CN117676576A - Access system and method of non-3GPP equipment - Google Patents

Access system and method of non-3GPP equipment Download PDF

Info

Publication number
CN117676576A
CN117676576A CN202311696078.7A CN202311696078A CN117676576A CN 117676576 A CN117676576 A CN 117676576A CN 202311696078 A CN202311696078 A CN 202311696078A CN 117676576 A CN117676576 A CN 117676576A
Authority
CN
China
Prior art keywords
authentication
access
core network
user equipment
module
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202311696078.7A
Other languages
Chinese (zh)
Inventor
张向裕
张聚明
邓懿
邱涛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
GHT CO Ltd
Original Assignee
GHT CO Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by GHT CO Ltd filed Critical GHT CO Ltd
Priority to CN202311696078.7A priority Critical patent/CN117676576A/en
Publication of CN117676576A publication Critical patent/CN117676576A/en
Pending legal-status Critical Current

Links

Landscapes

  • Mobile Radio Communication Systems (AREA)

Abstract

The invention discloses an access system and method of non-3GPP equipment, comprising: when user equipment initiates an authentication request, receiving an access message sent by the user equipment through an N6 interface of a data plane network element of a core network, and filtering the access message according to a preset configuration rule to generate an authentication request message; extracting authentication information in the authentication request message, and authenticating the authentication information through a preset standard authentication protocol; when authentication information is successfully authenticated, adding VN group members through a core network control surface, and establishing a mapping relation between a core network user identifier and user equipment; and notifying the data surface network element to update the forwarding rule of the VN group level, adding authentication information to the forwarding rule and establishing a data forwarding path for the user equipment. The invention can realize the access of non-3GPP equipment without complex signaling conversion, so that the network is more concise and efficient, and the data transmission delay is effectively reduced.

