Access authentication method and equipment

Abstract

Provided are an access authentication method and device, applied to a user plane function (UPF) network element, the method comprising: the UPF network element receiving an extensible authentication protocol (EAP) request message sent by a terminal; the UPF network element sends the EAP request message to an enterprise authentication, authorization and accounting (AAA) server according to the EAP request message and an initial forwarding rule sent by a session management function (SMF) network element in advance; wherein the initial forwarding rule is used for indicating a target message type forwarded by the UPF network element to an enterprise AAA server; and the UPF network element receives an EAP response message sent by the enterprise AAA server according to the EAP request message, and the EAP response message at least comprises an authentication result to realize a network access control function during access authentication.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an access authentication method and device. Background Art

[0002] In the 5G scenario, when an enterprise's client devices use 5G access, they need to follow the corresponding security architecture and design. However, 5G itself has its own security authentication mechanism, and the 5G security authentication mechanism needs to be integrated with the 802.1x authentication mechanism.

[0003] Currently, the 3rd Generation Partnership Project (3GPP) provides a secondary authentication functional network element in TS33.501 and TS23.502. Authentication support in traditional wired scenarios is achieved by transmitting the EAP-Request and EAP-Response messages required in 802.1x and Extensible Authentication Protocol (EAP) solutions in the Non-Access Stratum (NAS) messages between the terminal and the 5G core network, provided that the corresponding terminal device supports the corresponding functional network element. Currently, not all terminals natively support this functional network element, and although the authentication operation is implemented through the transmission of EAP messages, the core network will release all sessions of the corresponding terminal after the authentication is passed, and the access control function required in 802.1x is missing.

[0004] Therefore, there are certain limitations in the existing technology for enterprise authentication in 5G scenarios. Summary of the invention

[0005] The purpose of this application is to provide an access authentication method and device to address the deficiencies in the above-mentioned prior art, so as to solve the practical problem that enterprise authentication in 5G scenarios in the prior art has certain limitations.

[0006] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0007] In a first aspect, an embodiment of the present application provides an access authentication method, which is applied to a user plane function UPF network element; the method includes:

[0008] The UPF network element receives an Extensible Authentication Protocol EAP request message sent by the terminal;

[0009] The UPF network element sends the EAP request message to the enterprise authentication, authorization and accounting AAA server according to the EAP request message and the initial forwarding rule sent in advance by the session management function SMF network element; wherein the initial forwarding rule is used to indicate the target message type forwarded by the UPF network element to the enterprise AAA server;

[0010] The UPF network element receives an EAP response message sent by the enterprise AAA server according to the EAP request message, and the EAP response message includes at least an authentication result.

[0011] As an optional implementation manner, the UPF network element sends the EAP request message to the enterprise authentication, authorization and accounting AAA server according to the EAP request message and the initial forwarding rule sent in advance by the session management function SMF network element, including:

[0012] The UPF network element identifies the message type of the EAP request message, and determines whether the message type of the EAP request message matches the target message type according to the target message type indicated by the initial forwarding rule;

[0013] If there is a match, the UPF network element obtains the pre-configured enterprise AAA server information and user information through the SMF network element, and sends the EAP request message to the enterprise AAA server based on the enterprise AAA server information and the user information, wherein the enterprise AAA server information is used to indicate the address of the enterprise AAA server, and the user information is used to indicate the target device identifier.

[0014] As an optional implementation manner, the UPF network element obtains pre-configured enterprise AAA server information and user information through the SMF network element, including:

[0015] The UPF network element generates a reception prompt and sends the reception prompt to the SMF network element through the N4 interface;

[0016] The UPF network element receives the pre-configured enterprise AAA server information and user information sent by the SMF network element through the N4 interface based on the reception prompt.

[0017] As an optional implementation manner, sending the EAP request message to the enterprise AAA server according to the enterprise AAA server information and the user information includes:

[0018] The UPF network element determines the device identifier of the terminal according to the EAP request message, and determines whether to send the EAP request message to the enterprise AAA server according to the device identifier and the target device identifier indicated by the user information;

[0019] If so, the UPF network element sends the EAP request message to the enterprise AAA server according to the address of the enterprise AAA server indicated by the enterprise AAA server information.

[0020] As an optional implementation manner, after the UPF network element receives the EAP response message sent by the enterprise AAA server according to the EAP request message, it also includes:

[0021] If the UPF network element determines that the authentication result is an authentication failure, the initial forwarding rule is used as the target forwarding rule.

[0022] As an optional implementation manner, after the UPF network element receives the EAP response message sent by the enterprise AAA server according to the EAP request message, it also includes:

[0023] If the UPF network element determines that the authentication result is successful, the EAP response message is sent to the SMF network element, wherein the EAP response message also includes: the security rules newly generated by the enterprise AAA server;

[0024] The UPF network element receives the forwarding rules generated by the SMF network element according to the security rules, and uses the forwarding rules as target forwarding rules.

[0025] In a second aspect, an embodiment of the present application provides an access authentication method, which is applied to a session management function SMF network element; the method includes:

[0026] The SMF network element generates an initial forwarding rule, wherein the initial forwarding rule is used to indicate the target message type forwarded by the user plane function UPF network element to the enterprise authentication, authorization and accounting AAA server;

[0027] The SMF network element sends the initial forwarding rule to the UPF network element, so that the UPF network element sends the EAP request message to the enterprise AAA server according to the Extensible Authentication Protocol EAP request message sent by the terminal and the initial forwarding rule.

[0028] As an optional implementation, the method further includes:

[0029] The SMF network element receives an EAP response message forwarded by the UPF network element when the authentication result sent by the enterprise AAA server is successful authentication, wherein the EAP response message is sent by the enterprise AAA server to the UPF network element according to the EAP request message, and the EAP response message includes at least the authentication result; the EAP response message also includes: the security rules newly generated by the enterprise AAA server;

[0030] The SMF network element generates a forwarding rule according to the security rule;

[0031] The SMF network element sends the forwarding rule to the UPF network element so that the UPF network element uses the forwarding rule as the target forwarding rule.

[0032] As an optional implementation, the SMF network element generates an initial forwarding rule, including:

[0033] The SMF network element determines whether the enterprise authentication function is enabled;

[0034] If yes, an initial forwarding rule is generated according to the policy control instruction.

