Network control method, device and equipment

Abstract

The embodiment of the invention discloses a network control method, device and equipment, and the method comprises the steps: determining the address information of a received message; the session information is searched based on the address information of the message, the type of the terminal corresponding to the message is determined based on the session information, the types comprise a first type and a second type, the first type represents that the terminal accesses a core network based on the wireless local area network, and the second type represents that the terminal accesses a data network based on the wireless local area network; and forwarding the message based on the type of the terminal.

Description

Technical Field

[0001] The present application relates to but is not limited to the field of communication technology, and in particular to a network control method, device and equipment. Background Art

[0002] When many enterprises deploy core networks in office areas, there may be an existing wireless network environment in the office area. In order to reduce costs, enterprises do not want to purchase additional network equipment when deploying core networks. Instead, they hope to follow the principle of reuse and connect the network equipment used in the previous wireless network environment to the core network. However, in existing application scenarios, only specified types of network equipment can be used to connect network equipment to the core network. If the existing network equipment in the office area is not compatible with the core network, the reuse principle proposed by the enterprise cannot be met, resulting in low customer satisfaction. Summary of the invention

[0003] In view of this, the embodiments of the present application at least provide a network control method, device and equipment.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] On the one hand, an embodiment of the present application provides a network control method, the method comprising:

[0006] Determine the address information of the received message;

[0007] Searching for session information based on the address information of the message, and determining the type of the terminal corresponding to the message based on the search result of the session information, the type including a first type and a second type, the first type characterizing that the terminal accesses the core network based on the wireless local area network, and the second type characterizing that the terminal accesses the data network based on the wireless local area network;

[0008] Forward the message based on the terminal type.

[0009] On the other hand, an embodiment of the present application provides a network control device, applied to a first device, including:

[0010] A first determining module, used to determine address information of a received message;

[0011] A second determination module is used to search for session information based on the address information of the message, and determine the type of the terminal corresponding to the message based on the search result of the session information, where the type includes a first type and a second type, the first type characterizing that the terminal accesses the core network based on the wireless local area network, and the second type characterizing that the terminal accesses the data network based on the wireless local area network;

[0012] The forwarding module is used to forward messages based on the type of terminal.

[0013] On the other hand, an embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0014] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0016] Figure 1 A schematic diagram of an implementation flow of a network control method provided in an embodiment of the present application;

[0017] Figure 2 A schematic diagram of an implementation method of mutual access between an N5CW device and a STA device in a related technology provided in an embodiment of the present application;

[0018] Figure 3 A schematic diagram of a local forwarding mode and a centralized forwarding mode provided in an embodiment of the present application;

[0019] Figure 4 A schematic diagram of a network method compatible with a third-party WLAN provided in an embodiment of the present application;

[0020] Figure 5A A schematic diagram of the implementation process of a method for connecting an N5CW device to a core network based on an established WLAN environment provided in an embodiment of the present application Figure 1 ;

[0021] Figure 5B A schematic diagram of the implementation process of a method for connecting an N5CW device to a core network based on an established WLAN environment provided in an embodiment of the present application Figure 2 ;

[0022] Figure 6 A schematic diagram of an implementation flow of a method for transmitting an uplink message provided in an embodiment of the present application;

[0023] Figure 7 A schematic diagram of a process flow for implementing a method for transmitting a downlink message provided in an embodiment of the present application;

[0024] Figure 8 A schematic diagram of the structure of a network control device provided in an embodiment of the present application;

[0025] Fig. 9A hardware entity diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application are further elaborated in detail below in conjunction with the drawings and embodiments. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0027] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0028] It should be pointed out that the terms "first\second\third" involved in the embodiments of the present application are merely to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0029] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as the general understanding of those skilled in the art in the field to which the embodiments of the present application belong. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0030] Before describing the embodiments of the present application, the nouns and terms involved in the embodiments of the present application are described. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0031] PDU (Protocol Data Unit) session: It is a key function of the 5G system and provides a connection for the terminal to reach the core network. The PDU session can be regarded as a logical connection between the terminal and the core network, providing the terminal with a user plane connection to the core network.

[0032] DHCP (Dynamic Host Configuration Protocol): is a network protocol whose main function is to automatically assign IP addresses and other related network configuration parameters to devices in the network.

[0033] TWAN (Trusted WLAN Access Network) equipment: proposed by 3GPP, it has the function of connecting devices that do not have core network access capabilities to the core network through a trusted WLAN access network.

[0034] 5GC (5G Core Network): It is a key network component in the fifth generation mobile communication system (5G), responsible for processing and controlling various data and information flows in the network, as well as providing connections and interactions with other networks. 5GC consists of multiple core network elements, each of which has specific functions:

[0035] AMF (Access and Mobility Management Function): responsible for terminal access management and mobility management, including terminal authentication, authorization, location management and session management.

[0036] SMF (Session Management Function): responsible for the establishment, modification and release of terminal sessions, as well as the management and billing of data traffic.

[0037] UPF (User Plane Function): responsible for forwarding and processing terminal data, providing high-speed transmission and filtering functions of data packets.

[0038] AUSF (Authentication Server Function): responsible for terminal authentication and key generation, providing secure and reliable authentication services.

[0039] UDM (Unified Data Management): stores and manages user contract information and related data.

[0040] PCF (Policy Control Function): responsible for resource management and allocation based on terminal requirements and network policies, and providing personalized network services.

[0041] NSSF (Network Slice Selection Function): selects appropriate network slices according to business needs and provides a customized network environment.

[0042] NRF (Network Repository Function): stores and manages relevant information and data in the network, supports network function discovery and service registration.

[0043] NEF (Network Exposure Function): Provides an open API interface, supports the access and integration of third-party applications, and promotes the openness and innovation of the network.

[0044] RAN (Radio Access Network): The wireless part of the mobile communication network, responsible for connecting terminals (such as mobile phones, tablets, etc.) to the core network. It is mainly composed of base stations, base station controllers and related wireless transmission and access equipment.

[0045] The present application embodiment provides a network control method, which is applied to a first device, such as Figure 1 As shown, it includes steps S101 to S103:

[0046] Step S101: determining the address information of the received message;

[0047] Here, the address information is a digital label used to identify a device in a network. For example, the address information may be an IP (Internet Protocol) address.

[0048] A message refers to a data block organized by the sender according to a certain format and rules during the communication process, which contains the complete data information to be sent. For example, a message may include an uplink message and a downlink message, where an uplink message refers to a data message sent from a client (or terminal) to a server (or central device), and a downlink message refers to a data message sent from a server (or central device) to a client (or terminal).

[0049] The first device refers to a device that has the ability to access a device that does not have 5G access capability to the 5G core network (5GC). For example, the first device may be a TWAN device.

[0050] Step S102: searching for session information based on the address information of the message, and determining the type of the terminal corresponding to the message based on the search result of the session information, where the type includes a first type and a second type, where the first type represents a terminal accessing a core network based on a wireless local area network, and the second type represents a terminal accessing a data network based on a wireless local area network;

[0051] Here, session information refers to various data and information involved in the temporary connection or communication relationship established between the terminal and the core network to complete a task. For example, session information may include session identification, session protocol, and tunnel information. Terminal refers to a device that can access the communication network to achieve data communication and interaction. These devices usually have a user interface, can receive user input, and send data to other devices in the network. For example, terminals may include mobile phones, computers, tablets, smart TVs, etc. Wireless local area network is a computer network based on wireless communication technology. It uses wireless signals instead of traditional wired cable connections to achieve data transmission and communication between devices. The core network is a key component of the communication network. It is mainly responsible for connecting the access network with other networks and managing and distributing data in the network. For example, the core network can be 5GC.