Description

Access system and method of non-3GPP equipment
Technical Field
The present invention relates to the field of wireless communications technologies, and in particular, to an access system and method for a non-3GPP device.
Background
In the 5G network, the Non-3GPP network may access the 5G core network through an N3IWF (Non-3 GPP Inter Working Function ) network element. For example, when the N3IWF is used to access the 5G core network, firstly, the terminal and the N3IWF need to perform identity authentication to establish an IPSec tunnel, and then the NAS (Network Attached Storage ) signaling between the relay terminal and the AMF (Authentication Management Function ) completes the identity authentication procedure of the 5G core network and the establishment of a PDU (Protocol Data Unit ) session, so that the 5G core network can perform unified management on these devices. However, the non-3GPP access technology involves multiple non-3GPP network types, such as Wi-Fi, fixed broadband, etc., which are very different from the 3GPP protocols, so that additional network devices are required to be added to switch signaling, and data needs to be transmitted and switched between multiple different types of networks, which causes additional transmission delay in the data transmission process, thereby reducing network performance.
Disclosure of Invention
The invention provides an access system and method of non-3GPP equipment, which can realize the access of the non-3GPP equipment without complex signaling conversion, so that the network is more concise and efficient, and the data transmission delay is effectively reduced.
In order to solve the technical problems, the embodiment of the invention provides an access system of non-3GPP equipment, which comprises a service filtering module, an access authentication module, an AAA module and a control plane interface adaptation module;
the service filtering module is used for receiving an access message sent by the user equipment through an N6 interface of a data plane network element of the core network, filtering the access message according to a preset configuration rule, generating an authentication request message, and sending the authentication request message to the access authentication module;
the access authentication module is used for receiving and detecting the authentication request message, extracting authentication information in the authentication request message, sending the authentication information to the AAA module, adding VN group members through a core network control plane after receiving an authentication result returned by the AAA module, establishing a mapping relation between a core network user identifier and the user equipment, and informing the control plane interface adaptation module to establish a data forwarding path;
the AAA module is used for receiving the authentication information, authenticating the authentication information through a preset standard authentication protocol, and returning the authentication success as an authentication result to the access authentication module when the authentication information is successfully authenticated;
the control plane interface adapting module is configured to notify the core network data plane network element to update a forwarding rule of a VN group level after receiving the notification of the access authentication module, and add the authentication information to the forwarding rule to establish the data forwarding path for the user equipment.
Preferably, the authentication information at least comprises a MAC address, an IP address, a user name, a user password, and domain name information;
the adding of the VN group members through the control plane of the core network and the establishment of the mapping relation between the user identification of the core network and the user equipment comprise:
determining a VN group according to the domain name information;
adding VN group members through the core network control plane, and generating the core network user identification;
and establishing a mapping relation between the core network user identifier and the user equipment.
Preferably, the filtering the access message according to a preset configuration rule to generate an authentication request message includes:
detecting whether an authentication protocol used by the authentication request message is a preset authentication protocol according to a preset configuration rule;
if yes, the access message passes authentication and generates the authentication request message;
if not, the authentication fails, and the user equipment is refused to be accessed.
Preferably, the system further comprises an authentication preprocessing module;
the authentication preprocessing module is used for inquiring available VN groups through a core network when the user equipment initiates an authentication request, and determining an authentication protocol used by an access message according to the configuration of the user equipment through the available VN groups.
Preferably, the AAA module is further configured to grant network access rights to the user equipment authenticated by the authentication information.
The invention discloses an access system of non-3GPP equipment, when user equipment initiates an authentication request, an access message sent by the user equipment is received through an N6 interface of a core network data plane network element, and the access message is filtered according to a preset configuration rule to generate an authentication request message; extracting authentication information in the authentication request message, and authenticating the authentication information through a preset standard authentication protocol; when authentication information is successfully authenticated, adding VN group members through a core network control surface, and establishing a mapping relation between a core network user identifier and user equipment; and notifying the data surface network element to update the forwarding rule of the VN group level, adding authentication information to the forwarding rule and establishing a data forwarding path for the user equipment. And using an N6 interface supporting an Ethernet protocol in a core network data plane network element as an access interface of a non-3GPP terminal, using a general authentication technology to identify and authenticate the user identity, and finally establishing a data plane forwarding path for the access equipment through a core network open interface. The invention can realize the access of non-3GPP equipment without complex signaling conversion, so that the network is more concise and efficient, and the data transmission delay is effectively reduced.
In order to solve the technical problem, the embodiment of the invention also provides an access method of non-3GPP equipment, which comprises the following steps:
when user equipment initiates an authentication request, receiving an access message sent by the user equipment through an N6 interface of a data plane network element of a core network, and filtering the access message according to a preset configuration rule to generate an authentication request message;
extracting authentication information in the authentication request message, and authenticating the authentication information through a preset standard authentication protocol;
when the authentication information is successfully authenticated, adding VN group members through a core network control surface, and establishing a mapping relation between a core network user identifier and the user equipment;
and notifying a data surface network element to update a forwarding rule of a VN group level, adding the authentication information to the forwarding rule, and establishing a data forwarding path for the user equipment.
Preferably, the authentication information at least comprises a MAC address, an IP address, a user name, a user password, and domain name information;