[0035] In a third aspect, an embodiment of the present application provides an authentication device, comprising: a processor, a memory and a bus, the memory storing machine-readable instructions executable by the processor, and when the access authentication device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to perform the steps of the access authentication method as described in any one of the first and second aspects above.

[0036] The beneficial effects of this application are:

[0037] The present application provides an access authentication method and device. In the 5G access authentication scenario, the UPF network element receives the EAP request message sent by the 5G terminal, and identifies the EAP request message based on the initial forwarding rule sent in advance by the SMF network element and the EAP message identification function of the UPF network element itself. The EAP request message sent by the 5G terminal is forwarded to the enterprise AAA server, so that the enterprise AAA server performs access authentication on the 5G terminal based on the EAP request message, and receives the EAP response message generated and sent by the enterprise AAA server for access authentication of the 5G terminal based on the EAP request message. The UPF network element directly forwards the EAP request message to the enterprise AAA server, which simplifies the network architecture, reduces the cost of network construction and maintenance, and improves the efficiency and security of message transmission. The UPF network element identifies the EAP request message based on the initial forwarding rule, without adding additional functions to the 5G terminal, and realizes a refined network access control function. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A schematic diagram of the architecture of a 5G access authentication system provided in an embodiment of the present application;

[0040] Figure 2 Schematic diagram of the access authentication method provided in this application embodiment Figure 1 ;

[0041] Figure 3 Schematic diagram of the access authentication method provided in this application embodiment Figure 2 ;

[0042] Figure 4 Schematic diagram of the access authentication method provided in this application embodiment Figure 3 ;

[0043] Figure 5 Schematic diagram of the access authentication method provided in this application embodiment Figure 4 ;

[0044] Figure 6 Schematic diagram of the access authentication method provided in this application embodiment Figure 5 ;

[0045] Figure 7 Schematic diagram of the access authentication method provided in this application embodiment Figure 6 ;

[0046] Figure 8 Schematic diagram of the access authentication method provided in this application embodiment Figure 7 ;

[0047] Fig. 9 Schematic diagram of the access authentication method provided in this application embodiment Figure 8 ;

[0048] Fig.10 The process of the access authentication method provided in the embodiment of the present application Figure 9 ;

[0049] Fig.11 The process of the access authentication method provided in the embodiment of the present application Figure 10 ;

[0050] Fig.12 A schematic diagram of the structure of the access authentication device provided in the embodiment of the present application Figure 1 ;

[0051] Fig.13 A schematic diagram of the structure of the access authentication device provided in the embodiment of the present application Figure 2 ;

[0052] Fig.14 A schematic diagram of the structure of the access authentication device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0053] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0054] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0055] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0056] In the 5G scenario, the enterprise's 5G terminal equipment needs to follow the corresponding security architecture and design when using 5G access. Since 5G has its own security authentication mechanism, it is necessary to integrate the 5G security authentication mechanism with the 802.1x authentication mechanism. At present, 3GPP provides a functional network element for secondary authentication in TS33.501 and TS23.502, which realizes the authentication support in the traditional wired scenario by transmitting the EAP request message and EAP response message required in the 802.1x and EAP schemes in the NAS message between the terminal and the 5G core network, but the premise is that the corresponding 5G terminal equipment needs to support the corresponding functional network element. However, not all terminals currently support this functional network element natively, and although the authentication operation is realized through the transmission of EAP messages, after the authentication is passed, the 5G core network will release all sessions of the corresponding terminal, which lacks the access control function required in 802.1x, and the security is low, resulting in certain limitations in the enterprise authentication in the 5G scenario in the existing technology.

[0057] Based on the above problems, an embodiment of the present application provides an access authentication method, which adds an EAP message identification function in the UPF network element, and uses the UPF forwarding and routing policy association rule (FAP) message of the N4 interface, combined with the EAP message identification function of the UPF network element, to achieve access authentication and network access control functions in 5G scenarios without changing the 5G terminal function, thereby improving the security of enterprise access authentication in 5G scenarios.

[0058] Figure 1 The schematic diagram of the architecture of the 5G access authentication system provided in the embodiment of the present application is as follows: Figure 1 As shown, the 5G access authentication system includes: terminals, user plane function (UPF) network elements, session management function (SMF) network elements, and enterprise authentication (Authentication), authorization (Authorization) and billing (Accounting) servers. Among them, the terminal can be a 5G terminal, the UPF network element communicates with the 5G terminal through the N3 interface, the UPF network element communicates with the SMF network element through the N4 interface, and the UPF network element can communicate with the enterprise AAA server based on multiple protocols, such as Remote Authentication Dial In User Service (RADIUS) protocol or Diameter protocol.

[0059] The UPF network element is used to receive, process and forward user-plane data. Specifically, the UPF network element receives and identifies the EAP request message sent by the 5G terminal when requesting to access the network, and forwards the EAPoL type EAP request message to the enterprise AAA server in accordance with the initial forwarding rules that only allow the Extensible Authentication Protocol over LAN (EAPoL) message to access the enterprise network.

[0060] The SMF network element is used to send the initial forwarding rules to the UPF, and based on the EAP response message sent by the UPF network element when the authentication is successful, it generates new forwarding rules and sends them to the UPF network element, so that the UPF network element can identify and forward subsequent EAP request messages based on the new forwarding rules. The network access control function in the 5G scenario is realized.

[0061] The enterprise AAA server is used to perform access authentication for the 5G terminal based on the EAP request message, generate an EAP response message including the authentication result and send it to the UPF network element, so that the UPF network element forwards the EAP response message to the 5G terminal, thereby realizing access authentication in the 5G scenario without changing the function of the 5G terminal.

[0062] The following, combined Figure 2-Figure 6 The access authentication method performed by the UPF network element provided in this application is described.

[0063] Figure 2 Schematic diagram of the access authentication method provided in this application embodiment Figure 1 The execution subject of this method is the above Figure 1 The UPF network element in the 5G access authentication system shown in FIG. Figure 2 As shown, the method includes:

[0064] S101. A UPF network element receives an Extensible Authentication Protocol (EAP) request message sent by a terminal.

[0065] Optionally, in the 5G access authentication scenario, when the 5G terminal needs to access the network, it will generate an EAP request message in accordance with the EAP protocol and send it to the UPF network element through the N3 interface. The UPF network element receives the EAP request message.

