WO2018149342A1

WO2018149342A1 - Public network accessing method and device and computer storage medium for user terminal of mobile private network

Info

Publication number: WO2018149342A1
Application number: PCT/CN2018/075548
Authority: WO
Inventors: 翟来国; 池海祥; 池柏祥; 李睿
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-02-15
Filing date: 2018-02-07
Publication date: 2018-08-23
Also published as: CN108696546B; CN108696546A

Abstract

The present invention discloses a public network accessing method and device and a storage medium for a user terminal of an enterprise mobile private network. The method comprises: an enterprise mobile private network base station side determining, upon receiving an uplink public network packet transmitted from a mobile terminal of an enterprise internal user, a packet type of the uplink public network packet; the enterprise mobile private network base station side establishing, according to the determined packet type of the uplink public network packet, a protocol connection corresponding to the packet type with the mobile terminal of the enterprise internal user, and acquiring an uplink protocol packet transmitted via the protocol connection from the mobile terminal of the enterprise internal user; the enterprise mobile private network base station side routing the uplink protocol packet to an HTTP proxy server; and the enterprise mobile private network base station side transmitting, upon receiving a downlink protocol packet returned from the HTTP proxy server, the downlink protocol packet via the established protocol connection to the mobile terminal of the enterprise internal user.

Description

Method, device and storage medium for user terminal of mobile private network to access public network

Cross-reference to related applications

The present application is filed on the basis of the Chinese Patent Application No. PCT Application No.

Technical field

The present invention relates to the field of mobile communication technologies, and in particular, to a method and device for accessing a public network by a user terminal of an enterprise mobile private network.

Background technique

Enterprise networks are generally divided into internal networks (referred to as intranets) and DMZs (Demilitarized Zones, also known as quarantine areas). The internal computer of the enterprise (hereinafter referred to as the internal network host) is located in the intranet of the enterprise. When the intranet host accesses the Internet (also known as the public network or the external network), the hypertext transfer protocol (HTTP) proxy server is used. (also known as WEB proxy server) access, HTTP proxy server is generally deployed in the DMZ zone.

The HTTP proxy server is used to proxy external network access of HTTP and HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer). Both the HTTP and HTTPS protocols are based on the TCP (Transmission Control Protocol) protocol and are distinguished by port numbers.

The intranet host accesses the public network of HTTP and HTTPS, and establishes a connection directly with different public network servers. Instead, it establishes an HTTP connection with the HTTP proxy server, and the HTTP proxy server establishes a specific protocol connection with the public network server, as shown in FIG.

Optionally, for HTTP access, as shown in FIG. 2, the intranet host establishes an HTTP connection with the proxy server, and the proxy server establishes an HTTP connection with the target public network WEB server.

For HTTPS access, as shown in Figure 3, the intranet host establishes an HTTP connection with the proxy server and uses the CONNECT method to request the proxy server to establish an SSL (Secure Socket Layer) connection with the public network server. An HTTP connection between the HTTP proxy server and transparent forwarding of SSL packets between the intranet host and the public network server, usually called a WEB tunnel.

In addition to providing public mobile network services for public users, the mobile operator's base station (eNB, evolved Node B, and evolved Node B) can also build a virtual mobile private network for enterprises, and internal users can access the enterprise through this virtual network. Network, here is called enterprise mobile private network. Correspondingly, these base stations may also be referred to as enterprise mobile private network base stations. It should be noted that the enterprise mobile private network base station here is actually a public base station, which is different from the ordinary public base station and can be used to construct an enterprise mobile private network. .

The mobile terminal of the enterprise internal user of the enterprise mobile private network, that is, the user equipment (UE, User Equipment), can access the internal network of the enterprise on the base station side, but when accessing the public network, the APN (Access Point Name) , access point) can not set the proxy, need to go through the carrier's mobile network base station, backhaul network (Backhaul) and core network EPC (Evolved Packet Core, evolved packet core network) to the Internet, and then route to the public network server, As shown in FIG. 4, the consumed mobile network has a large bandwidth and a large transmission delay.

Summary of the invention

The technical problem that the solution provided by the embodiment of the present invention is to solve is that the mobile terminal of the internal user of the enterprise cannot access the public network by using the HTTP proxy server of the enterprise network on the access side of the mobile network.

A method for a user terminal of an enterprise mobile private network to access a public network according to an embodiment of the present invention includes:

When the base station side of the enterprise mobile private network receives the uplink public network packet sent by the mobile terminal of the internal user of the enterprise, the packet type of the uplink public network packet is determined;

The base station side of the enterprise mobile private network establishes a protocol connection of the corresponding packet type between the mobile terminal and the mobile terminal of the enterprise according to the determined packet type of the uplink public network packet, and obtains the connection through the protocol connection. An uplink protocol packet sent by a mobile terminal of an internal user of the enterprise;

The base station side of the enterprise mobile private network routes the uplink protocol packet to the HTTP proxy server, so that the mobile terminal of the internal user of the enterprise accesses the public network via the HTTP proxy server;

When receiving the downlink protocol packet returned by the HTTP proxy server, the base station side of the enterprise mobile private network sends the downlink protocol packet to the mobile terminal of the internal user of the enterprise through the established protocol connection.