the adding of the VN group members through the control plane of the core network and the establishment of the mapping relation between the user identification of the core network and the user equipment comprise:
determining a VN group according to the domain name information;
adding VN group members through the core network control plane, and generating the core network user identification;
and establishing a mapping relation between the core network user identifier and the user equipment.
Preferably, the filtering the access message according to a preset configuration rule to generate an authentication request message includes:
detecting whether an authentication protocol used by the authentication request message is a preset authentication protocol according to a preset configuration rule;
if yes, the access message passes authentication and generates the authentication request message;
if not, the authentication fails, and the user equipment is refused to be accessed.
Preferably, before receiving the access message sent by the user equipment through the N6 interface of the data plane network element of the core network, the method further includes:
and inquiring available VN groups through a core network, and determining an authentication protocol used by the access message according to the user equipment and the available VN groups.
Preferably, before adding the VN group member through the core network control plane, the method further comprises:
and granting network access rights to the user equipment successfully authenticated by the authentication information through the AAA module.
The invention discloses an access system and method of non-3GPP equipment, comprising: when user equipment initiates an authentication request, receiving an access message sent by the user equipment through an N6 interface of a data plane network element of a core network, and filtering the access message according to a preset configuration rule to generate an authentication request message; extracting authentication information in the authentication request message, and authenticating the authentication information through a preset standard authentication protocol; when authentication information is successfully authenticated, adding VN group members through a core network control surface, and establishing a mapping relation between a core network user identifier and user equipment; and notifying the data surface network element to update the forwarding rule of the VN group level, adding authentication information to the forwarding rule and establishing a data forwarding path for the user equipment. The invention can realize the access of non-3GPP equipment without complex signaling conversion, so that the network is more concise and efficient, and the data transmission delay is effectively reduced.
Drawings
Fig. 1 is a block diagram of an access system of a non-3GPP device according to an embodiment of the present invention.
Fig. 2 is a flow chart of an access method of a non-3GPP device according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
The embodiment of the invention provides an access system of non-3GPP equipment, referring to FIG. 1, which is a structural block diagram of the access system of non-3GPP equipment provided by the embodiment of the invention; the system comprises a service filtering module, an access authentication module, an AAA module and a control surface interface adaptation module;
the service filtering module is used for receiving an access message sent by the user equipment through an N6 interface of a data plane network element of the core network, filtering the access message according to a preset configuration rule, generating an authentication request message, and sending the authentication request message to the access authentication module;
the access authentication module is used for receiving and detecting the authentication request message, extracting authentication information in the authentication request message, sending the authentication information to the AAA module, adding VN group members through a core network control plane after receiving an authentication result returned by the AAA module, establishing a mapping relation between a core network user identifier and the user equipment, and informing the control plane interface adaptation module to establish a data forwarding path;
the AAA module is used for receiving the authentication information, authenticating the authentication information through a preset standard authentication protocol, and returning the authentication success as an authentication result to the access authentication module when the authentication information is successfully authenticated;
the control plane interface adapting module is configured to notify the core network data plane network element to update a forwarding rule of a VN group level after receiving the notification of the access authentication module, and add the authentication information to the forwarding rule to establish the data forwarding path for the user equipment.
The invention discloses an access system of non-3GPP equipment, when user equipment initiates an authentication request, an access message sent by the user equipment is received through an N6 interface of a core network data plane network element, and the access message is filtered according to a preset configuration rule to generate an authentication request message; extracting authentication information in the authentication request message, and authenticating the authentication information through a preset standard authentication protocol; when authentication information is successfully authenticated, adding VN group members through a core network control surface, and establishing a mapping relation between a core network user identifier and user equipment; and notifying the data surface network element to update the forwarding rule of the VN group level, adding authentication information to the forwarding rule and establishing a data forwarding path for the user equipment. And using an N6 interface supporting an Ethernet protocol in a core network data plane network element as an access interface of a non-3GPP terminal, using a general authentication technology to identify and authenticate the user identity, and finally establishing a data plane forwarding path for the access equipment through a core network open interface. The invention can realize the access of non-3GPP equipment without complex signaling conversion, so that the network is more concise and efficient, and the data transmission delay is effectively reduced.
In yet another embodiment of the present invention, the authentication information includes at least a MAC address, an IP address, a user name, a user password, and domain name information;
the adding of the VN group members through the control plane of the core network and the establishment of the mapping relation between the user identification of the core network and the user equipment comprise:
determining a VN group according to the domain name information;
adding VN group members through the core network control plane, and generating the core network user identification;
and establishing a mapping relation between the core network user identifier and the user equipment.