[0066] Among them, the 5G terminal, as the source of the EAP request message, can be various 5G devices used by users, such as smartphones, tablets or laptops. As an authentication framework, EAP defines a set of mechanisms and message formats for identity authentication during the access authentication process. The EAP request message is a message type used in the EAP protocol to start the authentication process. When a 5G terminal attempts to access the network, in order to prove its legal identity, it will generate an EAP request message in accordance with the provisions of the EAP protocol. The EAP request message can include the device identification of the 5G terminal and the authentication request.

[0067] For example, in an enterprise's 5G access authentication network environment, if an employee's mobile phone wants to connect to the enterprise network, the mobile phone, as a 5G terminal, will generate an EAP request message and send it to the UPF network element, indicating its identity (such as employee account and other identifiers) to the enterprise network and requesting identity authentication to obtain access to the network.

[0068] S102. The UPF network element sends an EAP request message to the enterprise authentication, authorization and billing AAA server according to the EAP request message and the initial forwarding rule sent in advance by the session management function SMF network element; wherein the initial forwarding rule is used to indicate the target message type forwarded by the UPF network element to the enterprise AAA server.

[0069] Optionally, the UPF network element receives the initial forwarding rule sent by the SMF network element through the N4 interface in advance, wherein the initial forwarding rule is used to indicate the target message type that the UPF network element forwards to the enterprise AAA server. Exemplarily, in the LAN access authentication scenario, the target message type may be EAPoL, that is, the initial forwarding rule, by default, only allows EAPoL type messages to access the enterprise network, and blocks other types of messages from accessing. EAPoL messages can be used for device identity authentication and key negotiation.

[0070] The UPF network element has an EAP message identification function. Based on its own EAP message identification function, it identifies the EAP request message sent by the 5G terminal and the initial forwarding rule sent in advance by the SMF network element to obtain an identification result. As a proxy, it forwards the EAP request message sent by the 5G terminal to the enterprise AAA server through the RADIUS protocol or the Diameter protocol according to the identification result, so that the enterprise AAA server can perform access authentication on the 5G terminal based on the EAP request message.

[0071] Among them, the UPF network element identifies the EAP request message based on the initial forwarding rules, and can achieve sophisticated network access control functions without adding additional functions to the 5G terminal. The UPF network element forwards the EAP request message to the enterprise AAA server as a proxy, reducing the functional network elements or functional modules dedicated to authentication message forwarding in the 5G access authentication system. No additional external switches or other functional network elements are required, which simplifies the network architecture of the 5G access authentication system and reduces network construction and maintenance costs. In addition, the EAP request message identification and forwarding functions are integrated into the UPF network element, so that user plane data and authentication-related EAP request messages are managed at the same level, improving the network management efficiency.

[0072] S103. The UPF network element receives an EAP response message sent by the enterprise AAA server according to the EAP request message. The EAP response message includes at least an authentication result.

[0073] Optionally, the enterprise AAA server verifies whether the information provided by the 5G terminal matches the information stored in the enterprise AAA server based on the EAP request message and the pre-stored user subscription data and authentication key, and then performs enterprise identity authentication, authorization and authorization on the 5G terminal, generates an EAP response message and sends it to the UPF network element via the RADIUS protocol or the Diameter protocol. The EAP response message includes at least the authentication result given by the enterprise AAA server for the EAP request message, such as authentication success or authentication failure.

[0074] The UPF network element can forward the received EAP response message to the 5G terminal through the N3 interface so that the 5G terminal can clarify its own access authentication status. If the authentication is successful, the 5G terminal can continue with the subsequent network access operation and access the enterprise network resources. The UPF network element forwards the received EAP response message to the 5G terminal, realizing the transmission of the EAP response message from the enterprise AAA server to the 5G terminal, improving the efficiency and security of message transmission.

[0075] In this embodiment, in the 5G access authentication scenario, the UPF network element receives the EAP request message sent by the 5G terminal, and identifies the EAP request message based on the initial forwarding rules sent in advance by the SMF network element and the EAP message identification function of the UPF network element itself. The EAP request message sent by the 5G terminal is forwarded to the enterprise AAA server, so that the enterprise AAA server performs access authentication on the 5G terminal based on the EAP request message, and receives the EAP response message generated and sent by the enterprise AAA server for access authentication of the 5G terminal based on the EAP request message. The UPF network element directly forwards the EAP request message to the enterprise AAA server, which simplifies the network architecture, reduces the cost of network construction and maintenance, and improves the efficiency and security of message transmission. The UPF network element identifies the EAP request message based on the initial forwarding rule, without adding additional functions to the 5G terminal, and realizes a refined network access control function.

[0076] The following describes in detail the process of the UPF network element sending an EAP request message to the enterprise authentication, authorization and accounting AAA server according to the EAP request message and the initial forwarding rule sent in advance by the session management function SMF network element.

[0077] Figure 3 Schematic diagram of the access authentication method provided in this application embodiment Figure 2 ,like Figure 3 As shown, in the above step S102, the UPF network element sends an EAP request message to the enterprise authentication, authorization and accounting AAA server according to the EAP request message and the initial forwarding rule pre-sent by the session management function SMF network element, including:

[0078] S201. The UPF network element identifies the message type of the EAP request message, and determines whether the message type of the EAP request message matches the target message type according to the target message type indicated by the initial forwarding rule.

[0079] Optionally, the EAP protocol defines a specific message format, and the UPF network element parses and identifies the format of the EAP request message based on the EAP message identification function, and then determines the message type of the EAP request message. After identifying the message type of the EAP request message, the UPF network element compares it with the target message type indicated by the initial forwarding rule to determine whether the message type of the EAP request message matches the target message type.

[0080] Specifically, if the message type of the EAP request message is exactly the same as the target message type, for example, the message type of the EAP request message can be an EAP request message of the EAPoL type, that is, an EAP request message of the target message type, the UPF network element determines that the message type of the EAP request message matches the target message type; if the message type of the EAP request message is inconsistent with the target message type, the UPF network element determines that the message type of the EAP request message does not match the target message type.

