Terminal dynamic access control method and device, storage medium and program product

Abstract

The invention relates to the technical field of communication, and particularly provides a terminal dynamic access control method and device, a storage medium and a program product. The method comprises the following steps: receiving an authentication request from core network equipment, wherein the authentication request carries multiple pieces of information of a terminal requesting to access a core network; obtaining a composite strategy decision corresponding to the terminal; and based on the composite policy decision and the plurality of pieces of information, authenticating the terminal to obtain an authentication result, and returning the authentication result to the core network device. When a single authentication request of a terminal is processed, comprehensive evaluation and logical judgment can be carried out on at least two or more sub-policies of different dimensions according to a preset composite policy decision, and whether terminal access is allowed or not is determined according to a comprehensive judgment result. Through a composite strategy decision, complex and scenarized security requirements (for example, a specific device can access at a specific time and a specific place) can be perfectly matched, and the security management and control granularity is improved to a brand new level.

Description

Terminal dynamic access control methods, devices, storage media, and software products Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a method, device, storage medium, and program product for dynamic access control of a terminal. Background Technology

[0002] In existing 5G private network or public network enhancement solutions, in order to strengthen the control of terminal access, a secondary authentication mechanism is usually introduced in addition to the standard authentication process of the 5G core network.

[0003] In related technologies, when a terminal (UE) initiates a PDU (Protocol Data Unit) session establishment request, the Session Management Function (SMF) entity forwards the request to an external Authentication, Authorization, and Accounting (AAA) server through the User Plane Function (UPF) entity. The AAA server then authenticates the UE.

[0004] Currently, AAA server authentication policies are typically single-dimensional or separated into different dimensions. While these single-dimensional control policies enhance security to some extent, they are independent of each other. Administrators need to configure and maintain different system or policy modules for different security needs, lacking a unified mechanism that can make a one-time decision based on all security dimensions. Summary of the Invention

[0005] This disclosure is made in view of the above-mentioned problems. This disclosure provides a method, device, storage medium, and program product for dynamic access control of a terminal.

[0006] According to a first aspect of this disclosure, a terminal dynamic access control method is provided, applied to an authentication server. The method includes: receiving an authentication request from a core network device, the authentication request carrying multiple pieces of information about a terminal requesting access to the core network; obtaining a composite policy decision corresponding to the terminal; the composite policy decision including at least two sub-decisions; authenticating the terminal based on the composite policy decision and the multiple pieces of information, obtaining an authentication result, and returning the authentication result to the core network device.

[0007] Furthermore, according to the terminal dynamic access control method of the first aspect of this disclosure, obtaining the composite policy decision corresponding to the terminal includes: obtaining the user group corresponding to the terminal; and using the composite policy decision corresponding to the user group as the composite policy decision corresponding to the terminal.

[0008] Furthermore, according to the terminal dynamic access control method of the first aspect of this disclosure, before obtaining the composite policy decision corresponding to the terminal, the method further includes: confirming that the plurality of information includes a slice identifier.

[0009] Furthermore, according to the terminal dynamic access control method of the first aspect of this disclosure, the terminal is authenticated based on the composite policy decision and the plurality of information to obtain an authentication result, including: converting the composite policy decision expressed in JSON format into a composite policy decision expressed in an abstract syntax tree; and executing the composite policy decision expressed in the abstract syntax tree layer by layer in the order from leaf node to root node based on the plurality of information to obtain the authentication result.

[0010] Furthermore, according to the terminal dynamic access control method of the first aspect of this disclosure, based on the composite policy decision and the plurality of information, the terminal is authenticated, an authentication result is obtained, and the authentication result is returned to the core network device, including: when the composite policy decision includes a first sub-policy and a second sub-policy with a dependency relationship, the first sub-policy and the second sub-policy are executed serially according to the dependency relationship based on the plurality of information, wherein the execution time of the policy that is depended on in the first sub-policy and the second sub-policy is earlier than the dependent policy; when the composite policy decision includes a third sub-policy and a fourth sub-policy without a dependency relationship, the third sub-policy and the fourth sub-policy are executed in parallel based on the plurality of information.

