Access control method, apparatus, and system for edge resource pool, and communication device

Abstract

The present application relates to an access control method, apparatus, and system for an edge resource pool, and a communication device. The method comprises: in response to an access control request for an edge resource pool, determining first access control information of a switch in the edge resource pool, wherein the first access control information is used to control access to the switch; and sending the first access control information to a proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch on the basis of the received first access control information. By adopting the present method, the security of access control for edge resource pools can be improved.

Description

Access control method, device, system and communication equipment for edge resource pool

[0001] Related applications

[0002] This application claims priority to Chinese patent application number 202310950722.2, filed on July 31, 2023, entitled “Access control method, device, system and communication equipment for edge resource pool,” the entire text of which is hereby incorporated by reference. Technical Field

[0003] The present application relates to the field of network security technology, and in particular to an access control method, apparatus, system and communication equipment for an edge resource pool. Background Art

[0004] With the development of wireless communication technology, MEC (Multi-access Edge Computing) has emerged, representing cloud computing at the edge of the network. This technology deploys computing power closer to users, providing computing power and applications locally, thereby improving the user experience.

[0005] Traditional technologies use virtual private clouds (VPCs), security domains, and network isolation in traditional cloud computing to protect MEC, moving security control from the network center to the edge. This approach allows MEC to determine security protection measures based only on its own node information, potentially leading to security vulnerabilities and becoming a launching point for hacker attacks.

[0006] Therefore, the current access control technology for edge resource pools has a low security problem and there is no effective solution.

[0007] Summary of the Invention

[0008] Based on this, it is necessary to provide an access control method, device, system, communication equipment, computer-readable storage medium and computer program product for an edge resource pool that can improve security in response to the above technical problems.

[0009] In a first aspect, the present application provides an access control method for an edge resource pool, which is applied to a control node, the control node being connected to an edge resource pool, the edge resource pool being provided with a switch and a proxy node corresponding to the switch; the method comprising:

[0010] In response to an access control request for the edge resource pool, determining first access control information of the switch in the edge resource pool, wherein the first access control information is used to control access to the switch;

[0011] The first access control information is sent to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

[0012] In one embodiment, before determining the first access control information of the switch in the edge resource pool in response to the access control request for the edge resource pool, the method further includes:

[0013] Upon receiving a registration request for an edge resource from the edge resource pool, or upon detecting the edge resource of the edge resource pool, acquiring resource information of the edge resource;

[0014] The resource information is registered to obtain registered resource information of the edge resource pool; the registered resource information is used to determine the first access control information.

[0015] In one embodiment, after sending the first access control information to the proxy node corresponding to the switch in the edge resource pool, the method further includes:

[0016] Upon receiving an identity authentication request from a target user, performing identity authentication on the target user;

[0017] If the identity authentication is successful, determining second access control information of the switch, where the second access control information is used to control access between the target user and the switch;

[0018] The second access control information is sent to the proxy node corresponding to the switch, so that the proxy node performs access control on the switch according to the received second access control information.

[0019] In one embodiment, after sending the second access control information to the proxy node corresponding to the switch, the method further includes:

[0020] Acquire user traffic of the target user and resource pool traffic of the edge resource pool corresponding to the second access control information;

[0021] In a case where the user traffic does not match the resource pool traffic, an alarm signal for the second access control information is generated.

[0022] In one embodiment, the control node is deployed in a resource pool at an upper level of the edge resource pool.

[0023] In a second aspect, the present application further provides an access control method for an edge resource pool, which is applied to a proxy node, wherein the proxy node is set in the edge resource pool and corresponds to a switch in the edge resource pool, and the edge resource pool is connected to a control node; the method includes:

[0024] receiving first access control information sent by the control node, where the first access control information is information for controlling access to the switch in the edge resource pool, determined by the control node in response to an access control request for the edge resource pool;

[0025] Access control is performed on the switch corresponding to the proxy node according to the received first access control information.

[0026] In one embodiment, performing access control on the switch corresponding to the proxy node according to the received first access control information includes:

[0027] Upon receiving the first access control information, performing access permission verification on the switch corresponding to the proxy node;

[0028] When the access authority verification is passed, access control is performed on the switch.

[0029] In a third aspect, the present application further provides an access control device for an edge resource pool, which is applied to a control node, the control node being connected to the edge resource pool, the edge resource pool being provided with a switch and a proxy node corresponding to the switch; the device comprising:

[0030] a determination module, configured to determine first access control information of the switch in the edge resource pool in response to an access control request for the edge resource pool; the first access control information is used to control access to the switch;

[0031] The sending module is configured to send the first access control information to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

[0032] In one embodiment, the apparatus further comprises:

[0033] A resource acquisition module, configured to, upon receiving a registration request for an edge resource from the edge resource pool or upon detecting an edge resource of the edge resource pool, acquire resource information of the edge resource;

[0034] The resource registration module is used to register the resource information to obtain the registered resource information of the edge resource pool, and the registered resource information is used to determine the first access control information.