[0081] S202. If there is a match, the UPF network element obtains the pre-configured enterprise AAA server information and user information through the SMF network element, and sends an EAP request message to the enterprise AAA server based on the enterprise AAA server information and user information, wherein the enterprise AAA server information is used to indicate the address of the enterprise AAA server, and the user information is used to indicate the target device identifier.

[0082] Optionally, if the UPF network element determines that the message type of the EAP request message matches the target message type, it interacts with the SMF network element through the N4 interface to obtain the enterprise AAA server information and user information pre-configured in the SMF network element. The UPF network element establishes a communication connection with the enterprise AAA server based on the enterprise AAA server information and user information, and sends an EAP request message to the enterprise AAA server through the RADIUS protocol or the Diameter protocol.

[0083] Among them, the enterprise AAA server information may include the network address of the enterprise AAA server, such as an Internet Protocol (IP) address, to indicate the address of the enterprise AAA server. The address of the enterprise AAA server indicated by the enterprise AAA server information is the basic information for the UPF network element to establish a communication connection with the enterprise AAA server. The user information may include a unique identifier of the target device, which is used by the enterprise AAA server to identify the user identity of the target device. For example, the enterprise AAA server can query the user's contract information and permission information based on the user information. The target device is a pre-configured terminal device that is allowed to access the enterprise network.

[0084] In this embodiment, the UPF network element parses and identifies the format of the EAP request message based on the EAP message identification function, and then determines the message type of the EAP request message. The UPF network element compares the EAP request message with the target message type indicated by the initial forwarding rule to determine whether the message type of the EAP request message matches the target message type. If they match, it interacts with the SMF network element through the N4 interface to obtain the enterprise AAA server information and user information pre-configured in the SMF network element. According to the enterprise AAA server information and user information, a communication connection is established with the enterprise AAA server, and an EAP request message is sent to the enterprise AAA server through the RADIUS protocol or the Diameter protocol. The UPF network element implements network access control by identifying and matching the type of the EAP request message. Based on the enterprise AAA server information and user information pre-configured in the SMF network element, an EAP request message is sent to the enterprise AAA server, and the terminal access authentication process is securely started.

[0085] The following describes in detail the process by which the UPF network element obtains pre-configured enterprise AAA server information and user information through the SMF network element.

[0086] Figure 4 Schematic diagram of the access authentication method provided in this application embodiment Figure 3 ,like Figure 4 As shown, in the above step S202, the UPF network element obtains the pre-configured enterprise AAA server information and user information through the SMF network element, including:

[0087] S301. The UPF network element generates a receiving prompt and sends the receiving prompt to the SMF network element through the N4 interface.

[0088] Optionally, after the UPF network element determines that the message type of the EAP request message matches the target message type, it generates a reception prompt. The reception prompt is a notification message generated after the UPF receives the EAP request message of the target message type sent by the terminal, indicating that the UPF network element has successfully received the EAP request message of the target message type.

[0089] The N4 interface is the key interface connecting the UPF network element and the SMF network element. It is used to transmit plane control information. The N4 interface allows the UPF network element to send a reception prompt to the SMF network element. Specifically, the UPF network element encapsulates the generated reception prompt into the message format corresponding to the protocol according to the protocol specification of the N4 interface and transmits it to the SMF network element, so that the SMF network element can clearly understand that the UPF network element has successfully received the EAP request message of the target message type according to the received reception prompt, and provide corresponding information feedback.

[0090] S302. The UPF network element receives the pre-configured enterprise AAA server information and user information sent by the SMF network element through the N4 interface according to the reception prompt.

[0091] Optionally, the SMF network element parses the receiving prompt sent by the UPF network element and can determine that the UPF network element has successfully received the EAP request message of the target message type. The SMF network element then encapsulates the enterprise AAA server information and user information pre-configured in itself and combines them according to the message format specified by the N4 interface to ensure that the enterprise AAA server information and user information can be safely and accurately transmitted to the UPF network element on the N4 interface.

[0092] The UPF network element parses the combined information received through the N4 interface and decomposes it into enterprise AAA server information and user information, so as to send an EAP request message to the enterprise AAA server based on the enterprise AAA server information and the user information.

[0093] In this embodiment, the UPF network element determines that the message type of the EAP request message matches the target message type, generates a receiving prompt, and sends it to the SMF network element through the N4 interface to indicate to the SMF network element that the UPF network element has successfully received the EAP request message of the target message type. The UPF network element receives the enterprise AAA server information and user information fed back by the SMF network element based on the receiving prompt through the N4 interface, so as to send an EAP request message to the enterprise AAA server based on the enterprise AAA server information and user information. The UPF network element interacts with the SMF network element through the N4 interface, providing a basis for subsequent communication with the enterprise AAA server.

[0094] The following describes in detail the process of sending an EAP request message to the enterprise AAA server according to the enterprise AAA server information and user information.

[0095] Figure 5 Schematic diagram of the access authentication method provided in this application embodiment Figure 4 ,like Figure 4 As shown, the step of sending an EAP request message to the enterprise AAA server according to the enterprise AAA server information and the user information in the above step S202 includes:

[0096] S401. The UPF network element determines the device identification of the terminal according to the EAP request message, and determines whether to send the EAP request message to the enterprise AAA server according to the device identification and the target device identification indicated by the user information.

[0097] Optionally, the EAP request message sent by the 5G terminal may include the device identification and authentication request of the 5G terminal. The UPF network element performs field parsing on the EAP request message to obtain the device identification of the 5G terminal. The UPF network element determines whether the 5G terminal is a legal access device allowed to access by matching the device identification of the 5G terminal extracted from the EAP request message and the target device identification indicated by the pre-configured user information.

[0098] Specifically, the UPF network element compares the device identifier of the 5G terminal with the target device identifier indicated by the user information to determine whether the device identifier is consistent with the target device identifier. If they are consistent, it means that the 5G terminal is a legal access device. In other words, the 5G terminal is a pre-configured terminal device that is allowed to access the enterprise network. Further authentication procedures are required to complete the access authentication of the 5G terminal. The UPF network element determines that an EAP request message can be sent to the enterprise AAA server.

[0099] If there is inconsistency, it means that the 5G terminal is not a pre-configured terminal device allowed to access the enterprise network, and no further authentication process is required. The UPF network element determines not to send the EAP request message to the enterprise AAA server. In other words, the UPF network element can intercept the EAP request message sent by the 5G terminal to further realize more refined network access control functions.