[0011] Furthermore, the terminal dynamic access control method according to the first aspect of this disclosure further includes: obtaining the processor utilization rate of the authentication server; and, if the processor utilization rate is greater than a utilization rate threshold, modifying the parallel execution of the third sub-policy and the fourth sub-policy to the serial execution of the third sub-policy and the fourth sub-policy.

[0012] Furthermore, according to the terminal dynamic access control method of the first aspect of this disclosure, the composite policy decision includes at least one of the following policies: an identity dimension check policy, used to check whether the terminal identifier and / or the MAC address of the terminal included in the plurality of information exist in a preset list of legitimate device types; a binding dimension check policy, used to check whether the terminal identifier and user identity identifier included in the plurality of information satisfy a preset device-card binding relationship; a spatial dimension check policy, used to check whether the terminal location included in the plurality of information is within a legitimate access geographical area configured for the user of the terminal; and a time dimension check policy, used to check whether the requested access time included in the plurality of information is within a set legitimate access time range.

[0013] According to a second aspect of this disclosure, a terminal dynamic access control device is provided, applied to an authentication server. The device includes: a receiving module for receiving an authentication request from a core network device, the authentication request carrying multiple pieces of information about a terminal requesting access to the core network; an obtaining module for obtaining a composite policy decision corresponding to the terminal, the composite policy decision including at least two sub-decisions; and an authentication module for authenticating the terminal based on the composite policy decision and the multiple pieces of information, obtaining an authentication result, and returning the authentication result to the core network device.

[0014] According to a third aspect of this disclosure, a network device is provided, including a memory, a processor, and a computer program stored on the memory, the processor executing the computer program to implement the steps of the method described in the first aspect. According to a fourth aspect of this disclosure, a computer-readable storage medium is provided, having stored thereon a computer program / instructions that, when executed by a processor, implement the steps of the method described in the first aspect. According to a fifth aspect of this disclosure, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in the first aspect.

[0015] As will be described in detail below, the terminal dynamic access control method according to embodiments of this disclosure, when processing a single authentication request from a terminal, can comprehensively evaluate and logically judge at least two or more sub-policies of different dimensions (such as identity, binding, space, and time) based on a preset composite policy decision, and decide whether to allow the terminal to access based on the result of the comprehensive judgment. Through composite policy decision, it can perfectly match complex and scenario-based security requirements (such as "specific devices can only access at specific times and locations"), raising the granularity of security control to a whole new level.

[0016] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0017] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0018] Figure 1 is a flowchart illustrating a terminal dynamic access control method according to an embodiment of the present disclosure.

[0019] Figure 2 is a structural diagram illustrating a terminal dynamic access control device according to an embodiment of the present disclosure.

[0020] Figure 3 is a hardware block diagram illustrating a network device according to an embodiment of the present disclosure.

[0021] Figure 4 is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. Detailed Implementation

[0022] The technical methods of the embodiments of the present invention will now be clearly and completely described with reference to the accompanying drawings.

[0023] In related technologies, the authentication strategy of AAA servers is usually single-dimensional or dimension-separated. For example: Scheme 1: Device-card binding authentication. The AAA server only checks whether the IMEI (device code) and IMSI (card number) reported by the UE are consistent with the preset binding relationship.

[0024] Option 2: Access Location Authentication. The AAA server only checks whether the location information (such as CGI / TAC) reported by the UE is within the allowed geofence.

[0025] Option 3: Access Time Authentication. The AAA server only checks whether the current access time is within the allowed time window.

[0026] The main drawbacks of using this single-dimensional control strategy for terminal access control are: isolated policies and coarse-grained management. Existing access control schemes typically only perform single-dimensional policy checks, or even if they support multiple policies, these policies take effect independently. For example, a legitimate device (via SIM card binding) may still successfully access the network at an unauthorized time or location because the time or location policy may be in another independent system or not triggered simultaneously. This results in significant shortcomings and vulnerabilities in security management.

