Terminal mutual access management method and device and medium

Abstract

The invention provides a terminal mutual access management method and device and a medium, relates to the technical field of communication, and is used for solving the problem that terminal mutual access data is not supervised in a terminal mutual access process. The method comprises the following steps: acquiring a terminal mutual access request from a source terminal to a target terminal; obtaining a first data path and a second data path according to the terminal mutual access request, the first data path leading to a network data supervision platform, and the second data path connecting the source terminal and the target terminal; and copying and distributing the terminal mutual access data of the source terminal and the target terminal through the first data path and the second data path, so as to realize data supervision on the terminal mutual access data through the first data path, and realize terminal mutual access of the source terminal and the target terminal through the second data path. According to the method and the device, the data path is designed, copying and distribution of the terminal mutual access data are realized based on the data path, and supervision of the terminal mutual access data is realized while terminal mutual access is realized.

Description

Technical Field

[0001] The present disclosure at least relates to the field of communication technology, and in particular to a terminal mutual access management method, device and medium. Background Art

[0002] Terminal inter-access technology reduces the traffic backhauled to the core network, effectively reduces the terminal inter-access delay and core network load, and improves the transmission efficiency during the terminal inter-access process. However, terminal inter-access technology poses a challenge to network data supervision. Since the data does not pass through the various network elements of the core network completely, the data is out of supervision, posing a hidden danger to network security. Summary of the invention

[0003] The technical problem to be solved by the present disclosure is to provide a terminal mutual visit management method, device and medium in view of the above-mentioned shortcomings, so as to solve the problem that the terminal mutual visit data is not supervised during the terminal mutual visit process.

[0004] In a first aspect, the present disclosure provides a terminal mutual access management method, the method comprising:

[0005] Obtaining a terminal mutual access request from a source terminal to a target terminal;

[0006] Acquire a first data path and a second data path according to the terminal mutual access request, the first data path leading to the network data supervision platform, and the second data path connecting the source terminal and the target terminal;

[0007] Through the first data path and the second data path, the terminal mutual access data between the source terminal and the target terminal is copied and distributed, so as to realize data supervision of the terminal mutual access data through the first data path, and realize the terminal mutual access between the source terminal and the target terminal through the second data path.

[0008] Further, wherein:

[0009] The first data path includes: a first communication path between a source terminal and a source network element, a first tunnel between the source network element through a core network user plane function UPF network element and a tunnel service platform, and / or, a second communication path between a target terminal and a target network element, a second tunnel between the target network element through a core network UPF network element and a tunnel service platform, and an interface path between the tunnel service platform and a network data supervision platform;

[0010] The second data path includes: a first communication path between a source terminal and a source network element, a first tunnel between the source network element through a core network UPF network element and a tunnel service platform, a second tunnel between a target network element through a core network UPF network element and a tunnel service platform, and a second communication path between a target terminal and a target network element, or a first communication path between a source terminal and a source network element, a third tunnel between a source network element through a core network UPF network element and a target network element, and a second communication path between a target terminal and a target network element;

[0011] The tunnel service platform or the core network UPF network element copies the terminal mutual access data into two copies. The first copy of the terminal mutual access data is sent to the network data supervision platform through the first data path to realize data supervision, and the second copy of the terminal mutual access data is sent through the second data path to realize terminal mutual access.

[0012] Further, wherein:

[0013] The first tunnel and the second tunnel are specifically the second layer tunnel protocol L2TP tunnels, the source network element includes the source L2TP access concentrator LAC, the target network element includes the target LAC, the tunnel service platform is specifically the L2TP network server LNS, the first tunnel connects the source LAC, the core network UPF network element and LNS in sequence, and the second tunnel connects the LNS, the core network UPF network element and the target LAC in sequence.

[0014] Furthermore, the method further comprises:

[0015] A terminal-attached network communication management module is set in the core network. The terminal-attached network communication management module obtains the communication topology relationship and the media access control MAC address of the terminal, allocates an Internet interconnection protocol IP address to each terminal according to the communication topology relationship and the MAC address, obtains the address resolution protocol ARP table according to the communication topology relationship and the IP address, and sends the ARP table to the LNS to enable the LNS to have an IP routing function.

[0016] Further, obtaining a terminal mutual access request from the source terminal to the target terminal specifically includes:

[0017] The network communication management module under the terminal includes the core network access and mobility management function AMF network element. The core network AMF network element receives the terminal mutual access request from the source terminal, obtains the source terminal MAC address and the target terminal MAC address according to the terminal mutual access request, and obtains the terminal mutual access data in the terminal mutual access request.

[0018] Further, acquiring the first data path and the second data path according to the terminal mutual access request specifically includes:

[0019] A data tunnel construction module and a data supervision and distribution module are set up in the core network. The data tunnel construction module includes a source LAC and a target LAC. The data supervision and distribution module includes an LNS. The data tunnel construction module is connected to the network communication management module under the terminal.

[0020] The network communication management module under the terminal notifies the source LAC and the target LAC to establish the first tunnel and the second tunnel in response to receiving the terminal mutual access request.

[0021] The network communication management module under the terminal sends the source terminal MAC address, the target terminal MAC address and the terminal mutual access data to the LNS through the first tunnel.

[0022] The LNS queries the ARP table according to the source terminal MAC address and the target terminal MAC address to obtain the source terminal IP address and the target terminal IP address, and obtains the first communication path and the second communication path according to the source terminal IP address and the target terminal IP address.

[0023] Further, through the first data path and the second data path, the terminal mutual access data between the source terminal and the target terminal is copied and distributed, so as to realize data supervision of the terminal mutual access data through the first data path, and the terminal mutual access between the source terminal and the target terminal is realized through the second data path, specifically including:

[0024] LNS copies the terminal access data into two copies.

[0025] LNS sends the first terminal access data to the network data supervision platform through the interface path between itself and the network data supervision platform.

[0026] LNS sends the target terminal IP address and the second terminal access data to the network communication management module under the terminal through the second tunnel.