[0035] In one embodiment, the apparatus further comprises:

[0036] An identity authentication module is used to authenticate the target user upon receiving an identity authentication request from the target user;

[0037] a control information module, configured to determine second access control information of the switch if the identity authentication passes, wherein the second access control information is used to control access between the target user and the switch;

[0038] The access control module is configured to send the second access control information to the proxy node corresponding to the switch, so that the proxy node performs access control on the switch according to the received second access control information.

[0039] In one embodiment, the apparatus further comprises:

[0040] a traffic acquisition module, configured to acquire the user traffic of the target user and the resource pool traffic of the edge resource pool corresponding to the second access control information;

[0041] An alarm signal module is used to generate an alarm signal for the second access control information when the user traffic does not match the resource pool traffic.

[0042] In a fourth aspect, the present application further provides an access control device for an edge resource pool, which is applied to a proxy node, wherein the proxy node is arranged in the edge resource pool and corresponds to a switch in the edge resource pool, and the edge resource pool is connected to a control node; the device includes:

[0043] a receiving module, configured to receive first access control information sent by the control node; the first access control information is information for controlling access between the switches in the edge resource pool, determined by the control node in response to an access control request for the edge resource pool;

[0044] A control module is configured to perform access control on the switch corresponding to the proxy node according to the received first access control information.

[0045] In one embodiment, the control module is further configured to perform access permission verification on the switch upon receiving the first access control information; and perform access control on the switch if the access permission verification passes.

[0046] In a fifth aspect, the present application further provides an access control system for an edge resource pool, the system comprising a control node and an agent node, the control node being connected to the edge resource pool, the edge resource pool being provided with a switch and the agent node corresponding to the switch;

[0047] The control node is configured to determine, in response to an access control request for the edge resource pool, first access control information of the switch in the edge resource pool, and send the first access control information to the proxy node in the edge resource pool; the first access control information is used to control access to the switch;

[0048] The proxy node is configured to perform access control on the switch corresponding to the proxy node according to the received first access control information.

[0049] In a sixth aspect, the present application further provides a communication device. The communication device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0050] In response to an access control request for the edge resource pool, determining first access control information of the switch in the edge resource pool, where the first access control information is used to control access to the switch;

[0051] The first access control information is sent to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

[0052] In a seventh aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0053] In response to an access control request for the edge resource pool, determining first access control information of the switch in the edge resource pool, where the first access control information is used to control access to the switch;

[0054] The first access control information is sent to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

[0055] In an eighth aspect, the present application further provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the following steps:

[0056] In response to an access control request for the edge resource pool, determining first access control information of the switch in the edge resource pool, where the first access control information is used to control access to the switch;

[0057] The first access control information is sent to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

[0058] The access control method, apparatus, system, communication equipment, storage medium and computer program product of the above-mentioned edge resource pool determine the first access control information for controlling access to the switch in the edge resource pool in response to the access control request for the edge resource pool, and send the first access control information to the proxy node corresponding to the switch in the edge resource pool; by setting a corresponding proxy node for each switch in the edge resource pool and enabling the control node to interact with the proxy node, while achieving unified control of each switch in the edge resource pool, a micro-isolation protection function is formed between each switch, thereby improving the security of the access control of the edge resource pool. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technology descriptions. Obviously, the drawings described below are only some embodiments of this application. For those of ordinary skill in the art, other drawings can be derived from these drawings without inventive effort.

[0060] FIG1 is a diagram illustrating an application environment of an access control method for an edge resource pool in an embodiment of the present application.

[0061] FIG2 is a flow chart of an edge resource pool access control method according to an embodiment of the present application.

[0062] FIG3 is a flow chart of an access control method for an edge resource pool in another embodiment of the present application.

[0063] Figure 4 is a structural block diagram of a public unified micro-isolation management and control system implemented on MEC in one embodiment of the present application.

[0064] FIG5 is a flow chart of a method for implementing a common unified micro-isolation control on MEC in one embodiment of the present application.

[0065] FIG6 is a flow chart of an access control method for an edge resource pool in another embodiment of the present application.

[0066] FIG7 is a structural block diagram of an access control device for an edge resource pool in an embodiment of the present application.

[0067] FIG8 is a structural block diagram of an access control device for an edge resource pool in another embodiment of the present application.