[0027] Unable to handle complex, scenario-based security requirements: In complex industrial scenarios such as smart manufacturing and smart mines, security requirements are multi-dimensional and complex. For example, it may be required that "a specific AGV (identity dimension) can only access the network during the daytime working hours (time dimension) of workshop A (spatial dimension)." Existing technologies cannot complete such complex and complex policy judgments through a single authentication interaction.

[0028] Complex system configuration and low operational efficiency: Due to the dispersed nature of policies, administrators need to configure them in different systems or modules, increasing the complexity of operations and maintenance and the possibility of errors. Policy changes and auditing also become very difficult.

[0029] To facilitate understanding of this embodiment, a detailed description of a terminal dynamic access control method disclosed in this disclosure will be provided first. The execution entity of the terminal dynamic access control method provided in this disclosure is an authentication server. In some possible implementations, this terminal dynamic access control method can be implemented by a processor calling computer-readable instructions stored in memory.

[0030] Referring to Figure 1, which is a flowchart of a terminal dynamic access control method provided in an embodiment of this disclosure, the method includes the following steps: Step 101: Receive an authentication request from a core network device, wherein the authentication request carries multiple pieces of information about the terminal requesting access to the core network.

[0031] In this embodiment, during the process of requesting access to the core network, the terminal initiates a request to establish a PDU session with the core network. This request includes multiple pieces of information about the terminal, including IMSI (International Mobile Subscriber Identity), IMEI (International Mobile Equipment Identity), ULI (User Location Information), and 3GPP-S-NSSAI slice identifier.

[0032] Among them, IMSI is also known as User Identity, corresponding to User-Name (Attribute 1, RFC 2865), IMEI is also known as Terminal Identifier, corresponding to Calling-Station-Id (Attribute 31, RFC 2865), ULI location information corresponds to Vendor-Specific (vendor number 4509, sub-attribute "User-Location-Info"), and 3GPP-S-NSSAI slice identifier is used to distinguish slice-specific authentication processes, corresponding to Vendor-Specific (sub-attribute "3GPP-S-NSSAI").

[0033] Step 102: Obtain the composite strategy decision corresponding to the terminal.

[0034] In this embodiment, the authentication server is internally configured with a composite policy decision engine. Upon receiving an authentication request, the composite policy decision engine can obtain the composite policy decision corresponding to the terminal and initiate the subsequent authentication evaluation process. The composite policy decision defines which dimensions of the policy need to be checked and the logical relationships between them.

[0035] In one embodiment, an administrator can pre-configure a corresponding multi-dimensional management policy for each terminal in the authentication server. This allows for direct identification of the composite policy decision corresponding to the terminal in the authentication request.

[0036] In one embodiment, multi-dimensional management policies can also be configured by the administrator for each user group on the authentication server. The administrator also configures terminals belonging to each user group. Thus, when obtaining the composite policy decision corresponding to a terminal, the user group to which the terminal belongs is first determined, and then the composite policy decision corresponding to the user group is used as the composite policy decision corresponding to the terminal.

[0037] In this embodiment, composite strategy decisions can be expressed in the form of composite strategy templates. Each composite strategy template includes a template ID, such as PT-2025-001, which is used to uniquely identify a composite strategy template. This template ID can also be used for strategy library indexing, version number (V1.0) to control strategy template iteration and support canary release, creation time (2025-01-01) to record template generation time for audit traceability, and signature hash (SHA-256) to verify template integrity and prevent tampering.

[0038] Step 103: Based on the composite strategy decision and multiple pieces of information, authenticate the terminal, obtain the authentication result, and return the authentication result to the core network equipment.