[0027] The network communication management module under the terminal sends the second terminal mutual access data to the target terminal according to the IP address of the target terminal.

[0028] Further, after implementing data supervision of terminal mutual access data through the first data path, the method further includes:

[0029] In response to failure of data supervision on the terminal mutual access data, the LNS does not send the target terminal IP address and the second terminal mutual access data to the network communication management module under the terminal, and / or the LNS interrupts subsequent terminal mutual access between the source terminal and the target terminal.

[0030] In a second aspect, the present disclosure provides a terminal mutual visit management device, the device comprising:

[0031] An acquisition unit, used for acquiring a terminal mutual access request from a source terminal to a target terminal;

[0032] A path unit, connected to the acquisition unit, for acquiring a first data path and a second data path according to a terminal mutual access request, wherein the first data path leads to a network data supervision platform, and the second data path connects a source terminal and a target terminal;

[0033] The distribution unit is connected to the path unit and is used to copy and distribute the terminal mutual access data between the source terminal and the target terminal through the first data path and the second data path, so as to realize data supervision of the terminal mutual access data through the first data path, and realize the terminal mutual access between the source terminal and the target terminal through the second data path.

[0034] In a third aspect, the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the terminal mutual access management method as described above is implemented.

[0035] The present invention provides a terminal mutual access management method, device and medium. According to a terminal mutual access request from a source terminal to a target terminal, a first data path leading to a network data supervision platform and a second data path connecting the source terminal and the target terminal are obtained, and the replication and distribution of the terminal mutual access data are realized based on the first data path and the second data path. While realizing the terminal mutual access, the terminal mutual access data is supervised. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a flow chart of a terminal mutual access management method according to an embodiment of the present disclosure;

[0037] Figure 2 It is a structural diagram of a terminal mutual access management device according to an embodiment of the present disclosure;

[0038] Figure 3 It is a schematic diagram of the process of an existing terminal mutual access method;

[0039] Figure 4 is a process diagram of a terminal mutual access method according to an embodiment of the present disclosure;

[0040] Figure 5 is a structural diagram of a terminal mutual access system according to an embodiment of the present disclosure;

[0041] Figure 6 It is a flowchart of another terminal mutual access management method according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

[0043] It should be understood that the specific embodiments and drawings described herein are only used to explain the present disclosure rather than to limit the present disclosure.

[0044] It can be understood that, in the absence of conflict, the various embodiments of the present disclosure and the various features in the embodiments can be combined with each other.

[0045] It can be understood that, for the convenience of description, the drawings of the present disclosure only show parts related to the present disclosure, while parts irrelevant to the present disclosure are not shown in the drawings.

[0046] It can be understood that each module or unit involved in the embodiments of the present disclosure may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple modules or units may be integrated into one entity structure.

[0047] It will be understood that, in the absence of conflict, the functions and steps marked in the flowcharts and block diagrams of the present disclosure may occur in an order different from that marked in the drawings.

[0048] It is understood that the flowcharts and block diagrams of the present disclosure illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present disclosure. Each box in the flowchart or block diagram may represent a module, unit, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based device that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0049] It can be understood that the modules and units involved in the embodiments of the present disclosure can be implemented by software or hardware, for example, the modules and units can be located in a processor.

[0050] Embodiment 1:

[0051] like Figure 1 As shown, the present disclosure provides a terminal mutual access management method, the method comprising:

[0052] S1. Obtain a terminal mutual access request from a source terminal to a target terminal;

[0053] S2. Acquire a first data path and a second data path according to the terminal mutual access request, wherein the first data path leads to the network data supervision platform, and the second data path connects the source terminal and the target terminal;

[0054] S3. Through the first data path and the second data path, the terminal mutual access data between the source terminal and the target terminal is copied and distributed, so as to realize data supervision of the terminal mutual access data through the first data path, and realize the terminal mutual access between the source terminal and the target terminal through the second data path.

[0055] In this embodiment, the method obtains a first data path leading to the network data supervision platform and a second data path connecting the source terminal and the target terminal according to the terminal mutual access request from the source terminal to the target terminal, and realizes the replication and distribution of the terminal mutual access data based on the first data path and the second data path, and realizes the supervision of the terminal mutual access data while realizing the terminal mutual access. Figure 1 The method shown is applicable to Figure 2 The terminal mutual access management device shown.

[0056] Specifically, this embodiment provides a terminal mutual access system and method, including a terminal and Figure 2 The terminal mutual visit management device shown, in a terminal mutual visit communication, the terminals include a source terminal and a target terminal for the mutual visit, the source terminal initiates a terminal mutual visit request, and the terminal mutual visit management device obtains a first data path for realizing data supervision and a second data path for realizing terminal mutual visit according to the terminal mutual visit request. The first data path and the second data path may partially overlap, but the terminal mutual visit data will be distributed into two copies through the data supervision distribution module, one for supervision and the other for completing the mutual visit, thereby realizing the full tracking and recording of data interaction between terminals, ensuring the security of data and the effectiveness of supervision.

[0057] In one embodiment, wherein:

[0058] The first data path includes: a first communication path between a source terminal and a source network element, a first tunnel between the source network element through a core network user plane function UPF network element and a tunnel service platform, and / or, a second communication path between a target terminal and a target network element, a second tunnel between the target network element through a core network UPF network element and a tunnel service platform, and an interface path between the tunnel service platform and a network data supervision platform;

[0059] The second data path includes: a first communication path between a source terminal and a source network element, a first tunnel between the source network element through a core network UPF network element and a tunnel service platform, a second tunnel between a target network element through a core network UPF network element and a tunnel service platform, and a second communication path between a target terminal and a target network element, or a first communication path between a source terminal and a source network element, a third tunnel between a source network element through a core network UPF network element and a target network element, and a second communication path between a target terminal and a target network element;

[0060] The tunnel service platform or the core network UPF network element copies the terminal mutual access data into two copies. The first copy of the terminal mutual access data is sent to the network data supervision platform through the first data path to realize data supervision, and the second copy of the terminal mutual access data is sent through the second data path to realize terminal mutual access.