An apparatus for accessing a public network by a user terminal of an enterprise mobile private network according to an embodiment of the present invention includes:

The determining module is configured to determine the packet type of the uplink public network packet when receiving the uplink public network packet sent by the mobile terminal of the internal user of the enterprise;

Establishing a protocol connection module, configured to establish, according to the determined packet type of the uplink public network packet, a protocol connection of a corresponding packet type between the mobile terminal and the mobile terminal of the enterprise, and obtain the protocol connection through the protocol connection An uplink protocol packet sent by the mobile terminal of the internal user of the enterprise;

a sending module, configured to route the uplink protocol packet to an HTTP proxy server, so that the mobile terminal of the internal user of the enterprise accesses the public network via the HTTP proxy server, and receives the downlink protocol returned by the HTTP proxy server The packet is sent to the mobile terminal of the internal user of the enterprise through the established protocol connection.

The embodiment of the present invention provides a computer storage medium, where the computer storage medium stores computer executable instructions. After the computer executable instructions are executed, the method for accessing the public network by the user terminal of the enterprise mobile private network can be implemented.

In the solution provided by the embodiment of the present invention, the user mobile terminal in the local network, on the mobile network base station side, determines that the packet sent by the internal mobile terminal of the enterprise is the uplink public network packet, based on the type of the packet. And establishing a protocol connection of the user mobile terminal that is adapted to the type of the message, and using the protocol to connect and receive the packet sent by the internal user mobile terminal, and forwarding the packet to the local network HTTP proxy server, and using the packet The local network HTTP proxy server accesses the public network service. On the one hand, when the internal mobile terminal of the enterprise accesses the public network, it does not need to pass back to the EPC through the base station (such as the eNB) and then access the public network through the router. Therefore, the wired transmission bandwidth originally leased by the enterprise network is fully utilized, and the mobile network is not occupied. The additional bandwidth saves the cost; on the other hand, the routing of packets in the radio eNB and the EPC can reduce the time consumed for packet transmission as a whole, thus reducing the packet delay; in addition, it is also convenient for the local network to control its internal The behavior of the user mobile network terminal accessing the public network.

DRAWINGS

1 is a schematic diagram of an intranet host indirectly accessing a public network;

2 is a schematic diagram of an intranet host HTTP accessing a website;

3 is a schematic diagram of an intranet host HTTPS accessing a website;

4 is a schematic diagram of a mobile network terminal of an internal user of an enterprise accessing a public network;

FIG. 5 is a flowchart of a method for a user terminal of an enterprise mobile private network to access a public network according to an embodiment of the present disclosure;

6 is a schematic diagram of an apparatus for accessing a public network by a user terminal of an enterprise mobile private network according to an embodiment of the present invention;

7 is a schematic diagram of an internal user mobile network terminal using an HTTP proxy server according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of an internal user mobile network terminal using an HTTP proxy server according to an embodiment of the present invention; FIG.

9 is a schematic diagram of a new module provided by an embodiment of the present invention;

FIG. 10 is a schematic diagram of the deployment of the new module in FIG. 9 according to an embodiment of the present invention; FIG.

11 is a flowchart of processing an HTTP internal network uplink request packet of an internal user of the enterprise according to an embodiment of the present invention;

FIG. 12 is a flowchart of processing an HTTP internal network access downlink packet of an internal user of the enterprise according to an embodiment of the present disclosure;

FIG. 13 is a flowchart of processing an internal user HTTPS public network access uplink message according to an embodiment of the present invention;

FIG. 14 is a flowchart of processing an HTTPS public network access downlink packet of an internal user of the enterprise according to an embodiment of the present invention.

detailed description

The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.

FIG. 5 is a flowchart of a method for a user terminal of an enterprise mobile private network to access a public network according to an embodiment of the present invention. As shown in FIG. 5, the method includes:

Step S501: The base station side of the enterprise mobile private network determines the packet type of the uplink public network packet when receiving the uplink public network packet sent by the mobile terminal of the internal user of the enterprise;

Step S502: The base station side of the enterprise mobile private network establishes a protocol connection of the corresponding packet type between the mobile terminal and the mobile terminal of the enterprise according to the determined packet type of the uplink public network packet, and the protocol is connected through the protocol. Connecting to obtain an uplink protocol packet sent by the mobile terminal of the internal user of the enterprise; the protocol connection established here is that the compliance between the base station side of the enterprise mobile private network and the mobile terminal of the internal user of the enterprise is adapted to the packet type The connection of the agreement.

Step S503: The base station side of the enterprise mobile private network routes the uplink protocol packet to the HTTP proxy server, so that the mobile terminal of the internal user of the enterprise accesses the public network via the HTTP proxy server.

Step S504: The base station side of the enterprise mobile private network sends the downlink protocol packet to the mobile terminal of the internal user of the enterprise through the established protocol connection when receiving the downlink protocol packet returned by the HTTP proxy server.

The uplink public network packet includes destination address information for identifying a public network address and TCP port number information for identifying a packet type. The packet type includes an HTTP packet type and an HTTPS packet type.