[0039] In this embodiment, the composite policy decision is configured in JSON format in the authentication server. Therefore, when authenticating the terminal based on the composite policy decision, it is necessary to convert the composite policy decision expressed in JSON format into a composite policy decision expressed in an abstract syntax tree. Based on multiple pieces of information, the composite policy decision expressed in the abstract syntax tree is executed layer by layer in the order from leaf node to root node to obtain the authentication result.

[0040] In this embodiment, the composite strategy decision expressed using an abstract syntax tree includes multiple levels: root node, child nodes, and leaf nodes. The root node describes the logical relationships between the multiple sub-strategy decisions included in the composite strategy decision, such as AND / OR relationships. Child nodes describe multiple sub-strategy decisions, for example, identity-dimension detection strategy sub-nodes, binding-dimension inspection strategy sub-nodes, spatial-dimension inspection strategy sub-nodes, and / or time-dimension detection strategy sub-nodes. Leaf nodes describe the specific decision content of each sub-strategy decision.

[0041] This embodiment also specifies that in the logical relationships of the abstract syntax tree, the AND operation has a higher priority than the OR operation.

[0042] Based on the above, when the composite policy decision is expressed in a composite policy template in JSON format, the authentication of the terminal based on the composite policy decision and multiple pieces of information can include a loading phase, a parsing phase, an evaluation phase, and an adjudication phase.

[0043] The composite policy decision engine operates as follows: During the loading phase, it loads the composite policy template from the database into a memory cache upon startup. During the parsing phase, it converts the JSON-formatted composite policy template into an Abstract Syntax Tree (AST). During the evaluation phase, it performs policy checks hierarchically, returning intermediate results in real time. Finally, during the adjudication phase, it aggregates results based on logical relationships and outputs the final decision. Specifically, the composite policy decision engine summarizes the check results (pass / fail) of all sub-policies and makes a final adjudication based on logical relationships (AND / OR). Logical operations follow a priority rule: parentheses first > NOT operation > AND operation > OR operation. For example, in the rule "Identity Pass ∧ (Time Allowed ∨ Location Authorized)," parentheses are forced to be evaluated first in the OR operation. Administrators can drag and drop to adjust the order of operations via a web interface, and the configuration results are synchronized to the composite policy decision engine in real time.

[0044] For example, if the rule is A AND B AND C, then the final decision is "authentication successful" only if all three dimensions of identity, binding, and space are checked and passed. If any sub-policy check fails, the final decision is "authentication failed".

[0045] In this embodiment, when authenticating a terminal based on a composite policy decision, the following principles are supported: First, for two independent sub-policy decisions included in the composite policy decision, the two sub-policy decisions are executed in parallel, while for two dependent sub-policy decisions included in the composite policy decision, the two sub-policy decisions are executed serially.

[0046] In specific implementation, when the composite strategy decision includes a first sub-strategy and a second sub-strategy with a dependency relationship, the first sub-strategy and the second sub-strategy are executed sequentially according to the dependency relationship based on multiple pieces of information, wherein the execution time of the strategy that is depended on in the first sub-strategy and the second sub-strategy is earlier than the dependent strategy; when the composite strategy decision includes a third sub-strategy and a fourth sub-strategy without a dependency relationship, the third sub-strategy and the fourth sub-strategy are executed in parallel based on multiple pieces of information.

[0047] In the case where the first sub-strategy depends on the second sub-strategy, the second sub-strategy is the strategy being depended upon, and the first unit strategy is the dependent strategy. The first unit strategy depending on the second sub-strategy means that the execution of the first unit strategy requires the result obtained from the execution of the second sub-strategy; therefore, the execution time of the second sub-strategy is earlier than the execution time of the first unit strategy.

[0048] Regarding the first and second sub-policies with dependencies, as an example, the binding dimension check policy and the identity dimension check policy are two sub-policies with dependencies. The identity dimension check policy must be completed before the binding dimension check policy can be executed.

[0049] The identity dimension check strategy is used to check whether the terminal identifier and / or the terminal's MAC address, which are included in multiple pieces of information, exist in a preset list of legitimate device types. The binding dimension check strategy is used to check whether the terminal identifier and user identity identifier, which are included in the multiple pieces of information, satisfy a preset device-card binding relationship.