In the implementation of the invention, after receiving the authentication request message, the authentication request message is extracted from the authentication request message Useful for Information such as a MAC address, an IP address, a user name, a user password, a domain name and the like is used as authentication information; when a VN group (Virtual Network Group ) member needs to be added, firstly, determining a VN group, namely a target VN group, according to domain name information in the authentication information, wherein the VN group needs to be added by user equipment; the VN group members are then added by the core network control plane and a core network user identity is generated, which is used to uniquely identify each mobile user in the mobile communication network, GPSI (Generic Public Subscription Identifier, generic public user identity). It can ensure that each user has a unique identifier, so that the network can accurately identify and distinguish different user equipment, and is also used for user identity verification in the mobile communication network, so that only legal users can access the network and communicate. The mapping relation is established between the core network user identifier GPSI and the user equipment, so that the mobile communication network canThe user equipment is managed and monitored, for example, the data flow of the user equipment is limited, the network resource allocation is regulated, and the like, so that the network performance is optimized, the reliability and the efficiency of the network are improved, only legal user equipment can be ensured to access the network and communicate, and the safety of the network is ensured.
In still another embodiment of the present invention, the filtering the access message according to a preset configuration rule to generate an authentication request message includes:
detecting whether an authentication protocol used by the authentication request message is a preset authentication protocol according to a preset configuration rule;
if yes, the access message passes authentication and generates the authentication request message;
if not, the authentication fails, and the user equipment is refused to be accessed.
In the implementation of the present invention, the received authentication request message is usually an LDAP (Lightweight Directory Access Protocol ), DNS (Domain Name System, domain name system) or a message whose source IP or source MAC is unknown but whose destination MAC/IP is a user, so if the access message is not any one of the above messages, the access message does not satisfy the preset configuration rule, and the access message cannot be used as the authentication request message, and the authentication fails. The illegal access message can be prevented from being used as a normal authentication request message through the preset configuration rule, and the subsequent authentication procedure is interfered.
In yet another embodiment provided by the present invention, the system further includes an authentication preprocessing module;
the authentication preprocessing module is used for inquiring available VN groups through a core network when the user equipment initiates an authentication request, and determining an authentication protocol used by an access message according to the configuration of the user equipment through the available VN groups.
When the user equipment initiates the access request, firstly, a query request is sent to the core network in a broadcast mode to acquire domain name information of all VN groups so as to query available VN groups, and the core network access control network element sends activated VN group configuration information to the user equipment, wherein the configuration information generally comprises domain name information, online members and a supported access authentication algorithm, the VN groups are screened in advance, and screening results are fed back to the user equipment, so that the success rate of the access of the user equipment is improved.
In another embodiment of the present invention, the AAA module is further configured to grant network access rights to a user equipment that is successfully authenticated by the authentication information.
In the implementation of the present invention, the AAA module refers to a module responsible for three functions of Authentication (Authentication), authorization (Accounting) and Accounting (Accounting) in a computer network. The AAA module uses a preset RADIUS (Remote Authentication Dial-In User Service) protocol to authenticate the information of the User, and the User after authentication can be granted network access right after successful authentication because the RADIUS protocol provides a safe authentication mechanism to ensure that only authenticated users can access the network resources. Authentication is performed through credentials such as a user name and a password, so that unauthorized users can be prevented from entering. This helps to protect the network and sensitive data from unauthorized access.
The embodiment of the invention provides a method, referring to fig. 1, which is a schematic flow chart provided by the embodiment of the invention, and comprises steps S20 to S13;
step S20: when user equipment initiates an authentication request, receiving an access message sent by the user equipment through an N6 interface of a data plane network element of a core network, and filtering the access message according to a preset configuration rule to generate an authentication request message;
step S21: extracting authentication information in the authentication request message, and authenticating the authentication information through a preset standard authentication protocol;
step S22: when the authentication information is successfully authenticated, adding VN group members through a core network control surface, and establishing a mapping relation between a core network user identifier and the user equipment;
step S23: and notifying a data surface network element to update a forwarding rule of a VN group level, adding the authentication information to the forwarding rule, and establishing a data forwarding path for the user equipment.
All steps of the implementation of the method for accessing a non-3GPP device provided in the embodiment of the present invention correspond to functions and implemented technical effects of the access system of a non-3GPP device provided in the foregoing embodiment, and are not described herein.
It should be noted that the above-described apparatus embodiments are merely illustrative, and the units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. In addition, in the drawings of the embodiment of the device provided by the invention, the connection relation between the modules represents that the modules have communication connection, and can be specifically implemented as one or more communication buses or signal lines. Those of ordinary skill in the art will understand and implement the present invention without undue burden.
In summary, the invention discloses an access system and method of non-3GPP equipment, comprising: when user equipment initiates an authentication request, receiving an access message sent by the user equipment through an N6 interface of a data plane network element of a core network, and filtering the access message according to a preset configuration rule to generate an authentication request message; extracting authentication information in the authentication request message, and authenticating the authentication information through a preset standard authentication protocol; when authentication information is successfully authenticated, adding VN group members through a core network control surface, and establishing a mapping relation between a core network user identifier and user equipment; and notifying the data surface network element to update the forwarding rule of the VN group level, adding authentication information to the forwarding rule and establishing a data forwarding path for the user equipment. The invention can realize the access of non-3GPP equipment without complex signaling conversion, so that the network is more concise and efficient, and the data transmission delay is effectively reduced.
While the foregoing is directed to the preferred embodiments of the present invention, it will be appreciated by those skilled in the art that changes and modifications may be made without departing from the principles of the invention, such changes and modifications are also intended to be within the scope of the invention.

