obtain a verification result, wherein the verification includes verifying the identity authentication information of the national security card and verifying the certificate of the national security card; when the verification result is passed, the target information is forwarded to the front-end processor deployed in the government extranet area via the private network transmission channel, and the front-end processor is used to produce a CD based on the target information, and migrate the target information to the server in the government intranet area via the CD. The target information is sent by the grassroots client.

2. The private network access system according to claim 1, characterized in that: The private network access system further includes a user plane function UPF network element, and the private network security gateway is further used for: When the verification result is passed, determining a target Internet Protocol IP address included in the target information; If the target IP address is the IP address of the front-end processor, forward the target information to the front-end processor; If the target IP address is the IP address of other grassroots terminals, the target information will be forwarded to other grassroots clients via the UPF network element.

3. The private network access system according to claim 2, characterized in that: The private network security gateway is also used to store a routing table containing network configurations of each grassroots terminal. If the target IP address is the IP address of another grassroots terminal, the target information is forwarded to another grassroots client via the UPF network element, including: If the target IP address is the IP address of another grassroots terminal, determining the routing information matching the IP address in the routing table; Based on the routing information, the target information is forwarded to other grassroots clients via the UPF network element.

4. The private network access system according to claim 1 or 2, characterized in that: The card holder is connected to the grassroots terminal where the grassroots client is located through a target interface, and the target interface includes a serial bus USB interface and a Type-C interface.

5. The private network access system according to claim 4, characterized in that: The card holder is also used for: Collecting physical information of the grassroots terminal and physical information of the card tray, wherein the physical information includes a serial number and a media access control address; The physical information of the base terminal is compared with the physical information of the card tray to confirm whether the physical information of the base terminal matches the physical information of the card tray.

6. The private network access system according to claim 5, characterized in that: Before forwarding the target information to the front-end processor deployed in the government extranet area via the dedicated network transmission channel, the dedicated network security gateway is also used to: Acquire the locally stored physical information of the target grassroots terminal and the physical information of the target card tray corresponding to the target grassroots terminal; If the physical information of the base terminal does not match the physical information of the target base terminal, and / or if the physical information of the card tray does not match the physical information of the target card tray, restricting information transmission through the target interface; If the physical information of the base terminal matches the physical information of the target base terminal, and the physical information of the tray matches the physical information of the target tray, information transmission through the target interface is allowed.

7. An information transmission method, characterized in that: The private network access system applied to any one of claims 1 to 6, the private network access system comprising a card holder and a private network security gateway, the information transmission method comprising: The Cato responds to the information transmission instruction of the grassroots client connected to the Cato, and based on the dedicated data network name signing information of the national encryption card built into the Cato, interacts with the private network security gateway to establish a dedicated network transmission channel, and the Cato is connected to the grassroots terminal where the grassroots client is located; The private network security gateway verifies the national security card based on the private network transmission channel to obtain a verification result, wherein the verification includes verifying the identity authentication information of the national security card and verifying the certificate of the national security card; when the verification result is passed, the target information is forwarded to the front-end processor deployed in the government extranet area via the private network transmission channel, and the front-end processor is used to produce a CD based on the target information, and migrate the target information to the server in the government intranet area via the CD. The target information is sent by the grassroots client, and the private network security gateway is deployed in the government extranet area.

8. The information transmission method according to claim 7, characterized in that: The private network access system further includes a user plane function UPF network element, and the information transmission method further includes: The private network security gateway determines the target Internet Protocol IP address included in the target information when the verification result is passed; If the target IP address is the IP address of the front-end processor, the private network security gateway forwards the target information to the front-end processor; If the target IP address is the IP address of other grassroots clients, the private network security gateway will forward the target information to other grassroots clients via the UPF network element.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed, are used to implement the method as claimed in claim 7 or 8.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed, the method according to claim 7 or 8 is implemented.

Images