KR20220121045A - Edge computing system and method for controlling network access thereof - Google Patents

Abstract

The present invention relates to a method for operating an edge computing system operated by at least one processor, which comprises the steps of: receiving user authority information including a user list using an edge computing service and a network access allowable location range for each user included in the user list; requesting location contexts of user terminals included in the user list to a network exposure function (NEF) device of a core network; and authenticating a specific user terminal as a terminal which can use the edge computing service when the location context of the specific user terminal received from the NEF device corresponds to the user authority information. The location text of the specific user terminal is generated based on location data transmitted from a wireless network to which the specific user terminal is accessed, to the NEF device. Therefore, the security of user terminal authentication can be improved.

Description

EDGE COMPUTING SYSTEM AND METHOD FOR CONTROLLING NETWORK ACCESS THEREOF

This disclosure relates to edge computing.

In general, for the security of data that can be accessed through the Internet, a company issues an ID and password to an accessible user, and then permits data access to a user authenticated with the entered ID and password. However, as cyberattacks continue to increase, online service security operators are either building expensive hardware devices with various security functions added, or requesting additional authentication despite user inconvenience. Nevertheless, as the security model (zero trust) that all data and all user access cannot be trusted is gradually spreading, stronger authentication procedures and user context verification procedures are required for secure data access.

On the other hand, individuals or companies using the Internet are demanding an Internet environment in which access to malicious codes, hacking programs, harmful sites, and harmful contents is fundamentally blocked as well as to strengthen security for data protection. However, it is not easy for an administrator to register and manage an access blocking domain.

The present disclosure provides an edge computing system for controlling network access of a user terminal by using a location context of the user terminal provided from a Network Exposure Function (NEF) device.

An object of the present disclosure is to provide an edge computing system that integrates various types of user access control information (eg, ID, face, etc.), including the location context of the user terminal, to authenticate whether the user terminal is a network-accessible user terminal.

An object of the present disclosure is to provide an edge computing system for controlling content access of a user terminal based on a domain name or packet inspection.

As an operating method of an edge computing system operated by at least one processor according to an embodiment, inputting user authorization information including a list of users using an edge computing service and a network access allowed location range for each user included in the user list Receiving step, a network exposure function (NEF) device of the core network, requesting the location context of the user terminals included in the user list, the location context of the specific user terminal received from the NEF device is the user and authenticating the specific user terminal as a terminal capable of using the edge computing service when it corresponds to the authorization information. The location text of the specific user terminal is generated based on the location data transmitted to the NEF device in the wireless network to which the specific user terminal is connected.

In the authenticating step, when access of a user related to the specific user terminal is permitted based on the information input from the access control device, and the location context of the specific user terminal corresponds to the user authorization information, the specific user terminal can be authenticated.

The information input from the access control device may include at least one of identification information, face recognition information, and fingerprint recognition information.

The user authority information may further include a network access allowed time range for each user included in the user list.

The method of operation includes storing an IP address of a content server provided by the edge computing system, and when receiving a DNS query for the content server from the authenticated specific user terminal, the content server stored in the eDNS record It may further include the step of delivering the IP address of the specific user terminal.

The operation method includes storing a domain name of a content server blocked by the edge computing system, and when receiving a DNS query for the content server from the authenticated specific user terminal, a lookup failure response to the specific user terminal It may further include the step of delivering.

The operation method includes registering the authenticated identification information of the specific user terminal and the access blocking and/or access approval domain information as a packet filter rule, and passing the traffic of the specific user terminal based on the packet filter rule Or it may further include a step of blocking.

An edge computing system according to another embodiment includes a plurality of modules executed by at least one processor. The plurality of modules is a NEF-GW (Gateway) module that obtains the location context of user terminals in conjunction with a network exposure function (NEF) device of the core network, a user list using an edge computing service, and the user list. Stores user rights information including the included network access permitted location range for each user, obtains the location context of a specific user terminal from the NEF-GW module, and the location context of the specific user terminal corresponds to the user authority information In this case, an edge network access control (eNAC) module that authenticates the specific user terminal as a terminal capable of using the edge computing service, and processes the authenticated traffic of the specific user terminal at the edge of the core network and an edge user plan function (eUPF) module.

The edge computing system may further include an access control solution module that permits access of a user based on information input from the access control device. When the eNAC module receives the access-permitted user information from the access control solution module, it queries the NEF-GW module for the location context corresponding to the access-permitted user information to obtain the location context of the specific user terminal. can

The information input from the access control device may include at least one of identification information, face recognition information, and fingerprint recognition information.

The edge computing system stores access blocking and/or access authorization domain information, and IP addresses of access authorization domains in an eDNS record, and an edge Domain Name Server (eDNS) module that responds to a DNS query requested from the eUPF module. may include

The eDNS module, through the NEF-GW module, the access blocking and / or access authorization domain information registered in the eNAC module, and the access blocking and / or access authorization domain information transmitted from the harmful site database managed by the core network. can be input.

When receiving a DNS query for the access approval domain from the eUPF module, the eDNS module may respond to a lookup result including the IP address of the corresponding access approval domain stored in the eDNS record.

When receiving a DNS query for an access blocking domain from the eUPF module, the eDNS module may respond to a lookup failure.

The eNAC module may transmit the authenticated IP information of the specific user terminal to the NEF-GW module. The NEF-GW module may generate a routing policy for forwarding the DNS query of the specific user terminal to the eDNS module based on the IP information of the specific user terminal, and transmit the routing policy to the eUPF module. The eUPF module may register the routing policy in a routing table.

When the eUPF module receives the first DNS query of the user terminal registered in the routing table, transmits the first DNS query to the eDNS module, and receives the second DNS query of the user terminal not registered in the routing table , the second DNS query may be forwarded to the central DNS.