Claims (10)

1. An access system of non-3GPP equipment, which is characterized by comprising a service filtering module, an access authentication module, an AAA module and a control plane interface adapting module;
the service filtering module is used for receiving an access message sent by the user equipment through an N6 interface of a data plane network element of the core network, filtering the access message according to a preset configuration rule, generating an authentication request message, and sending the authentication request message to the access authentication module;
the access authentication module is used for receiving the authentication request message, extracting authentication information in the authentication request message, sending the authentication information to the AAA module, adding a VN group member through a core network control plane after receiving an authentication result returned by the AAA module, establishing a mapping relation between a core network user identifier and the user equipment, and informing the control plane interface adaptation module of establishing a data forwarding path;
the AAA module is used for receiving the authentication information, authenticating the authentication information through a preset standard authentication protocol, and returning the authentication success as an authentication result to the access authentication module when the authentication information is successfully authenticated;
the control plane interface adapting module is configured to notify the core network data plane network element to update a forwarding rule of a VN group level after receiving the notification of the access authentication module, and add the authentication information to the forwarding rule to establish the data forwarding path for the user equipment.
2. The access system of a non-3GPP device according to claim 1, wherein said authentication information comprises at least a MAC address, an IP address, a user name, a user password and domain name information;
the adding of the VN group members through the control plane of the core network and the establishment of the mapping relation between the user identification of the core network and the user equipment comprise:
determining a VN group according to the domain name information;
adding VN group members through the core network control plane, and generating the core network user identification;
and establishing a mapping relation between the core network user identifier and the user equipment.
3. The access system of a non-3GPP device according to claim 1, wherein the filtering the access message according to a preset configuration rule to generate the authentication request message includes:
detecting whether an authentication protocol used by the authentication request message is a preset authentication protocol according to a preset configuration rule;
if yes, the access message passes authentication and generates the authentication request message;
if not, the authentication fails, and the user equipment is refused to be accessed.
4. The access system of a non-3GPP device according to claim 1, further comprising an authentication pre-processing module;
the authentication preprocessing module is used for inquiring available VN groups through a core network when the user equipment initiates an authentication request, and determining an authentication protocol used by an access message according to the configuration of the user equipment through the available VN groups.
5. The access system of claim 1, wherein the AAA module is further configured to grant network access rights to user equipment that is successfully authenticated by the authentication information.
6. An access method for non-3GPP devices, the method comprising:
when user equipment initiates an authentication request, receiving an access message sent by the user equipment through an N6 interface of a data plane network element of a core network, and filtering the access message according to a preset configuration rule to generate an authentication request message;
extracting authentication information in the authentication request message, and authenticating the authentication information through a preset standard authentication protocol;
when the authentication information is successfully authenticated, adding VN group members through a core network control surface, and establishing a mapping relation between a core network user identifier and the user equipment;
and notifying a data surface network element to update a forwarding rule of a VN group level, adding the authentication information to the forwarding rule, and establishing a data forwarding path for the user equipment.
7. The access method of a non-3GPP device according to claim 6, wherein the authentication information includes at least a MAC address, an IP address, a user name, a user password, and domain name information;
the adding of the VN group members through the control plane of the core network and the establishment of the mapping relation between the user identification of the core network and the user equipment comprise:
determining a VN group according to the domain name information;
adding VN group members through the core network control plane, and generating the core network user identification;
and establishing a mapping relation between the core network user identifier and the user equipment.
8. The method for accessing non-3GPP equipment according to claim 6, wherein filtering the access message according to a preset configuration rule to generate an authentication request message comprises:
detecting whether an authentication protocol used by the authentication request message is a preset authentication protocol according to a preset configuration rule;
if yes, the access message passes authentication and generates the authentication request message;
if not, the authentication fails, and the user equipment is refused to be accessed.
9. The method for accessing non-3GPP equipment according to claim 6, further comprising, before receiving an access message sent by the user equipment via an N6 interface of a data plane network element of the core network:
and inquiring available VN groups through a core network, and determining an authentication protocol used by the access message according to the user equipment and the available VN groups.
10. The method for accessing a non-3GPP device according to claim 6, wherein prior to adding VN group members through the core network control plane, the method further comprises:
and granting network access rights to the user equipment successfully authenticated by the authentication information through the AAA module.
CN202311696078.7A 2023-12-11 2023-12-11 Access system and method of non-3GPP equipment Pending CN117676576A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311696078.7A CN117676576A (en) 2023-12-11 2023-12-11 Access system and method of non-3GPP equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311696078.7A CN117676576A (en) 2023-12-11 2023-12-11 Access system and method of non-3GPP equipment