[0061] In this embodiment, a method is first introduced. Figure 3 A terminal inter-access technology shown in the figure, in the 5G core network (5GC, 5th Generation Core), the user plane function (UPF, User Plane Function) is the key network element that carries user data and is responsible for implementing the data path selection, forwarding and flow control of the user plane. The terminal inter-access technology based on UPF reduces the flow back to the core network, and does not need to pass through other network elements such as the SMF (Service Management Function) of the core network. It directly uses the local UPF for data exchange, effectively reducing the terminal inter-access delay and the core network load, and improving the transmission efficiency during the terminal inter-access process.

[0062] From the perspective of network supervision, this UPF-based terminal inter-access technology poses a challenge to network data supervision. In general communication processes, all data usually needs to pass through each network element of the core network in its entirety, which enables the data supervision platform to monitor and manage data flows securely. However, the UPF-based terminal inter-access technology bypasses this process, so that the data traffic between terminals is no longer centrally transmitted back to each network element in the core network, but flows directly between terminals, making the data unsupervised. Data supervision cannot identify and block abnormal behaviors and potential network attacks in the network in real time, which poses a hidden danger to network security.

[0063] While improving the communication efficiency of IoT terminals, the terminal inter-access technology based on UPF has the following two main disadvantages: First, data is out of control. Since the data exchange between terminals is directly carried out in the local UPF, bypassing other network elements of the core network, it makes it difficult for network supervision to monitor the communication behavior between terminals in real time, lacks effective protection against potential security threats, and may not be able to fully identify and prevent malicious terminal attacks, such as man-in-the-middle attacks, data tampering or forged communication requests, which can easily cause the overall security of the IoT system to decline and increase network risks; second, it has poor flexibility. The existing UPF terminal inter-access technology lacks customized traffic control and supervision capabilities for different IoT application scenarios when targeting communication needs of different application scenarios. With the increase in the number of terminals and the diversification of application scenarios, traditional static routing and fixed path selection are difficult to meet the dynamically changing network needs, resulting in low utilization efficiency of communication resources.

[0064] At present, the general UPF has the ability of terminal mutual access in hardware, but for security reasons, the terminal mutual access function of UPF is not open in the case of public network communication. Because in general, during the public network communication process, UPF needs to forward the data to the network security network manager, and the network security network manager will conduct security review and supervision on the data. If the UPF terminal in the public network enables the mutual access capability, then the data can be forwarded directly between the terminals via UPF without being supervised by the network security network manager, thereby generating data and network risks. However, terminal mutual access can actually technically reduce the number of network layers between terminals and increase the speed, which can greatly improve the performance of many network scenarios and has certain practical needs. Therefore, how to use other technical solutions to not enable the terminal mutual access function of UPF in the public network environment, while maintaining the excellent performance of terminal mutual access and achieving network security supervision, is the key problem that this embodiment intends to solve.

[0065] This embodiment proposes Figure 4 A terminal mutual access system and method is shown, the system includes a data supervision distribution module, a data tunnel construction module and a terminal hanging network communication module, and provides a technical solution that can realize data flow monitoring and management in the process of terminal mutual access, ensuring that end-to-end data interaction meets security and privacy requirements, thereby enhancing data transparency and network security. By introducing the terminal hanging network communication module, the hanging communication capability (post-routing capability) in the process of terminal mutual access is expanded, and the terminal mutual access strategy is automatically adjusted according to different IoT application scenarios to meet the diverse terminal mutual access needs, thereby improving the utilization rate of communication resources and improving the terminal mutual access efficiency while ensuring security. The data supervision distribution module forwards the data to the corresponding network security network management (network data supervision platform) to achieve supervision. The data supervision distribution module itself does not supervise, but realizes supervision by transmitting data to a platform with supervision function, distributes data to the network supervision platform, and then receives feedback from the network security network management on the data supervision results, and then makes corresponding operations.

[0066] This embodiment is mainly aimed at the IoT scenarios that require terminal mutual access, low latency, high performance, and flexible networking, and at the same time require terminals to access the public network. Traffic control is mainly achieved through the data tunnel construction module, by building and allocating different tunnels to different scenarios to control different traffic. This embodiment is mainly designed for IoT scenarios, but it is also applicable to general scenarios. Communication scenarios can be divided into two situations, one is voice communication and the other is data communication. In most cases, IoT system scenarios are data communications, but this embodiment does not exclude the possibility of application in voice communication scenarios.

[0067] Understandably, Figure 4The UPF network element is displayed as one, but the actual number is determined according to the communication network structure, and may also be divided into source UPF network elements and target UPF network elements. In addition, the base station can also be regarded as a network element, which is divided into a source and a target. This embodiment provides an improved terminal mutual access technology through UPF network elements, but is not limited to this. The terminal mutual access described in this disclosure means that the terminal mutual access data does not pass through the various network elements of the core network completely. Whether the data passes through the various network elements of the core network completely can be defined according to the consensus in this field.

[0068] In one embodiment, wherein:

[0069] The first tunnel and the second tunnel are specifically the second layer tunnel protocol L2TP tunnels, the source network element includes the source L2TP access concentrator LAC, the target network element includes the target LAC, the tunnel service platform is specifically the L2TP network server LNS, the first tunnel connects the source LAC, the core network UPF network element and LNS in sequence, and the second tunnel connects the LNS, the core network UPF network element and the target LAC in sequence.

[0070] In this embodiment, if Figure 4 As shown, the supervision capability is mainly achieved through the data supervision distribution module, by connecting the communication data to the network security network management and receiving feedback from the network security network management. The data supervision distribution module also plays a key role in routing. The module is essentially an LNS platform with IP routing matching function. The IP routing process of this embodiment is only performed on the LNS platform to more effectively manage terminal mutual access. Figure 4 LAC is L2TP Access Concentrator; LNS is L2TP Network Server; LNS is pre-connected to the network data supervision platform; the first layer, second layer, and third layer terminals represent different levels of terminals in the process of downlink communication (referring to the terminal mutual access of the method of this embodiment). For example, Figure 3 In the process, no supervision module plays a role. For example, the communication process between terminals A and B is: terminal A-base station A-UPF-base station B-terminal B; Figure 4 In the process, for example, the communication process between terminal a21 and terminal a31 is: a21–a2–A–base station A–C–D–C–base station A–A–a3–a31, wherein C is a data tunnel construction module, and D is a data supervision and distribution module. There will be a data supervision and distribution module in the data circulation environment to implement supervision, and the method provided in this embodiment can be applied to both public network communication and non-public network communication.