[0100] S402: If yes, the UPF network element sends an EAP request message to the enterprise AAA server according to the address of the enterprise AAA server indicated by the enterprise AAA server information.

[0101] Optionally, if the UPF network element determines that an EAP request message can be sent to the enterprise AAA server, the EAP request message is encapsulated in a protocol message in accordance with the corresponding protocol, and the EAP request message encapsulated in the protocol message is sent to the enterprise AAA server through the corresponding protocol according to the address of the enterprise AAA server indicated by the enterprise AAA server information, such as the IP address.

[0102] In this embodiment, the UPF network element performs field parsing on the EAP request message to determine the device identifier of the 5G terminal, and performs device identifier matching based on the device identifier of the 5G terminal and the target device identifier indicated by the user information to determine whether the 5G terminal is a legal access device that is allowed to access. If so, the UPF network element determines that an EAP request message can be sent to the enterprise AAA server, and encapsulates the EAP request message in the message of the protocol according to the corresponding protocol, and sends the EAP request message encapsulated in the message of the protocol to the enterprise AAA server through the corresponding protocol according to the address of the enterprise AAA server indicated by the enterprise AAA server information. If not, the EAP request message sent by the 5G terminal is intercepted, and it is determined not to send the EAP request message to the enterprise AAA server. The UPF network element ensures the security and legitimacy of network access by determining and matching the device identifier, ensuring that only terminal devices that meet the user information can enter the subsequent authentication and authorization process, preventing illegal terminal devices from accessing the network, and further realizing a more refined network access control function.

[0103] As an optional implementation manner, after the UPF network element receives the EAP response message sent by the enterprise AAA server according to the EAP request message in the above step S103, the method further includes:

[0104] If the UPF network element determines that the authentication result is an authentication failure, the initial forwarding rule is used as the target forwarding rule.

[0105] Optionally, the UPF network element extracts the authentication result from the EAP response message sent by the enterprise AAA server and makes a judgment based on the authentication result. If the authentication result is marked as a failure mark, the authentication result is determined to be an authentication failure. At this time, the UPF network element directly uses the initial forwarding rule pre-issued by the SMF as the target forwarding rule, and forwards subsequent EAP messages according to the target forwarding rule. In other words, the UPF network element keeps the previous initial forwarding rule unchanged, and forwards subsequent EAP messages according to the initial forwarding rule to prevent the terminal that fails the authentication from bypassing the authentication process to perform illegal data access and network operations.

[0106] In this embodiment, the UPF network element extracts the authentication result from the EAP response message sent by the enterprise AAA server and makes a judgment based on the authentication result. If the authentication result is determined to be an authentication failure, the UPF network element directly uses the initial forwarding rule pre-issued by the SMF as the target forwarding rule, forwards subsequent EAP messages according to the target forwarding rule, and only allows EAP messages of the target message type to pass. This prevents terminals that fail authentication from bypassing the authentication process to access data and perform network operations illegally, ensuring network access security and service reliability.

[0107] Figure 6 Schematic diagram of the access authentication method provided in this application embodiment Figure 5 ,like Figure 6 As shown, in the above step S103, after the UPF network element receives the EAP response message sent by the enterprise AAA server according to the EAP request message, the steps further include:

[0108] S501. If the UPF network element determines that the authentication result is successful, it sends an EAP response message to the SMF network element, where the EAP response message also includes: the security rules newly generated by the enterprise AAA server.

[0109] Optionally, if the identification of the authentication result is a success identification, the UPF determines that the authentication result is a successful authentication. When the authentication is successful, the EAP response message includes not only the authentication result but also the security rules newly generated by the enterprise AAA server. At this time, the UPF network element forwards the EAP response message sent by the enterprise AAA server to the SMF network element through the N4 interface, so that the SMF extracts the security rules newly generated by the enterprise AAA server from the EAP response message.

[0110] S502. The UPF network element receives the forwarding rules generated by the SMF network element according to the security rules, and uses the forwarding rules as the target forwarding rules.

[0111] Optionally, the UPF network element receives the forwarding rules corresponding to the security rules generated by the SMF network element based on the security rules through the N4 interface, and uses the forwarding rules as the target forwarding rules to forward subsequent EAP messages according to the forwarding rules. Among them, the forwarding rules are used to indicate the new target message type that the UPF network element forwards to the enterprise AAA server. That is, the UPF network element can allow EAP messages of the new target message type to pass through, and filter and intercept EAP messages that do not conform to the new target message type.

[0112] In this embodiment, if the identification of the authentication result is a success identification, the UPF determines that the authentication result is a successful authentication. The UPF network element forwards the EAP response message sent by the enterprise AAA server to the SMF network element through the N4 interface, so that the SMF extracts the newly generated security rules of the enterprise AAA server from the EAP response message. The UPF network element receives the forwarding rules corresponding to the security rules generated by the SMF network element based on the security rules through the N4 interface, and uses the forwarding rules as the target forwarding rules, and forwards subsequent EAP messages according to the forwarding rules. The UPF network element allows EAP messages of the new target message type indicated by the target forwarding rule to pass, and filters and intercepts EAP messages that do not meet the new target message type. The flexibility and security of network access control are improved.

[0113] The following, combined Figure 7-Figure 9 The access authentication method performed by the SMF network element provided in this application is described.

[0114] Figure 7 Schematic diagram of the access authentication method provided in this application embodiment Figure 6 The execution subject of this method is the aforementioned Figure 1 The SMF network element in the 5G access authentication system shown in FIG. Figure 7 As shown, the method includes:

[0115] S601. The SMF network element generates an initial forwarding rule, wherein the initial forwarding rule is used to indicate the target message type that the user plane function UPF network element forwards to the enterprise authentication, authorization and billing AAA server.

[0116] Optionally, in a 5G network environment, especially when it comes to network services for enterprise users, in order to ensure network security, service quality and user experience, it is necessary to manage the transmission of network data in a refined manner. As the core part of the session management function, the SMF network element generates initial forwarding rules based on the overall strategy and service requirements of the enterprise network to guide the UPF network element to correctly process and forward different types of messages. Among them, the initial forwarding rules are used to indicate the target message type that the UPF network element forwards to the enterprise AAA server to ensure that during the authentication, authorization and billing process, only messages of the target message type can be correctly transmitted between the UPF network element and the enterprise AAA server, preventing unauthorized messages from entering the enterprise AAA server. Exemplarily, in a LAN access authentication scenario, the target message type can be EAPoL.