[0068] FIG9 is a structural block diagram of an access control system of an edge resource pool in an embodiment of the present application.

[0069] FIG10 is a diagram showing the internal structure of a communication device in one embodiment of the present application. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0071] The access control method for the edge resource pool provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. Among them, the control node 102 can be a terminal or a server, deployed in a management-level cloud resource pool, for example, a provincial / municipal cloud resource pool. The edge resource pool 104 can be a MEC (Multi-access Edge Computing) cloud resource pool. A physical switch and an OVS (Open vSwitch, virtual switch) are provided in the edge resource pool 104. Both the physical switch and the OVS correspond to the agent node 106. For example, the agent software can be installed on the physical switch or the OVS, and the physical switch or the OVS with the agent software installed is used as the agent node 106; the control node 102 is connected to the edge resource pool 104 through each agent node 106, and the user terminal is connected to the 5GC (core network) through the RAN (access network). The 5GC is provided with network elements such as AMF (access and mobility management function), SMF (session management function), and NEF (network open function). The UPF (User Plane Function) network element is located in edge resource pool 104, and user terminals are connected to the UPF network element in edge resource pool 104 via the RAN. In addition to physical switches, OVS, and UPF, edge resource pool 104 also includes MEP (Message Exchange Pattern), cloud hardware, and a cloud operating system.

[0072] In one embodiment, as shown in FIG2 , a method for controlling access to an edge resource pool is provided. The method is described by taking the method applied to the control node 102 in FIG1 as an example, and includes the following steps:

[0073] Step S210 : In response to an access control request for an edge resource pool, determining first access control information of a switch in the edge resource pool; wherein the first access control information is used to control access to the switch.

[0074] The access control request may be a signal requesting access control to the edge resource pool.

[0075] The first access control information may be access control information of a switch.

[0076] In a specific implementation, resource information of each switch in the edge resource pool can be obtained in advance and stored in the control node. The user terminal sends an access control request for the edge resource pool to the control node. The control node responds to the received access control request and generates first access control information of the switch based on the pre-stored resource information of each switch in the edge resource pool to control access to the switch.

[0077] In practical applications, agent software can be installed on the physical switches and OVS in the MEC cloud resource pool to enable micro-isolation protection between switches. Control nodes can also be deployed on the management-level cloud resource pool to uniformly manage and control micro-isolation for each switch in the MEC cloud resource pool. For example, the resource information of each switch in the MEC cloud resource pool can be pre-registered with the control node in the management-level cloud resource pool. In response to micro-isolation control requirements sent by user terminals, the control node can generate a unified east-west micro-isolation access control policy between each switch in the MEC cloud resource pool based on the registered resource information.

[0078] Step S220: Send the first access control information to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

[0079] In a specific implementation, after generating the first access control information of the switch, the control node can determine the proxy node corresponding to the switch and send the first access control information to the proxy node. The proxy node verifies the access rights of the switch based on the first access control information. If the verification is successful, the switch is accessed; otherwise, if the verification fails, the switch is not accessed.

[0080] In actual applications, after generating an east-west micro-segmentation access control policy, the control node can distribute it to each physical switch or OVS installed with agent software. The physical switch or OVS then uses the agent software to enforce east-west micro-segmentation access control. For example, the agent software can verify access rights to the physical switch or OVS. If verification passes, east-west micro-segmentation access is granted to the physical switch or OVS. Otherwise, if verification fails, east-west micro-segmentation access is not granted to the physical switch or OVS.

[0081] The access control method of the above-mentioned edge resource pool determines the first access control information for controlling the access of the switch in the edge resource pool in response to the access control request for the edge resource pool, and sends the first access control information to the proxy node corresponding to the switch in the edge resource pool; by setting a corresponding proxy node for each switch in the edge resource pool and enabling the control node to interact with the proxy node, while achieving unified control of each switch in the edge resource pool, a micro-isolation protection function is formed between each switch, thereby improving the security of the access control of the edge resource pool.

[0082] In one embodiment, before the above-mentioned step S210, the above-mentioned access control method may further specifically include: upon receiving a registration request for edge resources from the edge resource pool, or upon detecting edge resources of the edge resource pool, obtaining resource information of the edge resources, registering the resource information, and obtaining registered resource information of the edge resource pool; wherein the registered resource information is used to determine the first access control information.

[0083] The registration request may be a signal requesting to register resource information of the edge resource.

[0084] The edge resource may be a storage resource in an edge resource pool.

[0085] The registered resource information of the edge resource pool includes the registered resource information of all edge resources in the edge resource pool.