[0071] The main function of the terminal-mounted network communication management module is to connect to the terminal. This function can be realized by combining the existing AMF, SMF, AAA and other network elements. It can be used as a terminal management platform or an operation point for terminal management. It can refer to the combined function of multiple network management systems. The data tunnel construction module is specially built for the terminal mutual access tunnel. The characteristic is that this tunnel is an L2TP tunnel, which will penetrate the UPF, and directly connect to the LNS platform without the three-layer forwarding of the UPF. The LNS platform can send data to the network security network management through the API (Application Programming Interface). From the perspective of the core network, it is generally considered that the data is regulated after the LNS platform is connected, so the terminal mutual access process bypasses the LNS platform. The LNS platform is regulated, so the data is regulated and the terminal mutual access can be realized. LNS realizes the termination of the tunnel and the connection of the route. In fact, it replaces the routing function of the network element. The LNS platform determines the target IP address and actually determines the second data path. Data transmission is necessary for network security network management, but data feedback from network security network management is not necessary. That is to say, all data must be distributed to the network manager, but the network manager has been silently monitoring and may not give feedback, and only gives feedback when a problem occurs. In actual business, the main responsibility of the network manager is to trace back after a problem occurs, that is, to monitor. In theory, the network manager will operate on the data after a problem occurs, but in reality, after the data is transmitted to the network manager, it is supervised by default. Both the source terminal and the target terminal have tunnels to the data supervision and distribution module, and then the data supervision and distribution module distributes a copy of the data to the network manager.

[0072] In one embodiment, the method further comprises:

[0073] A terminal-attached network communication management module is set in the core network. The terminal-attached network communication management module obtains the communication topology relationship and the media access control MAC address of the terminal, allocates an Internet interconnection protocol IP address to each terminal according to the communication topology relationship and the MAC address, obtains the address resolution protocol ARP table according to the communication topology relationship and the IP address, and sends the ARP table to the LNS to enable the LNS to have an IP routing function.

[0074] In this embodiment, a terminal mutual access system and method can also be as follows: Figure 5 As shown in the figure, a specific terminal mutual access process is as follows:

[0075] The terminal-attached network communication management module allocates IP (Internet Protocol) addresses to all terminals it manages (including terminal A and terminal B, terminal A is the source terminal, terminal B is the target terminal) according to the communication topology relationship between the terminals and the MAC (Media Access Control) addresses, and obtains the ARP (Address Resolution Protocol) table. The data tunnel construction module establishes a dedicated tunnel for transmitting the ARP table, and transmits the ARP table to the data supervision and distribution module through the dedicated tunnel.

[0076] Terminal A initiates a terminal mutual access request to the network communication management module under the terminal. The request carries the MAC address information of terminal A, the mutual access data sent by terminal A, and the name of the mutual access target terminal B. The network communication management module under the terminal obtains the MAC address of terminal B based on the name of the mutual access target terminal B.

[0077] The data tunnel construction module establishes a tunnel T specifically for terminal A to access the data supervision and distribution module. AJ , this tunnel is L2TP (Layer 2Tunneling Protocol) tunnel.

[0078] The network communication management module under the terminal transmits the MAC address information of terminal A, the MAC address information of terminal B, and the mutual access data of terminal A through the tunnel T AJ Sent to the data supervision distribution module.

[0079] After obtaining the MAC address of terminal A and the MAC address of terminal B, the data supervision and distribution module queries the ARP table to obtain the IP address of terminal A and the IP address of terminal B respectively, and sends the mutual access data of terminal A and the IP address of terminal B to the network communication management module under the terminal.

[0080] The network communication management module under the terminal sends the mutual access data of terminal A to terminal B according to the IP address of terminal B.

[0081] It can be understood that in the above terminal mutual visit process, the terminal mutual visit request carries the terminal mutual visit data, or terminal A may first initiate the terminal mutual visit request, and after the first data path and the second data path are established, terminals A and B send the terminal mutual visit data, and the terminal mutual visit data may be sent by either side, or both sides; in the above terminal mutual visit process, the terminal mutual visit data is equivalent to the terminal mutual visit data after Figure 4LAC1-UPF-LNS, LNS copies the data, distributes one copy to the network data supervision platform, and the other copy goes through LNS-UPF-LAC2-terminal B. The distribution of terminal mutual access data can also be realized in UPF. At this time, the third tunnel is part of the first tunnel and part of the second tunnel.

[0082] In one implementation, S1, obtaining a terminal mutual access request from a source terminal to a target terminal, specifically includes:

[0083] The network communication management module under the terminal includes the core network access and mobility management function AMF network element. The core network AMF network element receives the terminal mutual access request from the source terminal, obtains the source terminal MAC address and the target terminal MAC address according to the terminal mutual access request, and obtains the terminal mutual access data in the terminal mutual access request.

[0084] In this embodiment, the entity corresponding to the network communication management module under the terminal is a self-developed terminal management platform, which involves core network elements AMF, SMF, AAA server, etc.; the entity corresponding to the data tunnel construction module is the self-developed service activation system including tunnel setting related functions; the entity corresponding to the data supervision and distribution module is a self-developed LNS platform with IP routing matching function.

[0085] A specific signaling process can be:

[0086] Terminal A initiates a terminal mutual access request to the core network AMF (Access and Mobility Management Function), requesting access to terminal B. The terminal mutual access request carries the MAC of terminal A, the MAC of the access target terminal B, and the service data of the terminal mutual access.

[0087] The core network AMF requests the core network SMF (Service Management Function) to create a terminal inter-access session.

