KR20240042960A - Enterprise dedicated network service system for providing multi authentication - Google Patents

Abstract

A corporate dedicated network service system that controls access to a dedicated network of a primary terminal and a secondary terminal connected to the primary terminal through short-distance communication, wherein the secondary terminal connects to the corporate dedicated network through the primary terminal through a session connected to the primary terminal. A user plane management device (User plane) that processes user plane data transmitted and received, and a control plane management device (Control plane) in which the primary terminal and the secondary terminal process control plane data related to access control of the enterprise dedicated network. ) includes.
The control plane management device blocks traffic transmission between the primary terminal and the user plane management device until multi-authentication using a separate authentication method different from terminal authentication for the primary terminal and the secondary terminal is confirmed. Instructs the plane management device to allow the traffic to be forwarded if the multi-authentication is confirmed.

Description

Enterprise dedicated network service system providing multiple authentication {ENTERPRISE DEDICATED NETWORK SERVICE SYSTEM FOR PROVIDING MULTI AUTHENTICATION}

This disclosure relates to a corporate dedicated network service system that performs multi-factor authentication for a secondary terminal connected to a primary terminal to access a corporate dedicated network.

The enterprise private network service, called Private LTE/5G, separates the public network such as the Internet network from the enterprise private network through EPC (Evolved Packet Core) and connects the terminal of the enterprise subscriber to the public network or enterprise private network. It is a technique to do.

This corporate network service allows corporate employees to experience the same work as in the office anywhere in the country, so the need for it is increasing as work from home and mobile work becomes more active.

Corporate employees can use corporate network services from the secondary terminal by connecting an electronic device such as a laptop (referred to as a secondary terminal) to a mobile router (referred to as a primary terminal) connected to the corporate network. The primary terminal and the secondary terminal can be connected through short-distance communication methods such as WiFi, USB (Universal Serial Bus), or UTP (Unshielded Twisted Pair).

At this time, the primary terminal can be controlled by EPC, the core system of the communication service provider, according to communication standards, but authentication control and traffic control for the secondary terminal require a separate enterprise network access control technology. Accordingly, communication service providers build devices that control access to a corporate dedicated network to enable private network access control of primary and secondary terminals.

As work from home/remote work becomes a daily routine, corporate network services are being advanced to enhance user convenience while strengthening security, and attempts are being made to converge various external IT (Information Technology) technologies.

However, corporate subscribers who value security do not want terminals connected to the corporate network to receive external IT services through the Internet. In order to meet these needs, a structure for linking corporate network services and external IT technology needs to be designed.

This disclosure is a company that can control access to the corporate network for secondary terminals that connect to the corporate network through the primary terminal by linking with various ^third party authentication systems that provide multiple authentication without going through the Internet. Provides a dedicated network service system.

According to one feature, it is a corporate dedicated network service system that controls access to a dedicated network of a primary terminal and a secondary terminal connected to the primary terminal through short-distance communication, wherein the secondary terminal is connected to the first terminal through a session connected to the primary terminal. A user plane management device (User plane) that processes user plane data transmitted and received from and to the corporate dedicated network through a secondary terminal, and a control that processes control plane data related to access control of the corporate dedicated network by the primary terminal and the secondary terminal. It includes a control plane, wherein the control plane management device is a multi-authentication system that performs multi-authentication using a separate authentication method different from terminal authentication for the primary terminal and the secondary terminal. Request and instruct the user plane management device to block traffic transmission between the primary terminal and the user plane management device until a multi-authentication success response is received from the multi-authentication system, and when the multi-authentication success response is received. , instructs the user plane management device to allow forwarding the traffic.

The enterprise dedicated network service system further includes an external network interconnection device that transmits data related to multi-authentication between the multi-authentication system and the control plane management device,

The multi-authentication system may store information about the multi-authentication system and transmit a multi-authentication request received from the control plane management device based on the stored information.

The external network interconnection device stores a multi-authentication DB matching multi-authentication types for each subscriber identifier and an interconnection DB matching the IP address of the multi-authentication system corresponding to each multi-authentication type, and stores the multi-authentication DB matching the multi-authentication types for each subscriber identifier, and the multi-authentication DB matching the IP addresses of the multi-authentication systems corresponding to each multi-authentication type. The multi-authentication type matching the subscriber identifier included in the authentication request can be confirmed from the authentication DB, and the IP address of the multi-authentication system corresponding to the confirmed multi-authentication type can be confirmed from the linked DB.

The external network interconnection device stores an interconnection DB matching the IP address of the multi-authentication system corresponding to each multi-authentication type indicator indicating the multi-authentication type, and multi-authentication included in the multi-authentication request received from the control plane management device. The IP address of the multi-authentication system corresponding to the type indication is confirmed from the interworking DB, and the control plane management device stores multi-authentication type indicator information matching the identifiers or corporate identifiers of the primary terminal and the secondary terminal. You can manage it by doing this.