[0086] In a specific implementation, when a new edge resource is present in the edge resource pool, the edge resource pool may send a registration request to the control node for the new edge resource. Upon receiving the registration request, the control node may register the resource information of the new edge resource on the control node, thereby forming the registered resource information of the new edge resource on the control node. Alternatively, the control node may detect whether there is a new edge resource in the edge resource pool according to a preset period. If a new edge resource is detected in the edge resource pool, the resource information of the new edge resource may be registered on the control node, thereby forming the registered resource information of the new edge resource on the control node. Upon receiving an access control request, the control node may determine the first access control information based on the registered resource information of all edge resources in the edge resource pool in response to the access control request.

[0087] In actual applications, when the MEC cloud resource pool releases a new virtual machine or a new container, the MEC cloud resource pool can register the new virtual machine or new container on the control node of the management-level cloud resource pool. The control node of the management-level cloud resource pool can also register the new virtual machine or new container through a self-discovery program, so that in response to the micro-isolation control requirements sent by the user terminal, the control node can uniformly manage the virtual machines and containers in the MEC cloud resource pool based on the registration information of the virtual machines and containers.

[0088] In this embodiment, when a registration request for edge resources is received from the edge resource pool, or when edge resources of the edge resource pool are detected, resource information of the edge resources is obtained; the resource information is registered to obtain the registered resource information of the edge resource pool, so that the control node can obtain the resource information of all edge resources in the edge resource pool, and uniformly manage all edge resources to meet the micro-isolation management and control requirements of edge resources, thereby ensuring the security of access control of the edge resource pool.

[0089] In one embodiment, after step S220, the access control method may further include: upon receiving an identity authentication request sent by the target user, performing identity authentication on the target user; if the identity authentication is successful, determining second access control information of the switch; the second access control information is used to control access between the target user and the switch; and sending the second access control information to a proxy node corresponding to the switch, so that the proxy node performs access control on the switch based on the received second access control information.

[0090] The target user may be a user of the edge resource pool.

[0091] The identity authentication request may be a signal requesting identity authentication.

[0092] The second access control information may be access control information between the switch and the user.

[0093] In a specific implementation, a target user can send an identity authentication request to a control node. Upon receiving the identity authentication request, the control node performs identity authentication on the target user. If the authentication fails, there is no need to determine the second access control information between the target user and the target switch. If the authentication passes, the second access control information is determined and sent to the target proxy node corresponding to the target switch. The target proxy node then performs access control on the target switch based on the received second access control information. Specifically, the target proxy node can verify access rights on the target switch based on the second access control information. If the authentication passes, access to the target switch is granted; if the authentication fails, access to the target switch is not granted.

[0094] The target switch may be a switch corresponding to the target user in the north-south access control policy, and the target proxy node may be a proxy node corresponding to the target switch.

[0095] In actual applications, after the user accesses the mobile network through 5GC authentication, a PDN (Packet Data Network) connection to the UPF is established. When the user accesses the MEC cloud resource pool through the security gateway (physical switch), the user can initiate identity authentication to the control node through the security gateway. If the authentication is successful, the control node can open the north-south access permission policy of a specific VLAN (Virtual Local Area Network) and send it to the security gateway; if the authentication fails, the control node will not open the north-south access permission policy.

[0096] In this embodiment, upon receiving an identity authentication request sent by the target user, the target user is authenticated; if the identity authentication is passed, the second access control information of the switch is determined; the second access control information is used to control the access between the target user and the switch; the second access control information is sent to the proxy node corresponding to the switch, so that the north-south access of the edge resource pool can be uniformly micro-isolated and controlled, further improving the security of the access control of the edge resource pool.

[0097] In one embodiment, after the above-mentioned step of sending the second access control information to the proxy node corresponding to the switch, the above-mentioned access control method may further specifically include: obtaining the user traffic of the target user and the resource pool traffic of the edge resource pool corresponding to the second access control information; when the user traffic does not match the resource pool traffic, generating an alarm signal for the second access control information.

[0098] The user traffic can be the target user's transmission traffic per unit time, and the resource pool traffic can be the edge resource pool's transmission traffic per unit time.

[0099] In a specific implementation, after sending the second access control information to the target proxy node, the target proxy node controls access between the target user and the target switch based on the received second access control information. Subsequently, the control node can obtain the user traffic of the target user and the resource pool traffic of the edge resource pool, and compare the user traffic with the resource pool traffic. If the user traffic matches the resource pool traffic, no processing is required; otherwise, if the user traffic does not match the resource pool traffic, an alarm signal can be generated for the second access control information. Matching the user traffic and the resource pool traffic means that the difference between the user traffic and the resource pool traffic is within a preset range.