In the embodiment of the present invention, the base station side of the enterprise mobile private network includes the base station of the mobile private network; the base station of the mobile private network refers to the public base station of the mobile operator that can provide the function of constructing the enterprise mobile private network, and the enterprise mobile private network only It is used for mobile terminal access of internal users of the enterprise.

When the base station side of the enterprise mobile private network receives the uplink public network packet sent by the mobile terminal of the enterprise internal user, the packet type of the uplink public network packet is determined to be: the base station side of the enterprise mobile private network receives the internal user of the enterprise. When the uplink public network packet is sent by the mobile terminal, the destination address and the TCP port number of the uplink public network packet are obtained by parsing the uplink public network packet; and the base station side of the enterprise mobile private network uses the preset The public network address library, the HTTP port list library, and the HTTPS port list library perform matching processing on the obtained destination address and the TCP port number; if the obtained destination address and TCP port number are obtained, the public network address library and the HTTP port list library are obtained. If the matching is performed, the base station side of the enterprise mobile private network determines that the uplink public network packet is an HTTP packet type; if the obtained destination address and the TCP port number match the public network address pool and the HTTPS port list database, the enterprise The mobile private network base station side determines that the uplink public network packet is an HTTPS packet type.

The base station side of the enterprise mobile private network establishes a protocol connection of a corresponding packet type between the mobile terminal and the mobile terminal of the enterprise according to the determined packet type of the uplink public network packet, and connects through the protocol. Obtaining an uplink protocol packet sent by the mobile terminal of the enterprise internal enterprise includes: when the base station side of the enterprise mobile private network determines that the uplink public network packet is an HTTP packet type, establishing a mobile terminal with the internal user of the enterprise The HTTP protocol is connected, and the uplink HTTP protocol packet sent by the mobile terminal of the enterprise internal user is obtained through the HTTP protocol connection. When the base station side of the enterprise mobile private network receives the downlink protocol packet returned by the HTTP proxy server, the mobile terminal that sends the downlink protocol packet to the internal user of the enterprise through the established protocol connection includes: When receiving the downlink HTTP protocol packet returned by the HTTP proxy server, the mobile private network base station side encapsulates the downlink HTTP protocol packet into a downlink user packet for the mobile terminal sent to the internal user of the enterprise. And sending the downlink user packet to the mobile terminal of the internal user of the enterprise by using the established HTTP protocol connection.

Optionally, the base station side of the enterprise mobile private network establishes, according to the determined packet type of the uplink public network packet, a protocol connection of a corresponding packet type between the mobile terminal and the mobile terminal of the enterprise, and And the establishing, by the protocol connection, the uplink protocol packet sent by the mobile terminal of the enterprise: the base station side of the enterprise mobile private network determines that the uplink public network packet is an HTTPS packet type, and establishes the internal user with the enterprise The SSL protocol connection between the mobile terminals is obtained, and the uplink SSL protocol packet sent by the mobile terminal of the internal user of the enterprise is obtained through the SSL protocol connection. When the base station side of the enterprise mobile private network receives the downlink protocol packet returned by the HTTP proxy server, the mobile terminal that sends the downlink protocol packet to the internal user of the enterprise through the established protocol connection includes: When receiving the downlink SSL protocol packet returned by the HTTP proxy server, the base station side of the mobile private network encapsulates the downlink SSL protocol packet into a downlink user packet for the mobile terminal sent to the internal user of the enterprise. And sending the downlink user packet to the mobile terminal of the internal user of the enterprise by using the established SSL protocol connection.

In the embodiment of the present invention, if the enterprise mobile private network base station establishes a protocol connection with the UE, the routing information is established, and the routing information is connected to the received information sent by the UE through the protocol, and is routed to the HTTP server, and is The information sent by the HTTP server to the UE is sent to the UE through the protocol connection.

FIG. 6 is a schematic diagram of a device for accessing a public network of a user mobile private network in an enterprise mobile private network according to an embodiment of the present invention, which can be applied to an enterprise mobile private network base station, as shown in FIG. 6, including: a determining module 601 configured to receive When the uplink public network packet sent by the mobile terminal of the internal user is sent, the packet type of the uplink public network packet is determined; and the protocol connection module 602 is configured to be configured according to the determined packet type of the uplink public network packet. Establishing a protocol connection of a corresponding packet type between the mobile terminal and the mobile terminal of the enterprise, and obtaining an uplink protocol packet sent by the mobile terminal of the enterprise internal user via the protocol connection; the sending module 603, Routing the uplink protocol packet to the HTTP proxy server, so that the mobile terminal of the internal user of the enterprise accesses the public network via the HTTP proxy server, and receives the downlink protocol packet returned by the HTTP proxy server. The downlink protocol packet is sent to the mobile terminal of the internal user of the enterprise through the established protocol connection.

The uplink public network packet includes a destination address information for identifying a public network address and a TCP port number for identifying a packet type. The packet type includes an HTTP packet type and an HTTPS packet type.

The determining module 601 includes: a parsing unit, configured to parse the uplink public network packet to obtain the uplink public network packet when receiving the uplink public network packet sent by the mobile terminal of the internal user of the enterprise The destination address and the TCP port number of the text; the matching unit is configured to perform matching processing on the obtained destination address and the TCP port number by using the preset public network address library, the HTTP port list library, and the HTTPS port list library; When the destination address and the TCP port number are matched with the public network address pool and the HTTP port list, the uplink public network packet is determined to be an HTTP packet type, and the destination address and the TCP port are obtained. The number is matched with the public network address pool and the HTTPS port list, and the uplink public network packet is determined to be an HTTPS packet type.