[0052] Data Network (DN) refers to a network system that connects various computing devices and services and allows data to be transmitted between different nodes.

[0053] In some embodiments, address information and session information are stored in the first device, and there is a correspondence between the address information and the session information, wherein the correspondence between the address information and the session information can be implemented in the form of a dictionary, in the form of a key-value pair, or in the form of a data table.

[0054] In some implementations, the correspondence between the address information and the session information may be used to determine whether the first device stores session information corresponding to the address information, thereby determining the type of the terminal based on the search result of the session information corresponding to the address information.

[0055] In some embodiments, the first type may be an N5CW (Non-5G-Capable over WLAN) device, and the second type of terminal may be a STA (Station) device, wherein the STA device and the N5CW device belong to the same device in terms of hardware, and are devices that only have WIFI access capabilities, such as tablets, laptops, and mobile phones without SIM cards. N5CW devices refer to the classification of devices that can be accessed to the core network through certain means, such as AP (Access Point), and STA devices refer to the classification of devices that are only used in a WIFI environment and are managed by AC (Access Controller) instead of going through the core network.

[0056] Step S103: forwarding the message based on the type of the terminal.

[0057] In some implementations, after the type of the terminal is determined, the message may be sent to a receiving end corresponding to the terminal in a message transmission manner corresponding to the type of the terminal.

[0058] In an embodiment of the present application, first, based on the address information in the received message, it is determined whether the session information with the address information is stored in the first device, thereby determining the type of the terminal. In this way, the message can be transmitted in a message transmission mode corresponding to the type of the terminal. In this way, the first device can open up data channels between different types of terminals and corresponding data access networks (such as a core network or a data network) without replacing the network device corresponding to the wireless local area network, and can realize the transmission of messages between different types of terminals and their corresponding data access networks. This not only complies with the principle of reusing old things proposed by customers and improves customer satisfaction, but also realizes unified management and message forwarding of different types of terminals.

[0059] In some embodiments, the message is an uplink message, and the receiving end of the message includes a core network or a data network. The above step S103 forwards the message based on the type of the terminal, including step S1031 and step S1032:

[0060] Step S1031: when the type of the terminal is the first type, determine the tunnel information of the message, encapsulate the message according to the tunnel information, and send the encapsulated message to the core network;

[0061] Here, the tunnel information is used to identify relevant information of the tunnel between the terminal and the core network.

[0062] In some implementations, the uplink message may be a message sent by a first type of terminal device to the core network.

[0063] In some embodiments, when the terminal type is the first type, after receiving the uplink message, the first device determines the tunnel information through the address information in the uplink message, so that the tunnel between the terminal and the core network can be determined based on the tunnel information, thereby transmitting the messages between the terminal and the core network through the tunnel, wherein the tunnel can be a GTP (GPRS Tunneling Protocol, General Packet Radio Service Tunneling Protocol) tunnel, which realizes the interaction between the first type of terminal and the core network through the first device.

[0064] In some implementations, when the first device receives a message sent by the terminal, it re-encapsulates the message using a tunnel protocol and then sends it through the tunnel.

[0065] For example, taking the first device as TWAN, after TWAN queries the tunnel information corresponding to the address information, TWAN encapsulates the uplink message according to the tunnel protocol, and sends the encapsulated uplink message from the N3 interface to the core network through the tunnel corresponding to the tunnel information.

[0066] Step S1032: When the terminal type is the second type, forward the message to the data network.

[0067] In some implementations, the uplink message may be a message sent by the second type of terminal device to the data network.

[0068] In some embodiments, when the terminal type is the second type, after receiving the uplink message, the second device determines that the sender of the message is the second type of terminal through the address information in the uplink message, and the first device sends the uplink message to the data network, thereby realizing the interaction between the second type of terminal and the data network through the first device.

[0069] In the above embodiment, two different types of transmission methods for uplink messages of terminals are proposed, wherein for the first type of terminal, the first device sends the uplink message to the core network through the tunnel corresponding to the tunnel information, and for the second type of terminal, the first device can send the uplink message to the data network, thereby realizing unified management of different transmission methods for uplink messages of different types of terminals.

[0070] In some embodiments, the message is a downlink message, and the receiving end of the message includes a terminal. The above step S103, based on the type of the terminal, forwards the message, including step S1033 and step S1034:

[0071] Step S1033: when the type of the terminal is the first type, determine the tunnel information of the message, decapsulate the message according to the tunnel information, and send the decapsulated message to the terminal;

[0072] In some implementations, the downlink message may be a message sent by the core network to the first type of terminal.

[0073] In some embodiments, when the first device receives a downlink message sent by the core network, it uses a tunnel protocol to decapsulate the message and determines the tunnel information for sending the downlink message, thereby searching for identification information of the terminal corresponding to the tunnel information through the tunnel information, and then sending the decapsulated message to the terminal corresponding to the identification information, thereby realizing interaction between the first type of terminal and the core network through the first device.

[0074] Step S1034: when the type of the terminal is the second type, forward the message to the terminal.

[0075] In some implementations, the downlink message may be a message sent by the data network to the second type of terminal.

[0076] In some embodiments, when the first device receives a downlink message sent by the data network, it determines the identification information of the terminal corresponding to the address information based on the address information in the downlink message, and sends the downlink message to the terminal corresponding to the identification information, thereby enabling the second type of terminal to interact with the data network through the first device.

[0077] In the above embodiment, two different types of transmission methods for downlink messages of terminal devices are proposed, wherein for the first type of terminal, the first device receives the downlink message through the tunnel corresponding to the tunnel information, decapsulates the downlink message, and sends the decapsulated downlink message to the terminal; for the second type of terminal, the first device can send the downlink message to the terminal, thereby realizing unified management of different transmission methods for downlink messages of different types of terminals.

[0078] In some embodiments, the above step S102, searching for session information based on the address information of the message, and determining the type of the terminal corresponding to the message based on the search result of the session information, may include steps S1021 to S1023:

[0079] Step S1021: determining whether session information of the terminal is stored in the first device based on the address information of the message;

[0080] In some implementations, the address information and the session information are stored correspondingly, so that the session information of the terminal can be searched through the address information of the message.

[0081] In some implementations, the session information is stored in a storage area of ​​the first device, where the storage area may be a data table of the first device or a cache area of ​​the first device.

[0082] In some implementations, the session information is generated when a PDU session between the terminal and the core network is established.

[0083] Step S1022: When the session information of the terminal is stored in the first device, determining that the type of the terminal is the first type;

[0084] Here, the receiving end of the message sent by the first type of terminal is the core network. Therefore, before the first type of terminal transmits the message to the core network, it is necessary to establish a PDU session between the first type of terminal and the core network, and in the process of establishing the PDU session between the first type of terminal and the core network, the generated session information between the first type of terminal and the core network is stored.

[0085] Step S1023: When the session information of the terminal is not stored in the first device, determine that the type of the terminal is the second type.