[0088] The core network SMF sends an authentication request to the AAA (Authentication, Authorization, Accounting) server based on the request.

[0089] The AAA server authenticates terminal A, determines whether terminal A has terminal mutual access permission, and sends the authentication result to the core network SMF.

[0090] The core network SMF sends a confirmation to the core network AMF and confirms the establishment of the terminal mutual access tunnel.

[0091] The core network SMF establishes an L2TP tunnel between the core network UPF and the LNS platform with IP routing function.

[0092] When the terminal access data is transmitted from the core network AMF to the core network UPF, it is directly connected to the L2TP tunnel port on the core network UPF and reaches the LNS platform with IP routing function.

[0093] The LNS platform with IP routing function authenticates the access data sent to the network security network management and receives feedback from the network security network management. If the content is safe, the corresponding IP address is obtained based on the MAC addresses of terminal A and terminal B, and the data is sent to terminal B based on IP routing.

[0094] In one embodiment, S2, acquiring a first data path and a second data path according to a terminal mutual access request, wherein the first data path leads to a network data supervision platform, and the second data path connects a source terminal and a target terminal, specifically includes:

[0095] A data tunnel construction module and a data supervision and distribution module are set up in the core network. The data tunnel construction module includes a source LAC and a target LAC. The data supervision and distribution module includes an LNS. The data tunnel construction module is connected to the network communication management module under the terminal.

[0096] The network communication management module under the terminal notifies the source LAC and the target LAC to establish the first tunnel and the second tunnel in response to receiving the terminal mutual access request.

[0097] The network communication management module under the terminal sends the source terminal MAC address, the target terminal MAC address and the terminal mutual access data to the LNS through the first tunnel.

[0098] The LNS queries the ARP table according to the source terminal MAC address and the target terminal MAC address to obtain the source terminal IP address and the target terminal IP address, and obtains the first communication path and the second communication path according to the source terminal IP address and the target terminal IP address.

[0099] In this embodiment, if Figure 6 As shown, a terminal mutual access method includes:

[0100] S01: The terminal-mounted network communication module receives a terminal mutual access request and determines the source terminal and the target terminal according to the mutual access request. The terminal-mounted network communication management module can be compared to a device management system, which records the topological relationship between different terminals and controls the mutual access requests of the terminals. When a mutual access request occurs between terminals, the module will plan the communication path and finally realize the mutual access between terminals through the data tunnel construction module and the data supervision and distribution module.

[0101] S02: The data tunnel construction module establishes a tunnel between the core network UPF and the data supervision and distribution module. The data tunnel construction module is set up on the control plane of the core network. It can be compared to a core network management system. It is responsible for configuring and operating various network elements in the core network. It is mainly responsible for tunnel construction.

[0102] S03: The terminal network communication module uses the tunnel to send the terminal mutual access data to the data supervision and distribution module. The terminal mutual access request mainly carries two parts of data, one part of which is the information of the target terminal, and the other part is the business data that the sending terminal wants to send.

[0103] S04: The data supervision and distribution module performs IP resolution and analysis on the terminal mutual access data, determines the source terminal IP and the target terminal IP of the mutual access data, and sends the terminal mutual access data to the terminal network communication module through the tunnel. The terminal network communication management module allocates IPs according to the topological relationship of the network between the terminals. The terminal network communication management module allocates IPs to each terminal according to the topological relationship of all managed terminals, and synchronizes the IP routing table to the data supervision and distribution module. The IP routing table is stored in the data supervision and distribution module, and the data supervision and distribution module implements the resolution and connection between IPs.

[0104] S05: The network communication module under the terminal receives the terminal mutual access data and the source terminal IP and target terminal IP of the mutual access data, determines the routing path after the terminal data, and transmits the data to the target terminal. The problem that the terminal mutual access data is not supervised is the number one problem to be solved in this embodiment. In order to maintain the high performance advantage of terminal mutual access while ensuring the supervision of network security network management, such a solution is designed to supervise the terminal mutual access process.

[0105] The terminal network communication management module only allocates IPs, and the docking communication between specific IPs is implemented in the data supervision and distribution module. This process is separated into two different modules, which is an optimization solution that maintains supervision without adding extra communication burden. The terminal data post-routing path is the terminal data hanging communication path, which is determined according to the topological relationship between terminals and network scenario requirements.

[0106] In one embodiment, S3, through the first data path and the second data path, the terminal mutual access data between the source terminal and the target terminal is copied and distributed, so as to realize data supervision of the terminal mutual access data through the first data path, and the terminal mutual access between the source terminal and the target terminal is realized through the second data path, specifically including:

[0107] LNS copies the terminal access data into two copies.

[0108] LNS sends the first terminal access data to the network data supervision platform through the interface path between itself and the network data supervision platform.

[0109] LNS sends the target terminal IP address and the second terminal access data to the network communication management module under the terminal through the second tunnel.

[0110] The network communication management module under the terminal sends the second terminal mutual access data to the target terminal according to the IP address of the target terminal.

[0111] In this embodiment, a supervision function can be added to the UPF. Based on the current 5G (fifth generation mobile communication technology, 5th Generation Mobile Communication Technology) network technology evolution trend is decoupling, which mainly splits different functions, and each network element is only responsible for one or a class of functions. The function of UPF is mainly the forwarding of user plane data, which requires high performance, high throughput and other characteristics. In this embodiment, the preferred UPF still independently completes its own tasks, and the work of docking with the network security network management is implemented by other modules, so that the function can be decoupled. In this embodiment, LNS is selected to dock with the network security network management. A layer 2 tunnel is used to connect LNS and UPF. The layer 2 tunnel is lower-level and faster to maintain high communication performance, and the distributed data still has a low latency.

[0112] In one embodiment, after implementing data supervision of terminal mutual access data through the first data path, the method further includes:

[0113] In response to failure of data supervision on the terminal mutual access data, the LNS does not send the target terminal IP address and the second terminal mutual access data to the network communication management module under the terminal, and / or the LNS interrupts subsequent terminal mutual access between the source terminal and the target terminal.