Publications (1)

Publication Number Publication Date
CN117676576A true CN117676576A (en) 2024-03-08

Family

ID=90080566

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311696078.7A Pending CN117676576A (en) 2023-12-11 2023-12-11 Access system and method of non-3GPP equipment

Country Status (1)

Country Link
CN (1) CN117676576A (en)

Similar Documents

Publication Publication Date Title
US11425202B2 (en) Session processing method and device
EP3629613B1 (en) Network verification method, and relevant device and system
EP3008935B1 (en) Mobile device authentication in heterogeneous communication networks scenario
CA2656919C (en) Method and system for controlling access to networks
US8806596B2 (en) Authentication to an identity provider
JP5982389B2 (en) Cross-access login controller
KR20070108365A (en) Remote access system and method for enabling a user to remotely access a terminal equipment from a subscriber terminal
AU2014410591B2 (en) Connection establishment method, device, and system
JP2019522945A (en) Operations related to user equipment that uses secret identifiers
CN109936515B (en) Access configuration method, information providing method and device
WO2021002180A1 (en) Relay method, relay system, and relay program
CN113411286B (en) Access processing method and device based on 5G technology, electronic equipment and storage medium
CN112423299B (en) Method and system for wireless access based on identity authentication
CN106341374B (en) Method and device for limiting access of unlicensed user equipment to home gateway
EP2891299B1 (en) Systems and methods for efficient remote security panel configuration and management
KR20070102830A (en) Method for access control in wire and wireless network
CN117676576A (en) Access system and method of non-3GPP equipment
JP5423320B2 (en) Wireless communication system and method
CN113556337A (en) Terminal address identification method, network system, electronic device and storage medium
CN114006807A (en) Client terminal equipment, configuration method thereof and configuration server
CN114024693A (en) Authentication method, authentication device, session management function entity, server and terminal
CN107800569B (en) VPN quick access system and method based on ONT
WO2024067955A1 (en) Initiation of seconday authentication for a subscriber entity
CN116684113A (en) Service processing method and related device based on SDP (software defined boundary)
CN116868609A (en) User equipment authentication and authorization procedure for edge data networks

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination