WO2018050007A1

WO2018050007A1 - Method and apparatus for accessing local network by user terminal and computer storage medium

Info

Publication number: WO2018050007A1
Application number: PCT/CN2017/100636
Authority: WO
Inventors: 翟来国; 徐法禄; 林愈银; 李睿
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-09-13
Filing date: 2017-09-06
Publication date: 2018-03-22
Also published as: CN107819732B; CN107819732A

Abstract

The disclosure relates to a method and an apparatus for accessing a local network by a user terminal and a computer storage medium, comprising: receiving a user plane S1-U uplink packet, and identifying and intercepting a local network access packet in the S1-U uplink packet; determining a user type of a user terminal corresponding to the local network access packet, and verifying a local network access permission of the user terminal according to the user type and a destination address in the local network access packet; and if the verification succeeds, disassembling the S1-U uplink packet, converting a source IP address and a source port number in a user IP packet to a device IP address and a mapped port number, re-encapsulating the packet into a local network packet, and forwarding the local network packet to a next hop address of a subnet to which the destination address belongs. In this way, a local network can be securely accessed directly from a base station side of a mobile network, so that nodes on an access path are greatly reduced, network latency is decreased, and transmission rate is increased.

Description

Method and device for accessing local network by user terminal and computer storage medium

Technical field

The present disclosure relates to the field of communications technologies, and in particular, to a method and apparatus for accessing a local network by a user terminal and a computer storage medium.

Background technique

With the development of mobile communication technologies, access to enterprise networks using mobile network terminals is widespread, such as using a smart phone to move around anytime and anywhere. The deployment location of the mobile network base station is also getting closer and closer to the enterprise network, especially in the indoor deployment scenario. In some large enterprises, commercial places, and Central Business District (CBD), operators meet the high-capacity requirements of the room. Indoor base stations, such as indoor distribution systems, are deployed, and these mobile network indoor base stations and enterprise networks are deployed in the same building. A private network (non-Internet) deployed near the carrier's mobile network base station is collectively referred to as a local network.

When a user terminal accesses the local network, the uplink packet sent by the user equipment (UE) to the mobile network passes through LTE (Long Term Evolution), the mobile network base station eNB, and the backhaul network (Backhaul). After the core network EPC, enter the Internet, such as the backbone network and the metropolitan area network, and then enter the enterprise firewall from the Internet. After the VPN gateway is authenticated, access the server of the intranet, and the mobile network sends a report to the user terminal. The path of the text is the opposite. The way in which the user terminal accesses the local network is entered from the public network, that is, the Internet when entering the enterprise network, and there are many problems of the access path node and the network delay.

Summary of the invention

Based on the above, it is necessary to provide a method and device for a user terminal to access a local network, which can directly and securely access a local network from a mobile network base station side, thereby greatly reducing access path nodes, reducing network delay, and improving Transmission rate.

A method for a user terminal to access a local network, the method comprising:

Receiving an uplink packet of the user plane S1-U, and identifying and intercepting the local network access packet in the uplink packet of the S1-U;

Determining a user type of the user terminal corresponding to the local network access packet, according to the user type and location Determining a local network access right of the user terminal by using a destination address in the local network access message;

If the verification succeeds, the S1-U uplink packet is disassembled, and the source IP address and the source port number in the user IP packet are converted into the device IP address and the mapped port number, and the cost network packet is re-encapsulated. Forwarding the local network packet to the next hop address of the subnet where the destination address is located.

A device for a user terminal to access a local network, the device comprising:

The local network packet identification module is configured to receive the user plane S1-U uplink packet, and identify and intercept the local network access packet in the S1-U uplink packet;

a local network access processing module, configured to determine a user type of the user terminal corresponding to the local network access message, and verify local network access of the user terminal according to the user type and the destination address in the local network access message Privilege, if the authentication is passed, the S1-U upstream packet is disassembled, the source IP address and the source port number in the user IP packet are converted into the device IP address and the mapped port number, and the cost network report is re-encapsulated. And forwarding the local network packet to a next hop address of a subnet where the destination address is located.

An apparatus for a user terminal to access a local network, wherein the processor and the memory storing the processor-executable instructions perform the following operations when the instructions are executed by the processor:

Determining a user type of the user terminal corresponding to the local network access message, and verifying the local network access right of the user terminal according to the user type and the destination address in the local network access message;

A computer storage medium having stored therein one or more programs executable by a computer, the one or more programs being executed by the computer to cause the computer to perform the method.