[0114] In this embodiment, in general, Figure 5The three modules in the system are: the terminal-mounted network communication module is responsible for the authentication and management of the initiating terminal and the target terminal during the terminal mutual visit, and is responsible for adjusting the terminal mutual visit strategy according to different application scenarios; the data supervision and distribution module is responsible for the supervision and analysis of the terminal mutual visit data, and the allocation of IP addresses for terminal mutual visit. The data supervision and distribution module is set up in the metropolitan area network, and realizes network supervision by connecting with the network security network management. It cannot identify some attack behaviors by itself, and can only identify attack behaviors after receiving feedback from the network security network management. The network security network management feedbacks whether there is an attack behavior. If so, the access is interrupted, which can be the interruption of the current access or only the interruption of subsequent access, that is, the data that can be distributed may arrive at the terminal and the supervision platform at the same time, and the second data path does not wait for the feedback of the supervision platform; the data tunnel construction module is responsible for establishing a private network tunnel between the terminal-mounted network communication module and the data supervision and distribution module to avoid the three-layer routing mutual conversion of data on the core network UPF network element, and adopts a two-layer tunnel. The two-layer tunnel works at the data link layer (MAC layer) and can encapsulate various two-layer protocols (such as Ethernet frames, PPP (point to point protocol, Point to Point The network data flow transmitted in the Layer 2 tunnel is more transparent to the external system or network environment. The communication in the tunnel can "seamlessly" transmit the original data packets, protocols, and information without causing obvious changes or impacts on the data flow.

[0115] Each of the above modules is not completely equivalent to a network element. Each module contains some functions of the network element and involves the management level (control plane) of the network element.

[0116] To facilitate understanding of the present embodiment, an analogy is given.

[0117] Figuratively speaking, if we compare different terminals to different residents in a building, such as resident A and resident B. Under normal circumstances, residents are not allowed to visit each other directly through the corridor. If resident A wants to visit resident B, he needs to register at the property management office. In this way, resident A needs to go downstairs, leave the unit door, go to the property management office, register, return to the unit door, and then go upstairs to resident B's home. In this way, the property management office can clearly supervise the visits between users.

[0118] However, if UPF terminal mutual visit is enabled, different residents are allowed to knock on each other's doors directly in the corridor without having to register at the property management office. In this way, the property management office will not know the visit status between residents.

[0119] However, it is too far to walk to the property management office, and the speed is too slow. So it is proposed to install an APP for each household, which can tell each resident where the unit door of the place they want to visit is. Each household installs an elevator that goes directly to the unit door, and can directly reach the unit door through the special elevator of each household. When visiting in the future, for example, resident A can directly reach his own unit door through his own special elevator, and then find resident B's unit door on the APP. After arriving at resident B's unit door, register at the unit door, and then directly reach resident B's home through the special elevator. Resident B's unit door directly connects the visit situation to the property management office. This is also fast, and the property management office can also be managed.

[0120] In the above examples, the residents are the terminals, the corridors are the UPF terminal inter-access function, the APP is the network communication management module under the terminal, the elevator for entering the house is the data tunnel construction module, the unit door is the data supervision and distribution module, and the property management office is the network security network management.

[0121] The design of "registering at the unit door" is one of the key innovations of this embodiment. Compared with the slow speed of "going around in a big circle" directly through the public network, this embodiment does not need to expose the data on the public network, and distributes it directly in the data supervision and distribution module, which is more efficient. Compared with the "direct access" of UPF terminal mutual access without supervision, the data supervision and distribution module "goes around the unit door and communicates with the property management office through the unit door", while maintaining supervision, it reasonably shortens the data transmission path and improves the efficiency of terminal mutual access.

[0122] In summary, this embodiment 1 proposes a terminal mutual access system and method, which realizes the full tracking and recording of data interaction between terminals through the data supervision and distribution module, ensuring the security of data and the effectiveness of supervision. Through the data tunnel construction module, the three-layer routing conversion in the traditional UPF terminal mutual access technology is avoided, so that the uplink data from the terminal is directly transmitted to the data supervision and distribution module, which reduces the delay and improves the data processing efficiency. By hanging the network communication module under the terminal, the terminal device is not only responsible for sending and receiving data, but can collaborate with the network, and participate in the selection of data transmission paths by sensing its own communication needs, resource status, location and other information.

[0123] While the data between terminal devices is exchanged using UPF, refined traffic classification and traffic control are achieved (traffic classification and traffic control are mainly achieved by establishing different tunnels). The supervision module can ensure the security of data interaction across terminals and meet network security and data compliance requirements (this is achieved by the data supervision distribution module forwarding to the corresponding network security network management platform). At the same time, it can reduce the data backhaul to other network elements of the core network, avoid the three-layer routing conversion on UPF, and thus improve the performance of terminal mutual access to the network. The transmission path is dynamically optimized through the terminal post-routing technology, which enhances the communication efficiency between terminals, improves the adaptability and flexibility of the network, and strengthens the performance of 5G networks in large-scale IoT terminal interconnection.

[0124] The principle of the three-module design of this embodiment is that to achieve full-process supervision of terminal mutual access, two basic problems need to be solved: the first problem is how to identify and manage the terminal, and the second problem is how to maintain supervision during the terminal mutual access process. The first problem is to use the network communication management module under the terminal to realize the management of the terminal. The second problem is to use the data supervision distribution module to solve it, and the data supervision distribution module is realized by docking with the network security network management. A derivative problem also arises: how to communicate efficiently between the two modules. The data tunnel construction module is used to achieve efficient communication between the two modules. The data supervision distribution module is not in the public network, and the terminal mutual access data is transmitted through the tunnel, which has better privacy and performance. The three-module design is a targeted design to solve the problem of terminal mutual access under full supervision, with a streamlined structure. At the same time, because the data supervision process is docked with the network security network management through a distribution mode, it has better independence and better compatibility.

[0125] Embodiment 2:

[0126] like Figure 2 As shown, the present disclosure provides a terminal mutual visit management device, the device comprising:

[0127] An acquisition unit 1 is used to acquire a terminal mutual access request from a source terminal to a target terminal;

[0128] Path unit 2, connected to acquisition unit 1, for acquiring a first data path and a second data path according to a terminal mutual access request, the first data path leading to a network data supervision platform, and the second data path connecting a source terminal and a target terminal;

[0129] The distribution unit 3 is connected to the path unit 2, and is used to realize the replication and distribution of the terminal mutual access data between the source terminal and the target terminal through the first data path and the second data path, so as to realize the data supervision of the terminal mutual access data through the first data path, and realize the terminal mutual access between the source terminal and the target terminal through the second data path.

[0130] In one embodiment, wherein:

[0131] The first data path includes: a first communication path between a source terminal and a source network element, a first tunnel between the source network element through a core network user plane function UPF network element and a tunnel service platform, and / or, a second communication path between a target terminal and a target network element, a second tunnel between the target network element through a core network UPF network element and a tunnel service platform, and an interface path between the tunnel service platform and a network data supervision platform;

[0132] The second data path includes: a first communication path between a source terminal and a source network element, a first tunnel between the source network element through a core network UPF network element and a tunnel service platform, a second tunnel between a target network element through a core network UPF network element and a tunnel service platform, and a second communication path between a target terminal and a target network element, or a first communication path between a source terminal and a source network element, a third tunnel between a source network element through a core network UPF network element and a target network element, and a second communication path between a target terminal and a target network element;

[0133] The distribution unit 3 includes a tunnel service platform or a core network UPF network element, which copies the terminal mutual access data into two copies. The first copy of the terminal mutual access data is sent to the network data supervision platform through the first data path to realize data supervision, and the second copy of the terminal mutual access data is sent through the second data path to realize terminal mutual access.

[0134] In one embodiment, wherein:

[0135] The first tunnel and the second tunnel are specifically the second layer tunnel protocol L2TP tunnels, the source network element includes the source L2TP access concentrator LAC, the target network element includes the target LAC, the tunnel service platform is specifically the L2TP network server LNS, the first tunnel connects the source LAC, the core network UPF network element and LNS in sequence, and the second tunnel connects the LNS, the core network UPF network element and the target LAC in sequence.

[0136] In one embodiment, the device further includes a terminal-attached network communication management module:

[0137] A terminal-attached network communication management module is set in the core network. The terminal-attached network communication management module obtains the communication topology relationship and the media access control MAC address of the terminal, allocates an Internet interconnection protocol IP address to each terminal according to the communication topology relationship and the MAC address, obtains the address resolution protocol ARP table according to the communication topology relationship and the IP address, and sends the ARP table to the LNS to enable the LNS to have an IP routing function.

[0138] In one embodiment, the acquisition unit 1 includes a terminal-attached network communication management module:

[0139] The network communication management module under the terminal includes the core network access and mobility management function AMF network element. The core network AMF network element receives the terminal mutual access request from the source terminal, obtains the source terminal MAC address and the target terminal MAC address according to the terminal mutual access request, and obtains the terminal mutual access data in the terminal mutual access request.

[0140] In one embodiment, the path unit 2 includes a data tunnel construction module and a data supervision and distribution module:

[0141] A data tunnel construction module and a data supervision and distribution module are set up in the core network. The data tunnel construction module includes a source LAC and a target LAC. The data supervision and distribution module includes an LNS. The data tunnel construction module is connected to the network communication management module under the terminal.

[0142] The network communication management module under the terminal notifies the source LAC and the target LAC to establish the first tunnel and the second tunnel in response to receiving the terminal mutual access request.

[0143] The network communication management module under the terminal sends the source terminal MAC address, the target terminal MAC address and the terminal mutual access data to the LNS through the first tunnel.

[0144] The LNS queries the ARP table according to the source terminal MAC address and the target terminal MAC address to obtain the source terminal IP address and the target terminal IP address, and obtains the first communication path and the second communication path according to the source terminal IP address and the target terminal IP address.

[0145] In one embodiment, the distribution unit 3 comprises an LNS:

[0146] LNS copies the terminal access data into two copies.

[0147] LNS sends the first terminal access data to the network data supervision platform through the interface path between itself and the network data supervision platform.

[0148] LNS sends the target terminal IP address and the second terminal access data to the network communication management module under the terminal through the second tunnel.

[0149] The network communication management module under the terminal sends the second terminal mutual access data to the target terminal according to the IP address of the target terminal.

[0150] In one embodiment, the apparatus further comprises a supervisory response unit, including an LNS, configured to:

[0151] In response to failure of data supervision on the terminal mutual access data, the LNS does not send the target terminal IP address and the second terminal mutual access data to the network communication management module under the terminal, and / or the LNS interrupts subsequent terminal mutual access between the source terminal and the target terminal.

[0152] It can be understood that the units and modules described in this embodiment can all be partial functions set in some physical device entities. For example, "distribution unit 3 includes LNS" may mean that at least some of the functions corresponding to the distribution unit 3 are set in the LNS, and "acquisition unit 1 includes a terminal-mounted network communication management module, and the terminal-mounted network communication management module includes a core network access and mobility management function AMF network element" is also a similar expression, that is, at least some of the functions corresponding to the terminal-mounted network communication management module are set in the core network AMF network element, and at least some of the functions corresponding to the terminal-mounted network communication management module are the same as at least some of the functions corresponding to the acquisition unit 1.

[0153] Embodiment 3:

[0154] Embodiment 3 of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the terminal mutual visit management method as described in Embodiment 1 or the terminal mutual visit management device as described in Embodiment 2 is implemented.

[0155] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program elements or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0156] In addition, the present disclosure may also provide a computer device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor runs the computer program stored in the memory, the processor executes the terminal mutual visit management method as described in Example 1. The computer device may be the terminal mutual visit management device as described in Example 2.

[0157] The memory is connected to the processor, the memory may be a flash memory or a read-only memory or other memory, and the processor may be a central processing unit or a single-chip microcomputer.

[0158] Embodiments 1-3 of the present disclosure provide a terminal mutual access management method, device and medium, which obtain a first data path leading to a network data supervision platform and a second data path connecting the source terminal and the target terminal according to a terminal mutual access request from a source terminal to a target terminal, and implement replication and distribution of terminal mutual access data based on the first data path and the second data path, thereby implementing supervision of terminal mutual access data while implementing terminal mutual access.

[0159] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present disclosure, but the present disclosure is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and substance of the present disclosure, and these modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A terminal mutual access management method, characterized in that: The method comprises: Obtaining a terminal mutual access request from a source terminal to a target terminal; Acquire a first data path and a second data path according to the terminal mutual access request, the first data path leading to the network data supervision platform, and the second data path connecting the source terminal and the target terminal; Through the first data path and the second data path, the terminal mutual access data between the source terminal and the target terminal is copied and distributed, so as to realize data supervision of the terminal mutual access data through the first data path, and realize the terminal mutual access between the source terminal and the target terminal through the second data path.

2. The method according to claim 1, characterized in that in: The first data path includes: a first communication path between a source terminal and a source network element, a first tunnel between the source network element through a core network user plane function UPF network element and a tunnel service platform, and / or, a second communication path between a target terminal and a target network element, a second tunnel between the target network element through a core network UPF network element and a tunnel service platform, and an interface path between the tunnel service platform and a network data supervision platform; The second data path includes: a first communication path between a source terminal and a source network element, a first tunnel between the source network element through a core network UPF network element and a tunnel service platform, a second tunnel between a target network element through a core network UPF network element and a tunnel service platform, and a second communication path between a target terminal and a target network element, or a first communication path between a source terminal and a source network element, a third tunnel between a source network element through a core network UPF network element and a target network element, and a second communication path between a target terminal and a target network element; The tunnel service platform or the core network UPF network element copies the terminal mutual access data into two copies. The first copy of the terminal mutual access data is sent to the network data supervision platform through the first data path to realize data supervision, and the second copy of the terminal mutual access data is sent through the second data path to realize terminal mutual access.

3. The method according to claim 2, characterized in that in: The first tunnel and the second tunnel are specifically the second layer tunnel protocol L2TP tunnels, the source network element includes the source L2TP access concentrator LAC, the target network element includes the target LAC, the tunnel service platform is specifically the L2TP network server LNS, the first tunnel connects the source LAC, the core network UPF network element and LNS in sequence, and the second tunnel connects the LNS, the core network UPF network element and the target LAC in sequence.

4. The method according to claim 3, characterized in that The method further comprises: A terminal-attached network communication management module is set in the core network. The terminal-attached network communication management module obtains the communication topology relationship and the media access control MAC address of the terminal, allocates an Internet interconnection protocol IP address to each terminal according to the communication topology relationship and the MAC address, obtains the address resolution protocol ARP table according to the communication topology relationship and the IP address, and sends the ARP table to the LNS to enable the LNS to have an IP routing function.

5. The method according to claim 4, characterized in that Obtain the terminal mutual access request from the source terminal to the target terminal, including: The network communication management module under the terminal includes the core network access and mobility management function AMF network element. The core network AMF network element receives the terminal mutual access request from the source terminal, obtains the source terminal MAC address and the target terminal MAC address according to the terminal mutual access request, and obtains the terminal mutual access data in the terminal mutual access request.

6. The method according to claim 5, characterized in that Acquiring a first data path and a second data path according to a terminal mutual access request, wherein the first data path leads to a network data supervision platform, and the second data path connects a source terminal and a target terminal, specifically includes: A data tunnel construction module and a data supervision and distribution module are set up in the core network. The data tunnel construction module includes a source LAC and a target LAC. The data supervision and distribution module includes an LNS. The data tunnel construction module is connected to the network communication management module under the terminal. The network communication management module under the terminal notifies the source LAC and the target LAC to establish the first tunnel and the second tunnel in response to receiving the terminal mutual access request. The network communication management module under the terminal sends the source terminal MAC address, the target terminal MAC address and the terminal mutual access data to the LNS through the first tunnel. The LNS queries the ARP table according to the source terminal MAC address and the target terminal MAC address to obtain the source terminal IP address and the target terminal IP address, and obtains the first communication path and the second communication path according to the source terminal IP address and the target terminal IP address.

7. The method according to claim 6, characterized in that The method of implementing the duplication and distribution of the terminal mutual access data between the source terminal and the target terminal through the first data path and the second data path, so as to implement the data supervision of the terminal mutual access data through the first data path, and implementing the terminal mutual access between the source terminal and the target terminal through the second data path, specifically includes: LNS copies the terminal access data into two copies. LNS sends the first terminal access data to the network data supervision platform through the interface path between itself and the network data supervision platform. LNS sends the target terminal IP address and the second terminal access data to the network communication management module under the terminal through the second tunnel. The network communication management module under the terminal sends the second terminal mutual access data to the target terminal according to the IP address of the target terminal.

8. The method according to claim 7, characterized in that After data supervision of terminal mutual access data is implemented through the first data path, the method further includes: In response to failure of data supervision on the terminal mutual access data, the LNS does not send the target terminal IP address and the second terminal mutual access data to the network communication management module under the terminal, and / or the LNS interrupts subsequent terminal mutual access between the source terminal and the target terminal.

9. A terminal mutual access management device, characterized in that: The device comprises: An acquisition unit, used for acquiring a terminal mutual access request from a source terminal to a target terminal; A path unit, connected to the acquisition unit, for acquiring a first data path and a second data path according to a terminal mutual access request, wherein the first data path leads to a network data supervision platform, and the second data path connects a source terminal and a target terminal; The distribution unit is connected to the path unit and is used to copy and distribute the terminal mutual access data between the source terminal and the target terminal through the first data path and the second data path, so as to realize data supervision of the terminal mutual access data through the first data path, and realize the terminal mutual access between the source terminal and the target terminal through the second data path.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the terminal mutual access management method according to any one of claims 1 to 8 is implemented.

Images