The control plane management device manages information indicating whether to activate multiple authentication for each identifier of at least one of a primary terminal identifier or a secondary terminal identifier, and when performing authentication for the secondary terminal, the multi-authentication activation is performed. Once confirmed, a multi-authentication request can be transmitted to the external network-connected device.

According to the embodiment, by performing multi-authentication by combining various external IT technologies without Internet access, it is possible to control the private network access of the primary terminal and the secondary terminal that connects to the corporate network through the primary terminal.

1 is a configuration diagram of a corporate dedicated network service system according to an embodiment.
Figure 2 is a flowchart showing a corporate network access procedure including multi-authentication according to an embodiment.
Figure 3 is a flowchart showing a multi-authentication control procedure of a control plane management device according to an embodiment.
Figure 4 is a flowchart explaining the operation of an external network interworking device according to an embodiment.
Figure 5 is a flowchart explaining the operation of an external network interworking device according to another embodiment.

Below, with reference to the attached drawings, embodiments of the present disclosure will be described in detail so that those skilled in the art can easily practice them. However, the present disclosure may be implemented in many different forms and is not limited to the embodiments described herein. In order to clearly explain the present disclosure in the drawings, parts that are not related to the description are omitted, and similar parts are given similar reference numerals throughout the specification.

Throughout the specification, when a part "includes" a certain element, this means that it may further include other elements rather than excluding other elements, unless specifically stated to the contrary.

In addition, terms such as “…unit”, “…unit”, and “…module” used in the specification refer to a unit that processes at least one function or operation, which may be implemented through hardware or software or a combination of hardware and software. You can.

The devices described in the present invention are composed of hardware including at least one processor, a memory device, a communication device, etc., and a program that is executed in conjunction with the hardware is stored in a designated location. The hardware has a configuration and performance capable of executing the method of the present invention. The program includes instructions that implement the operating method of the present invention described with reference to the drawings, and executes the present invention by combining it with hardware such as a processor and memory device.

In this specification, “transmission or provision” may include not only direct transmission or provision, but also indirect transmission or provision through another device or using a circuitous route.

In this specification, expressions described as singular may be interpreted as singular or plural, unless explicit expressions such as “one” or “single” are used.

In this specification, the same reference numbers refer to the same elements regardless of the drawings, and “and/or” includes each and all combinations of one or more of the mentioned elements.

In this specification, terms including ordinal numbers, such as first, second, etc., may be used to describe various components, but the components are not limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, a first component may be referred to as a second component, and similarly, the second component may be referred to as a first component without departing from the scope of the present disclosure.

In the flowcharts described herein with reference to the drawings, the order of operations may be changed, several operations may be merged, certain operations may be divided, and certain operations may not be performed.

In the specification, the corporate dedicated network service provides mobile communication services with restricted external access to corporate subscriber terminals. The corporate dedicated network service separates the public network and dedicated network through the core network of the telecommunication company network. A private network provides mobile communication services with limited external access to specific subscribers, and may be called, for example, a private network or an intranet. At this time, since the embodiment targets corporate subscribers, it is called a corporate dedicated network. A corporate network is distinguished from a public network such as an Internet network that provides mobile communication services to an unspecified number of people.

At this time, the telecommunication company network may be a 3G network, a Long Term Evolution (LTE) network, or a 5G network, and the explanation will use the 5G network as an example.

In this specification, the 5G network includes a Radio Access network (RAN) through which primary terminals wirelessly access, and a Core Network consisting of a plurality of network functions. The core network has an Access and Mobility Management Function (AMF), a Session Management Function (SMF), and creates a PDU (Packet Data Unit) session through the SMF and a data network (Data Network, DN). User Plane Function (UPF), which is connected to and processes traffic, Policy Control Function (PCF), which controls charging and quality of service policies, and Unified Data Management function, which manages subscriber information. , UDM), Unified Data Repository (UDR), and Network Exposure function (NEF).

In this specification, a terminal directly connected to the 5G network may be referred to as a primary terminal or a higher-level terminal, and a terminal connected to the primary terminal and accessing the 5G network may be referred to as a secondary terminal or lower-level terminal. The secondary terminal is not limited to lower level terminals directly connected to the primary terminal, and may be an nth terminal. The primary terminal may be a mobile router such as a wireless egg, or a mobile terminal equipped with a mobile routing function, and in the description, it can mainly be described as a mobile router. The secondary terminal is a terminal that can be connected to the primary terminal through short-distance communication, and can mainly be described as a laptop in the description.

1 is a configuration diagram of a corporate dedicated network service system according to an embodiment.