The edge computing system registers the authenticated identification information of the specific user terminal and the access blocking and/or access approval domain information as a packet filter rule, and blocks or passes the traffic transmitted from the eUPF module according to the packet filter rule It may further include an edge Deep Packet Inspection (eDPI) module.

The NEF-GW module may receive the identification information of the specific user terminal from the eNAC module, and may transmit a packet filter rule for the identification information of the specific user terminal to the eDPI module.

The NEF-GW module performs packet filter rules based on the access blocking and/or access approval domain information registered in the eNAC module, and the access blocking and/or access approval domain information transmitted from the harmful site database managed by the core network. The generated packet filter rule may be transmitted to the eDPI module.

According to the present disclosure, the edge computing system may authenticate the user terminal using the location context of the user terminal provided from the network exposure function (NEF) device, and also control various types of user access together with the location context. Through multidimensional authentication combining information, the security of user terminal authentication can be improved.

According to the present disclosure, the edge computing system may allow the authenticated user terminal to access the secure content server and block the access to the harmful content server.

According to the present disclosure, it is possible to restrict access to the gateway module (NEF-GW) interworking with the NEF only in the eNAC module among the various functional modules built in the MEC system, so that various sub-function modules built in the MEC system are operated in a closed manner. While doing so, the security of data transferred between functional modules can be strengthened.

According to the present disclosure, an administrator can set a list of users who can use the edge computing system, user authorization information, authentication policy, and domain information to block/approve access by context, and directly control user terminal authentication and content access by context Therefore, it is possible to provide an edge computing system suitable for various service environments.

According to the present disclosure, the MEC application of various functions built in the edge computing system can be selected and adapted to the service environment, and various types of edge networks can be provided, such as a corporate-only network, a campus-only network, and a resident-only network. .

1 is a network configuration diagram according to an embodiment.
2 is a configuration diagram of an MEC system according to an embodiment.
3 is a flowchart of a user terminal authentication method according to an embodiment.
4 is a diagram for explaining eDNS-based content access control according to an embodiment.
5 is a flowchart of an eDNS-based content access control method according to an embodiment.
6 is a diagram for explaining eDPI-based content access control according to an embodiment.
7 is a flowchart of an eDPI-based content access control method according to an embodiment.
8 is a hardware configuration diagram of an MEC system according to an embodiment.

Hereinafter, with reference to the accompanying drawings, embodiments of the present disclosure will be described in detail so that those of ordinary skill in the art to which the present disclosure pertains can easily implement them. However, the present disclosure may be implemented in several different forms and is not limited to the embodiments described herein. And in order to clearly explain the present disclosure in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

In the present disclosure, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated. The devices constituting the network may be implemented by hardware or software or a combination of hardware and software.

In the present disclosure, a user equipment (UE), an edge computing system, various devices, and various modules are operated by at least one processor, and one or more processors, a memory for loading a computer program executed by the processor, and a computer program and a storage device for storing various data and a communication interface. A computer program may include instructions that, when loaded into memory, cause a processor to perform methods/operations according to various embodiments of the present disclosure. That is, the processor may perform the method/operations according to various embodiments of the present disclosure by executing the instructions. An instruction refers to a set of computer readable instructions grouped on the basis of a function, which is a component of a computer program and is executed by a processor.

In the present disclosure, a user terminal, as a subscriber terminal using an edge computing service, may be connected to a service server through an edge computing system built at an edge of a core network. The user terminal may transmit/receive traffic through a user plane function (UPF) of a core network, but in the description, a case in which traffic is transmitted/received through an edge UPF (eUPF) of an edge computing system is mainly described.

In the present disclosure, the user terminal may be a 5G device equipped with a 5G communication module, and may be a terminal of various types and uses, such as a portable terminal, an IoT terminal, a vehicle terminal, a display terminal, a broadcasting terminal, and a game terminal.

In the present disclosure, an edge computing system is a system that provides a low-latency service or an edge-network-specific service by using a resource built at the edge of a core network. The edge computing system may conform to Multi-Access Edge Computing (MEC) technology, may be referred to as an MEC system in the description, or may be referred to as MEC for short, but is not limited to MEC technology.

In the present disclosure, when calling a device or module in which a specific function is implemented, the device or module may be omitted and called.

1 is a network configuration diagram according to an embodiment.

Referring to FIG. 1 , a 5G network may include a core network 10 composed of a plurality of network functions and a radio access network (RAN) 20 . The core network 10 generates a PDU session by the Access and Mobility Management Function (AMF) 11, the Session Management Function (SMF) 12, and the SMF 12, and User Plane Function (UPF) (13) that is connected to a data network (DN) to process traffic, Policy Control Function (PCF) (14) that controls billing and quality of service policies (14), Unified Data Management (UDM) (15) to manage subscriber information, Network Exposure function (NEF) (16) to provide network information to a third party, subscriber authentication function ( Authentication Server Function (AUSF) (17), a network repository function (Network Repository Function, NRF) (18) and the like may be included. In addition, the application function (AF) is a network function used outside the core network to interwork with network functions inside the core network, and may use the network functions of the core network through the NEF 16 . Hereinafter, the network function related to the present disclosure will be mainly described.

The NEF 16 is a function capable of interworking with the functions of the RAN or core network to monitor the location, movement, and connection state of the user terminal, and to perform QoS control. Through the NEF 16 , the edge computing system 100 may acquire a location context of the user terminal (UE Location Context). The location context of the user terminal may include a user terminal identifier (eg, IMSI), a user terminal IP address, cell information in which the user terminal is located (Cell ID, Cell tracking, Cell Distance, etc.), GPS information of the user terminal, etc. have.