The method and device for accessing the local network by the user terminal, by receiving the S1-U uplink packet, identify and intercept the local network access packet in the uplink packet of the S1-U, and the intercepted local network access packet is not sent to the core network. The access path node is reduced, the user type of the user terminal corresponding to the local network access message is determined, and the local network access authority of the user terminal is verified according to the user type and the destination address in the local network access message; if the verification is passed, the S1 is determined. The -U uplink packet is disassembled, and the source IP address and source port number in the user IP packet are translated into the device IP address and the mapped port number, and the local network packet is re-encapsulated, and the local network packet is forwarded to the local network packet. The next hop address of the subnet where the destination address is located is forwarded only by the local network access packets that pass the authentication, ensuring the security of the local network information, so that the user terminal can quickly and securely access the local network.

DRAWINGS

1 is an application environment diagram of a method for a user terminal to access a local network in an embodiment;

Figure 2 is a diagram showing the internal structure of the server of Figure 1 in an embodiment;

3 is a flow chart of a method for a user terminal to access a local network in an embodiment;

4 is a flow chart of a DNS query response in an embodiment;

5 is a flow chart of local network access authority verification in an embodiment;

6 is a flowchart of determining, according to an embodiment, whether a user access right meets an access right corresponding to a destination subnet type;

7 is a flow chart of initiating a user type modification request in an embodiment;

8 is a flow chart of modifying a user type according to a decision algorithm in an embodiment;

9 is a timing diagram of querying a local network domain name by a user terminal in a specific embodiment;

10 is a sequence diagram of an uplink packet of a user terminal accessing a local network DMZ subnet in a specific embodiment;

11 is a sequence diagram of a user terminal accessing a local network DMZ downlink message in a specific embodiment;

12 is a timing diagram of a local network DMZ visitor authorization in a specific embodiment;

FIG. 13 is a timing diagram of a user terminal accessing a local line message in a local network in a specific embodiment; FIG.

FIG. 14 is a timing diagram of a downlink message received by a user terminal in an intranet of a local network in a specific embodiment; FIG.

15 is a timing diagram of a local network intranet authorization in a specific embodiment;

16 is a structural block diagram of an apparatus for a user terminal to access a local network in an embodiment;

17 is a structural block diagram of an apparatus for a user terminal to access a local network in another embodiment;

18 is a structural block diagram of a local network access processing module in an embodiment;

19 is a structural block diagram of an apparatus for accessing a local network by a user terminal in still another embodiment;

20 is a structural block diagram of an apparatus for a user terminal to access a local network in still another embodiment;

21 is a structural block diagram of a first verification unit in an embodiment;

22 is a structural block diagram of a local network access processing module in an embodiment;

23 is a structural block diagram of a local network access authorization module in an embodiment;

24 is a structural block diagram of an apparatus for a user terminal to access a local network in still another embodiment;

25 is a schematic diagram of an internal structure of a mobile network base station after a user equipment accesses a local network device in an embodiment;

26 is a structural block diagram of a system for a user terminal to access a local network in an embodiment;

27 is a schematic diagram showing the internal structure of a system in which a user terminal accesses a local network in an embodiment;

28 is a schematic diagram showing the internal structure of a system in which a user terminal accesses a local network in another embodiment.

detailed description

1 is an application environment diagram of a method for a user terminal to access a local network in an embodiment. As shown in FIG. 1 , the application environment includes a terminal 110, an eNodeB eNB 120, a server 130, and an enterprise DMZ zone 140. The enterprise intranet 150, wherein the enterprise DMZ zone 140 includes a VPN gateway 141, a reverse proxy server 142, and a firewall 143. The enterprise intranet 150 includes a blocked choke router 151, a public server 152, and an APP application server 153. The devices in the application environment may be Increase or decrease according to the actual deployment. The terminal 110 is a device that can communicate using a mobile communication network, including but not limited to an intelligent terminal, a mobile communication industrial device, an Internet of Things (IoT) device, and the like. When the user terminal accesses the local network, it directly accesses the enterprise network through the user terminal authority verification from the mobile network base station side. The uplink packet and the downlink packet do not need to pass through the backhaul network Backhaul, the core network EPC, and the Internet, and can be quickly and securely connected. Access to the local network. The application environment can be applied to various scenarios, such as intranet access scenarios of mobile mobile office, wireless interconnection between industrial devices, industrial device data belonging to enterprise private data, large amount of data, high real-time requirements, wireless transmission of data to enterprises The scene of the network. Wireless transmission of commercial premises to the network server of the mall, such as large shopping malls, VR (Virtual Reality) and AR (Augmented Reality) promotion activities launched by merchants, large amount of data transmission, high real-time requirements, and wireless transmission of data to the mall network Server requirements. Large-scale events or exhibitions, where a large amount of video is wirelessly transmitted to the server in the venue.