Referring to Figure 1, the enterprise dedicated network service system 100 includes a control plane management device (101, 105), a user plane management device (102, 106), an enterprise dedicated UPF (103, 107), and an enterprise dedicated network (104, 108). , core network 109, path routing device 110, primary terminal 111, secondary terminal 112, access network/radio access network (RAN) 113, switch 114 ), an external network interconnection device 115, and a multi-authentication system 116.

Here, multi-authentication is additional authentication in addition to terminal authentication, and may be referred to as two-factor authentication. Two-factor authentication may be performed by the secondary terminal 112 or/and a third terminal owned by the user of the secondary terminal 112.

Control plane management devices (101, 105), user plane management devices (102, 106), enterprise UPF (103, 107), path routing device (110), access network/wireless access network (113), switch (114), external The network interworking device 115 may be referred to as a network device that provides a corporate dedicated network service to the primary terminal 111 and the secondary terminal 112.

The access network/wireless access network 113 may be used in the same sense as a base station, and will hereinafter be referred to as the base station 113 in the description.

The control plane management devices (101, 105), user plane management devices (102, 106), and enterprise-only UPFs (103, 107) manage the secondary terminal (112) connected to the primary terminal (111) to the enterprise-only network (104, 108). ) These are dedicated devices for connecting to.

The access control management devices (101, 102, 105, 106) are devices that perform corporate network access control between the corporate UPFs (103, 107) and the corporate dedicated networks (104, 108), and are connected to the primary terminal (111), 2 It is possible to perform corporate network connection authentication for the primary terminal 112, tunneling control, IP allocation to the secondary terminal 112, secondary terminal status management, and mobility management for the secondary terminal 112.

The access control management devices 101, 102, 105, and 106 are divided into control plane management devices 101 and 105 and user plane management devices 102 and 106.

The control plane management devices 101 and 105 perform controls related to access control to the corporate network, such as authentication to determine whether the primary terminal 111 and the secondary terminal 112 are authorized to access the corporate network 104 and 108. Processes flat data. Additionally, the control plane management devices 101 and 105 may perform IP allocation to the secondary terminal 112, secondary terminal status management, etc.

When the control plane management devices 101 and 105 succeed in authenticating the primary terminal, they transmit information about the user plane management device connected to the primary terminal 111 to the primary terminal 111 . Accordingly, the primary terminal 111 can access the user plane management devices 102 and 106 using the user plane management device information obtained from the control plane management devices 101 and 105.

The user plane management devices 102 and 106 transmit and receive user plane data from the secondary terminal 112 to the enterprise dedicated network 104 and 108 through the primary terminal 111 through a dedicated network session connected to the primary terminal 111. Processes uplink user plane data and downlink user plane data.

The user plane management devices 102 and 106 route uplink data and downlink data between the secondary terminal 112 and the enterprise private network 104 and 108.

The corporate UPF (103, 107) is a core device that connects a dedicated network session according to the 5G standard between the primary terminal 111 and the corporate dedicated network (104, 108).

The control plane management devices 101 and 105 and the user plane management devices 102 and 106 are connected through a dedicated line. The user plane management devices 102 and 106 and the enterprise UPF 103 and 107 are connected through a dedicated line.

These dedicated devices may be operated independently for each corporate subscriber, or may be operated integratedly for multiple corporate subscribers.

A structure in which dedicated equipment is operated independently is called a built-up structure, and a structure in which dedicated equipment is operated in an integrated manner is called a service-type structure.

Subscriber A's dedicated equipment can be operated independently, that is, in a built-in structure. In this case, the control plane management device 101, the user plane management device 102, and the corporate UPF 103 for connection to the corporate network 104 may be installed and operated at the corporate site. The user plane management device 102 and the enterprise-only UPF 103 may be connected to the core network 109 and the base station 113 through the switch 114.

Dedicated equipment for subscriber B, subscriber C, and subscriber D can be operated in an integrated manner, that is, in a service-type structure. In this case, the control plane management device 105, user plane management device 106, and corporate UPF 107 for connection to the corporate network 108 of each subscriber may be installed and operated at the telecommunication company site. The enterprise-only UPF (107) is connected to the core network (109).

At this time, the user plane management device 106 can distinguish the subscriber's corporate network 108 based on the APN (Access Point Name) received from the primary terminal 111 and connect the secondary terminal 112 to it.

The core network 109 is composed of core devices, and connects the primary terminal 111 with the enterprise-only UPFs 103 and 107 based on the subscriber information of the primary terminal 111. Since this connection process uses known technology, detailed description is omitted.

The core network 109 is composed of core devices, and connects the primary terminal 111 with the enterprise-only UPFs 103 and 107 based on the subscriber information of the primary terminal 111. Since this connection process corresponds to a known technology, that is, a network access procedure according to the 3GPP standard, detailed description is omitted.