The establishing protocol connection module 602 includes:

Establishing a first protocol connection unit, configured to establish an HTTP protocol connection between the uplink public network packet and the mobile terminal of the enterprise internal user when the uplink public network packet is determined to be an HTTP packet type, and connect through the HTTP protocol Obtaining an uplink HTTP protocol packet sent by the mobile terminal of the internal user of the enterprise.

The establishing the protocol connection module 602 further includes:

Establishing a second protocol connection unit, configured to establish an SSL protocol connection between the uplink public network packet and the mobile terminal of the enterprise internal user when the uplink public network packet is determined to be an HTTPS packet type, and connect through the SSL protocol. Obtain an uplink SSL protocol packet sent by the mobile terminal of the internal user of the enterprise.

The sending module 603 is configured to, when receiving the downlink HTTP protocol packet returned by the HTTP proxy server, encapsulate the downlink HTTP protocol packet into a downlink user report for sending to the mobile terminal of the enterprise internal user. The downlink user message is sent to the mobile terminal of the internal user of the enterprise by using the established HTTP protocol connection.

The sending module 603 is further configured to, when receiving the downlink SSL protocol packet returned by the HTTP proxy server, encapsulate the downlink SSL protocol packet into a mobile terminal for sending to the internal user of the enterprise. The downlink user packet is sent to the mobile terminal of the internal user of the enterprise by using the established SSL protocol connection.

7 is a schematic diagram of an internal user mobile network terminal using an HTTP proxy server according to an embodiment of the present invention. As shown in FIG. 7, when an internal user of an enterprise network accesses a public network by using a mobile network terminal, the new device simulates a public network server. Establish an HTTP protocol connection with the user terminal to collect user protocol packets; the new device simulates the Internet host agent online behavior and accesses the public network through an HTTP proxy server.

For HTTP access, the new device simulates that the public network server establishes an HTTP connection with the user terminal, and receives the HTTP request message of the user terminal; then the new device simulates the intranet host, establishes an HTTP connection with the HTTP proxy server, and receives the user terminal HTTP message. After the URL (Uniform resource locator) is processed, it is sent to the HTTP proxy server, and the HTTP proxy server is sent to the public network server through an HTTP connection with the public network server. The URL in the HTTP packet of the user terminal is a relative URL, and the HTTP packet sent by the intranet host to the proxy server is an absolute URL. In the URL processing, the relative URL in the HTTP packet of the user terminal is corrected to an absolute URL, and HTTP is received. The HTTP response message returned by the proxy server, the new device simulates the public network server, and sends it to the user terminal through an HTTP connection with the user terminal. The absolute URL is a storage path of the target information, and can be used to directly access the target information. The relative URL includes a path relationship of a storage path of the target information with respect to a storage path of the reference information. For example, the storage file of the target information may be a target file; the storage file of the reference information may be a reference file; and the relative URL includes: a path relationship of a storage path of the target file with respect to a storage path of the reference file. Therefore, if you need to access the target file, you need to import the storage path of the reference file. In the present embodiment, by processing the URL, it is possible to convert the relative URL into an absolute URL.

8 is a schematic diagram of an internal user mobile network terminal using an HTTP proxy server according to an embodiment of the present invention. As shown in FIG. 8, when an internal user of an enterprise network accesses a public network by using a mobile network terminal, the new device simulates a public network server. Establish an SSL protocol connection with the user terminal to collect user protocol packets; the new device simulates the online host agent's online behavior and accesses the public network through an HTTP proxy server.

For HTTPS access, the new device simulates the public network server to establish an SSL connection with the user terminal to receive the SSL message; then the new device simulates the intranet host, establishes an HTTP connection with the HTTP proxy server, and uses the connect method to request the HTTP proxy server to establish with the public network server. The SSL connection sends the received user terminal SSL message to the HTTP proxy server, and the HTTP proxy server sends the SSL connection to the public network server through the SSL connection with the public network server. The SSL packet returned by the HTTP proxy server is received, and the new device simulates the public network server and sends it to the user terminal through an SSL connection with the user terminal.

As shown in Figure 7 and Figure 8, the new device analyzes the user uplink packets of the mobile network base station on a packet-by-packet basis, identifies the public HTTP/HTTPS access packets of the internal users, and establishes the public network server and the user terminal according to the proxy configuration rules. HTTP or SSL connection, receiving the HTTP message or SSL message of the user terminal; simulating the intranet host, establishing an HTTP connection with the HTTP proxy server according to the proxy configuration rule, and sending the user HTTP or SSL protocol packet to the HTTP proxy server; The user message returned by the proxy server is received, and the public network server is simulated, and is sent to the user terminal through the mobile network base station through the HTTP or SSL protocol connection previously established with the user terminal.

Optionally, the following steps are included:

1) Identify HTTP/HTTPS public network access messages: The destination address complies with the public network address configuration rule, and the TCP port number conforms to the HTTP port list rule or the HTTPS port list rule.