In one embodiment, the internal structure of server 130 in FIG. 1 is as shown in FIG. 2, which includes a processor, storage medium, memory, and network interface connected by a system bus. The storage medium of the server 130 stores an operating system, a database, and a device for the user terminal to access the local network, and the database is used to store data, such as a user record table, etc., and the device is used to implement a user suitable for the server 130. The method by which the terminal accesses the local network. The processor of the server 130 is used to provide computing and control capabilities to support the operation of the entire server 130. The memory of the server 130 is a device for the user terminal in the storage medium to access the local network. Run the provisioning environment. The network interface of the server 130 is used to communicate with the base station eNB 120, the enterprise network, and the operator Backhaul through a network connection, such as receiving an uplink message sent by the base station eNB 120. Server 130 typically employs a high performance web server.

As shown in FIG. 3, in an embodiment, a method for a user terminal to access a local network is provided, which is applied to the application environment, and includes the following steps:

Step S110: Receive an uplink packet of the user plane S1-U, and identify and intercept the local network access packet in the uplink packet of the S1-U.

Specifically, when the terminal needs to access the local network, the terminal sends an air interface packet encapsulating the user packet to the base station, where the source IP address of the user packet, that is, the IP packet, is the UE PDN IP, and the UE PDN IP is the user terminal UE in the mobile network. The IP address assigned by the mobile network after registration is completed. After receiving the air interface packet, the base station extracts the user packet and sends it to the S1-U tunnel packet for transmission. The solution needs to obtain the source IP address as the user identifier, and identify different user terminals by using the source IP address. The mobile network base station and the core network use a tunnel to transmit user packets. The mobile network base station and the core network each assign a unique S1-U tunnel identifier TEID (Tunnel Endpoint Identifier) to each user terminal. The tunnel identifier assigned by the base station is called The mobile network base station tunnel identifier, and the tunnel network assigned tunnel identifier may be referred to as a core network tunnel identifier. The downlink packets sent to the mobile network base station are packaged into S1-U (S1 User Plane) user plane packets carrying the mobile network base station TEID. After receiving the mobile network base station, the mobile network base station tunnel identification TEID distinguishes different users. , packaged into an air interface message and sent to the corresponding user terminal. Similarly, the uplink packet sent by the mobile network base station eNB to the core network needs to be packaged into an S1-U packet carrying the core network tunnel identifier, and the core network receives the user according to the core network tunnel identifier, and sends the packet to the Internet after processing. The local network packet identification message in the uplink packet of the user plane S1-U can be identified and intercepted by the local network packet identification module deployed on the base station or the server. If the local network packet identification module is deployed in the base station, the local network access packet can be identified and intercepted before the base station sends the S1-U uplink packet, so that only the identified local network access packet is sent to the subsequent The processing module reduces the pressure on the subsequent processing modules. If the local network packet identification module is deployed in the server, the local network access packet is not sent by the server during the process of sending the S1-U uplink packet to the core network by the server. To the core network.

The local network access packet is a packet matching the local network access packet feature rule. The local network access packet feature list is configured to compare and analyze the user packets in the S1-U uplink packet one by one. Local network access message. In the configured local network access packet feature list, each record contains subnet segments and associations. The protocol number, port number, etc. allow the protocol number and port number fields to be optional. For example, a local network access message feature list record is: "address: 10.1.0.0, subnet mask: 255.255.0.0, protocol number: 6, port number: 443, the above address: 10.1.0.0, subnet mask :255.255.0.0", in the description, the subnet 10.1.0.0/16 is often used instead. The destination address, protocol number, and destination port number are extracted from the user packets in the S1-U upstream packet and then accessed with the local network. The feature list is compared. Only the feature match is the local network access message. If the user accesses the https message of hr.ttt.com.cn (ip address is 10.1.2.1), the destination address 10.1.2.1 matches 10.1.0.0/. The 16 subnets, https, protocol number 6, and port number 443, match the above feature records. The intercepted local network access messages are not sent to the core network, and only non-local network access messages are sent to the core network.