The corporate UPFs 103 and 107 are core network devices that connect private network sessions according to the 5G standard between the primary terminal 111 and the corporate dedicated networks 104 and 108.

The user plane management units 102 and 106 are physically connected directly to the enterprise dedicated UPFs 103 and 107.

The corporate dedicated network (104, 108) may include the corporate subscriber's internal network, special network, etc. Here, the special network is a specific service network provided by corporate subscribers, and may be, for example, a VDI (Virtual Desktop Infrastructure) system.

The path routing device 110 routes multiple authentication packets between the external network interconnection device 115 and the control plane management devices 101 and 105.

The path routing device 110 is connected to a plurality of control plane management devices 101 and 105. The path routing device 110 may include a routing path database that stores path information matching an enterprise identifier and a control plane management device IP address.

The route routing device 110 uses the routing path database to connect the multiple authentication packets that the external network interconnection device 115 transmits to the control plane management devices 101 and 105 and the control plane management devices 101 and 105 to the external network. Multiple authentication packets transmitted to the companion device 115 are routed.

The route routing device 110 may check the enterprise identifier from the multiple authentication packets received from the external network interconnection device 115 and select the control plane management device IP address matching the enterprise identifier from the routing path database. The path routing device 110 may set the selected control plane management device IP address as the destination IP of the multi-authentication packet and transmit the multi-authentication packet to the corresponding control plane management device 101.

In addition, when the route routing device 110 receives multiple authentication packets from the control plane management devices 101 and 105, the destination IP of the multiple authentication packets is changed from the IP address of the route routing device 110 to the external network interoperability device 115. After converting it to an IP address, it can be transmitted to the external network interconnection device 115.

The primary terminal 111 is directly connected to the network and connected to at least one secondary terminal 112. For example, the primary terminal 111 may be a mobile router connected to a 5G network, or a mobile terminal equipped with a mobile routing function.

The primary terminal 111 routes dedicated network traffic between at least one secondary terminal 112, the enterprise-only UPFs 103 and 107, and the user plane management devices 102 and 106.

The primary terminal 111 can connect to the base station 113 and transmit traffic to the enterprise-only UPFs 103 and 107 and the user plane management devices 102 and 106.

The secondary terminal 112 is a device connected to the primary terminal 111 and may be, for example, an electronic device such as a laptop.

Here, the secondary terminal 112 may be connected to the primary terminal 111 in various ways, for example, WiFi, USB (Universal Serial Bus), UTP (Unshielded Twisted Pair), etc.

The secondary terminal 112 is an employee terminal belonging to a corporate subscriber and may be a terminal managed by the control plane management devices 101 and 105 to authenticate access to a dedicated network. For example, the secondary terminal 112 may be a business device registered with the control plane management devices 101 and 105.

The primary terminal 111 routes control plane data transmitted and received between the secondary terminal 112 and the control plane management devices 101 and 105. The primary terminal 111 may connect to the base station 113 and transmit control plane data to the control plane management devices 101 and 105. Here, control plane data refers to data related to authentication that determines whether the primary terminal 111 and the secondary terminal 112 have permission to access the corporate network.

The primary terminal 111 routes user plane data that the secondary terminal 112 transmits and receives to and from the corporate dedicated networks 104 and 108 through the corporate UPFs 103 and 107 and the user plane management devices 102 and 106. . The primary terminal 111 may connect to the base station 113 and transmit user plane data to the user plane management devices 102 and 106 connected to the enterprise-only UPFs 103 and 107. Here, user plane data refers to service data transmitted and received between the primary terminal 111 and the secondary terminal 112 with the corporate dedicated networks 104 and 108.

Dedicated network traffic transmitted and received between the secondary terminal 112 and the enterprise dedicated network (104, 108), that is, user plane data, is transmitted and received by the primary terminal 111, the base station 113, the enterprise dedicated UPF (103, 107), and user plane management. It is transmitted through a tunneling path consisting of devices 102 and 106.

At this time, the base station 113 may be a corporate base station located at the corporate site.

The control plane management device 101, the enterprise UPF 103, and the path routing device 110 are connected to the switch 114. Switch 114 may be an L3 switch.

The external network interconnection device 115 is connected to the multi-authentication system 116 and processes all operations for interworking between the multi-authentication system 116 and the control plane management devices 101 and 105.

The external network interworking device 115 can process interworking between the multi-authentication system 116 and the control plane management devices 101 and 105 using an open API (Application Programming Interface).

The external network interconnection device 115 can accept various events occurring in the multi-authentication system 116 and transmit them to the control plane management devices 101 and 105. For example, in addition to blocking/allowing traffic, acceptable events may include traffic rate control, IP (or URL)-based access control, user event management, etc.

The multi-authentication system 116 performs additional authentication to determine whether the secondary terminal 112 can access the corporate network.

According to an embodiment, the multi-authentication system 116 may be a system that implements various authentication methods, such as Short Message Service (SMS) One Time Password (OTP) authentication, QR code authentication, face authentication, and access authentication system authentication.

The multi-factor authentication system 116 may be a third party server.

According to one embodiment, the multi-authentication system 116 may be comprised of a text authentication server and a text sending server for processing SMS OTP authentication. In this case, the multi-authentication request becomes a text authentication request.

When a text authentication request is received from the control plane management devices 101 and 105, the text authentication server may generate an OTP and request transmission to the text sending server.

The text sending server sends an OTP SMS to the user's phone number included in the text authentication request received from the text authentication server. At this time, the user phone number may be the phone number of a third terminal (hereinafter referred to as user terminal) of the user who owns the primary terminal 111/secondary terminal 112.

The text authentication server is connected to the user terminal, performs SMS OTP authentication to determine whether the OTP is valid, and transmits the authentication result (success or failure) to the control plane management devices 101 and 105.

According to another embodiment, the multi-authentication system 116 may be composed of a QR authentication server and a text sending server. In this case, the multi-authentication request becomes a QR authentication request.

When a QR authentication request is received from the control plane management devices 101 and 105, the QR authentication server may generate a QR code and request transmission to the text sending server. The text sending server sends a QR SMS to the user's phone number included in the QR authentication request received from the QR authentication server. The QR authentication server is connected to the user terminal, performs QR OTP authentication to determine whether the QR code is valid, and transmits the authentication result (success or failure) to the control plane management devices 101 and 105.

According to another embodiment, multi-factor authentication system 116 may be a facial authentication system. In this case, the multi-authentication request becomes a facial authentication request.

When a facial authentication request is received from the control plane management devices 101 and 105, the facial authentication system may be connected to the secondary terminal 112 to perform facial authentication. The secondary terminal 112 may install and run software that can access the facial authentication system in advance. Alternatively, the secondary terminal 112 may access the face authentication system through the web, or a separate user terminal may access the face authentication system through the web.

According to another embodiment, the multi-factor authentication system 116 may be an access authentication system. In this case, the multi-authentication request becomes an access authentication request.

When an access authentication request is received from the control plane management devices 101 and 105, the access authentication system may process access authentication and return the result.

Figure 2 is a flowchart showing a corporate network access procedure including multi-authentication according to an embodiment.

At this time, the same reference numerals as the components in FIG. 1 will be used for explanation.

Referring to FIG. 2, the primary terminal 111 transmits a primary terminal authentication request containing primary terminal information to the control plane management devices 101 and 105 (S101). The primary terminal information may be a terminal identifier such as International Mobile Subscriber Identity (IMSI), Mobile Directory Number (MDN), etc.

The control plane management devices 101 and 105 perform primary terminal authentication to determine whether the primary terminal 111 has permission to access the corporate network based on the primary terminal information obtained in S101 (S102).

If the control plane management devices 101 and 105 succeed in primary terminal authentication, they transmit a primary terminal authentication response containing the IP addresses of the user plane management devices 102 and 106 to the primary terminal 111 (S103). ).

The primary terminal 111 may receive a corporate network connection request containing secondary terminal information from the secondary terminal 112 (S104). The secondary terminal information may be the MAC address (Media Access Control Address) of the secondary terminal 112.

The primary terminal 111 transmits a secondary terminal authentication request containing secondary terminal information to the control plane management devices 101 and 105 (S105). The control plane management devices 101 and 105 perform secondary terminal authentication to determine whether the secondary terminal 112 has permission to access the corporate network based on the secondary terminal information obtained in S105 (S106). If the control plane management devices 101 and 105 succeed in authenticating the secondary terminal, the control plane management devices 101 and 105 may determine activation by checking the multi-authentication field of the subscription/authentication information matching the identifier of the secondary terminal 112 (S107). (S108).

At this time, the control plane management devices 101 and 105 may store and manage subscription/authentication information matched for each terminal identifier and corporate identifier of the primary terminal 111 and secondary terminal 112. Subscription/authentication information may include parameters as shown in Table 1.

field value corporate identifier AAAACO001 Login ID xxx-yyyy-zzzz Primary terminal identifier MDN/IMSI Secondary terminal identifier MAC address multi-factor authentication Active or Inactive

If the value 'Inactive' is included in the multi-authentication field of Table 1, the control plane management devices 101 and 105 determine that the secondary terminal 112 is not subject to multi-authentication. If it is determined that the device is not subject to multiple authentication, the control plane management devices 101 and 105 transmit a secondary terminal authentication response including permission to access the secondary terminal to the primary terminal 111 (S109).

If the value 'Active' is included in the multi-authentication field of Table 1, the control plane management devices 101 and 105 determine that the secondary terminal 112 is subject to multi-authentication. If it is determined that the device is subject to multiple authentication, the control plane management devices 101 and 105 transmit a secondary terminal authentication response including a traffic blocking instruction to the primary terminal 111 (S110).

The primary terminal 111 transmits a corporate network connection response to the secondary terminal 112 (S111).

At this time, the secondary terminal authentication response of S110 and the corporate network connection response of S111 may include multiple authentication instructions. The secondary terminal 112 that has received the multi-authentication instruction can prepare for interworking with the multi-authentication system 116.

After S110, the control plane management devices 101 and 105 transmit a traffic blocking instruction to the user plane management devices 102 and 106 (S112). The user plane management devices 102 and 106, which have received the tunneling blocking instruction, connect an IPSec tunneling session with the primary terminal 111 and set traffic blocking (S113).

The control plane management devices 101 and 105 transmit a multi-authentication request to the external network interconnection device 115 (S114).

The external network interconnection device 115 transmits a multi-authentication request to the multi-authentication system 116 (S115).

The multi-authentication system 116 transmits a multi-authentication response containing the multi-authentication result to the external network interconnection device 115 (S116).

The external network interconnection device 115 transmits a multi-authentication response to the control plane management devices 101 and 105 (S117).

At this time, the external network interworking device 115 may process interworking between the control plane management devices 101 and 105 and the multi-authentication system 116 using a Representational State Transfer (REST) Application Programming Interface (API). For example, in S114 and S115, a REST API Request message can be used. For S116 and S117, the REST API Response message can be used. The control plane management devices 101 and 105 determine whether multi-authentication is successful based on the multi-authentication response received at S117 (S118).

If the control plane management devices 101 and 105 determine that multiple authentication is successful in S118, they transmit a traffic permission instruction to the user plane management devices 102 and 106 (S119). Then, the user plane management devices 102 and 106 change the IPSec tunneling session with the primary terminal 111 to allow traffic (S120).

Thereafter, the uplink dedicated network traffic generated in the secondary terminal 112 passes through the sequential path of the primary terminal 111, the corporate UPF (103, 107), and the user plane management devices (102, 106) to the corporate dedicated network ( 104, 108). The downlink dedicated network traffic of the corporate dedicated network (104, 108) is delivered to the primary terminal 111 through the sequential path of the user plane management devices (102, 106) and the corporate dedicated UPF (103, 107), and the primary terminal It is routed to the secondary terminal 112 by (111).

On the other hand, if the control plane management devices 101 and 105 determine that multiple authentication has failed in S118, they transmit a tunneling session termination instruction to the user plane management devices 102 and 106 (S121). Then, the user plane management devices 102 and 106 terminate the IPSec tunneling session with the primary terminal 111 (S122).

In addition, before S107, the control plane management devices 101 and 105 perform user login authentication using the user login ID and login authentication information provided from the secondary terminal 112 to the primary terminal 111, and then perform multiple The authentication process can begin.

Figure 3 is a flowchart showing a multi-authentication control procedure of a control plane management device according to an embodiment.

Referring to FIG. 3, the control plane management device 101 transmits a multi-authentication request to the external network interworking device 115 (S201).

The multi-authentication request includes information about the authentication subject, and the control plane management device 101 stores information about the multi-authentication subject, that is, the multi-authentication terminal, in advance.

For example, the phone number of a third terminal owned by the user of the secondary terminal 112 may be included.

Alternatively, the multi-authentication request may include the identifier of the secondary terminal 112. In this case, a multi-authentication-specific app that works in conjunction with the multi-authentication system 116 is installed in advance on the secondary terminal 112. The multi-authentication system 116 performs multi-authentication with the secondary terminal 112 identified using the secondary terminal identifier in conjunction with the multi-authentication dedicated app.

According to another embodiment, instead of transmitting information about the multi-authentication subject to the multi-authentication system 116, the control plane management device 101 directly sends the multi-authentication terminal the URL (Uniform Resource Locator) of the multi-authentication system 116. You can send SMS or SNS push messages containing this. Here, the multi-authentication terminal may be a third terminal or the secondary terminal 112 owned by the user of the secondary terminal 112.

At this time, in an embodiment of the present invention, multi-authentication can be divided into initial access multi-authentication and real-time multi-authentication (always-on multi-authentication).

As shown in FIG. 2, initial access multi-authentication is performed during the initial connection of the primary terminal 111 and the secondary terminal 112 to the corporate network 104 and 108, and can be started after secondary terminal authentication. In this case, S201 corresponds to S114 in FIG. 2. For example, SMS (Short Message Service) OTP (One-Time Password) authentication may be used for initial access authentication.

Real-time multi-authentication can be performed repeatedly according to set cycles or conditions. For example, real-time multi-factor authentication may use biometric authentication such as facial authentication.

Additionally, in the case of face authentication, it may be performed repeatedly at intervals, for example, in minutes. Alternatively, in the case of face authentication, if the user leaves the seat and there is no camera at the camera according to set conditions, network data can be blocked, and network data can be connected when the user returns to the seat and is authenticated. To this end, face authentication can be performed repeatedly in real time. You can.

The control plane management device 101 determines whether the multi-authentication in S201 is initial access authentication or real-time authentication (S202).

In S202, the control plane management device 101 determines initial access authentication if S201 is performed because the multi-authentication field of the subscription/authentication information is activated.

In S202, the control plane management device 101 determines real-time authentication if S201 is performed after the initial connection authentication period arrives.

If it is determined that the initial connection is authenticated in S202, the control plane management device 101 starts an initial connection authentication timer (eg, 3 minutes) (S203).

The control plane management device 101 determines whether the initial access authentication timer expires (S204), and when the initial access authentication timer expires, a multi-authentication success response is received from the external network interconnection device 115 in response to the multi-authentication request of S201. Determine if it is possible (S205). S205 corresponds to S117 and S118 in FIG. 2.

If the control plane management device 101 determines that multiple authentication success responses have been received in S205, it transmits a traffic permission instruction to the user plane management device 102 (S206).

At this time, in the case of initial access multi-authentication, the user plane management device 102 sets blocking on all traffic according to S112 of FIG. 2, so blocks all traffic through S206 and sets traffic permission. do.

On the other hand, if it is determined in S205 that a multiple authentication success response is not received or a multiple authentication failure response is received, the control plane management device 101 transmits a tunneling session termination instruction to the user plane management device 102 (S206) ).

Meanwhile, if real-time authentication is determined in S202, the control plane management device 101 instructs the user plane management device 102 to block user traffic excluding authentication traffic for the established IPsec tunneling session (dedicated network session) (S207) ). The traffic blocking instruction in S207 includes authentication traffic path information. Authentication traffic path information may include IP address and port information set in the external network interconnection device 115.

Therefore, when receiving dedicated network traffic whose destination IP or source IP is included in the authentication traffic path information, the user plane management device 102, which has received the traffic blocking instruction of S207, determines it to be authentication traffic and allows transmission to the corresponding destination. .

Meanwhile, after S207, the control plane management device 101 runs a real-time authentication timer (eg, 1 hour) (S208).

The control plane management device 101 determines whether the timer in S208 expires (S209), and when the timer expires, determines whether a multi-authentication success response is received from the external network interoperating device 115 (S210).

For real-time authentication, the operations after S207 are the same as S114 to S122 in FIG. 2.

If the control plane management device 101 determines that the multi-authentication response is successful in S210, it transmits a traffic permission instruction to the user plane management device 102 (S211).

If the control plane management device 101 determines that the multi-authentication response is successful in S210, it transmits a tunneling session termination instruction to the user plane management device 102 (S212).

According to one embodiment, the control plane management devices 101 and 105 store information on whether to perform multiple authentication for the secondary terminal 112, and specific information about the type of multiple authentication is stored in the external network interoperability device 115. can be managed. The multi-authentication request/response procedure applying this embodiment is shown in FIG. 4.

FIG. 4 is a flowchart explaining the operation of an external network interworking device according to an embodiment, and is a detailed example of S114, S115, S116, and S117 of FIG. 2.

Referring to FIG. 4, the external network interconnection device 115 creates a multi-authentication DB matching multi-authentication types for each subscriber identifier (S301).

The external network interconnection device 115 creates an interconnection DB matching the IP address of the multi-authentication system 116 corresponding to each multi-authentication type (S302).

The control plane management devices 101 and 105 transmit a multi-authentication request to the external network interconnection device 115 (S303). The multi-authentication request may include a subscriber identifier to extract the multi-authentication type from the multi-authentication DB created in S301.

According to one embodiment, a multi-authentication method may be set for each corporate subscriber. In this case, the subscriber identifier is a corporate identifier.

According to another embodiment, the multi-authentication method can be set for each terminal user even within a corporate subscriber. In this case, the user's phone number may be used as the subscriber identifier, and the user's phone number may be the phone number of a third terminal of a user who has a primary terminal and a secondary terminal.

According to another embodiment, the multi-authentication method may be set for each primary terminal 111 and/or secondary terminal 112. In this case, the subscriber identifier may be a primary terminal identifier (eg, IMSI/MDN) and/or a secondary terminal identifier (eg, MAC address).

The external network interconnection device 115 checks the multi-authentication type mapped to the subscriber identifier from the multi-authentication DB created in S201 (S304).

The external network interconnection device 115 verifies the IP address matching the multi-authentication type of S304 from the interconnection DB (S305).

The external network interconnection device 115 transmits a multi-authentication request (including subscriber identifier) to the corresponding multi-authentication system 116 using the IP address confirmed in S305 (S306).

The external network interconnection device 115 transmits a multi-authentication response containing the multi-authentication result received from the multi-authentication system 116 (S307) to the control plane management devices 101 and 105 (S308).

According to another embodiment, the control plane management devices 101 and 105 store a type indicator indicating whether to perform multi-authentication for the secondary terminal 112 and the type of multi-authentication, and the external network interconnection device 115 performs multi-authentication. The IP address of the multi-authentication system 116 corresponding to each type can be stored. The multi-authentication request/response procedure applying this embodiment is shown in FIG. 5.

FIG. 5 is a flowchart explaining the operation of an external network interworking device according to another embodiment, and is a detailed embodiment of S114, S115, S116, and S117 of FIG. 2.

Referring to FIG. 5, the external network interconnection device 115 may create an interconnection DB matching the IP address of the multi-authentication system 116 corresponding to each multi-authentication type indicator (S401).

If the multi-authentication field is activated, the control plane management devices 101 and 105 additionally check the multi-authentication type indicator from the multi-authentication type field of the subscription/authentication information (S402).

For example, the multi-authentication type indicator can be expressed as a number or symbol, such as SMS OTP can be set to 1, QR authentication can be set to 2, facial authentication can be set to 3, and access authentication can be set to 4, but this is only an example. .

The control plane management devices 101 and 105 transmit a multi-authentication request including the type indicator identified in S402 to the external network interconnection device 115 (S403).

The external network interconnection device 115 confirms the IP address corresponding to the type indicator confirmed in S403 from the interconnection DB (S404).

The external network interconnection device 115 transmits a multi-authentication request to the corresponding multi-authentication system 116 using the IP address confirmed in S404 (S405).

The external network interconnection device 115 transmits a multi-authentication response containing the multi-authentication result received from the multi-authentication system 116 (S406) to the control plane management devices 101 and 105 (S407).

The embodiments of the present disclosure described above are not only implemented through devices and methods, but may also be implemented through programs that implement functions corresponding to the configurations of the embodiments of the present disclosure or recording media on which the programs are recorded.

Although the embodiments of the present disclosure have been described in detail above, the scope of the rights of the present disclosure is not limited thereto, and various modifications and improvements made by those skilled in the art using the basic concept of the present disclosure defined in the following claims are also possible. It falls within the scope of rights.

Claims (5)

A corporate dedicated network service system that controls access to a dedicated network of a primary terminal and a secondary terminal connected to the primary terminal through short-distance communication, comprising:
A user plane management device (User plane) that processes user plane data transmitted and received by the secondary terminal to and from the corporate dedicated network through the primary terminal through a session connected to the primary terminal, and
The primary terminal and the secondary terminal include a control plane management device (Control Plane) that processes control plane data related to access control of the enterprise network,
The control plane management device,
Requesting multiple authentication with a multiple authentication system that performs multiple authentication using a separate authentication method different from terminal authentication for the primary terminal and the secondary terminal,
Instructing the user plane management device to block traffic transmission between the primary terminal and the user plane management device until a multi-authentication success response is received from the multi-authentication system,
When the multi-authentication success response is received, instructing the user plane management device to allow forwarding the traffic. In paragraph 1:
Further comprising an external network interconnection device that transmits data related to multi-authentication between the multi-authentication system and the control plane management device,
The multi-authentication system is,
An enterprise dedicated network service system that stores information about the multi-authentication system and delivers a multi-authentication request received from the control plane management device based on the stored information. In paragraph 2,
The external network interlocking device,
Stores a multi-authentication DB that matches multi-authentication types for each subscriber identifier and an interconnected DB that matches the IP address of the multi-authentication system corresponding to each multi-authentication type,
Confirming the multi-authentication type matching the subscriber identifier included in the multi-authentication request received from the control plane management device from the authentication DB, and confirming the IP address of the multi-authentication system corresponding to the confirmed multi-authentication type from the linking DB. , Enterprise dedicated network service system. In paragraph 2,
The external network interlocking device,
Stores an interconnected DB that matches the IP address of the corresponding multi-authentication system for each multi-authentication type indicator indicating the multi-authentication type,
Confirming the IP address of the multi-authentication system corresponding to the multi-authentication type indication included in the multi-authentication request received from the control plane management device from the linked DB,
The control plane management device,
A corporate dedicated network service system that stores and manages multi-authentication type indicator information matching the identifiers or corporate identifiers of the primary terminal and the secondary terminal. In paragraph 2,
The control plane management device,
Manage information indicating whether multi-authentication is activated for each identifier of at least one of the primary terminal identifier or the secondary terminal identifier, and when performing authentication for the secondary terminal, if the multi-authentication activation is confirmed, interconnection with the external network An enterprise private network service system that transmits multi-factor authentication requests to devices.

Images