[0100] In practical applications, the control node can monitor edge resource pools and user traffic in real time by working with proxy nodes. If abnormal network behavior is detected, dynamic access control policies are generated to block it. For example, proxy nodes can report resource pool traffic to the control node in real time, and user terminals can also report transmission logs containing user traffic to the control node in real time. The control node generates dynamic access control policies based on resource pool traffic and user traffic and sends them to the switch. Specifically, if user traffic is much greater than resource pool traffic, the resource pool traffic can be appropriately increased. If user traffic is much less than resource pool traffic, the resource pool traffic can be appropriately reduced. If user traffic matches resource pool traffic, there is no need to adjust the access control policy.

[0101] In this embodiment, by obtaining the user traffic of the target user and the resource pool traffic of the edge resource pool corresponding to the second access control information; when the user traffic does not match the resource pool traffic, an alarm signal for the second access control information is generated. In this way, abnormal situations of the second access control information can be discovered in time, and corresponding strategies can be adopted in time to ensure the reliability of access control.

[0102] In one embodiment, the control node is deployed in a resource pool that is a level above the edge resource pool.

[0103] Among them, the upper-level resource pool of the edge resource pool can be a management-level cloud resource pool, for example, a provincial / municipal cloud resource pool.

[0104] In a specific implementation, the control node can be deployed in the upper-level management-level cloud resource pool of the edge resource pool.

[0105] In this embodiment, by deploying the control node in the upper-level resource pool of the edge resource pool, the edge cloud resource pool can be uniformly micro-isolated and managed to improve the security of edge resource pool access control.

[0106] In one embodiment, as shown in FIG3 , a method for controlling access to an edge resource pool is provided. The method is described by taking the application of the method to the proxy node 106 in FIG1 as an example, and includes the following steps:

[0107] Step S310: Receive first access control information sent by a control node; wherein the first access control information is information for controlling access to switches in an edge resource pool, determined by the control node in response to an access control request for the edge resource pool;

[0108] Step S320: Perform access control on the switch corresponding to the proxy node according to the received first access control information.

[0109] In a specific implementation, the control node can pre-acquire resource information of each switch in the edge resource pool and store it. The user terminal sends an access control request for the edge resource pool to the control node. In response to the received access control request, the control node generates first access control information of the switch based on the pre-stored resource information of each switch in the edge resource pool, and sends the first access control information to the proxy node. The proxy node verifies the access permission of the corresponding switch based on the first access control information. If the verification is successful, the switch is accessed; if the verification fails, the switch is not accessed.

[0110] In this embodiment, by receiving the first access control information sent by the control node, access control is performed on the switch corresponding to the proxy node based on the received first access control information. Corresponding proxy nodes can be set for each switch in the edge resource pool, and the control node and the proxy node can be interacted with each other. While achieving unified management and control of each switch in the edge resource pool, a micro-isolation protection function is formed between each switch, thereby improving the security of the access control of the edge resource pool.

[0111] In one embodiment, the above step S320 may specifically include: when the first access control information is received, performing access permission verification on the switch corresponding to the proxy node; when the access permission verification passes, performing access control on the switch.

[0112] In a specific implementation, when the proxy node receives the first access control information, it can determine the switch corresponding to the first access control information and perform access permission verification on the switch. If the verification passes, the proxy node can access the switch; if the verification fails, the proxy node cannot access the switch.

[0113] In this embodiment, by verifying the access rights of the switch corresponding to the proxy node when the first access control information is received; and performing access control on the switch when the access rights verification passes, micro-isolation management and control between the switches in the edge resource pool can be achieved, thereby improving the security of the access control of the edge resource pool.

[0114] In order to facilitate those skilled in the art to have a deeper understanding of the embodiments of the present application, a specific example will be used for illustration below.

[0115] Figure 4 provides a block diagram of a common, unified micro-segmentation control system implemented on MEC. As shown in Figure 4, to implement common, unified micro-segmentation control capabilities on MEC, agent software can be installed on the OVS and physical switches in the MEC cloud resource pool, enabling them to have micro-segmentation protection capabilities. A policy decision point (control node 102) is deployed in the provincial / municipal cloud resource pool (management-level cloud resource pool) to uniformly manage the MEC cloud resource pool OVS and physical switches. Virtual machines / container resources in the MEC cloud resource pool are isolated by default. Users must submit micro-segmentation access requirements for MEC resources to the operator. Based on these requirements, the operator generates a micro-segmentation policy based on VLAN QinQ (a technology that encapsulates user private VLAN tags within public VLAN tags, allowing packets to traverse the operator's backbone network with two layers of VLAN tags) through the policy decision point and sends it to the corresponding OVS or physical switch, providing micro-segmentation protection services for MEC resources.