Step S120: Determine a user type of the user terminal corresponding to the local network access message, and verify the local network access right of the user terminal according to the user type and the destination address in the local network access message.

Specifically, different user types have different access rights. The types of specific user types and corresponding rights can be customized according to requirements. When defining, different types of user types can be set according to the division of the local network area. The user type of the user terminal can be determined according to the network segment where the user terminal is located, such as a high-privileged user that can set a fixed IP address, and different fixed rights are assigned to different user terminals. You can also set the default user type to be a non-privileged user. You need to apply for a permission to the local network access authorization module in real time. The local network access authorization module applies for a request according to the user type. The authorization decision algorithm can be based on the authorization decision algorithm in real time. The current network communication status parameter, the area of the visited local network, and the like, the user terminal authorizes the corresponding dynamic user type with different rights, updates the user type in real time according to the current network communication status, and can control the user terminal to access the local network in real time. quantity. You can also obtain the user type of the user terminal by searching the user record table. If there is no user record corresponding to the user terminal in the user record table, you need to apply for the authorized user type to the local network access authorization module.

The verification is passed only if the local network access right of the user terminal matches the permission required by the destination address in the local network access message accessed. The local network can be divided into different areas, such as the DMZ area (Demilitarized Zone, also known as the quarantine area) and the internal network. Access to different areas requires different access rights. When the destination address of the user terminal is in a different area, the local network access authorization module may apply for a request according to the user type, and adopt different authorization decision algorithms, so that access of different areas sets different access rules according to the privacy of the content. Flexible and convenient. When the authorization is decided, the user can be authenticated by the VPN gateway. Only when the user is authenticated as an internal user, the user can apply for a specific user type to further ensure the security of the user type authorization.

Step S130: If the verification succeeds, the S1-U uplink packet is disassembled, and the source IP address and the source port number in the user IP packet are converted into the device IP address and the mapped port number, and the cost network packet is re-encapsulated. Forward the local network packet to the next hop address of the subnet where the destination address is located.

Specifically, only the local network access packets that pass the authentication are forwarded. If no authentication is passed, the packets are discarded, ensuring the security of the local network information. Before forwarding to the local network, you need to disassemble the S1-U packet. The source IP address and the source port number carried in the user packet are extracted and converted into the device IP address and the mapped port number. The IP address of the device is the IP address of the device in the local network. The number of device IP addresses can be set according to the number of network cards of the device. Each network card can also be configured with multiple device IP addresses. The source IP address assigned by the mobile network to the user terminal is uniformly converted into the device IP address to ensure the correct IP address transmitted in the local network. At the same time, the source port number carried in the user packet needs to be converted to the mapping port number. Since the source port number carried in the previous user packet may carry the same port number for different user terminals, the port needs to be reassigned under a local network address. No., to ensure that the combination of each device IP address + mapping port number is not repeated during the transmission process, thus ensuring the correctness of data transmission.

As shown in a specific embodiment, the access path of the user terminal 110 to the APP application server 153 is as shown by the route 160 in FIG. 1 , after the access path node base station eNB 120 , the server 130 , the VPN gateway 141 , the firewall 143 , and the choke router 151 . When the APP application server 153 is reached, the backhaul network, the core network EPC, and the Internet do not need to be passed in the middle, so that the access path node is greatly reduced, the network delay is reduced, and the transmission rate is increased.

In this embodiment, the local network access packet in the uplink packet of the S1-U is identified and intercepted by receiving the uplink packet of the S1-U, and the intercepted local network access packet is not sent to the core network, and the access path node is reduced. The user type of the user terminal corresponding to the local network access packet is determined, and the local network access authority of the user terminal is verified according to the user type and the destination address in the local network access message; if the verification is passed, the S1-U uplink packet is removed. The solution translates the source IP address and the source port number of the user IP packet into the device IP address and the mapped port number, and re-encapsulates the local network packet to forward the local network packet to the subnet where the destination address is located. For the next hop address, only the local network access packets that pass the authentication are forwarded, ensuring the security of the local network information, so that the user terminal can quickly and securely access the local network.

In an embodiment, as shown in FIG. 4, before step S110, the method further includes:

In step S210, the S1-U uplink packet is received, and the domain name system DNS query message of the local network domain name in the S1-U uplink packet is identified and intercepted.