2) Simulate the public network server to send and receive HTTP packets: simulate the public network server to establish an HTTP connection with the user terminal, and receive the HTTP protocol packet sent by the user terminal. The user HTTP protocol packet received from the HTTP proxy server is sent to the user terminal through an HTTP connection with the user terminal.

3) Simulate the public network server to send and receive SSL packets: simulate the public network server to establish an SSL connection with the user terminal, and receive the SSL protocol packet sent by the user terminal. The user SSL protocol packet received from the HTTP proxy server is sent to the user terminal through an SSL connection with the user terminal.

4) Simulate HTTP messages between the internal host transceiver and the HTTP proxy server: simulate internal host behavior and establish an HTTP connection with the HTTP proxy server. The HTTP protocol packet of the user terminal to be received is processed by the URL, and then sent to the HTTP proxy server; and the HTTP protocol packet returned by the HTTP proxy server is received.

5) Simulate the SSL message between the internal host transceiver and the HTTP proxy server: simulate the internal host behavior, establish an HTTP connection with the HTTP proxy server, and use the CONNECT method to request the proxy server to establish an SSL connection with the public network server. The user terminal SSL protocol packet to be received is sent to the HTTP proxy server through an HTTP connection with the proxy server; and the SSL protocol packet returned by the HTTP proxy server is received.

FIG. 9 is a schematic diagram of a newly added module according to an embodiment of the present invention. As shown in FIG. 9, the method includes: a rule configuration module, a user message proxy module, an uplink packet processing module, and a downlink packet processing module.

The rule configuration module provides public network address rules, HTTP port lists, HTTPS port lists, and HTTP proxy server rules. Public network address rules, which configure address information. These addresses will access the public network through an HTTP proxy server. In the specific implementation, a configuration method similar to the internal network host may be adopted, that is, the exception address list is configured, and otherwise, it is regarded as a public network address; the display indication method may also be adopted, that is, which subnets are explicitly indicated as public network addresses. . The HTTP port list configures which TCP ports are HTTP ports. The HTTPS port list configures which TCP ports are HTTPS ports. The HTTP proxy server rules configure the HTTP proxy server address and port number, allowing multiple HTTP proxy server configuration records to be configured for dynamic selection or load sharing.

The uplink packet processing module analyzes the S1-U uplink packet of the internal user, analyzes the destination address and the TCP port number in the user packet, and identifies the public network address rule, the HTTP port list rule, and the HTTPS port list rule. The HTTP/HTTPS packet of the public network is forwarded, and the user packet (IP packet) is extracted and sent to the user packet proxy module.

The user message proxy module is divided into an HTTP message proxy module and an HTTPS message proxy module. After receiving the packet sent by the uplink packet processing module, the HTTP packet proxy module and the HTTPS packet proxy module are dynamically created according to the type.

The HTTP message proxy module simulates the public network server to establish an HTTP connection with the user terminal, collects the HTTP packet of the user terminal, simulates the behavior of the intranet host, configures an HTTP connection with the HTTP proxy server according to the proxy rule configuration, and receives the user terminal HTTP. After the message is processed, it is sent to the HTTP proxy server. The HTTP response packet returned by the HTTP proxy server is received, and the public network server is simulated, and is sent to the user terminal through an HTTP connection with the user terminal, and the packet is packaged and sent to the downlink packet processing module.

The HTTPS message proxy module simulates the public network server to establish an SSL connection with the user terminal, collects the SSL message of the user terminal, simulates the behavior of the intranet host, configures an HTTP connection with the HTTP proxy server according to the proxy rule configuration, and requests the HTTP by using the CONNECT method. The proxy server establishes an SSL connection with the public network server, and sends the received user terminal SSL message to the HTTP proxy server through an HTTP connection with the HTTP proxy server. The SSL packet returned by the HTTP proxy server is received, and the public network server is simulated and sent to the user terminal through an SSL connection with the user terminal. The packet is packaged and sent to the downlink packet processing module.

The HTTP message proxy module and the HTTPS message proxy module are released when receiving the TCP connection release message from the user terminal, and notify the user of the message proxy module.

The downlink packet processing module is configured to package the user packet sent by the user packet proxy module into an S1-U packet and send it to the mobile network base station to send to the user terminal.

FIG. 10 is a schematic diagram of the deployment of the new module in FIG. 9 according to the embodiment of the present invention. As shown in FIG. 10, the method includes two deployment modes: deployment mode 1, which is deployed together with the mobile network base station. The new module deployment is integrated with the mobile network base station for easy management. In deployment mode 2, the separate device deployment includes new devices added to the new module. The separate deployment has no impact on the mobile network base station and is easy to deploy.

FIG. 11 is a flowchart of processing an HTTP public network access uplink message of an internal user of an enterprise according to an embodiment of the present invention. As shown in FIG. 11, S1 is a logical link between a mobile network base station eNB and a core network EPC, and the S1-U report is used. The text refers to the user packet on the S1 link. The S1-U packet encapsulates the IP packet of the user terminal, also called the user packet. In this example, the technical solution of the present invention receives the S1-U uplink packet from the mobile network base station eNB, identifies the uplink HTTP public network access message of the internal user, simulates the public proxy server charging, and performs the URL processing to simulate the internal network host. Send to the HTTP proxy server to access the public network. The method for the HTTP public network to access the uplink packet of the internal user of the enterprise may include:

Step 1101: The UE sends an air interface packet carrying a user packet (user HTTP packet);

Step 1102: The mobile network base station extracts a user packet (user HTTP packet), and packages it into an S1-U transmission.

Step 1103: The uplink packet processing module analyzes the S1-U uplink packet of the internal user by packet, parses the destination address and the TCP port number in the internal user packet, and identifies the uplink HTTP public network packet.

Step 1104: The uplink packet processing module sends the user packet (user HTTP packet) to the user packet proxy module.

Step 1105: The user message proxy module checks whether there is an HTTP message proxy module connected to the user, and if not, creates an HTTP packet proxy module connected to the user;

Step 1106: The user message proxy module is forwarded to the HTTP message proxy module for processing;

Step 1107: The HTTP message proxy module simulates a public network server, and creates an HTTP connection with the UE.

Step 1108: The HTTP connection between the UE and the HTTP message proxy module is successfully created. The message between the UE and the HTTP message proxy module will be sent through this HTTP connection;

Step 1109: The HTTP message proxy module initiates establishing an HTTP connection with the HTTP proxy server.

Step 1110: The HTTP message proxy module receives the user HTTP packet.

Step 1111: The HTTP message proxy module collects the user HTTP packet and performs URL processing, and then sends the HTTP packet to the HTTP proxy server.

FIG. 12 is a flowchart of processing an internal user HTTP public network access downlink packet according to an embodiment of the present invention. As shown in FIG. 12, after receiving an HTTP packet returned by an HTTP proxy server, simulating a public network server, and communicating with the UE The HTTP connection is sent to the user terminal, and the user packet is packaged into an S1-U downlink packet and sent to the mobile network base station, which may include:

Step 1201: The HTTP connection between the UE and the HTTP message proxy module is established.

Step 1202: An HTTP connection between the HTTP message proxy module and the HTTP proxy server is established.

Step 1203: The HTTP proxy server sends an HTTP response message to the HTTP message proxy module.

Step 1204: The HTTP message proxy module receives the HTTP response packet.

Step 1205: The HTTP message proxy module encapsulates the received HTTP response packet into a user packet (user IP packet) sent to the UE.

Step 1206: The HTTP message proxy module sends the user packet to the downlink processing module.

Step 1207: The downlink processing module is packaged into an S1-U downlink packet and sent to the mobile network base station.

Step 1208: The mobile network base station extracts the user packet and carries it to the UE through the air interface packet.

FIG. 13 is a flowchart of processing an internal user HTTPS public network access uplink packet according to an embodiment of the present invention. As shown in FIG. 13, the mobile network base station eNB receives an S1-U uplink packet, and identifies an uplink HTTPS public of the internal user. The network message is simulated by the public proxy server, and then the intranet host is sent to the HTTP proxy server to access the public network. Can include:

Step 1301: The UE sends an air interface packet carrying a user packet (a user SSL packet);

Step 1302: The mobile network base station extracts user packets (user SSL packets), and packages them into S1-U transmissions.

Step 1303: The uplink packet processing module analyzes the S1-U uplink packet of the internal user by packet, parses the destination address and the TCP port number in the internal user packet, and identifies the uplink HTTPS public network packet.

Step 1304: The uplink packet processing module sends the user packet (the user SSL packet) to the user packet proxy module.

Step 1305: The user message proxy module checks whether there is an HTTPS message proxy module connected to the user, and if not, creates an HTTPS message proxy module connected to the user;

Step 1306: The user message proxy module is forwarded to the HTTPS message proxy module for processing;

Step 1307: The HTTPS message proxy module simulates the public network server and creates an SSL connection with the UE.

Step 1308: The SSL connection between the UE and the HTTPS message proxy module is successfully created. The message between the UE and the HTTPS message proxy module will be sent through this SSL connection;

Step 1309: The HTTPS message proxy module initiates an HTTP connection with the HTTP proxy server, and requests the HTTP proxy server to establish an SSL connection with the public network server by using the CONNECT method.

Step 1310: The HTTPS message proxy module receives the user SSL packet.

Step 1311: The HTTPS message proxy module sends the received user SSL packet to the HTTP proxy server.

FIG. 14 is a flowchart of processing an internal user HTTPS public network access downlink packet according to an embodiment of the present invention. As shown in FIG. 14 , an SSL packet returned by an HTTP proxy server is received, and a public network server is simulated. The SSL connection is sent to the user terminal, and the user message is packaged into an S1-U downlink message and sent to the mobile network base station. Can include:

Step 1401: The SSL connection between the UE and the HTTPS message proxy module is established.

Step 1402: an HTTP connection between the HTTPS message proxy module and the HTTP proxy server is established;

Step 1403: The HTTP proxy server sends an SSL packet to the HTTPS packet proxy module.

Step 1404: The HTTPS message proxy module receives the SSL packet.

Step 1405: The HTTPS message proxy module encapsulates the received SSL packet into a user packet (user IP packet) sent to the UE.