[0086] Here, the first device stores session information between the first type of device and the core network. Therefore, when it is determined that the session information corresponding to the address information in the message is not stored in the first device, it can be determined that the terminal corresponding to the message is of the second type.

[0087] In the above embodiment, the type of terminal corresponding to the message can be distinguished through the session information stored in the first device, so that after the type of the terminal is determined, the message can be processed and transmitted in the transmission mode of the message corresponding to the terminal.

[0088] In some embodiments, before step S101, steps S104 to S106 are included:

[0089] Step S104: In response to the protocol configuration request sent by the terminal, allocate address information to the terminal;

[0090] Here, the protocol configuration request is used to automatically allocate and update address information and other network configuration information for the terminal. For example, the protocol configuration request may be a DHCP Config Request.

[0091] In some implementations, after receiving the protocol configuration request, the first device allocates address information to the terminal.

[0092] For example, taking the first device as TWAN, a TWAC (Trusted WLAN Access Point Controller) in the TWAN may allocate address information to the terminal, wherein the TWAC is responsible for managing and controlling wireless access points in the TWAN.

[0093] In some implementations, the address information allocated by the first device to the terminal may be pre-allocated by the core network to the first device, so that the first device can determine the address information allocated to the terminal from the address information pre-allocated by the core network.

[0094] Step S105: establishing a first data channel between the first device and the core network based on the address information, and determining session information;

[0095] In some implementations, the first device establishes a first data channel between the first device and the core network based on the address information of the terminal and the network identification information of the terminal, and determines the session information.

[0096] In some embodiments, after the first device is assigned to the terminal address information, the first device performs a PDU session establishment process with the core network based on the terminal address information on behalf of the terminal. After the first device establishes the PDU session with the core network on behalf of the terminal, a first data channel is generated between the first device and the core network.

[0097] During implementation, taking the first device as TWAN as an example, after TWAC assigns address information to the terminal, TWAC sends the address information to TWIF (Trusted WLAN Interworking Function), so that TWIF performs the PDU session establishment process with the core network based on the address information of the terminal, and generates the first data channel between the first device and the core network after the session is established.

[0098] Step S106: establishing a second data channel between the first device and the terminal based on the identification information and session information of the terminal.

[0099] Here, the identification information may be unique information for identifying the terminal, for example, the identification information may be MAC (Media Access Controls) information of the terminal.

[0100] In some implementations, after the first device forms mapping information between the identification information of the terminal and the session information, a second data channel is established between the first device and the terminal.

[0101] In the above embodiment, the first device performs the PDU session establishment process with the core network instead of the terminal. After the first device establishes the PDU session with the core network instead of the terminal, a first data channel is established between the first device and the core network, as well as a second data channel between the first device and the terminal. Thus, message transmission between the terminal and the core network can be realized through the first data channel and the second data channel.

[0102] In some embodiments, the above step S105, establishing a first data channel between the first device and the core network based on the address information, and determining the session information, includes steps S1051 to S1053:

[0103] Step S1051: Send a session establishment request to the core network based on the address information of the terminal; the session establishment request is used to request the core network to establish a PDU session with the first device;

[0104] Here, a PDU session is a data transmission channel established between a terminal and 5GC, which provides users with the ability to access data networks (such as the Internet, corporate intranet, etc.). A session establishment request is a request initiated by a terminal in a communication network to a core network to establish one or more PDU sessions. For example, a session establishment request can be a PDU SessionEstablishment request.

[0105] In some implementations, the terminal sends a session establishment request to the AMF in the core network through the base station. The session establishment request includes identification information, address information, slice network information, protocol data unit session identifier, and request type.

[0106] During implementation, taking the first device as TWAN as an example, TWAC sends a session creation request to TWIF. After TWIF receives the creation request, it will parse the information in the request and generate a session establishment request sent to the core network based on this information, and establish a PDU session with the core network on behalf of the terminal.

[0107] Step S1052: receiving a session establishment acceptance message sent by the core network, where the session establishment acceptance message is used to indicate the establishment of a PDU session, and the session establishment acceptance message includes session information of the PDU session;

[0108] In some implementations, after the core network receives the session establishment request, a PDU session establishment process is performed with the first device based on the session establishment request, and the PDU session establishment process includes the following steps:

[0109] 1)AMF selects SMF;

[0110] After receiving the session establishment request sent by the first device, the AMF in the core network will execute the SMF selection process to select a suitable SMF for the PDU session. During the selection process, the AMF may interact with the NSSF to obtain network slice information and select a suitable SMF through the NRF.

[0111] 2)AMF requests to establish a PDU session;

[0112] The AMF sends a session context creation request to the selected SMF to request the establishment of a PDU session. The session context creation request includes the terminal's subscription information, session type, AMF identification information, etc., wherein the session context creation request may be Nsmf_PDUSession_CreateSMContext Request.

[0113] 3) SMF obtains contract information;

[0114] SMF initiates session registration to UDM and obtains the terminal's subscription information, including session service continuity mode, session aggregation maximum bit rate, etc.

[0115] 4)SMF replies to AMF.

[0116] SMF replies a session context creation response message to AMF based on whether the PDU session is successfully established. After receiving the session context creation response message, AMF generates a session establishment acceptance message, where the session context creation response message can be Nsmf_PDUSession_CreateSMContext Response.

[0117] Step S1053: Initialize the PDU session resources and send a session resource establishment response message to the core network, where the session resource establishment response message is used to indicate the establishment of a PDU session between the core network and the first device.

[0118] Here, the session resource establishment response message is used to confirm that the PDU session resource allocation has been completed.

[0119] In some implementations, the first device initializes the PDU session resources after receiving the session establishment accept message.

[0120] During implementation, taking the first device as TWAN as an example, after receiving the session establishment acceptance message sent by the core network, TWIF obtains the session resource information of the PDU session in the session establishment acceptance message, and the session resource information includes the relevant resource information allocated by the core network to the terminal, such as session identification information, slice information and uplink tunnel information, etc., and generates a session resource initialization request message based on the session resource information and sends it to TWAC. After receiving the session resource initialization request message, TWAC will allocate resources according to the session resource information and the current network resource status, generate downlink tunnel information between the terminal and the core network, and map the session identification information, uplink tunnel information and downlink tunnel information with the address information of the terminal, generate the session information of the terminal and store it. In addition, TWAC sends the downlink tunnel information to TWIF, and TWIF generates a session resource establishment response message based on the downlink tunnel information and sends it to the core network.

[0121] In the above embodiment, it is described that the first device establishes a PDU session between the terminal and the core network instead of the terminal, so that after the terminal and the core network complete the PDU session establishment, the message transmission between the terminal and the core network can be completed based on the session information generated in the process.

[0122] In some embodiments, after step S104 and before step S101, steps S107 to S109 may be included:

[0123] Step S107: In response to the authentication request sent by the terminal, trigger the authentication server to authenticate the terminal;

[0124] Here, the authentication server is a centralized identity authentication system that is responsible for verifying the identity information of the terminal and providing the terminal with corresponding permissions and resources. For example, the authentication server can be a RADIUS server. The authentication request refers to a request message sent by the authenticator (such as a switch, wireless access point, etc.) to the authentication server. For example, the authentication request can be an Access Request.

[0125] In some implementations, the first device includes a server client, which processes the authentication request after receiving the authentication request from the device, obtains the identity information of the terminal, and encapsulates the identity information to generate an authentication request to be sent to the authentication server, and sends the authentication request to the authentication server. The authentication request usually includes the identity information of the terminal, such as the user name and password, and the identifier of the client and the request type.

[0126] In some implementations, after receiving the authentication request, the authentication server will authenticate the terminal based on the information in the authentication request. The specific process is as follows:

[0127] 1) Search for terminal information: The authentication server searches for a terminal record that matches the terminal name in the local user database or external authentication system.

[0128] 2) Verify password: If a matching terminal record is found, the authentication server will verify whether the password provided by the user is consistent with the password in the database. This usually involves a hash comparison of the password or other forms of password verification.

[0129] Step S108: in response to the authentication result sent by the authentication server being authentication passed, generating a key;

[0130] In some implementations, when the authentication result of the authentication server on the terminal is that the authentication is passed, it is determined that the terminal can access network resources, and network services are provided to the terminal as needed.

[0131] In some implementations, when the authentication result sent by the authentication server is authentication passed, the authentication server and the authentication client will negotiate to generate a key, which is used for subsequent data transmission and session management between the terminal and the core network to ensure data security during the session.

[0132] Step S109: Generate an authentication success message based on the key and the authentication result, and send the authentication success message to the terminal; the key is used by the access point to decrypt the received message from the terminal.

[0133] Here, the authentication pass message is used to determine whether the terminal can access network resources. The authentication pass message includes detailed configuration information required for terminal services, such as terminal permissions, service types, etc., so that the authentication client can provide services to the terminal based on the detailed configuration information.

[0134] In the above embodiment, the identity authentication of the terminal is completed by the authentication server, which can prevent illegal users and devices from accessing the network, thereby protecting the security of network resources and data. The key after successful authentication plays an encryption role in message transmission and storage, which can ensure that the message is not intercepted and tampered with during the transmission process.

[0135] In some embodiments, during step S109, steps S110 and S111 may be included:

[0136] Step S110: determining the network identification information of the terminal based on the identification information of the terminal; the identification information is the MAC address;

[0137] Here, the network identification information refers to a permanent identifier used to uniquely identify user subscription information in a mobile communication network.

[0138] In some implementations, the identification information of the terminal and the network identification information of the terminal are in one-to-one correspondence, so that the network identification information of the terminal can be determined by the identification information of the terminal.

[0139] In some implementations, the identification information of the terminal may be input into the first device, so that the first device may generate network identification information of the terminal based on the identification information of the terminal, and use the network identification information for signing a contract between the terminal and the core network.

[0140] Step S111: registering the terminal in the core network based on the network identification information of the terminal.

[0141] In some embodiments, the first device generates a registration request based on the network identification information of the terminal, and the registration request includes the network identification information of the terminal. The first device acts as an agent for the terminal device to register the terminal with the core network. The main process is as follows: After the core network receives the registration request sent by the first device, it will forward it to the AMF network element in the 5G core network. The AMF processes the registration request and performs terminal authentication, which may include verifying the identity information of the terminal, checking whether the terminal has the right to access the network, etc. In this way, after completing the registration of the terminal in the core network, it can trigger the creation of a PDU session between the terminal and the core network.

[0142] In the above embodiment, the core network may be triggered to register the terminal through the network identification information of the terminal, so that after the core network completes the registration of the terminal, a PDU session may be triggered to be created between the terminal and the core network.

[0143] The following describes the application of the embodiments of the present application in actual scenarios.

[0144] When many enterprises deploy 5G private networks in their office areas, there may be an existing wireless network environment in the office area, such as WiFi, which is connected to the network through AP devices for data transmission services. In order to reduce costs when deploying 5G private networks, enterprises generally do not want to purchase additional WLAN equipment, but hope to follow the principle of reusing old equipment and connect the WLAN equipment used in the previous wireless network environment to the 5G private network.

[0145] In existing application scenarios, the coupling degree of 5G+WiFi solutions is relatively high. Only specified types of WLAN equipment can be used to connect WLAN to the 5G core network. This cannot meet the principle of reuse proposed by enterprises, which reduces customer satisfaction.

[0146] Furthermore, in actual application scenarios, there are situations where N5CW devices and STA devices need to visit each other. However, due to the differences in network architecture and application scenarios between WLAN and 5G private networks, there is environmental isolation between WLAN and 5G private networks, which requires that messages between STA devices and N5CW devices need to jump multiple times in the DN when they are performing data intercommunication. During the multiple jumps of messages in the DN, it is possible that the messages may pass through multiple layers of firewalls in the DN. In addition, considering whether multicast, broadcast, layer 2 forwarding, and layer 3 forwarding are supported, it is necessary to add multiple routers in the DN, which not only increases the latency of network data transmission, but also fails to guarantee the security of network data.

[0147] like Figure 2 As shown in the figure, N5CW devices, such as 5G-Enable UE 1, access 5GC 3 through RAN 2, and STA 4 access AC 6 through the WiFi link of AP 5. If 5G-Enable UE 1 and STA 4 access data to each other, the following problems will occur:

[0148] 1) Routing lookup is complex

[0149] Since the 5G-Enable UE 1 device and the STA 4 device are connected to different networks (5GC and WiFi networks) respectively, the mutual access between the 5G-Enable UE 1 device and the STA 4 device requires multi-level routing lookup in the DN network 7, which not only increases the complexity of routing lookup, but also may cause messages to be frequently forwarded between multiple routers.

[0150] 2) Increased transmission delay

[0151] The message is forwarded by multiple routers in the DN network 7, which will increase the transmission delay. For application scenarios that require real-time communication, this may seriously affect the user experience.

[0152] 3) Security issues

[0153] During the transmission process, the message may pass through multiple layers of firewalls and other security devices, but this may also increase the risk of attack. At the same time, due to the complexity of route lookup and the forwarding of messages between multiple nodes, security monitoring and protection become more difficult.

[0154] 4) Multicast, broadcast, and layer 2 and 3 forwarding support issues

[0155] In the DN network 7, the support of multicast, broadcast, and layer 2 and layer 3 forwarding may vary depending on different terminal devices and network configurations, which may cause the 5G-Enable UE 1 device and the STA 4 device to encounter compatibility issues or performance bottlenecks during mutual access.

[0156] It should be noted that 1) RAN does not belong to 5GC. RAN is the access layer, which is designed to access 5G-Enable UE to 5GC in the wired environment. 5GC is responsible for opening up the data plane and efficiently forwarding service traffic, that is, forwarding the data of 5G-Enable UE through UPF. Figure 2 The solid line in the middle represents wired access, and the dotted line represents wireless access. Wireless access is also air interface access, such as mobile phone access to base stations and mobile phone access to AP devices.

[0157] In addition, according to the CAPWAP (Control and Provisioning of Wireless Access Points) protocol, messages in the local forwarding mode do not pass through the CAPWAP data tunnel, but are forwarded by AP 8 to the DN network 7. This method cannot apply the 5G message forwarding strategy and does not support management data. Figure 3 As shown in the figure, the dotted line represents the transmission process of the message in the local forwarding mode, while the solid line represents the transmission process of the message in the centralized forwarding mode. In the local forwarding mode, after the message is processed by AP 8, the processed message is sent to SW 9 (switch). When SW 9 determines that the message needs to be transmitted across network segments, it sends the message to Router 10 (router), and finally Router 10 forwards it to DN network 7; in the centralized forwarding mode, the message is encapsulated through the CAPWAP data tunnel and transmitted to AC 6, and AC 6 forwards the message to 5GC 3 through the GTP tunnel.

[0158] In summary, in order to solve the above problems, the embodiments of the present application propose a method that meets the principle of reuse, supports any WLAN to seamlessly access 5GC, forwards the traffic of N5CW devices in local forwarding mode and centralized forwarding mode to 5GC, and provides a method for unified management and forwarding of 5G+WiFi.

[0159] like Figure 4 As shown, the network mode compatible with third-party WLAN proposed in the embodiment of the present application, N5CW 12 device and STA4 device are both accessed from AP 5, the networking mode of AP 5 and AC 6 is side-hung, and the service VLAN (Virtual Local Area Network) and management VLAN are divided, wherein the management VLAN is mainly responsible for transmitting messages forwarded through the CAPWAP tunnel, including management messages and service messages forwarded through the CAPWAP tunnel; the service VLAN is mainly responsible for transmitting service messages, i.e., data when the terminal is surfing the Internet. In the embodiment of the present application, the above problems can be solved by adding a TWAN 11 device between the WLAN device and the core network, and the TWAN 11 device manages the devices accessed through the AP.

[0160] The management process of TWAN devices for devices accessed through APs mainly includes: when establishing a session between the device and the core network, a session table is generated, the session table entries of the N5CW device are marked to distinguish between STA devices and N5CW devices, and the GTP tunnel information allocated is bound to the N5CW device. In this way, when the TWAN device receives the message sent by the terminal device, it will implement the forwarding strategy according to the mark bit in the session table. The service traffic of the STA device is transparently transmitted to the DN (corresponding to the local forwarding mode), and the traffic of the N5CW device is sent to the UPF (corresponding to the centralized forwarding mode) through the GTPU tunnel, thereby realizing the unified management, diversion and forwarding of WiFi traffic and 5G traffic.

[0161] Next, for the above Figure 4 The network mode compatible with the third-party WLAN shown in the figure, the embodiment of the present application provides a method for enabling a terminal device to access the core network without perception by using the established WLAN environment, such as Figure 5A and Figure 5B As shown, it may include steps S502 to S532:

[0162] Step S501: input MAC information (i.e. identification information) of the N5CW device (i.e. the first type of terminal);

[0163] Here, before the N5CW device establishes a session with the core network, it is necessary to open an account for the N5CW device in the core network in advance.

[0164] In some implementations, the MAC information of the N5CW device may be input into an internal tool, where the internal tool refers to a tool that can convert the MAC information into SUPI information (ie, network identification information).

[0165] Step S502: TWAC generates a mapping SUPI through an internal tool service;

[0166] In some implementations, the internal tool may be built into the TWAN device (ie, the first device). In this way, the MAC address of the N5CW device is sent to the TWAN device, and the internal tool in the TWAN device generates SUPI information mapped to the MAC address.

[0167] Here, SUPI information is the identification of the terminal in the core network, and the N5CW device only has MAC information on the WLAN side, so the SUPI information is mapped with the MAC information, so that the terminal device can open an account in the core network.

[0168] Step S503: TWAC signs a contract and opens an account with UDM through the network management interface;

[0169] Here, the mapping information of the N5CW device in 5GC is determined based on the MAC information of the N5CW device.

[0170] During implementation, the MAC information of the N5CW device is sent to the TWAC in the TWAN device, which generates the SUPI information corresponding to the MAC information, and then sends the SUPI information to the 5GC for opening an account for the N5CW device in the 5GC.

[0171] Step S504: N5CW completes WLAN side association with AC;

[0172] When the N5CW device enters the coverage of the wireless network, it scans the available wireless signals and selects an AP with sufficient signal strength and security policy that meets the requirements for connection. Then, the N5CW device performs a series of handshake processes with the selected AP, including identity authentication, encryption key exchange, etc., so that the N5CW device and the AP are associated, and the AC records the association information for managing the AP and the N5CW device. Finally, the N5CW device and the AC complete the WLAN side association.

[0173] Step S505: The AP and AC perform a STA adding configuration process;

[0174] Here, the process of adding STA configuration may refer to Sta add config.

[0175] During implementation, after the N5CW device completes the WLAN side association with the AC, the AP sends a Sta add config request to the AC. After receiving the Sta add config request, the AP adds the relevant information of the N5CW device to the AP based on the message carried in the Sta add config request, and returns a Sta add config response message to the AC. In this way, the Staadd config process is completed between the AP and the AC.

[0176] Step S506: N5CW sends an 802.1X authentication request to AC;

[0177] Here, after the AP adds the N5CW device, the 802.1X authentication process is triggered. The 802.1X authentication process is a port-based network access control protocol. Through the authentication framework of the extensible authentication protocol, it can authenticate all terminals connected to the network at the LAN access interface level and control their network access rights.

[0178] 802.1X authentication request refers to EAPoL-Start, which is a network protocol frame used by the terminal (for example, N5CW device) to initiate an authentication request during the 802.1X authentication process. When the terminal wants to connect to a protected wireless network, it will send an EAPOL-Start frame to start the 802.1X authentication process. The EAPOL-Start frame marks the beginning of the 802.1X authentication phase, followed by a series of authentication procedures to ensure that the terminal has the right to access the network.

[0179] Step S507: AC sends an authentication identity information request to N5CW;

[0180] Here, the authentication identity information request refers to EAP-request / Identify, which is a data packet sent by an authenticator (eg, AC) and is used to inquire about the identity information or other necessary authentication information of a terminal.

[0181] Step S508: N5CW sends a first authentication identity information response to AC;

[0182] Here, the first authentication identity information response refers to EAP-response / Identify, which is sent by the terminal and is used to respond to the authentication request of the authenticator or the authentication server.

[0183] During implementation, after receiving the EAP-request / Identity message, the N5CW device will reply to the AC with an EAP-response / Identify message, which carries the user name or other identity information.

[0184] After receiving the EAP-response / Identity message, the AC will determine which authentication method to use for the subsequent authentication process based on the configuration. The authentication process includes interaction with the authentication server (such as the Radius server) and exchange of encryption keys.

[0185] Step S509: AC sends an authentication request Access request (EAP-response) to TWAC;

[0186] Here, the authentication request refers to an Access Request, which generally refers to a request message sent by an authenticator (eg, AC) to an authentication server, wherein the Access Request includes an EAP-response.

[0187] AC uses the Radius service module in TWAC as a third-party AAA authentication server. After receiving the dot1x authentication request from the terminal, AC initiates Radius authentication to TWAC.

[0188] Among them, AAA authentication server is an identity authentication server used for network security. AAA authentication refers to the collection of three links: Authentication, Authorization, and Accounting. It ensures the security and legitimacy of system resources and data by verifying and authorizing user identities.

[0189] Step S510: The TWAC Radius module forwards the request to the Radius Server.

[0190] Here, TWAC includes a Radius service module, and the Radius service module forwards the Access Request request to the Radius Server (ie, the Radius server).

[0191] Step S510a: Radius standard authentication process;

[0192] Here, when the Radius module forwards the Access Request request to the Radius Server, it indicates that the Radius standard authentication process has started.

[0193] Step S511a: TWAC sends a second authentication identity information request to AC;

[0194] Here, the second authentication identity information request refers to Access Challenge (EAP-request / start / peap), which is a challenge message sent by the Radius server to the authenticator (such as AC) after receiving the authentication request (Access Request) if it cannot immediately decide whether to allow the user to access the network. This message usually contains some additional authentication information or requirements for further verifying the user's identity or obtaining more authentication data.

[0195] EAP-request / start / peap refers to a message containing a PEAP authentication method request sent by the authenticator to the requester (such as a terminal) when starting the EAP authentication process. After receiving the EAP-request / start / peap message, the requester will start the TLS handshake process and establish a secure TLS tunnel with the authentication server.

[0196] Step S512a: The AC sends an authentication start message to the AP;

[0197] Here, the authentication start message refers to EAP-request / start / peap, which is a message sent by an authentication server (such as a Radius server) to a terminal (such as a computer, a smart phone, etc.) to start the PEAP authentication process.

[0198] Step S513a: AP sends an authentication start message to N5CW;

[0199] Step S511b: TWAC obtains MAC information and finds the mapped SUPI;

[0200] Here, when TWAC sends Access Challenge to AC, it also determines SUPI information corresponding to MAC information based on MAC information of N5CW device carried in Access Request request. In this way, the terminal can be registered in the core network based on SUPI information.

[0201] Step S512b: TWAC sends a registration initiation notification [SUPI] to TWIF;

[0202] Here, TWAC informs TWIF of the SUPI information to be registered through the Yw interface, and TWIF uses the SUPI information to register the terminal in the core network instead of the N5CW device. Among them, the Yw interface is a protocol interface between TWAC and TWIF network elements, defined by 3GPP, and is used to implement the interactive signaling between the terminal and the core network through WLAN.

[0203] Step S514a: N5CW performs TLS handshake with TWAC;

[0204] Here, after the N5CW device receives EAP-request / start / peap, the TLS handshake process between the N5CW device and TWAC is triggered. After the TLS handshake process between the N5CW device and TWAC is completed, a TLS tunnel between N5CW and TWAC is established, so that the data transmission between N5CW and TWAC is transmitted through the TLS tunnel, ensuring the security of data transmission between N5CW and TWAC.

[0205] Step S513b: TWIF creates a registration request on behalf of N5CW;

[0206] Here, TWIF establishes a core network registration request for the N5CW device based on the SUPI information and sends it to the core network.

[0207] Step S515a: PEAP authentication between TWAC and N5CW is completed;

[0208] Here, after the TLS handshake is completed between the N5CW device and TWAC, a secure TLS tunnel is established between the N5CW device and TWAC, indicating that the PEAP authentication is complete.

[0209] Step S516a: N5CW generates PMK;

[0210] Here, PMK is used to encrypt data on the terminal side and decrypt data forwarded by TWAN.

[0211] Step S514b: TWIF selects AMF;

[0212] Here, in the communication network, the purpose of TWIF selecting AMF is mainly to ensure that devices without 5G access capabilities (such as N5CW devices) can securely and effectively access 5GC through WLAN and enjoy network services.

[0213] Step S515b: TWIF and UDM perform registration process;

[0214] Here, TWIF replaces the N5CW device and performs the registration process of the N5CW device in the core network with UDM.

[0215] Step S516: TWIF sends a registration completion notification [SUPI] to TWAC;

[0216] Here, after the registration process is completed, TWIF sends a registration completion notification message to TWAC, wherein the registration completion notification message includes the SUPI information of the terminal.

[0217] TWIF sends a registration completion notification to TWAC, indicating that the N5CW device has been registered in the core network and has passed the Radius service authentication.

[0218] Step S517: TWAC sends an authentication success message to AC;

[0219] Here, after the Radius standard authentication process is completed, the authentication server obtains the authentication result of N5CW and sends the authentication result to AC. In the case of passing the authentication result, the message sent by TWAC to AC is: AccessAccept[EAP-success,PMK].

[0220] Step S518: AC installs PMK;

[0221] Here, TWAC obtains the PMK information (ie, key) in the Access Accept message and installs the PMK information. It should be noted that the PMK information is the same as the PMK information in S516a.

[0222] Step S519: The AC sends an authentication success message to the AP;

[0223] Here, during the EAP authentication process, a series of identity authentication information is exchanged between the terminal and the authentication server. The exchange of this information follows the format and process defined by the EAP protocol. When the authentication server successfully verifies the identity of the client and decides to grant it network access rights, the authentication server sends an EAP-success message to the terminal. This message marks the successful completion of the EAP authentication process, and the terminal can then start using network resources.

[0224] Step S520: AP sends an authentication success message to N5CW;

[0225] Step S521: N5CW performs air interface four-way handshake with AC;

[0226] Here, the air interface four-way handshake is a key step in the WiFi Protected Access (WPA / WPA2 / WPA3) security protocol, which is used to generate a secret key for encrypting wireless data between the AP and the accessed terminal.

[0227] Step S522: The AP and AC perform a STA adding configuration process;

[0228] Here, after the terminal negotiates the secret key, the AP and AC interact by adding STA configuration and sending the key information to the AC.

[0229] Step S523: N5CW sends a protocol configuration request to TWAC;

[0230] Here, the protocol configuration request refers to DHCP Config Request, which is part of the DHCP protocol automatic configuration process. By automatically allocating and updating IP addresses and other network configuration information, DHCP greatly simplifies the complexity of network management.

[0231] Step S524: The DHCP service in TWAC allocates an IP address;

[0232] Here, the terminal sends a DHCP request, which is directed to the DHCP service in TWAN through the service VLAN.

[0233] It should be noted that the IP of the N5CW device is allocated by the core network, and TWAC is only responsible for encapsulating the IP allocated by the core network using the DHCP protocol and replying it to the terminal.

[0234] In some implementations, the core network may pre-allocate a batch of IP information to the TWAC, so that the TWAC can determine the IP allocated to the N5CW device from the pre-allocated IP information.

[0235] Step S525: TWAC sends a session creation [SUP, IP] to TWIF, where SUP refers to SUPI;

[0236] Here, the TWAC sends the SUPI information and IP information required for session creation to the TWIF, so that the TWIF generates a PDU session establishment request based on the SUPI information and the IP information.

[0237] Step S526: TWIF sends a session establishment request to SMF;

[0238] Here, the session establishment request refers to the PDU Session Establishment request, which is a request initiated by the terminal to the network in the 5G network to establish one or more PDU sessions to transmit data between the terminal and the network. The PDUSession Establishment request is used to trigger the TWIF to replace the N5CW device to perform the session establishment process with the core network.

[0239] Step S527: SMF sends a PDU session establishment acceptance message to TWIF;

[0240] Here, the session establishment accept message refers to PDU Session Establishment accept, which is a message sent by the core network to the terminal in the 5G network to confirm that the PDU session establishment request has been accepted and allocate necessary network resources to the user.

[0241] Step S528: TWIF sends a session resource initialization request to TWAC;

[0242] Here, TWIF receives the session resource initialization request message sent by the core network, and sends the session resource initialization request message to TWAC, wherein the session resource initialization request message includes information such as the terminal IP address, uplink GTPU TEID, and uplink N3IP.

[0243] Step S529: TWAC sends a DHCP configuration confirmation response to N5CW;

[0244] Here, the DHCP configuration confirmation response refers to DHCP Config ACK. After the DHCP Config ACK message is sent to the N5CW device, the N5CW device will perform IP address conflict detection (such as sending a free ARP message). If there is no conflict in the IP address, the N5CW device will configure and use this IP address. At this time, it can be considered that the PDU session has been established.

[0245] Step S530: TWAC binds the core network session and generates downlink tunnel information;

[0246] Here, TWAC sends the terminal's session information and the allocated GTP tunnel information to TWAN-DP, where TWAN-DP is the data plane of TWAN and is used to transmit the terminal's data.

[0247] After receiving the session information and GTP tunnel information of the terminal, TWAN-DP creates a corresponding session table and establishes a mapping between the MAC information of the WLAN side information and the GTP tunnel information.

[0248] In this way, by mapping the session table and MAC information with the GTP tunnel information, the TWAN device can determine the type of terminal corresponding to the message after receiving the message and perform corresponding forwarding. Among them, the STA's business traffic is directly transmitted from the AP to the DN through the TWAN, and the N5CW's business traffic is sent to the UPF from the N3 interface after the TWAN queries the GTP tunnel information.

[0249] Step S531: TWAC sends a session resource initialization response to TWIF;

[0250] Step S532: TWIF sends a session resource establishment response message to SMF;

[0251] Here, the session resource establishment response message refers to PDUSessionREsourceSetupResponse. After TWIF sends a message to SMF, namely, the session resource establishment response message, an N3 connection (ie, the first data channel) has been established between TWAC and UPF, and a user plane communication (ie, the second data channel) has been established between TWAC and N5CW, so that data transmission between the N5CW device and the core network can be realized.

[0252] It should be noted that: the distinction between a and b in the same step in FIG. 5 above indicates that step a and step b can be performed concurrently at this stage.

[0253] The present application embodiment provides a method for transmitting an uplink message, such as Figure 6 As shown, it may include steps S601 to S604:

[0254] Step S601: searching the session table according to the source IP address of the received uplink message;

[0255] Here, the uplink message refers to a message sent from the user equipment to the core network.

[0256] In some implementations, after receiving a message sent by a terminal, TWAN associates a session table with the IP information in the message as an index, wherein the session table stores session information of N5CW, such as GTP tunnel information, session identifier (TEID), and the like.

[0257] Step S602: find&&n5cw?

[0258] Here, the session table is searched with the IP as the index to determine whether the IP information is stored in the session table. If the IP information is stored in the session table, it means that the terminal device sending the uplink message is an N5CW device; if the IP information is not stored in the session table, it means that the terminal device sending the uplink message is a STA device.

[0259] Step S603: Set teid to the vlib_buffer_opaque reserved for the message;

[0260] Here, the session identifier is set in the vlib_buffer_opaque field reserved in the message, so that the core network can identify the tunnel and session to which the uplink message belongs according to the TEID when receiving the data packet.

[0261] Step S604: gtpu encapsulation and forwarding.

[0262] Here, after obtaining the GTP tunnel information for sending data to the core network, the network data in the uplink message is encapsulated, and then the encapsulated message is sent to the core network through the GTP tunnel corresponding to the GTP tunnel information.

[0263] The present application embodiment provides a method for transmitting a downlink message, such as Figure 7 As shown, it may include steps S701 to S706:

[0264] Step S701: Find a route according to the destination IP address of the received downlink message;

[0265] Here, TWAN receives a downlink message containing a GTPU header sent by the core network. The downlink message encapsulates user data and carries information such as the destination IP address, destination port number, and TEID. After receiving the message, TWAN obtains the destination IP address in the downlink message and searches for a matching routing entry in the routing table based on the destination IP address.

[0266] Step S702: Destination IP = ACL N3 IP?

[0267] After the route search, TWAN determines whether the destination IP address is equal to the IP address of the N3 interface of a specific AC (if it is, it proceeds to the next step; if not, it forwards or discards the message according to the routing table.

[0268] Step S703: port=2152?

[0269] Here, if the destination IP address matches, TWAN then checks whether the destination port number of the message is 2152. If so, it proceeds to the next step. If not, it forwards or discards the message according to the policy, where 2152 is the port number used by the GTPU protocol.

[0270] Step S704: Is the TEID allocated by this machine?

[0271] Here, if the destination port number matches, TWAN further checks whether the TEID in the message is a valid TEID assigned by the local machine. If so, it proceeds to the next step. If not, it discards the message or performs error processing, where the local machine refers to the network element that is currently processing the message.

[0272] Step S705: Find the corresponding session information according to the TEID, and set sess_idx to the vlib_buffer_opaque reserved for the message;

[0273] Here, if the TEID is valid, TWAN uses the TEID as an index to search for the corresponding session information in the session table. The session information usually includes the session index (sess_idx), user data, session status, etc. After finding the session information, TWAN extracts sess_idx from the session information and sets it to the vlib_buffer_opaque field reserved in the message, so that the session information can be easily accessed during subsequent processing.

[0274] Step S706: Offset IP and GTPU headers.

[0275] Here, the GTP encapsulated data is specifically parsed to obtain the user data in the downlink message.

[0276] Based on the above embodiments, the following beneficial effects can be achieved: 1. Perfect compatibility with third-party WLAN networks without changing the original architecture. 2. Provide unified management and forwarding of 5G+Wi-Fi. 3. Open up the data channel of the local forwarding mode between TWAN and the core network, and the rules of the core network can be mapped to the device data. In this way, after the terminal successfully accesses the core network, the relevant session information will be recorded in the core network. These session information identifies the forwarding rules, tunnel identifiers, etc., so that after the core network receives the data sent by the terminal through WLAN, it can find the corresponding rules for effective forwarding. 4. Avoid passing through the firewall in the multi-layer DN when the N5CW device and the STA device visit each other, improve the security of message forwarding, greatly reduce the forwarding path when the N5CW device and the STA device visit each other, and reduce the forwarding delay. 5. It can realize efficient data transmission based on multicast and broadcast point-to-multipoint between the N5CW device and the STA device, effectively save bandwidth, reduce network load, and promote more efficient collaboration between devices.

[0277] Based on the foregoing embodiments, an embodiment of the present application provides a network control device, which includes the modules included and the units included in the modules, and can be implemented by a processor in a computer device; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0278] Figure 8 A schematic diagram of the structure of a network control device provided in an embodiment of the present application is shown in FIG. Figure 8As shown, the network control device 800 includes:

[0279] A first determining module 810, configured to determine address information of a received message;

[0280] A second determination module 820 is used to search for session information based on the address information of the message, and determine the type of the terminal corresponding to the message based on the search result of the session information, where the type includes a first type and a second type, the first type characterizing that the terminal accesses the core network based on the wireless local area network, and the second type characterizing that the terminal accesses the data network based on the wireless local area network;

[0281] The forwarding module 830 is used to forward the message based on the type of the terminal.

[0282] In some embodiments, the message is an uplink message, the receiving end of the message includes a core network or a data network, and the forwarding module includes: a first determination unit, used to determine the tunnel information of the message when the terminal type is the first type, and encapsulate the message through the tunnel information, and send the encapsulated message to the core network; a first forwarding unit, used to forward the message to the data network when the terminal type is the second type.

[0283] In some embodiments, the message is a downlink message, and the forwarding module includes: a second determination unit, used to determine the tunnel information of the message when the terminal type is the first type, and decapsulate the message through the tunnel information, and send the decapsulated message to the terminal; a second forwarding unit, used to forward the message to the terminal when the terminal type is the second type.