The edge computing system 100 is called a Multi-Access Edge Computing (MEC) system, and may be an MEC cluster including various functional modules. The user terminal 300 may access the MEC system 100 through a radio access network (RAN) (hereinafter referred to as “MEC-RAN”) 200 built in the service area (MEC Zone) of the MEC system 100 . have. Here, the user terminal 300 is a subscriber terminal using an edge computing service, and user right information is registered to use the MEC system 100 . The NEF 16 may periodically receive MEC location data from the MEC-RAN 200 built in the MEC Zone of the MEC system 100 . The MEC location data may include information of user terminals accessing the cell along with its own cell information. The NEF 16 may provide the location context of the user terminal extracted from the MEC location data to the MEC system 100 . The MEC-RAN 200 and the NEF 16 may interwork according to, for example, the MEC Location API described in the ETSI MEC013 document.

2 is a configuration diagram of an MEC system according to an embodiment.

Referring to FIG. 2 , the MEC system 100 may be built at the edge of the core network and may provide various edge computing services that may be managed by an administrator. For example, the MEC system 100 may provide a corporate-only network service, a campus-only network service, and a resident-only network service.

MEC system 100 is an edge network access control (Edge Network Access Control, eNAC) module (simply, referred to as “eNAC”) 110, a gateway module interworking with the NEF 16 (simply referred to as “NEF-GW”) ) 120 , and an edge user plan function (eUPF) module (simply referred to as “eUPF”) 130 . MEC system 100 is an access control solution (Access Control Solution) module (simply, referred to as “ACS”) 140, the edge DNS module (simply, It may further include a “eDNS”) 150 , and a Deep Packet Inspection (DPI) module (referred to simply as “eDPI”) 160 for processing packet filtering. A module type constituting the MEC system 100 may be selected according to a service area.

Various modules included in the MEC system 100 may be implemented as a plurality of applications installed in the application layer, or may be implemented as an independent computing device including a processor and a memory.

Looking at the architecture when various modules are implemented with a plurality of applications installed in the application layer, the MEC system 100 includes a hardware device 170 including at least one processor and a memory, and Physical computing resources provided by the virtualization layer (Virtualization Layer) 180 may be virtualized. The virtual computing resource for each MEC module may provide a function of the corresponding MEC module by executing instructions included in a computer program of each MEC module.

In the description, various modules included in the MEC system 100 may be described as subjects of operation.

The MEC system 100 may authenticate a network-accessible user terminal and control access to content of the authenticated user terminal. First, the operation of the MEC modules for user terminal authentication will be described.

The eNAC 110 manages a user management table including a user list and user authorization information. The eNAC 110 may provide an interface to which an administrator can access, may register a user management table from the administrator, and may provide various statistics to the administrator. The user list may include user identification information, and user authority information may be defined in various ways for each user. The user right information may include a network access permission range for each user. The network access permission range may include a location range and a time range. For example, the user management table may include a user name, an IMSI of the user terminal, a mobile communication subscriber number of the user terminal, a network access permitted location and/or a time range.

eNAC 110 is user information (eg, user name, IMSI, mobile communication) to the NEF-GW 120 interworking with the NEF (16) to obtain the location context of the registered user terminals from the NEF (16) subscriber number), and may receive a location context (UE GPS, Cell ID, Cell Tracking, Cell Distance, Time Stamp, etc.) for user information from the NEF-GW 120 .

The eNAC 110 specifies the location of the user terminal using the location context, and when the location and the current time of the user terminal fall within the network access allowable range, the edge computing service provided by the MEC system 100 to the user terminal can be authenticated as a terminal that can use

The NEF-GW 120 works with the eNAC 110 and the NEF 16 , and provides the location context of the user terminal obtained from the NEF 16 to the eNAC 110 . The location context of the user terminal includes a user terminal identifier (eg, IMSI), a user terminal IP address, cell information in which the user terminal is located (Cell ID, Cell tracking, Cell Distance, etc.), GPS information of the user terminal (UE GPS), etc. may include

The NEF-GW 120 receives the user information (user name, IMSI, mobile communication subscriber number) for which the location context is requested from the eNAC 110, and requests the location context for the user information to the NEF 16. The NEF-GW 120 may subscribe to a location context. Then, the NEF 16 transmits the location context for the subscribed user information to the NEF-GW 120 . The NEF 16 may have a different distribution (publish) time according to subscription information, and may be transmitted periodically or whenever the location context is changed. Alternatively, the NEF 16 may transmit a location context of a specific user terminal whenever it receives a request for a location context for a specific user terminal.

The NEF-GW 120 transfers the user location context received from the NEF 16 to the eNAC 110 . The NEF-GW 120 may transmit the user location context queried by the eNAC 110 or, upon receiving the user location context from the NEF 16 , may transmit it to the eNAC 110 .

Various location data (MEC location data and location context) transmitted between the MEC-RAN 200, NEF 16, and NEF-GW 120 may be transmitted as encrypted data in a secure network (5G Backbone). In addition, the virtualization interface may be designed so that the location context is transmitted only through the data plane between the NEF-GW 120 and the eNAC 110 within the MEC system 100 . Through this, devices or modules other than the eNAC 110 cannot access the location context.

Meanwhile, the authentication policy of the user terminal may be set to interwork with the access control solution (ACS) 140 . Then, the eNAC 110 may obtain the access permitted user information from the ACS 140 , and may request a location context for the access permitted user information from the NEF-GW 120 . The eNAC 110 specifies the location of the user terminal allowed access by using the location context received from the NEF-GW 120, and when the location of the user terminal corresponds to the network access permission location, the user terminal uses the MEC system ( 100) can be authenticated as a terminal that can use the edge computing service provided by

For example, it is assumed that the company establishes the MEC system 100 in which the employee terminals connected to the MEC-RAN 200 can access the internal network, and controls access to the internal network through the MEC system 100 . . At this time, in order to increase security, the eNAC 110 not only checks whether the employee terminals are in the MEC service area using the location context connected to the MEC-RAN 200, but also allows the employee to enter the office through ID tagging or face recognition. After additionally checking the entered information, you can allow the employee's terminal to access the internal network.