Step 1406: The HTTPS message proxy module sends the user packet to the downlink processing module.

Step 1407: The downlink processing module is packaged into an S1-U downlink packet and sent to the mobile network base station.

Step 1408: The mobile network base station extracts the user packet and carries it to the UE through the air interface packet.

According to the solution provided by the embodiment of the present invention, the user mobile terminal in the enterprise network accesses the public network service by using the enterprise network HTTP proxy server on the mobile network base station side, and fully utilizes the wired transmission bandwidth originally rented by the enterprise network, thereby saving cost and also saving cost. It is convenient for the enterprise network to control the behavior of its internal user mobile network terminal to access the public network.

The embodiment of the present invention provides a computer storage medium, where the computer storage medium stores computer executable instructions; after the computer executable instructions are executed, the user of the enterprise mobile private network provided by any one or more of the foregoing technical solutions is provided. The method for the terminal to access the public network, for example, one or more of the methods shown in FIG. 5 and FIG. 11 to FIG.

The computer storage medium may be various types of storage media, such as random storage media, read-only storage media, flash memory, optical disks, mobile hard disks, USB flash drives, or magnetic tapes, and the like, optionally non-instantaneous Storage medium.

The computer-executable instructions stored on the computer storage medium provided in the embodiment can be implemented by the processor to implement the method for the user terminal of the enterprise mobile private network provided by the one or more technical solutions to access the public network.

The embodiment further provides a base station, where the base station can be the foregoing enterprise mobile mobile private network base station, including:

The transceiver may include a transceiver antenna configured to send and receive information;

a processor, connected to the transceiver, for implementing a method for accessing a public network of a user terminal of an enterprise mobile private network provided by one or more technical solutions by executing the computer executable instructions such as a computer program, for example, as shown in FIG. 5 and one or more of the methods shown in Figures 11-14.

Although the invention has been described in detail above, the invention is not limited thereto, and various modifications may be made by those skilled in the art in accordance with the principles of the invention. Therefore, modifications made in accordance with the principles of the invention are to be understood as falling within the scope of the invention.

Industrial applicability

According to the technical solution provided by the embodiment of the present invention, if the internal mobile terminal of the enterprise needs to access the public network, if the base station side of the enterprise mobile private network receives the packet type of the uplink public network packet, the protocol connection between the base station and the user mobile terminal is established. The protocol is used to connect and receive packets to and from the user terminal to access the public network, and the packets sent by the user mobile terminal to the public network are forwarded to the public network through the HTTP server, and the packets sent to the mobile terminal are received from the HTTP server. On the one hand, the bandwidth of the HTTP server is borrowed instead of routing the packet to the public network through the EPC, thereby reducing the bandwidth consumption in the mobile network. At the same time, the HTTP server is usually directly connected to the public network, which reduces packet transmission. The number of hops can improve the efficiency of message transmission; therefore, it has a positive industrial effect, and at the same time has the characteristics of realizing the construction, so it can be widely promoted in industry.

Claims

A method for a user terminal of an enterprise mobile private network to access a public network includes:

When the base station side of the enterprise mobile private network receives the uplink public network packet sent by the mobile terminal of the internal user, the packet type of the uplink public network packet is determined;

And establishing, by the base station side of the enterprise mobile private network, a protocol connection of a corresponding packet type between the base station side of the enterprise mobile private network and the mobile terminal of the enterprise internal user, according to the determined packet type of the uplink public network packet, and Obtaining an uplink protocol packet sent by the mobile terminal of the internal user of the enterprise by using the protocol connection;

The base station side of the enterprise mobile private network routes the uplink protocol packet to the hypertext transfer protocol HTTP proxy server, so that the mobile terminal of the internal user of the enterprise accesses the public network via the HTTP proxy server;

When receiving the downlink protocol packet returned by the HTTP proxy server, the base station side of the enterprise mobile private network sends the downlink protocol packet to the mobile terminal of the internal user of the enterprise through the established protocol connection.
The method according to claim 1, wherein the uplink public network message includes destination address information for identifying a public network address and TCP control port protocol information for identifying a packet type; the packet type includes HTTP Message type and Hypertext Transfer Security Protocol HTTPS message type.
The method according to claim 2, when the base station side of the enterprise mobile private network receives the uplink public network message sent by the mobile terminal of the enterprise internal user, the packet type of the uplink public network packet is determined to include:

When the base station side of the enterprise mobile private network receives the uplink public network packet sent by the mobile terminal of the internal user, the destination address and the TCP port number of the uplink public network packet are obtained by parsing the uplink public network packet. ;

The base station side of the enterprise mobile private network uses the preset public address database, the HTTP port list library, and the HTTPS port list library to perform matching processing on the obtained destination address and the TCP port number;

If the obtained destination address and the TCP port number match the public network address pool and the HTTP port list, the base station side of the enterprise mobile private network determines that the uplink public network packet is an HTTP packet type.