[0284] In some embodiments, the second determination module includes: a third determination unit, used to determine whether the session information of the terminal is stored in the first device based on the address information of the message; a fourth determination unit, used to determine that the type of the terminal is the first type when the session information of the terminal is stored in the first device; and a fifth determination unit, used to determine that the type of the terminal is the second type when the session information of the terminal is not stored in the first device.

[0285] In some embodiments, the device also includes: an allocation module, used to allocate address information to the terminal in response to a protocol configuration request sent by the terminal; a third determination module, used to establish a first data channel between the first device and the core network based on the address information, and determine the session information; an establishment module, used to establish a second data channel between the first device and the terminal based on the terminal's identification information and session information.

[0286] In some embodiments, the third determination module includes: a first sending unit, used to send a session establishment request to the core network based on the address information of the terminal; the session establishment request is used to request the core network to establish a PDU session with the first device; a receiving unit, used to receive a session establishment acceptance message sent by the core network, the session establishment acceptance message is used to indicate the establishment of a PDU session, and the session establishment acceptance message includes session information of the PDU session; a second sending unit, used to initialize PDU session resources and send a session resource establishment response message to the core network, the session resource establishment response message is used to indicate the establishment of a PDU session between the core network and the first device.

[0287] In some embodiments, the device also includes: a trigger module, which is used to trigger the authentication server to authenticate the terminal in response to the authentication request sent by the terminal; a generation module, which is used to generate a key in response to the authentication result sent by the authentication server being authentication passed; a sending module, which is used to generate an authentication passed message based on the key and the authentication result, and send the authentication passed message to the terminal; the key is used by the access point to decrypt the received message from the terminal.

[0288] In some embodiments, the device also includes: a fourth determination module, used to determine the network identification information of the terminal based on the identification information of the terminal; the identification information is a MAC address; a registration module, used to register the terminal in the core network based on the network identification information of the terminal.

[0289] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0290] It should be noted that in the embodiment of the present application, if the control method of the above-mentioned network is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific hardware, software or firmware, or any combination of hardware, software, and firmware.

[0291] An embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0292] The embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, some or all of the steps in the above method are implemented. The computer-readable storage medium can be transient or non-transient.

[0293] An embodiment of the present application provides a computer program, including a computer-readable code. When the computer-readable code is run in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

[0294] The embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, some or all of the steps in the above method are implemented. The computer program product can be implemented specifically by hardware, software or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium, and in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK) and the like.

[0295] It should be noted here that the description of the various embodiments above tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. The description of the above device, storage medium, computer program and computer program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the embodiments of the device, storage medium, computer program and computer program product of this application, please refer to the description of the method embodiment of this application for understanding.

[0296] It should be noted that Fig. 9 A schematic diagram of a hardware entity of a computer device in an embodiment of the present application is shown in FIG. Fig. 9 As shown, the hardware entity of the computer device 900 includes: a processor 901, a communication interface 902 and a memory 903, wherein:

[0297] Processor 901 generally controls the overall operation of computer device 900 .

[0298] The communication interface 902 enables the computer device to communicate with other terminals or servers through a network.

[0299] The memory 903 is configured to store instructions and applications executable by the processor 901, and can also cache data to be processed or processed by the processor 901 and each module in the computer device 900 (for example, image data, audio data, voice communication data, and video communication data), which can be implemented by flash memory (FLASH) or random access memory (Random Access Memory, RAM). Data transmission between the processor 901, the communication interface 902 and the memory 903 can be carried out through the bus 904.

[0300] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the serial number of each step / process mentioned above does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The serial numbers of the embodiments of the present application mentioned above are for description only and do not represent the advantages and disadvantages of the embodiments.

[0301] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0302] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0303] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0304] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0305] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0306] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0307] The above are only implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A network control method, applied to a first device, comprising: Determine the address information of the received message; searching for session information based on the address information of the message, and determining the type of the terminal corresponding to the message based on the search result of the session information, the type including a first type and a second type, the first type representing that the terminal accesses a core network based on a wireless local area network, and the second type representing that the terminal accesses a data network based on the wireless local area network; The message is forwarded based on the type of the terminal.

2. The method according to claim 1, wherein: The message is an uplink message, the receiving end of the message includes the core network or the data network, and the forwarding of the message based on the type of the terminal includes: When the type of the terminal is the first type, determine the tunnel information of the message, encapsulate the message according to the tunnel information, and send the encapsulated message to the core network; When the type of the terminal is the second type, the message is forwarded to the data network.

3. The method according to claim 1, wherein: The message is a downlink message, the receiving end of the message includes the terminal, and the forwarding of the message based on the type of the terminal includes: When the type of the terminal is the first type, determine the tunnel information of the message, decapsulate the message according to the tunnel information, and send the decapsulated message to the terminal; When the type of the terminal is the second type, the message is forwarded to the terminal.

4. The method according to claim 1, wherein: The searching for session information based on the address information of the message, and determining the type of the terminal corresponding to the message based on the search result of the session information, includes: Determining, based on the address information of the message, whether the session information of the terminal is stored in the first device; In a case where session information of the terminal is stored in the first device, determining that the type of the terminal is the first type; In a case where the session information of the terminal is not stored in the first device, it is determined that the type of the terminal is the second type.

5. The method according to claim 1, wherein: The method further comprises: In response to a protocol configuration request sent by the terminal, allocating address information to the terminal; Establishing a first data channel between the first device and the core network based on the address information, and determining the session information; A second data channel is established between the first device and the terminal based on the identification information of the terminal and the session information.

6. The method according to claim 5, wherein: Establishing a first data channel between the first device and the core network based on the address information, and determining the session information, including: Sending a session establishment request to the core network based on the address information of the terminal; the session establishment request is used to request the core network to establish a PDU session with the first device; receiving a session establishment acceptance message sent by the core network, where the session establishment acceptance message is used to indicate establishment of the PDU session, and the session establishment acceptance message includes session information of the PDU session; Initialize PDU session resources and send a session resource establishment response message to the core network, where the session resource establishment response message is used to indicate establishment of a PDU session between the core network and the first device.

7. The method according to claim 1, wherein: The method further comprises: In response to the authentication request sent by the terminal, triggering the authentication server to authenticate the terminal; In response to the authentication result sent by the authentication server being authentication passed, generating a key; An authentication success message is generated based on the key and the authentication result, and the authentication success message is sent to the terminal; the key is used by the access point to decrypt a message received from the terminal.

8. The method according to claim 7, wherein: The method further comprises: Determine network identification information of the terminal based on identification information of the terminal; the identification information is a MAC address; The terminal is registered in the core network based on the network identification information of the terminal.

9. A network control device, applied to a first device, comprising: A first determining module, used to determine address information of a received message; a second determination module, configured to search for session information based on the address information of the message, and determine a type of a terminal corresponding to the message based on a search result of the session information, the type comprising a first type and a second type, the first type representing that the terminal accesses a core network based on a wireless local area network, and the second type representing that the terminal accesses a data network based on the wireless local area network; A forwarding module is used to forward the message based on the type of the terminal.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, wherein: When the processor executes the program, the steps in the method according to any one of claims 1 to 8 are implemented.

Images