Specifically, when the terminal needs to access the local network service, the local network IP address corresponding to the local network server domain name (such as hr.ttt.com.cn) needs to be obtained first. If the IP address of the local network server that needs to be accessed has been obtained in advance, such as For frequent access to a fixed local network, the local network IP address can be pre-stored, and the pre-stored local network IP address is directly carried in the sending network access message. However, in general, you need to obtain the IP address corresponding to the network domain name through DNS query packets. The local network packet identification module deployed in the base station or the server can identify and intercept the DNS query message of the local network domain name in the S1-U uplink packet.

The local network domain name query message is a standard DNS query message sent by the user terminal to the public network DNS server. The local network packet identification module analyzes the domain name in the DNS query packet and matches each domain name record in the configured local network domain name list to check whether the matching succeeds. The local network domain name query message is identified. In the configured local network domain name list, each record complies with the FQDN (Fully Qualified Domain Name) rule. If ttt.com.cn is a record in the local network domain name list, if the domain name in the DNS query message is hr.ttt.con.cn or ims.ttt.com.cn, the matching is successful.

Step S220: The DNS response packet carrying the local network IP address is configured according to the DNS query message of the local network domain name, and the DNS response packet is returned to the terminal, and the local network IP address is carried as the destination address in the local network access packet.

Specifically, the local network IP address corresponding to the domain name may be obtained according to the local network domain name configuration information, and a DNS query response message may be constructed, or may be forwarded to an external dedicated local network domain name DNS server to obtain a local network IP address corresponding to the domain name, and the DNS is constructed. Query response message. The local network IP address corresponding to each local network domain name is configured in the local network domain name configuration information, such as hr.ttt.com.cn corresponding address 10.1.2.1, and ims.tt.com.cn corresponding address 10.1.3.2. In addition, you need to configure the lifetime of the domain name record, that is, TTL (Time To Live). After the TTL time expires, the domain name record should be invalid and need to be reacquired. The DNS response packet is returned to the terminal, where the DNS response packet carries the local network domain name and the corresponding local network IP address, and the subsequent terminal sends the local network IP address as the destination address when sending the local network access message corresponding to the local network domain name. .

In an embodiment, as shown in FIG. 5, step S120 includes:

Step S121: Extract the user identifier carried in the local network access packet, determine the user type corresponding to the user identifier, and determine the subnet and subnet type where the destination address is located.

Specifically, the user identifier is a source IP address, and can be obtained according to the correspondence between the source IP address and the user type. The type of user that should be. The correspondence between the source IP address and the user type may be pre-stored in the form of a table, a text, or the like, thereby obtaining a corresponding user type by looking up a table or checking a string. The corresponding subnet is determined according to the IP address segment where the destination address is located, and different subnets correspond to their respective subnet types. The subnet type can be classified according to the information security importance of the local network. For example, it is divided into a DMZ subnet and an intranet subnet. The intranet subnet needs higher access rights to access. Different subnet types have corresponding user types with access rights, and can customize the correspondence between subnet types and user types with access rights. By assigning different user types with different access rights for different subnet types, the flexible control of access rights is improved.

In step S122, it is determined whether the user access right corresponding to the user type meets the access authority corresponding to the subnet type of the destination address. If yes, the process proceeds to step S123.

Specifically, the user access rights corresponding to the user type match the access rights corresponding to the subnet type of the destination address, and the next step is entered. Otherwise, the local network access packet is discarded.

Step S123: Determine whether the subnet where the destination address is located is a subnet that is allowed to access, and if yes, the local network access authority is verified, otherwise the local network access permission fails to pass the verification.

Specifically, after the user type meets the user access rights, it is further determined whether the subnet where the destination address is located is a subnet that is allowed to be accessed, and a different subnet list may be assigned to different types of users in advance, and the local network is determined by means of table lookup. Whether the subnet where the destination address is located in the access packet is the subnet that is allowed to access. If yes, the local network access permission is verified. Otherwise, the local network access permission is not verified.

In this embodiment, the guest authority and the subnet authority are double-verified, and the access rights of different user types are flexibly and conveniently controlled to ensure the security of local network access.

In an embodiment, the method further includes: if the user access right corresponding to the user type does not meet the access right corresponding to the subnet type of the destination address, updating the user type of the user terminal according to the authorization decision algorithm.