If the obtained destination address and the TCP port number match the public network address pool and the HTTPS port list, the enterprise mobile private network base station side determines that the uplink public network packet is an HTTPS packet type.
The method according to claim 3, wherein the base station side of the enterprise mobile private network establishes the mobile terminal of the enterprise mobile private network base station side and the enterprise internal user according to the determined packet type of the uplink public network message. The protocol link of the corresponding packet type, and the uplink protocol packet sent by the mobile terminal of the internal user of the enterprise via the protocol connection includes:

When the base station side of the enterprise mobile private network determines that the uplink public network packet is an HTTP packet type, establish an HTTP protocol connection between the base station side of the enterprise mobile private network and the mobile terminal of the internal user of the enterprise, and The HTTP protocol connection acquires an uplink HTTP protocol packet sent by the mobile terminal of the internal user of the enterprise.
The method according to claim 3, wherein the base station side of the enterprise mobile private network establishes the mobile terminal of the enterprise mobile private network base station side and the enterprise internal user according to the determined packet type of the uplink public network message. The protocol link of the corresponding packet type, and the uplink protocol packet sent by the mobile terminal of the internal user of the enterprise via the protocol connection includes:

When the base station side of the enterprise mobile private network determines that the uplink public network packet is an HTTPS packet type, establishing a secure socket layer SSL protocol connection between the base station side of the enterprise mobile private network and the mobile terminal of the enterprise internal user, and And obtaining, by using the SSL protocol connection, an uplink SSL protocol packet sent by the mobile terminal of the internal user of the enterprise.
The method according to claim 4, when the base station side of the enterprise mobile private network receives the downlink protocol packet returned by the HTTP proxy server, the downlink protocol packet is sent to the Mobile terminals for internal users of the enterprise include:

When receiving the downlink HTTP protocol packet returned by the HTTP proxy server, the base station side of the enterprise mobile private network encapsulates the downlink HTTP protocol packet into a downlink user packet for the mobile terminal sent to the internal user of the enterprise. And sending the downlink user message to the mobile terminal of the internal user of the enterprise by using the established HTTP protocol connection.
The method according to claim 5, when the base station side of the enterprise mobile private network receives the downlink protocol packet returned by the HTTP proxy server, the downlink protocol packet is sent to the Mobile terminals for internal users of the enterprise include:

When receiving the downlink SSL protocol packet returned by the HTTP proxy server, the base station side of the enterprise mobile private network encapsulates the downlink SSL protocol packet into a downlink user packet for the mobile terminal sent to the internal user of the enterprise. And sending the downlink user message to the mobile terminal of the internal user of the enterprise by using the established SSL protocol connection.
A device for accessing a public network by a user terminal of an enterprise mobile private network, comprising:

The determining module is configured to determine the packet type of the uplink public network packet when receiving the uplink public network packet sent by the mobile terminal of the internal user of the enterprise;

Establishing a protocol connection module, configured to establish, according to the determined packet type of the uplink public network packet, a protocol connection of a corresponding packet type between the mobile terminal and the mobile terminal of the enterprise, and obtain the protocol connection through the protocol connection An uplink protocol packet sent by the mobile terminal of the internal user of the enterprise;

a sending module, configured to route the uplink protocol packet to a hypertext transfer protocol HTTP proxy server, so that the mobile terminal of the enterprise internal user accesses the public network via the HTTP proxy server, and receives the HTTP proxy server When the downlink protocol packet is returned, the downlink protocol packet is sent to the mobile terminal of the internal user of the enterprise through the established protocol connection.
The apparatus according to claim 8, wherein the uplink public network message includes destination address information for identifying a public network address, and a transmission control protocol TCP port number information for identifying a packet type; the packet type includes HTTP Message type and Hypertext Transfer Security Protocol HTTPS message type.
The apparatus of claim 8, the determining module comprising:

The parsing unit is configured to: when receiving the uplink public network packet sent by the mobile terminal of the internal user, the destination address and the TCP port number of the uplink public network packet are obtained by parsing the uplink public network packet;

The matching unit is configured to perform matching processing on the obtained destination address and the TCP port number by using a preset public network address library, an HTTP port list library, and an HTTPS port list library;

The determining unit is configured to: when the obtained destination address and the TCP port number match the public network address pool and the HTTP port list, determine that the uplink public network packet is an HTTP packet type, and the obtained destination address And the TCP port number is matched with the public network address pool and the HTTPS port list, and the uplink public network packet is determined to be an HTTPS packet type.
The apparatus according to claim 10, wherein the establishing a protocol connection module comprises:

Establishing a first protocol connection unit, configured to establish an HTTP protocol connection between the uplink public network packet and the mobile terminal of the enterprise internal user when the uplink public network packet is determined to be an HTTP packet type, and connect through the HTTP protocol Obtaining an uplink HTTP protocol packet sent by the mobile terminal of the internal user of the enterprise.
The apparatus according to claim 10, wherein the establishing a protocol connection module comprises:

Establishing a second protocol connection unit, configured to establish a secure socket layer SSL protocol connection between the uplink public network packet and the mobile terminal of the enterprise internal user when the uplink public network packet is determined to be an HTTPS packet type, and The SSL protocol connection acquires an uplink SSL protocol packet sent by the mobile terminal of the internal user of the enterprise.
A computer storage medium storing computer executable instructions; after the computer executable instructions are executed, the user terminal of the enterprise mobile private network according to any one of claims 1 to 7 can be accessed to access the public network. method.