[0116] For user identity-based access control, users can access the mobile network through 5GC authentication and establish a PDN connection to the UPF. When users access MEC resources through the security gateway (physical switch), they need to initiate identity authentication to the policy decision point through the security gateway. After the authentication is passed, the policy decision point opens the specific VLAN access permission policy and sends it to the security gateway.

[0117] In order to improve the security processing rate of the MEC resource pool, the policy decision point can also be linked with the agent to monitor the resource pool traffic in real time, generate dynamic access control policies when abnormal network behavior is found, and block abnormal traffic.

[0118] In one embodiment, as shown in FIG5 , a flow chart of a method for implementing a common unified micro-isolation control method on an MEC is provided. As shown in FIG5 , the specific process of implementing a common unified micro-isolation control method on an MEC is as follows:

[0119] Step 1: Install agent software on the MEC resource pool OVS and physical switches to enable micro-isolation protection.

[0120] Step 2: Deploy policy decision points in provincial / municipal resource pools to implement unified micro-isolation management and control of MEC cloud resource pool OVS and physical switches.

[0121] Step 3: After the MEC resource pool releases a new virtual machine / container, the policy decision point provides unified management through registration or self-discovery, and the user submits the micro-isolation control requirements of the virtual machine / container resources to the operator.

[0122] In step 4, the operator analyzes the needs of enterprise customers, uses policy decision points to uniformly generate micro-segmentation access control policies, and sends them to physical switches or OVS agents. The physical switches or OVS agents execute micro-segmentation access control through the agents.

[0123] Step 5: After the user accesses the mobile network through 5GC authentication, a PDN connection to the UPF is established. When the user accesses MEC resources through the security gateway (physical switch), the security gateway must initiate identity authentication to the policy decision point. After the authentication is passed, the policy decision point opens the specific VLAN access permission policy and sends it to the security gateway.

[0124] In step 6, the policy decision point monitors the resource pool and user traffic in real time by coordinating with the agent. If abnormal network behavior is found, a dynamic access control policy is generated to block abnormal traffic.

[0125] In one embodiment, as shown in FIG6 , a method for controlling access to an edge resource pool is provided. The method is described by taking the method applied to the control node 102 in FIG1 as an example, and includes the following steps:

[0126] Step S601: When a registration request for an edge resource is received from an edge resource pool, or when an edge resource in an edge resource pool is detected, resource information of the edge resource is acquired.

[0127] Step S602: Register resource information to obtain registered resource information of the edge resource pool; wherein the registered resource information is used to determine first access control information.

[0128] Step S603: In response to the access control request for the edge resource pool, determine first access control information of the switches in the edge resource pool; wherein the first access control information is used to control access between switches.

[0129] Step S604: Send the first access control information to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

[0130] Step S605: upon receiving the identity authentication request sent by the target user, perform identity authentication on the target user.

[0131] Step S606: If the identity authentication is successful, determine the second access control information of the switch; wherein the second access control information is used to control access between the target user and the switch.

[0132] Step S607: Send the second access control information to the proxy node corresponding to the switch, so that the proxy node performs access control on the switch according to the received second access control information.

[0133] Step S608: Acquire the user traffic of the target user and the resource pool traffic of the edge resource pool corresponding to the second access control information.

[0134] Step S609: When the user traffic does not match the resource pool traffic, an alarm signal for the second access control information is generated.

[0135] In a specific implementation, the edge resource pool can send a registration request for edge resources to the control node. The control node registers the edge resources upon receiving the registration request. Alternatively, the control node can register the edge resources upon detecting edge resources in the edge resource pool and obtain the registered resource information of the edge resource pool after registration. Based on the user's access control request, the control node can generate first access control information for east-west micro-isolation and send the first access control information to the proxy node. The proxy node then performs access control on the corresponding switch. The target user can also send an identity authentication request to the control node through the switch. Upon receiving the identity authentication request, the control node performs identity authentication on the target user. If the authentication fails, no processing is required. If the authentication passes, the control node determines the access control information between the target user and the target switch, generates second access control information for north-south micro-isolation, and sends the second access control information to the target proxy node corresponding to the target switch. The target proxy node then performs access control on the target switch. The control node can also obtain user traffic and resource pool traffic in real time. If the user traffic and resource pool traffic match, no processing is required. If the user traffic and resource pool traffic do not match, an alarm signal can be generated to adjust the second access control information.

[0136] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0137] Based on the same inventive concept, the embodiments of the present application also provide an access control device and system for an edge resource pool for implementing the access control method for the edge resource pool involved above. The implementation solution provided by the device and system to solve the problem is similar to the implementation solution described in the above method. Therefore, the specific limitations in the embodiments of the access control device and system for one or more edge resource pools provided below can be found in the limitations of the access control method for the edge resource pool above, and will not be repeated here.