The access control solution (ACS) 140 may be selected from various solutions for managing the user's access, for example, the access control solution (ACS) 140 is an ID tag-based access control solution issued to the user, a camera At least one of a face recognition-based access control solution photographed with the camera and a fingerprint recognition-based access control solution may be used.

The access control solution (ACS) 140 may interwork with an access control device (ID tagging-based gate, face recognition-based gate, fingerprint recognition-based gate, etc.) 400 installed at a specific location. The access control device 400 may inquire about access permission for input information to the access control solution (ACS) 140 through the MEC-RAN 200, and the access control solution (ACS) 140 stores the user access An access permission result determined based on control information (identification card information, face recognition information, fingerprint recognition information, etc.) may be returned. Alternatively, the access control solution (ACS) 140 may receive the recognized user information from the access control device 400 and determine access permission for the corresponding user information. In addition, when the function of determining whether a user is permitted to enter is implemented in the access control device 400 , the access control solution (ACS) 140 may receive information about the user permitted to access from the access control device 400 .

The access control solution (ACS) 140 may be implemented to transmit access-approved user identification information to the eNAC 110 .

The eNAC 110 , the NEF-GW 120 , and the access control solution (ACS) 140 may use the same user information (eg, IMSI) or may use different types of identification information mapped to each other. For example, the access control solution (ACS) 140 uses a user name, employee number, and phone number as user information, and the eNAC 110 and NEF-GW 120 are the access control solution (ACS) 140 . User information used in the network can be managed by mapping user information (eg, IMSI) used in the network.

In this way, the eNAC 110 works with the access control solution (ACS) 140 and the NEF-GW 120 to authenticate the user terminal 300 , and the authenticated user terminal 300 is to the MEC system 100 . edge computing services provided by In this case, the MEC system 100 may control access to content for the authenticated user terminal 300 , and for this purpose, the eNAC 110 provides identification information (IP information, IMSI, etc.) of the authenticated user terminal 300 to NEF. -Transfer to GW 120. Then, the NEF-GW 120 registers the DNS query routing policy of the authenticated user terminal 300 in the eUPF 130 or by registering the packet filtering rule for the authenticated user terminal 300 in the eDPI 160 . , it is possible to control content access to the authenticated user terminal.

The eUPF 130 may receive a routing policy for the authenticated user terminal 300 from the NEF-GW 120 , register it in a routing table, and control the flow to the eDNS 150 . For example, when applying the UL CL (Uplink Classifier) technology, the NEF-GW 120 is the IP information (Source IP) of the authenticated user terminal 300, DNS communication port information (TCP / UDP No. 53), Then, a routing policy including eDNS IP information (Destination IP) is transmitted to the eUPF 130 . Then, the eUPF 130 may forward the port 53 request packet (DNS query) transmitted from the user terminal 300 to the destination eDNS 150 based on the routing table.

The eDPI 160 may receive the packet filter rule of the authenticated user terminal 300 from the NEF-GW 120 and perform packet filtering using it.

For content access control, the eNAC 110 may receive the access blocking/access approval domain information and the IP address of the access approval domain from the administrator, and register it in the eDNS 150 through the NEF-GW 120 . In addition, the NEF-GW 120 may receive the access blocking / access authorization domain information and the IP address of the access authorization domain from the NEF 16 , and may register it in the eDNS 150 .

The eNAC 110 may receive access blocking/access approval domain information (domain name, URL, IP address, port, etc.) from the administrator, and register it with the eDPI 160 through the NEF-GW 120 . In addition, the NEF-GW 120 may receive the access blocking / access approval domain information from the NEF (16), it may be registered in the eDPI (160).

The eDNS 150 is an application that provides a DNS-based access control function, and processes a DNS lookup requested from the eUPF 130 . The eDNS 150 receives the access blocking/access approval domain information registered in the eNAC 110 and the access blocking/access approval domain information transmitted from the malicious URL DB managed by the core network, manage with records. At this time, since the IP (end point IP) address of the secure content server is registered only in the eDNS record, only the eDNS 150 may reply the IP address for the secure content server domain.

The eDPI 160 is an application that provides a packet inspection-based access control function, and blocks or passes the traffic transmitted from the eUPF 130 according to a packet filter rule. The eDPI 160 receives the IP address and port list registered in the eNAC 110 and the IP address and port list transmitted from the malicious site database managed by the core network, and registers it in the packet filter rule.

The user terminal 300 is connected to the eUPF 130 through the MEC-RAN 200 and transmits a DNS query for accessing a specific server. Then, the eUPF 130 transmits the DNS query sent from the user terminal 300 to the destination eDNS 150 based on the routing table, and requests a lookup for the DNS query, and the user terminal 300 performs the lookup. Depending on the result, access to a specific server may be blocked or blocked.

Alternatively, the eUPF 130 transmits the traffic of the user terminal 300 to the eDPI 160, and the eDPI 160 passes the traffic of the authenticated user terminal 300 through packet inspection using a packet filter rule. or it can be blocked.

In this way, the MEC system 100 authenticates the user terminal 300 as a terminal capable of using the edge computing service through the secondary authentication procedure using the eNAC 110, and then the eDNS 150 or the eDPI 160. You can control access to content using Through such content access control, the MEC system 100 may control access to a content providing server (eg, an internal network server) requiring security, and may also block access to a harmful content providing server.

3 is a flowchart of a user terminal authentication method according to an embodiment.

Referring to FIG. 3 , the eNAC 110 registers a user list and user authority information ( S110 ). The user list may include user identification information, and user authority information may be defined in various ways for each user. The user right information may include a network access permission range for each user. For example, the user management table may include a user name, an IMSI of the user terminal, a mobile communication subscriber number of the user terminal, a network access permitted location and/or a time range. It is assumed that the user list includes the user terminal 300 .