[0050] As can be seen, the binding dimension check strategy requires the terminal identifier, which needs to be authenticated through the identity dimension check strategy. Only when the terminal identifier is authenticated as legitimate through the identity dimension check strategy can the binding dimension check strategy be executed for further authentication of the terminal identifier. In other words, the execution of the binding dimension check strategy depends on the execution of the identity dimension check strategy; that is, the identity dimension check strategy must be executed before the binding dimension check strategy can be executed.

[0051] Regarding the third and fourth sub-policies that have no dependencies, as an example, the identity dimension check policy and the spatial dimension check policy are two sub-policies that have no dependencies. The spatial dimension check policy is used to check whether the terminal location, which includes multiple pieces of information, is within the legal access geographical area configured for the user of the terminal.

[0052] It is evident that the input parameters required for authentication in the identity dimension inspection strategy and the spatial dimension inspection strategy do not overlap. Furthermore, the input parameters of each strategy are unrelated to the authentication result of the other strategy. Therefore, these are two completely independent sub-strategies.

[0053] It should be noted that when the processor utilization of the authentication server is too high, the parallel execution sub-policy is switched to serial execution in order to avoid resource contention.

[0054] In practice, the processor utilization of the authentication server is obtained; if the processor utilization is greater than the utilization threshold, the parallel execution of the third and fourth sub-policies is changed to the serial execution of the third and fourth sub-policies.

[0055] In this embodiment, the utilization threshold can be set manually based on experience or in advance according to actual needs. For example, the utilization threshold can be set to 95%.

[0056] Secondly, in logical relationships, if two sub-policies are represented by "AND", the execution of the other sub-policy will be terminated immediately if the authentication result of one sub-policy fails.

[0057] In this embodiment, the composite strategy decision includes at least one of the following strategies: an identity-based check strategy, a binding-based check strategy, a spatial-based check strategy, and a time-based check strategy. The specific content of the identity-based check strategy, the binding-based check strategy, and the spatial-based check strategy has been disclosed in the previous embodiments and will not be repeated here. The time-based check strategy is used to check whether the request access time included in multiple pieces of information is within a set legal access time range.

[0058] Regarding the identity dimension check strategy, the authentication server pre-configures a list of legitimate device types, also known as a whitelist. This list of legitimate devices stores terminal identifiers and / or terminal MAC addresses. As long as the terminal identifier and / or terminal MAC address belong to this list of legitimate device types, the terminal is considered a legitimate device.

[0059] Regarding the binding dimension check strategy, the device-card binding relationship in this strategy indicates which terminals a device-card can be bound to through the terminal identifier and user identity identifier. For example, if the device-card binding relationship pre-configured in the authentication server indicates that device-card 1 can only be bound to terminal 1, then if the terminal authentication request carries the terminal identifier of terminal 1, but the user identity identifier corresponds to device-card 2, the binding dimension check strategy will not be satisfied because the device-card binding relationship is not satisfied.

[0060] It should be noted that in some embodiments, the machine-card binding relationship can be either statically configured or learned by the system itself; this embodiment does not specifically limit this.

[0061] Regarding the spatial dimension inspection strategy, the legitimate access geographical area in this strategy can be the cell's CGI (Cell Global Identifier), the tracking area code (Tac), or the base station sector code.

[0062] A tracking area (CGI) consists of a group of consecutive cells and is the basic regional unit for network mobility management of terminals. The CGI is a code used to uniquely identify a cellular cell (i.e., a specific area covered by a base station antenna).

[0063] In this embodiment, multiple precision levels can be set for a legally accessible geographical area, so that the system can automatically trigger a degradation mechanism when high-precision positioning is unavailable.

[0064] As an example, the following three levels of accuracy are given: L1 (high accuracy): based on CGI+TAI positioning (accuracy ≤ 100 meters), downgraded to L2 level upon failure; L2 (standard accuracy): based on TAC positioning (positioning ≤ 1 kilometer), downgraded to L3 level upon failure; L3 (basic accuracy): based on base station sector positioning (positioning ≤ 3 kilometers), access denied upon failure. In other words, if the legitimate access geographical area is the CGI of a cell under a certain tracking area, and the terminal location carried in the authentication request is not the CGI of this cell, then the legitimate access geographical area can be upgraded to the code of the tracking area, and then it can be determined whether the terminal location is within this tracking area. If it still does not match, then it can be considered that the spatial dimension check strategy has failed authentication.

[0065] Regarding the time-dimensional inspection strategy, the legal access time range defined in this strategy satisfies time zone processing and holiday management. Time zone processing refers to adopting the UTC+8 standard time zone and integrating the annual daylight saving time switching schedule published by the National Astronomical Observatories (e.g., switching to daylight saving time at 2:00 AM on the last Sunday of March). Holiday management refers to the built-in national statutory holiday database, supporting enterprises to customize special holidays (e.g., factory holidays).

[0066] In this embodiment, the core network device receives the authentication result. If it is "successful", it continues to complete the establishment of the PDU session and the UE successfully accesses the network. If it is "failed", it interrupts the PDU session establishment process and returns the failure reason to the UE.

[0067] In the solution provided in this embodiment, when processing a single authentication request from a terminal, it can comprehensively evaluate and logically judge at least two different dimensions (such as identity, binding, space, and time) of sub-policies based on a preset composite policy decision, and decide whether to allow the terminal to access based on the result of the comprehensive judgment. Through composite policy decision, it can perfectly match complex and scenario-based security requirements (such as "specific devices can only access at specific times and locations"), raising the granularity of security control to a whole new level.

[0068] Furthermore, the solution adopted in this embodiment significantly enhances network security and eliminates security vulnerabilities: by using the "AND" logic judgment of composite policy decisions, a "multi-lock" security system is constructed. Attackers must simultaneously meet conditions across all dimensions to gain access, greatly increasing the difficulty of attacks and compensating for the defensive vulnerabilities of single-strategy approaches.

[0069] Furthermore, the solution adopted in this embodiment greatly simplifies operation and maintenance: administrators no longer need to manage multiple isolated policy systems; they can achieve integrated security control simply by configuring composite policy templates on a unified authentication service platform. Policy deployment, auditing, and modification become centralized, efficient, and less prone to errors.

[0070] Finally, the solution in this embodiment has a high system response efficiency: policy judgments for all dimensions are completed in a single authentication interaction, avoiding delays caused by multiple authentications or inter-system calls, and ensuring real-time terminal access and user experience.

[0071] In this embodiment, the authentication server is internally configured with a communication interface for communicating with core network devices. It is also configured with a user and policy database and a composite policy configuration module.

[0072] The user and policy database is used to store user information, device information, and security policies of various dimensions, such as the SIM card binding relationship database, IMEI whitelist, legal access geographical area, and legal access time range.

[0073] Composite Policy Configuration Module: Provides a management interface that allows administrators to define composite policy decisions for individual users or user groups, i.e., select the policy dimensions to be activated and set the logical relationships (AND / OR) between them. For example: AGV vehicle exclusive policy (policy ID: PT-AGV-001): As an example, the authentication server configures a composite policy decision for the user group of the intelligent manufacturing AGV group: User group: Intelligent manufacturing AGV group Logical relationship: (identity dimension ∧ binding dimension) ∧ (spatial dimension ∨ time dimension) Sub-policy conditions: Identity dimension: IMEI is in the whitelist ["864742053336717"] Binding dimension: IMSI and IMEI binding relationship exists in the machine card binding relationship library - AGV spatial dimension: Location information matches the geofence FACTORY-A-AREA-001 (CGI level) Time dimension: Access time is between [06:00-22:00] (UTC+8, including daylight saving time) Priority: 5 (levels 1-10) Composite policy decision Decision engine (core module): Responsible for parsing the request, obtaining the corresponding composite policy rules, calling the various policy check functions in parallel or serially, and making the final decision according to the preset logic when the authentication request is received.

[0074] This disclosure also provides a terminal dynamic access control device for executing the terminal dynamic access control method provided in any of the above embodiments. As shown in FIG2, the device includes: a receiving module 21 for receiving an authentication request from a core network device, the authentication request carrying multiple pieces of information about a terminal requesting access to the core network; an obtaining module 22 for obtaining a composite policy decision corresponding to the terminal; the composite policy decision includes at least two sub-decisions; and an authentication module 23 for authenticating the terminal based on the composite policy decision and the multiple pieces of information, obtaining an authentication result, and returning the authentication result to the core network device.

[0075] In one or more embodiments, the acquisition module 22 is configured to: acquire the user group corresponding to the terminal; and use the composite policy decision corresponding to the user group as the composite policy decision corresponding to the terminal.

[0076] In one or more embodiments, the device is further configured to: confirm that the plurality of information includes a slice identifier before obtaining a composite policy decision corresponding to the terminal.

[0077] In one or more embodiments, the authentication module 23 is configured to: convert the composite policy decision expressed in JSON format into a composite policy decision expressed in an abstract syntax tree; and, based on the plurality of information, execute the composite policy decision expressed in the abstract syntax tree layer by layer in order from leaf node to root node to obtain the authentication result.

[0078] In one or more embodiments, the authentication module 23 is configured to: when the composite strategy decision includes a first sub-strategy and a second sub-strategy with a dependency relationship, execute the first sub-strategy and the second sub-strategy serially according to the dependency relationship based on the plurality of information, wherein the execution time of the strategy that is depended upon in the first sub-strategy and the second sub-strategy is earlier than the dependent strategy; and when the composite strategy decision includes a third sub-strategy and a fourth sub-strategy without a dependency relationship, execute the third sub-strategy and the fourth sub-strategy in parallel based on the plurality of information.

[0079] In one or more embodiments, the apparatus is further configured to: obtain the processor utilization of the authentication server; and, if the processor utilization is greater than a utilization threshold, modify the parallel execution of the third sub-policy and the fourth sub-policy to the serial execution of the third sub-policy and the fourth sub-policy.

[0080] In one or more embodiments, the composite policy decision includes at least one of the following policies: an identity dimension check policy, used to check whether the terminal identifier and / or the MAC address of the terminal included in the plurality of information exist in a preset list of legitimate device types; a binding dimension check policy, used to check whether the terminal identifier and user identity identifier included in the plurality of information satisfy a preset device-card binding relationship; a spatial dimension check policy, used to check whether the location of the terminal included in the plurality of information is within a legitimate access geographical area configured for the user of the terminal; and a time dimension check policy, used to check whether the requested access time included in the plurality of information is within a set legitimate access time range.

[0081] The terminal dynamic access control device and the terminal dynamic access control method provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0082] This disclosure also provides a network device to execute the above-described terminal dynamic access control method. Please refer to FIG3, which shows a schematic diagram of a network device provided in some embodiments of this disclosure. As shown in FIG3, the network device 3 includes: a processor 300, a memory 301, a bus 302, and a communication interface 303. The processor 300, the communication interface 303, and the memory 301 are connected via the bus 302. The memory 301 stores a computer program that can run on the processor 300. When the processor 300 runs the computer program, it executes the terminal dynamic access control method provided in any of the foregoing embodiments of this disclosure.

[0083] The memory 301 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this device network element and at least one other network element is achieved through at least one communication interface 303 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0084] Bus 302 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 301 is used to store programs. After receiving an execution instruction, the processor 300 executes the program. The terminal dynamic access control method disclosed in any of the foregoing embodiments of this disclosure can be applied to the processor 300, or implemented by the processor 300.

[0085] The processor 300 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 300 or by instructions in software form. The processor 300 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 301. The processor 300 reads the information in memory 301 and, in conjunction with its hardware, completes the steps of the above method.

[0086] The network device and the terminal dynamic access control method provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0087] This disclosure also provides a computer-readable storage medium corresponding to the mid-terminal dynamic access control method provided in the foregoing embodiments. The computer-readable storage medium is an optical disc, on which a computer program (i.e., a computer program product) is stored. When the computer program is run by a processor, it executes the mid-terminal dynamic access control method provided in any of the foregoing embodiments.

[0088] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0089] The computer-readable storage medium provided in the above embodiments of this disclosure and the mid-terminal dynamic access control method provided in the embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0090] This disclosure also provides a computer program product. Please refer to Figure 4. The computer program product 400 carries program code, namely computer program 401. The instructions included in the computer program 401 can be used to execute the steps of the mid-terminal dynamic access control method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0091] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0092] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0093] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0094] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0095] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0096] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0097] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0098] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A method for dynamic access control of a terminal, characterized in that, The method, applied to an authentication server, includes: receiving an authentication request from a core network device, the authentication request carrying multiple pieces of information about a terminal requesting access to the core network; obtaining a composite policy decision corresponding to the terminal; the composite policy decision including at least two sub-decisions; authenticating the terminal based on the composite policy decision and the multiple pieces of information, obtaining an authentication result, and returning the authentication result to the core network device.

2. The method according to claim 1, characterized in that, Obtaining the composite policy decision corresponding to the terminal includes: obtaining the user group corresponding to the terminal; and using the composite policy decision corresponding to the user group as the composite policy decision corresponding to the terminal.

3. The method according to claim 1, characterized in that, Before obtaining the composite policy decision corresponding to the terminal, the method further includes: confirming that the multiple pieces of information include a slice identifier.

4. The method according to claim 1, characterized in that, Based on the composite policy decision and the multiple pieces of information, the terminal is authenticated to obtain an authentication result, including: converting the composite policy decision expressed in JSON format into a composite policy decision expressed in an abstract syntax tree; and based on the multiple pieces of information, executing the composite policy decision expressed in the abstract syntax tree layer by layer in the order from leaf node to root node to obtain the authentication result.

5. The method according to claim 1, characterized in that, Based on the composite policy decision and the multiple pieces of information, the terminal is authenticated to obtain an authentication result, and the authentication result is returned to the core network device. This includes: when the composite policy decision includes a first sub-policy and a second sub-policy with a dependency relationship, the first sub-policy and the second sub-policy are executed serially according to the dependency relationship based on the multiple pieces of information, wherein the execution time of the policy that is depended upon in the first sub-policy and the second sub-policy is earlier than the dependent policy; when the composite policy decision includes a third sub-policy and a fourth sub-policy without a dependency relationship, the third sub-policy and the fourth sub-policy are executed in parallel based on the multiple pieces of information.

6. The method according to claim 5, characterized in that, Also includes: Obtain the processor utilization rate of the authentication server; If the processor utilization rate is greater than the utilization threshold, the parallel execution of the third sub-strategy and the fourth sub-strategy will be modified to the serial execution of the third sub-strategy and the fourth sub-strategy.

7. The method according to any one of claims 1-6, characterized in that, The composite strategy decision includes at least one of the following strategies: an identity dimension check strategy, used to check whether the terminal identifier and / or the terminal's MAC address included in the multiple pieces of information exist in a preset list of legitimate device types; The binding dimension check strategy is used to check whether the terminal identifier and user identity identifier included in the multiple pieces of information meet the preset machine-card binding relationship; The spatial dimension check strategy is used to check whether the terminal location, which includes the multiple pieces of information, is within the legal access geographical area configured for the user of the terminal; the temporal dimension check strategy is used to check whether the requested access time, which includes the multiple pieces of information, is within the set legal access time range.

8. A network device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1-7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1-7.

Images