[0138] In one embodiment, as shown in FIG7 , an access control device 700 for an edge resource pool is provided, which is applied to a control node connected to an edge resource pool, wherein a switch and a proxy node corresponding to the switch are provided in the edge resource pool; the device includes: a determination module 710 and a sending module 720.

[0139] The determination module 710 is configured to determine first access control information of the switch in the edge resource pool in response to an access control request for the edge resource pool; the first access control information is used to control access to the switch.

[0140] The sending module 720 is configured to send the first access control information to a proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

[0141] In one embodiment, the access control device 700 of the edge resource pool may further include:

[0142] A resource acquisition module, configured to, upon receiving a registration request for an edge resource from the edge resource pool or upon detecting an edge resource of the edge resource pool, acquire resource information of the edge resource;

[0143] The resource registration module is used to register the resource information to obtain the registered resource information of the edge resource pool; the registered resource information is used to determine the first access control information.

[0144] In one embodiment, the access control device 700 of the edge resource pool may further include:

[0145] The identity authentication module is used to authenticate the target user upon receiving an identity authentication request from the target user;

[0146] A control information module, configured to determine second access control information of the switch when identity authentication is successful; wherein the second access control information is used to control access between the target user and the switch;

[0147] The access control module is configured to send the second access control information to a proxy node corresponding to the switch, so that the proxy node performs access control on the switch according to the received second access control information.

[0148] In one embodiment, the access control device 700 of the edge resource pool may further include:

[0149] A traffic acquisition module, configured to acquire the user traffic of the target user and the resource pool traffic of the edge resource pool corresponding to the second access control information;

[0150] The alarm signal module is used to generate an alarm signal for the second access control information when the user traffic does not match the resource pool traffic.

[0151] In one embodiment, the control node is deployed in a resource pool at an upper level of the edge resource pool.

[0152] In one embodiment, as shown in FIG8 , an access control device 800 for an edge resource pool is provided, which is applied to a proxy node. The proxy node is set in the edge resource pool and corresponds to a switch in the edge resource pool. The edge resource pool is connected to a control node. The device includes a receiving module 810 and a control module 820.

[0153] The receiving module 810 is configured to receive first access control information sent by the control node; wherein the first access control information is information for controlling access to the switch in the edge resource pool determined by the control node in response to an access control request for the edge resource pool.

[0154] The control module 820 is configured to perform access control on the switch corresponding to the proxy node according to the received first access control information.

[0155] In one embodiment, the control module 820 may be further configured to perform access permission verification on the switch corresponding to the proxy node upon receiving the first access control information; and perform access control on the switch if the access permission verification passes.

[0156] In one embodiment, as shown in FIG9 , an access control system 900 for an edge resource pool is provided. The system may include: a control node 910 and an agent node 920 ; the control node is connected to the edge resource pool, and the edge resource pool is provided with a switch and an agent node corresponding to the switch.

[0157] The control node 910 is used to determine first access control information of a switch in the edge resource pool in response to an access control request for the edge resource pool, and send the first access control information to an agent node in the edge resource pool; wherein the first access control information is used to control access to the switch.

[0158] The proxy node 920 is configured to perform access control on the switch corresponding to the proxy node according to the received first access control information.

[0159] Each module in the aforementioned edge resource pool access control device and system can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a communication device in hardware form, or can be stored in a memory in the communication device in software form, so that the processor can call and execute the corresponding operations of each module.

[0160] In one embodiment, a communication device is provided, which may be a server, and its internal structure diagram may be shown in Figure 10. The communication device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the communication device is used to provide computing and control capabilities. The memory of the communication device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the communication device is used to store data. The input / output interface of the communication device is used to exchange information between the processor and an external device. The communication interface of the communication device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an access control method for an edge resource pool is implemented.

[0161] Those skilled in the art will understand that the structure shown in Figure 10 is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the communication device to which the scheme of the present application is applied. The specific communication device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0162] In one embodiment, a communication device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0163] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0164] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0165] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0166] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0167] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0168] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. An access control method for an edge resource pool, applied to a control node, the control node is connected to an edge resource pool, the edge resource pool is provided with a switch and a proxy node corresponding to the switch; the method comprises: In response to an access control request for the edge resource pool, determining first access control information of the switch in the edge resource pool, where the first access control information is used to control access to the switch; The first access control information is sent to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

2. The method according to claim 1, wherein before determining the first access control information of the switch in the edge resource pool in response to the access control request for the edge resource pool, the method further comprises: When a registration request for an edge resource is received from the edge resource pool, or when the edge resource of the edge resource pool is detected, resource information of the edge resource is acquired; The resource information is registered to obtain the registered resource information of the edge resource pool; the registered resource information is used to determine the first access control information.