The eNAC 110 transmits the list of users using the edge computing service to the NEF-GW 120 (S120). The user list delivered to the NEF-GW 120 includes user information for which a location context is required. The user information may be defined according to an interworking protocol with the NEF 16, for example, a user name, IMSI, and movement. It may include at least one of a communication subscriber number.

The NEF-GW 120 requests the location context of the user terminals included in the user list to the NEF 16 (S130). The NEF-GW 120 may subscribe to a location context. The NEF-GW 120 may acquire the location context of the user terminal in which the location change has occurred in real time through a dedicated backbone network through location context subscription. It is assumed that the user terminal 300 is included in the user list.

After the user terminal 300 accesses the MEC-RAN 200 (S140), the NEF 16 receives the MEC location data including information on the user terminals accessing the cell from the MEC-RAN 200 ( S142). The MEC-RAN 200 may transmit MEC location data periodically or whenever a user terminal accesses it. The MEC location data may include information of user terminals accessing the cell along with its own cell information.

The NEF 16 extracts the location context of the user terminal 300 connected to the MEC-RAN 200 from the MEC location data, and transmits the location context of the user terminal 300 to the NEF-GW 120 (S150). ). The NEF 16 may publish the changed location context of the user terminal 300 to the NEF-GW 120 that has requested (subscribed to) the location context of the user terminal 300 . The location context of the user terminal may include UE GPS, Cell ID, Cell Tracking, Cell Distance, Time Stamp, and the like, which are information for knowing the location, movement, and time of the user terminal.

On the other hand, when the user carrying the user terminal 300 performs ID tagging and/or biometric information recognition (face or fingerprint) on the access control device 400, the access control solution (ACS) 140 is the access control device ( 400) receives user access information input through identification tagging and/or biometric information recognition (face or fingerprint) (S160). For example, when an ID tagging-based gate is installed for access control, the access control solution (ACS) 140 may receive the user's ID tagging information (ID Tag value) through the user plane of the eUPF 130 . . Alternatively, when a face recognition-based gate is installed for access control, the access control solution (ACS) 140 may receive a user's face image or a feature value thereof through the user plane of the eUPF 130 .

The access control solution (ACS) 140 compares the stored user access control information (identity card information, face recognition information, fingerprint recognition information, etc.) with the input user access information to determine whether the user is allowed to enter or not, and information about the permitted user to the eNAC 110 (S162). Alternatively, the access control solution (ACS) 140 may receive the recognized user information from the access control device 400 and determine access permission for the corresponding user information. In addition, when the function of determining whether a user is permitted to enter is implemented in the access control device 400 , the access control solution (ACS) 140 may receive information about the user permitted to access from the access control device 400 .

The eNAC 110 queries the NEF-GW 120 for the location context of the user terminal mapped to the access-permitted user information (S170). Meanwhile, instead of the eNAC 110 querying the NEF-GW 120 for the location context, the NEF-GW 120 may report the changed user location context to the eNAC 110 .

The NEF-GW 120 transmits the location context of the inquired user terminal 300 to the eNAC 110 (S172).

The eNAC 110 specifies the location of the user terminal by using the received location context, and determines whether the current user terminal is located in the network access permitted location range (S174). In this case, the eNAC 110 may further determine whether it corresponds to the network access allowed time range. If the current user terminal is not located in the network access permitted location range, the eNAC 110 may return an authentication failure.

The eNAC 110 authenticates the user terminal 300 as a terminal capable of using the edge computing service provided by the MEC system 100 according to the determination result (S176).

Thereafter, when the eNAC 110 transmits the identification information of the authenticated user terminal 300 to the NEF-GW 120, the NEF-GW 120 transmits the DNS query routing policy of the authenticated user terminal 300 to the eUPF ( 130) or by registering a packet filtering rule for the authenticated user terminal 300 to the eDPI 160, it is possible to control access to content for the authenticated user terminal.

The eUPF 130 may receive the routing policy of the authenticated user terminal 300 from the NEF-GW 120 , register it in a routing table, and control the flow to the eDNS 150 . The NEF-GW 120 eUPF a routing policy including IP information (Source IP), DNS communication port information (TCP / UDP No. 53), and eDNS IP information (Destination IP) of the authenticated user terminal 300 When sending to 130, the eUPF 130 registers it in the routing table. Thereafter, the eUPF 130 forwards the port 53 request packet (DNS query) transmitted from the user terminal 300 to the destination eDNS 150 based on the routing table. Through this, the DNS query transmitted from the authenticated user terminal 300 is transmitted to the eDNS 150 instead of the central CG (carrier grade) DNS (not shown), and the eDNS 150 provides a lookup result for the DNS query. In response, the IP information of the secure content server that is not registered in the CG DNS and registered only in the eDNS record can be responded.

The eDPI 160 registers a packet filter rule for the user terminal 300 authenticated from the NEF-GW 120 . In addition, the eDPI 160 may pass or block the traffic of the authenticated user terminal 300 through packet inspection (eg, IP address inspection of the authenticated user terminal) using a packet filter rule.

Meanwhile, the procedure of FIG. 3 may be variously changed. The eNAC 110 may perform network access authentication for the user terminal 300 by changing the order of the access control solution-based primary authentication and the user location context-based secondary authentication. For example, the eNAC 110 first receives the changed user location context from the NEF-GW 120, specifies the location of the user terminal, and then sets the current location of the user terminal to the network access permission location and/or time range. determine whether it is appropriate Thereafter, the eNAC 110 may authenticate the user terminal 300 when receiving the result of the access permission from the access control solution (ACS) 140 for user identification information existing in the network access permission range.

4 is a diagram for explaining eDNS-based content access control according to an embodiment, and FIG. 5 is a flowchart of an eDNS-based content access control method according to an embodiment.