[0117] S602. The SMF network element sends an initial forwarding rule to the UPF network element, so that the UPF network element sends an EAP request message to the enterprise AAA server according to the Extensible Authentication Protocol EAP request message sent by the terminal and the initial forwarding rule.

[0118] Optionally, the SMF network element pre-sends the initial forwarding rules to the UPF network element through the N4 interface, so that the UPF network element sends an EAP request message to the enterprise AAA server based on its own EAP message identification function, the EAP request message sent by the 5G terminal, and the initial forwarding rules pre-sent by the SMF network element.

[0119] It is worth noting that the process of the UPF network element sending an EAP request message to the enterprise AAA server can refer to the steps of the aforementioned embodiment and will not be repeated here.

[0120] In this embodiment, the SMF network element, as the core part of the session management function, generates initial forwarding rules according to the overall strategy and service requirements of the enterprise network to guide the UPF network element to correctly process and forward different types of messages. The SMF network element pre-sends the initial forwarding rules to the UPF network element through the N4 interface, so that the UPF network element sends an EAP request message to the enterprise AAA server based on its own EAP message identification function, the EAP request message sent by the 5G terminal, and the initial forwarding rules pre-sent by the SMF network element. The initial forwarding rules are used to indicate the target message type that the UPF network element forwards to the enterprise AAA server to ensure that only messages of the target message type can be correctly transmitted between the UPF network element and the enterprise AAA server during the authentication, authorization, and billing process, preventing unauthorized messages from entering the enterprise AAA server. The security of network access authentication is guaranteed, and the network access control function is realized.

[0121] Figure 8 Schematic diagram of the access authentication method provided in this application embodiment Figure 7 ,like Figure 8 As shown, the method also includes:

[0122] S701, the SMF network element receives the EAP response message forwarded by the UPF network element when the authentication result sent by the enterprise AAA server is successful authentication, wherein the EAP response message is sent by the enterprise AAA server to the UPF network element according to the EAP request message, and the EAP response message includes at least the authentication result; the EAP response message also includes: the security rules newly generated by the enterprise AAA server.

[0123] Optionally, after receiving the EAP request message forwarded by the UPF network element, the enterprise AAA server performs an authentication operation on the terminal according to the user authentication information stored in itself, checks whether the information provided by the terminal matches the stored information, and generates an EAP request message and sends it to the UPF network element. The EAP response message includes at least the authentication result, and when the authentication result is successful, the EAP response message also includes the security rules newly generated by the enterprise AAA server.

[0124] When the authentication result is successful, the SMF network element receives the EAP response message forwarded by the UPF network element, and extracts the security rules newly generated by the enterprise AAA server from the EAP response message.

[0125] S702. The SMF network element generates forwarding rules based on security rules.

[0126] Optionally, the SMF network element generates new forwarding rules corresponding to the security rules based on the security rules newly generated by the enterprise AAA server. The new forwarding rules are used to indicate the new target message type that the UPF forwards to the enterprise AAA server, so as to guide the UPF network element to allow EAP messages of the new target message type to pass through, and to filter and intercept EAP messages that do not conform to the new target message type.

[0127] For example, if the newly generated security rules of the enterprise AAA server stipulate that only messages of a certain specific message type are allowed to access the enterprise AAA server, the SMF network element will generate corresponding forwarding rules, instructing the UPF network element to only allow data of this specific message type to flow to the enterprise AAA server.

[0128] S703. The SMF network element sends the forwarding rules to the UPF network element so that the UPF network element uses the forwarding rules as the target forwarding rules.

[0129] Optionally, the SMF network element re-sends the newly generated forwarding rules to the UPF network element through the N4 interface, so that the UPF network element uses the forwarding rules as target forwarding rules, and in the subsequent message forwarding processing, allows EAP messages of the new target message type indicated by the target forwarding rules to pass, and intercepts and filters EAP messages that do not conform to the new target message type.

[0130] In this embodiment, when the authentication result is successful authentication, the SMF network element receives the EAP response message forwarded by the UPF network element, and extracts the security rules newly generated by the enterprise AAA server from the EAP response message. According to the security rules newly generated by the enterprise AAA server, a new forwarding rule corresponding to the security rule is generated and sent to the UPF network element through the N4 interface, so that the UPF network element uses the forwarding rule as the target forwarding rule, and guides the UPF network element to allow the EAP message of the new target message type indicated by the target forwarding rule to pass in the subsequent message forwarding process, and intercept and filter the EAP message that does not meet the new target message type. Improve the flexibility and security of network access control.

[0131] The following is a detailed description of the process of generating initial forwarding rules by the SMF network element.

[0132] Fig. 9 Schematic diagram of the access authentication method provided in this application embodiment Figure 8 ,like Figure 8 As shown, the step of the SMF network element generating the initial forwarding rule in the above step S601 includes:

[0133] S801. The SMF network element determines whether the enterprise authentication function is enabled.

[0134] Optionally, the SMF network element can determine whether the enterprise authentication function is enabled based on a local configuration file or by checking a database. Specifically, the local configuration file of the SMF network element stores configuration information of various network services and functions, and the SMF network element determines whether the enterprise authentication function is enabled by reading the flag of the enterprise authentication function. Alternatively, the SMF network element stores key network configuration information in a database, and determines whether the enterprise authentication function is enabled by querying the configuration items of the enterprise authentication function in the database.

[0135] It is worth mentioning that the SMF network element can also interact with the Policy Control Function (PCF) network element through the N7 interface, and determine whether the enterprise authentication function is enabled based on the policy information sent by the PCF network element.

[0136] S802: If yes, generate an initial forwarding rule according to the policy control instruction.

[0137] Optionally, if the SMF network element determines that the enterprise authentication function is turned on, it receives the policy control instructions sent by the PCF network element through the N7 interface, and generates initial forwarding rules based on the policy control instructions. Specifically, the PCF network element generates policy control instructions based on factors such as the overall network strategy, user contract information, service requirements, and real-time network status. The policy control instructions can indicate the target message types that the enterprise AAA server is allowed to receive. The SMF network element generates corresponding initial forwarding rules based on the policy control instructions. The initial forwarding rules are used to indicate the target message types that the UPF network element forwards to the enterprise AAA server.