3. The method according to claim 1, wherein after sending the first access control information to the proxy node corresponding to the switch in the edge resource pool, the method further comprises: Upon receiving an identity authentication request sent by a target user, performing identity authentication on the target user; If the identity authentication is passed, determining second access control information of the switch, where the second access control information is used to control access between the target user and the switch; The second access control information is sent to the proxy node corresponding to the switch, so that the proxy node performs access control on the switch according to the received second access control information.

4. The method according to claim 3, wherein after sending the second access control information to the proxy node corresponding to the switch, the method further comprises: Acquire the user flow of the target user and the resource pool flow of the edge resource pool corresponding to the second access control information; In a case where the user traffic does not match the resource pool traffic, an alarm signal for the second access control information is generated. 5 . The method according to claim 1 , wherein the control node is deployed in a resource pool of an upper level of the edge resource pool.

6. An access control method for an edge resource pool, applied to a proxy node, wherein the proxy node is arranged in the edge resource pool and corresponds to a switch in the edge resource pool, and the edge resource pool is connected to a control node; the method comprises: receiving first access control information sent by the control node, where the first access control information is information for controlling access to the switch in the edge resource pool, determined by the control node in response to an access control request for the edge resource pool; Access control is performed on the switch corresponding to the proxy node according to the received first access control information.

7. The method according to claim 6, wherein the step of performing access control on the switch corresponding to the proxy node according to the received first access control information comprises: Upon receiving the first access control information, performing access rights verification on the switch corresponding to the proxy node; When the access authority verification is passed, access control is performed on the switch.

8. An access control device for an edge resource pool, applied to a control node, the control node is connected to an edge resource pool, the edge resource pool is provided with a switch and a proxy node corresponding to the switch; the device comprises: A determination module, configured to determine first access control information of the switch in the edge resource pool in response to an access control request for the edge resource pool, wherein the first access control information is used to control access to the switch; The sending module is used to send the first access control information to the proxy node corresponding to the switch in the edge resource pool, so that the proxy node performs access control on the switch according to the received first access control information.

9. The apparatus according to claim 8, further comprising: A resource acquisition module, configured to acquire resource information of the edge resource upon receiving a registration request for an edge resource from the edge resource pool or upon detecting an edge resource of the edge resource pool; The resource registration module is used to register the resource information to obtain the registered resource information of the edge resource pool, and the registered resource information is used to determine the first access control information.

10. The apparatus according to claim 8, further comprising: An identity authentication module, configured to perform identity authentication on the target user upon receiving an identity authentication request sent by the target user; A control information module, used for determining second access control information of the switch when the identity authentication is passed, wherein the second access control information is used for controlling access between the target user and the switch; The access control module is used to send the second access control information to the proxy node corresponding to the switch, so that the proxy node performs access control on the switch according to the received second access control information.

11. The apparatus according to claim 10, further comprising: A traffic acquisition module, used to acquire the user traffic of the target user and the resource pool traffic of the edge resource pool corresponding to the second access control information; An alarm signal module is used to generate an alarm signal for the second access control information when the user traffic does not match the resource pool traffic.

12. An access control device for an edge resource pool, applied to a proxy node, wherein the proxy node is arranged in the edge resource pool and corresponds to a switch in the edge resource pool, and the edge resource pool is connected to a control node; the device comprises: A receiving module, configured to receive first access control information sent by the control node, where the first access control information is information for controlling access to the switch in the edge resource pool, determined by the control node in response to an access control request for the edge resource pool; A control module is used to perform access control on the switch corresponding to the proxy node according to the received first access control information.

13. The device according to claim 12, wherein the control module is further used to perform access permission verification on the switch when the first access control information is received; and perform access control on the switch when the access permission verification passes.

14. An access control system for an edge resource pool, the system comprising a control node and an agent node, the control node being connected to the edge resource pool, the edge resource pool being provided with a switch and the agent node corresponding to the switch; wherein: The control node is used to determine first access control information of the switch in the edge resource pool in response to an access control request for the edge resource pool, and send the first access control information to the proxy node in the edge resource pool, where the first access control information is used to control access to the switch; The proxy node is used to perform access control on the switch corresponding to the proxy node according to the received first access control information.

15. A communication device, comprising a memory and a processor, wherein the memory stores a computer program, wherein the processor implements the steps of the method according to any one of claims 1 to 7 when executing the computer program.

16. A computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the method according to any one of claims 1 to 7 when executed by a processor.

17. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images