Referring to FIG. 4 , the eNAC 110 may receive access blocking/access approval domain information from an administrator and register the domain information in the eDNS 150 through the NEF-GW 120 . In addition, the NEF-GW 120 may receive the access blocking / access approval domain information from the NEF (16), and may register the domain information in the eDNS (150). The NEF 16 may transmit the access blocking/access approval domain information of the malicious URL DB managed by the core network to the NEF-GW 120 . The domain information may include an access blocking/access approval domain name and an IP address of the access approval domain.

The eDNS 150 receives the access blocking/access approval domain information registered by the administrator in the eNAC 110 and the access blocking/access approval domain information managed by the core network, and manages it as an eDNS record. At this time, the eDNS record stores the IP address of the access authorization domain. Only the eDNS record registers the IP address of the secure content server, which is the access authorization domain, so that the IP address of the secure content server can be obtained through the central CG DNS lookup. make sure not to The eDNS record may store a lookup failure response to the access blocking domain, and the eDNS 150 may respond as a lookup failure response to a web server address that delivers a timeout response or a blocking message.

Since the eDNS record is very important information for the user to use the web service, each module or device cannot directly update the record, and can be set to update/history management only through the NEF-GW 120 .

The NEF-GW 120 receives the IP information of the authenticated user terminal 300 from the eNAC 110 and routes the DNS query of the authenticated user terminal 300 to the eDNS 150 eUPF ( 130) to register. For example, the routing policy may include IP information (Source IP) of the authenticated user terminal 300, DNS communication port information (TCP/UDP No. 53), and eDNS IP information (Destination IP).

The eUPF 130 may receive a routing policy for the authenticated user terminal 300 from the NEF-GW 120 , register it in a routing table, and control the flow to the eDNS 150 . Thereafter, the eUPF 130 forwards the DNS query transmitted from the user terminal 300 to the eDNS 150 based on the routing table.

The eDNS 150 looks up the eDNS record and responds to the lookup result for the DNS query. Upon successful lookup, the eDNS 150 transmits the IP address corresponding to the DNS query to the user terminal 300 . Then, the user terminal 300 accesses the acquired IP address. Since the secure content server domain provided by the edge computing service is registered as an access approval domain only in the eDNS 150 , the authenticated user terminal 300 provides secure content The IP address of the server 500 may be obtained.

If the DNS query received from the eUPF 130 queries the harmful content server 600 registered as an access blocking domain, the eDNS 150 transmits a lookup failure response to the user terminal 300 , so that the user terminal 300 ) can be blocked from using harmful content.

Referring to FIG. 5 , the user terminal 300 transmits a DNS query of the secure content server to the eUPF 130 before network access by the eNAC 110 is permitted ( S210 ). It is assumed that the IP address of the secure content server is stored only in the eDNS record, and it is assumed that the CG DNS 20 is allocated as a DNS server for the user terminal 300 in an unauthenticated state.

The eUPF 130 forwards the DNS query of the user terminal 300 to the central CG DNS 20 and requests a lookup for the DNS query (S212). Since the user terminal 300 is not authenticated by the eNAC 110 , a routing policy for routing the DNS query of the user terminal 300 to the eDNS 150 is not registered in the eUPF 130 . Accordingly, the eUPF 130 forwards the DNS query requested by the unauthenticated terminal to the CG DNS 20 .

Since the CG DNS 20 does not store the IP address of the DNS-queried secure content server 500 , the domain lookup fails, and transmits a lookup failure response to the user terminal 300 ( S214 ). The lookup failure response may be a timeout response or a web server address response delivering a blocking message. Through this, the MEC system 100 may block a user terminal unauthorized access to the network from accessing the secure content server.

Thereafter, when the eNAC 110 authenticates the user terminal 300 based on the location context of the user who is allowed access (S220), the IP information of the authenticated user terminal 300 is transferred to the NEF-GW 120 and (S222), when the NEF-GW 120 forwards the routing policy for routing the DNS query of the user terminal 300 to the eDNS 150 to the eUPF 130 (S224), the eUPF 130 is the user terminal 300 ) registers the DNS query routing policy in the routing table (S226). For example, the routing policy may include IP information (Source IP) of the authenticated user terminal 300, DNS communication port information (TCP/UDP No. 53), and eDNS IP information (Destination IP).

The authenticated user terminal 300 transmits a DNS query of the secure content server to the eUPF 130 (S230).

The eUPF 130 transmits the DNS query of the authenticated user terminal 300 to the destination eDNS 150 based on the routing table (S232).

The eDNS 150 successfully looks up the DNS-queried IP address of the secure content server 500 from the eDNS record, and transmits the IP address of the lookup secure content server to the user terminal 300 (S234).

The user terminal 300 accesses the secure content server 500 with the obtained IP address, and uses the secure content provided by the secure content server 500 through the eUPF 130 (S240).

The user terminal 300 may transmit a DNS query of the harmful content server 600 to the eUPF 130 (S250). It is assumed that the harmful content server 600 is stored as an access blocking domain in the eDNS record.

The eUPF 130 transmits the DNS query of the authenticated user terminal 300 to the eDNS 150 based on the routing table (S252).

Since the DNS-queried harmful content server 600 is registered as an access blocking domain in the eDNS record, the eDNS 150 fails the domain lookup and transmits a lookup failure response to the user terminal 300 (S254). Through this, the MEC system 100 may block the user terminal allowed to access the network from accessing the harmful content server.

6 is a diagram for explaining eDPI-based content access control according to an embodiment, and FIG. 7 is a flowchart of an eDPI-based content access control method according to an embodiment.

Referring to FIG. 6 , the eNAC 110 receives the access blocking/access approval domain information from the administrator, and registers the packet filter rule created based on the domain information to the eDPI 160 through the NEF-GW 120. have. The domain information may include an access blocking/access approval domain name, URL, IP address, port, and the like.

In addition, the NEF-GW 120 may receive a packet filter rule for blocking access / granting access from the NEF 16 , and may register with the eDPI 160 . A packet filter rule may be created based on the access blocking/access approval domain information of the malicious URL DB managed by the core network.

The NEF-GW 120 receives the identification information (IP information or IMSI) of the user terminal 300 from the eNAC 110 , and registers the packet filter rule for the authenticated user terminal 300 in the eDPI 160 . can

The eDPI 160 controls access to content through a packet filter rule registered through the NEF-GW 120 . Since the packet filter rule is very important information for a user to use a web service, each application or device cannot directly update a record, and it can be set to update/history management only through the NEF-GW 120 .

The eDPI 160 passes the traffic sent from the user terminal 300 to the access-approved secure content server based on the packet filter rule, and blocks the traffic sent from the user terminal 300 to the blocked harmful content server. do.

Referring to FIG. 7 , the eDPI 160 registers a packet filter rule for filtering packets to the access blocking/access approval domain ( S310 ). A packet filter rule is a rule that passes traffic from a user terminal authorized for network access to a secure content server that has been granted access, and blocks traffic to a malicious content server whose access is blocked. The source address, destination address, and It may consist of port information, URL, and the like.

The eNAC 110 authenticates the user terminal 300 based on the location context of the user who is allowed access (S320), and transfers the identification information of the authenticated user terminal 300 to the NEF-GW 120 (S322) , when the NEF-GW 120 transmits the packet filter rule for the user terminal 300 authenticated by the eDPI 160 (S324), the eDPI 160 registers the packet filter rule (S326).

The authenticated user terminal 300 transmits traffic directed to the secure content server 500 through the user plane (S330). Upon receiving the traffic, the eUPF 130 transfers the traffic of the user terminal 300 to the eDPI 160 (S332). The eDPI 160 determines whether to pass the access request based on the packet filter rule and passes the traffic from the authenticated user terminal 300 to the secure content server 500 (S334). Through this, the user terminal 300 may access the secure content server 500 and use the secure content provided by the secure content server 500 through the eUPF 130 .

Meanwhile, the user terminal 300 may transmit traffic directed to the harmful content server 600 through the user plane (S340). Upon receiving the traffic, the eUPF 130 transfers the traffic of the user terminal 300 to the eDPI 160 (S342). The eDPI 160 blocks traffic from the authenticated user terminal 300 to the blocked harmful content server 600 based on the packet filter rule, and transmits a transmission failure response to the user terminal 300 (S344). ). The transmission failure response may be a timeout response or a web server address response that delivers a blocking message.

Through this, the MEC system 100 may block the user terminal allowed to access the network from accessing the harmful content server.

8 is a hardware configuration diagram of an MEC system according to an embodiment.

Referring to FIG. 8 , the hardware device 170 of the MEC system 100 may include at least one processor 171 , a memory 173 , a storage device 175 , and a network interface 177 , and a bus can be connected through In addition, hardware such as an input device and an output device may be included. The physical computing resources provided by the hardware device 170 may be virtualized.

The processor 171 is a device for controlling the operation of the computing device, and may be various types of processors that process instructions included in a computer program, for example, a central processing unit (CPU), a micro processor unit (MPU), It may be a micro controller unit (MCU), a graphic processing unit (GPU), or the like. Also, the processor 171 may perform an operation on a computer program for executing the method described above.

The memory 173 stores various data, commands and/or information. The memory 173 may load a corresponding computer program from the storage device 175 so that instructions described to execute the operations of the present disclosure are processed by the processor 171 . The memory 173 may be, for example, read only memory (ROM), random access memory (RAM), or the like.

The storage device 175 may store various data, computer programs, and the like required to execute the operations of the present disclosure. The storage device 175 may non-temporarily store a computer program. The storage device 175 may be implemented as a non-volatile memory.

The network interface 177 may be a wired/wireless communication module.

The hardware device 170 may be loaded with various software and computer programs including an operating system, and may execute them. The various MEC modules described in FIG. 2 are executed by the hardware device 170 and may be executed using virtualized computing resources. The virtual computing resource for each MEC module executes the instructions included in each MEC module to provide the function of the corresponding MEC module. Meanwhile, each of the MEC modules may be implemented as a computing device including an independent processor and memory.

As such, the MEC system 100 can authenticate the user terminal using the location context of the user terminal provided from the NEF 16, and also through multi-dimensional authentication combining various types of user access control information with the location context. The security of user terminal authentication can be improved.

The MEC system 100 may allow the authenticated user terminal to access the secure content server and block access to the harmful content server.

According to the present disclosure, it is possible to restrict access to the NEF-GW 120 only from the eNAC 110 among various functional modules built in the MEC system, so that various sub-function modules built in the MEC system 100 are operated in a closed manner. While doing so, the security of data transferred between functional modules can be strengthened.

According to the present disclosure, an administrator can set a list of users who can use the MEC system 100, user authorization information, authentication policy, and domain information to block/approve access for each situation, and perform user terminal authentication and content access for each situation. Since it can be directly controlled, it is possible to provide the MEC system 100 suitable for various service environments.

The MEC application of various functions built in the MEC system 100 may be selected and adapted to a service environment, and various types of edge networks such as a corporate-only network, a campus-only network, and a resident-only network may be provided.

The MEC system 100 may provide various services as follows.

Most access control devices may be all RFID tag gates or face recognition-based gates installed at the entrance. Then, detailed network access control for each floor or space within the site is impossible. However, when using the MEC system 100, the location of the user terminal can be precisely tracked through the MEC-RAN 200 installed on each floor or each space, and the network access can be performed through the location and movement pattern of the user terminal. You can strengthen the user terminal authentication process.

When the MEC system 100 is used in a multi-family house such as an apartment, access to the harmful content server is blocked as soon as the resident enters the apartment, so that a clean Internet environment can be provided, and a dedicated network service for the resident can be provided. .

When the MEC system 100 is used in a shared office site, secondary authentication for using the existing access control device can be provided through the access control solution 140 interlocking with the installed access control device, and user terminals belonging to various affiliations Even if they are connected to the same MEC-RAN 200, access to the corporate network mapped to the visitor may be permitted.

The embodiment of the present disclosure described above is not implemented only through the apparatus and method, and may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present disclosure or a recording medium in which the program is recorded.

Although the embodiments of the present disclosure have been described in detail above, the scope of the present disclosure is not limited thereto, and various modifications and improved forms of the present disclosure are also provided by those skilled in the art using the basic concept of the present disclosure as defined in the following claims. is within the scope of the right.

Claims (19)

A method of operating an edge computing system operated by at least one processor, comprising:
receiving user authorization information including a list of users using an edge computing service and a range of network access permitted locations for each user included in the user list;
A network exposure function (NEF) device of the core network, requesting the location context of the user terminals included in the user list;
When the location context of the specific user terminal received from the NEF device corresponds to the user right information, authenticating the specific user terminal as a terminal capable of using the edge computing service,
The location text of the specific user terminal is generated based on the location data transmitted to the NEF device in the wireless network to which the specific user terminal is connected, the operating method. In claim 1,
The authentication step is
When access of a user related to the specific user terminal is permitted based on the information input from the access control device and the location context of the specific user terminal corresponds to the user authorization information, the method of authenticating the specific user terminal . In claim 2,
The information input from the access control device includes at least one of identification information, face recognition information, and fingerprint recognition information. In claim 1,
The user rights information is
Further comprising a network access allowed time range for each user included in the user list, the operating method. In claim 1,
storing the IP address of a content server provided by the edge computing system; and
When receiving a DNS query for the content server from the authenticated specific user terminal, transmitting the IP address of the content server stored in the eDNS record to the specific user terminal
Further comprising, the method of operation. In claim 1,
storing the domain name of the content server blocked by the edge computing system; and
When receiving a DNS query for the content server from the authenticated specific user terminal, forwarding a lookup failure response to the specific user terminal
Further comprising, the method of operation. In claim 1,
Registering the authenticated identification information of the specific user terminal, and access blocking and/or access approval domain information as a packet filter rule, and
Passing or blocking the traffic of the specific user terminal based on the packet filter rule
Further comprising, the method of operation. An edge computing system comprising:
a plurality of modules executed by at least one processor;
The plurality of modules
NEF-GW (Gateway) module to obtain the location context of user terminals in conjunction with the network exposure function (NEF) device of the core network,
Stores user authorization information including a list of users using edge computing service and a network access permitted location range for each user included in the user list, obtains the location context of a specific user terminal from the NEF-GW module, and the specific user When the location context of the terminal corresponds to the user right information, an edge network access control (eNAC) module for authenticating the specific user terminal as a terminal capable of using the edge computing service (Edge Network Access Control, eNAC) module, and
An edge user plan function (eUPF) module that processes the authenticated traffic of the specific user terminal at the edge of the core network
An edge computing system comprising a. In claim 8,
Further comprising an access control solution module that permits the user's access based on the information input from the access control device,
The eNAC module is
Upon receiving the access-permitted user information from the access control solution module, query the NEF-GW module for a location context corresponding to the access-permitted user information to obtain the location context of the specific user terminal, an edge computing system . In claim 9,
The information input from the access control device is an edge computing system including at least one of identification information, face recognition information, and fingerprint recognition information. In claim 8,
An edge Domain Name Server (eDNS) module that stores access blocking and/or access authorization domain information, and IP addresses of access authorization domains in an eDNS record, and responds to a DNS query requested from the eUPF module
Further comprising, an edge computing system. In claim 11,
The eDNS module is
Through the NEF-GW module, the access blocking and / or access authorization domain information registered in the eNAC module, and receiving the access blocking and / or access authorization domain information transmitted from the harmful site database managed by the core network, edge computing system. In claim 11,
The eDNS module is
When receiving a DNS query for an access authorization domain from the eUPF module, the edge computing system responds to a lookup result including the IP address of the corresponding access authorization domain stored in the eDNS record. In claim 11,
The eDNS module is
When receiving a DNS query for an access blocking domain from the eUPF module, responding to a lookup failure. In claim 11,
The eNAC module is
Transmitting the authenticated IP information of the specific user terminal to the NEF-GW module,
The NEF-GW module is
based on the IP information of the specific user terminal, generate a routing policy for forwarding the DNS query of the specific user terminal to the eDNS module, and transmit the routing policy to the eUPF module;
The eUPF module is
and registering the routing policy in a routing table. In claim 15,
The eUPF module is
Upon receiving the first DNS query of the user terminal registered in the routing table, the first DNS query is transmitted to the eDNS module, and upon receiving the second DNS query of the user terminal not registered in the routing table, the central DNS forwarding the second DNS query to In claim 8,
Edge Deep (eDPI) that registers the authenticated identification information of the specific user terminal and access blocking and/or access approval domain information as a packet filter rule, and blocks or passes the traffic transmitted from the eUPF module according to the packet filter rule Packet Inspection) module
Further comprising, an edge computing system. In claim 17,
The NEF-GW module is
Receives identification information of the specific user terminal from the eNAC module, and transmits a packet filter rule for the identification information of the specific user terminal to the eDPI module. In claim 17,
The NEF-GW module is
A packet filter rule is created based on the access blocking and/or access approval domain information registered in the eNAC module, and the access blocking and/or access approval domain information transmitted from the harmful site database managed by the core network, and the generated packet passing filter rules to the eDPI module.

Images