[0138] In this embodiment, the SMF network element determines whether the enterprise authentication function is enabled based on the local configuration file, checking the database, or interacting with other network elements. If so, it receives the policy control instruction sent by the PCF network element, and generates an initial forwarding rule for instructing the UPF network element to forward the target message type to the enterprise AAA server according to the policy control instruction. In order to guide the UPF network element to perform refined network access control.

[0139] The following, combined Fig.10 and Fig.11 The complete process of enterprise access authentication in 5G scenarios is described in detail.

[0140] Fig.10 The process of the access authentication method provided in the embodiment of the present application Figure 9 , Fig.11 The process of the access authentication method provided in the embodiment of the present application Figure 10 ,like Fig.10 and Fig.11As shown, after the enterprise authentication function is enabled, the SMF network element sends the initial forwarding rules to the UPF. The initial forwarding rules are used to guide the UPF network element to only allow EAPoL type messages to access the enterprise AAA server by default, and intercept other types of messages. When the 5G terminal has an access request, it initiates an EAP request message to the UPF network element. The UPF network element supports the EAP message identification function. When the EAP request message is identified as EAPoL type based on the initial forwarding rules, it sends a receiving prompt to the SMF network element. The SMF network element feeds back the pre-configured enterprise AAA server and user information to the UPF network element. When the target device identifier indicated by the user information is consistent with the device identifier of the 5G terminal, the UPF network element forwards the EAP request message to the enterprise AAA server as a proxy. The enterprise AAA server performs enterprise authentication and certification based on the EAP request message, generates an EAP response message and feeds it back to the UPF network element. After the UPF network element forwards the EAP response message to the 5G terminal, it makes a judgment based on the authentication result included in the EAP response message.

[0141] Reference Fig.10 If the authentication result is authentication failure, UPF will continue to keep the current initial forwarding rule unchanged, use the initial forwarding rule as the target forwarding rule, and continue to forward subsequent EAP messages according to the initial forwarding rule, that is, only EAPoL type messages are allowed to be sent to the enterprise AAA server, and other types of messages are intercepted and filtered. This can prevent the terminal that fails the authentication from bypassing the authentication process to perform illegal data access and network operations, ensuring network access security and service reliability.

[0142] Reference Fig.11 If the authentication result is successful, the EAP response message also includes the security rules newly generated by the enterprise AAA server. The UPF forwards the EAP response message to the SMF network element. The SMF network element generates corresponding forwarding rules based on the security rules newly generated by the enterprise AAA server and sends them to the UPF network element. The UPF network element updates the forwarding rules newly sent by the SMF network element to the target forwarding rules, and forwards subsequent EAP messages according to the target forwarding rules. The UPF network element allows EAP messages of the new target message type indicated by the target forwarding rules to pass, intercepts and filters EAP messages that do not meet the new target message type, and improves the flexibility and security of network access control. Refined network access control is achieved.

[0143] Based on the same inventive concept, an access authentication device corresponding to the access authentication method is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the above-mentioned access authentication method in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0144] Fig.12A schematic diagram of the structure of the access authentication device provided in the embodiment of the present application Figure 1 , the device can be applied to UPF network elements. Fig.12 As shown, the device comprises:

[0145] The receiving module 901 is configured to receive an Extensible Authentication Protocol (EAP) request message sent by a terminal.

[0146] The sending module 902 is used to send an EAP request message to the enterprise authentication, authorization and billing AAA server according to the EAP request message and the initial forwarding rule sent in advance by the session management function SMF network element; wherein the initial forwarding rule is used to indicate the target message type forwarded by the UPF network element to the enterprise AAA server.

[0147] The receiving module 901 is further configured to receive an EAP response message sent by the enterprise AAA server according to the EAP request message, where the EAP response message at least includes an authentication result.

[0148] As an optional implementation manner, the sending module 902 is specifically configured to:

[0149] The message type of the EAP request message is identified, and it is determined whether the message type of the EAP request message matches the target message type according to the target message type indicated by the initial forwarding rule.

[0150] If there is a match, the pre-configured enterprise AAA server information and user information are obtained through the SMF network element, and an EAP request message is sent to the enterprise AAA server based on the enterprise AAA server information and user information, where the enterprise AAA server information is used to indicate the address of the enterprise AAA server, and the user information is used to indicate the target device identifier.

[0151] As an optional implementation manner, the sending module 902 is specifically configured to:

[0152] Generate a receive prompt and send it to the SMF network element through the N4 interface.

[0153] The receiving SMF network element receives the pre-configured enterprise AAA server information and user information sent through the N4 interface based on the receiving prompt.

[0154] As an optional implementation manner, the sending module 902 is specifically configured to:

[0155] According to the EAP request message, the device identification of the terminal is determined, and according to the device identification and the target device identification indicated by the user information, it is determined whether to send the EAP request message to the enterprise AAA server.

[0156] If so, an EAP request message is sent to the enterprise AAA server according to the address of the enterprise AAA server indicated by the enterprise AAA server information.

[0157] As an optional implementation, the device further includes:

[0158] The determination module 903 is configured to use the initial forwarding rule as the target forwarding rule if the authentication result is determined to be an authentication failure.

[0159] As an optional implementation manner, the determining module 903 is further configured to:

[0160] If the authentication result is determined to be successful, an EAP response message is sent to the SMF network element, where the EAP response message also includes: the security rules newly generated by the enterprise AAA server.

[0161] Receive the forwarding rules generated by the SMF network element according to the security rules, and use the forwarding rules as the target forwarding rules.

[0162] For the description of the processing flow of each module in the device and the interaction flow between each module, please refer to the relevant description of the method steps executed by the UPF network element in the above method embodiment, which will not be described in detail here.

[0163] Fig.13 A schematic diagram of the structure of the access authentication device provided in the embodiment of the present application Figure 2 , the device can be applied to SMF network elements. Fig.13 As shown, the device comprises:

[0164] The generation module 1001 is used to generate an initial forwarding rule, wherein the initial forwarding rule is used to indicate the target message type forwarded by the user plane function UPF network element to the enterprise authentication, authorization and accounting AAA server.

[0165] The sending module 1002 is used to send an initial forwarding rule to the UPF network element, so that the UPF network element sends an EAP request message to the enterprise AAA server according to the Extensible Authentication Protocol EAP request message sent by the terminal and the initial forwarding rule.

[0166] As an optional implementation, the device further includes:

[0167] The receiving module 1003 is used to receive the EAP response message forwarded by the UPF network element when the authentication result sent by the enterprise AAA server is successful authentication, wherein the EAP response message is sent by the enterprise AAA server to the UPF network element according to the EAP request message, and the EAP response message includes at least the authentication result; the EAP response message also includes: the security rules newly generated by the enterprise AAA server.

[0168] The generating module 1001 is further used to generate a forwarding rule according to the security rule.

[0169] The sending module 1002 is also used to send the forwarding rules to the UPF network element so that the UPF network element uses the forwarding rules as target forwarding rules.

[0170] As an optional implementation, the generating module 1001 is specifically used for:

[0171] Determine whether the enterprise authentication function is enabled.

[0172] If yes, an initial forwarding rule is generated according to the policy control instruction.

[0173] For the description of the processing flow of each module in the device and the interaction flow between each module, please refer to the relevant description of the method steps executed by the SMF network element in the above method embodiment, which will not be described in detail here.

[0174] Fig.14 This is a schematic diagram of the structure of the access authentication device provided in the embodiment of the present application. The device can be implemented by the above-mentioned UPF network element and SMF network element. Fig.14 As shown, the device includes: a processor 111, a memory 112 and a bus 113. The memory 112 stores machine-readable instructions executable by the processor 111. When the access authentication device is running, the processor 111 communicates with the memory 112 through the bus 113. The processor 111 executes the machine-readable instructions to execute the steps of the access authentication method executed by the above-mentioned UPF network element and SMF network element.

[0175] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the access authentication method described in the above embodiment are executed.

[0176] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the modules is only a logical function network element division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0177] In addition, each functional network element unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the functional network element is implemented in the form of a software functional network element unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

[0178] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. An access authentication method, characterized in that: Applied to a user plane function UPF network element; the method comprises: The UPF network element receives an Extensible Authentication Protocol EAP request message sent by the terminal; The UPF network element sends the EAP request message to the enterprise authentication, authorization and accounting AAA server according to the EAP request message and the initial forwarding rule sent in advance by the session management function SMF network element; wherein the initial forwarding rule is used to indicate the target message type forwarded by the UPF network element to the enterprise AAA server; The UPF network element receives an EAP response message sent by the enterprise AAA server according to the EAP request message, and the EAP response message includes at least an authentication result.

2. The method according to claim 1, characterized in that: The UPF network element sends the EAP request message to the enterprise authentication, authorization and accounting AAA server according to the EAP request message and the initial forwarding rule sent in advance by the session management function SMF network element, including: The UPF network element identifies the message type of the EAP request message, and determines whether the message type of the EAP request message matches the target message type according to the target message type indicated by the initial forwarding rule; If there is a match, the UPF network element obtains the pre-configured enterprise AAA server information and user information through the SMF network element, and sends the EAP request message to the enterprise AAA server based on the enterprise AAA server information and the user information, wherein the enterprise AAA server information is used to indicate the address of the enterprise AAA server, and the user information is used to indicate the target device identifier.

3. The method according to claim 2, characterized in that The UPF network element obtains pre-configured enterprise AAA server information and user information through the SMF network element, including: The UPF network element generates a reception prompt and sends the reception prompt to the SMF network element through the N4 interface; The UPF network element receives the pre-configured enterprise AAA server information and user information sent by the SMF network element through the N4 interface based on the reception prompt.

4. The method according to claim 2, characterized in that: The sending the EAP request message to the enterprise AAA server according to the enterprise AAA server information and the user information includes: The UPF network element determines the device identifier of the terminal according to the EAP request message, and determines whether to send the EAP request message to the enterprise AAA server according to the device identifier and the target device identifier indicated by the user information; If so, the UPF network element sends the EAP request message to the enterprise AAA server according to the address of the enterprise AAA server indicated by the enterprise AAA server information.

5. The method according to claim 1, characterized in that After the UPF network element receives the EAP response message sent by the enterprise AAA server according to the EAP request message, it also includes: If the UPF network element determines that the authentication result is an authentication failure, the initial forwarding rule is used as the target forwarding rule.

6. The method according to claim 1, characterized in that After the UPF network element receives the EAP response message sent by the enterprise AAA server according to the EAP request message, it also includes: If the UPF network element determines that the authentication result is successful, the EAP response message is sent to the SMF network element, wherein the EAP response message also includes: the security rules newly generated by the enterprise AAA server; The UPF network element receives the forwarding rules generated by the SMF network element according to the security rules, and uses the forwarding rules as target forwarding rules.

7. An access authentication method, characterized in that: Applied to a session management function SMF network element; the method comprises: The SMF network element generates an initial forwarding rule, wherein the initial forwarding rule is used to indicate the target message type forwarded by the user plane function UPF network element to the enterprise authentication, authorization and accounting AAA server; The SMF network element sends the initial forwarding rule to the UPF network element, so that the UPF network element sends the EAP request message to the enterprise AAA server according to the Extensible Authentication Protocol EAP request message sent by the terminal and the initial forwarding rule.

8. The method according to claim 7, characterized in that The method further comprises: The SMF network element receives an EAP response message forwarded by the UPF network element when the authentication result sent by the enterprise AAA server is successful authentication, wherein the EAP response message is sent by the enterprise AAA server to the UPF network element according to the EAP request message, and the EAP response message includes at least the authentication result; the EAP response message also includes: the security rules newly generated by the enterprise AAA server; The SMF network element generates a forwarding rule according to the security rule; The SMF network element sends the forwarding rule to the UPF network element so that the UPF network element uses the forwarding rule as the target forwarding rule.

9. The method according to claim 7, characterized in that: The SMF network element generates an initial forwarding rule, including: The SMF network element determines whether the enterprise authentication function is enabled; If yes, an initial forwarding rule is generated according to the policy control instruction.

10. An access authentication device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the access authentication device is running, the processor communicates with the memory via the bus, and the processor executes the machine-readable instructions to perform the steps of the access authentication method as described in any one of claims 1-9.

Images