Specifically, if the user access right corresponding to the user type does not meet the access right corresponding to the subnet type of the destination address, the local network access authorization module may apply for the change of the user type, and the local network access authorization module receives the user type change request. The user type of the user terminal is updated according to the user type change request and the authorization decision algorithm. When a user type change request is sent, different user type change requests may be generated according to the subnet type of the destination address and the current user type. Different user type change requests may correspond to different authorization decision algorithms, and the determination of the authorization decision algorithm may be customized according to requirements, such as the number of authorized persons and the current online number according to different subnet types configured, and the total traffic threshold and current online traffic. Factors such as determining whether to grant a user type change request to the corresponding user type. In this embodiment, if the user access authority corresponding to the user type does not match The access permission corresponding to the subnet type of the destination address can be applied to the user type with the corresponding permission to achieve dynamic permission change.

The type of the user that meets the access authority corresponding to the subnet type of the destination address can be modified to an unprivileged user, and the access authority can be flexibly controlled according to the authorization decision algorithm.

In an embodiment, before the step of disassembling the S1-U uplink packet in step S130, the method further includes: determining, according to the current access state, whether to provide a forwarding permission for the local network access packet, if the local network access packet is forwarded. If the permission is obtained, the step of disassembling the S1-U uplink packet is performed. If the local network access packet does not obtain the forwarding permission, the local network access packet is discarded.

Specifically, the current access status includes information such as the uplink and downlink access rate limit, the access duration, and the total access traffic of the user, and determines whether to provide a forwarding permission for the local network access message according to the current access status. Only when a forwarding permission is obtained can a forwarding report, and different subnet types can correspond to different forwarding permission grant policies. The forwarding license further flexibly controls the access traffic, access duration, and the like of the local network. The DMZ authorized guest user accesses the DMZ subnet, and provides a guest forwarding permission for the local network access processing module according to information such as the uplink and downlink access rate limit, the access duration, and the total access traffic of the guest user. The authorized intranet user accesses the internal network subnet, and provides an authorization forwarding permission for the local network access processing module according to the user's uplink and downlink access rate limit. The controlled authorized user accesses the local network VPN gateway, and provides a controlled forwarding permission for the local network access processing module according to the uplink and downlink access rate limit, the access duration, and the total access traffic of the controlled authorized user.

In an embodiment, the step of determining the user type of the user terminal corresponding to the local network access message in step S120 includes: querying the user record table according to the user identifier of the user terminal carried in the local network access message, if the user identifier is in the In the user record table, the user type recorded in the user record table is obtained. If the user ID is not in the user record table, the user type is a non-privileged user.

Specifically, different types of user record tables may be generated according to the user type, and the records are identified by the record table identifier. If the user type is updated, the user record table is updated synchronously. Therefore, if the user type with permission is obtained last time, the user record of the permission can be obtained directly through the user record table in the next access, and the user type without permission is not required to be re-applied to quickly obtain the access right. In one embodiment, the valid time corresponding to the user record in the user record table is obtained, and it is determined that the user record is deleted when the user does not access the local network within the valid time range. In one embodiment, if the user access right expires, the corresponding period of the user is set. During the disabled period, the user does not have the right to apply for the user type update, and only after the disabling period expires, the application is eligible. In one embodiment, the local network is divided into a DMZ zone and an intranet, and the subnet type is divided into a DMZ subnet and an internal network. The network subnet, the user type includes a DMZ authorized guest user, a controlled authorized user, and an authorized intranet user. As shown in FIG. 6, step S122 includes at least one of the following steps:

Step S122a: If the subnet type of the destination address is a DMZ subnet, and the user type is a DMZ authorized guest user, it is determined that the user access right corresponding to the user type matches the access right corresponding to the subnet type of the destination address.

Specifically, the DMZ zone provides isolation between the external network and the internal network, and is protected by external routers and firewalls. Most devices deployed in the DMZ zone also have certain anti-attack capabilities, also known as bastion hosts. The internal network is protected by an internal router, the choke router (blocking router) in Figure 1, and the firewall. The internal network does not allow external direct access. Only some of the bastion hosts in the DMZ zone are allowed to access. The external network users must be authenticated by the VPN gateway before they can access. The VPN gateway can be used as a bastion host. Most of them are deployed in the DMZ zone. They can also lease the carrier's VPN gateway. They can transit through the bastion host in the DMZ zone and access the internal network. The DMZ area server can also be deployed with a reverse proxy server. Most of the external public servers are deployed on the internal network. When the user accesses the external public service, the DMZ reverse proxy server accesses the external public server deployed on the internal network. Public servers provide better protection. The DMZ authorized guest user indicates that the user with the DMZ subnet access rights has the subnet type of the DMZ subnet, and the user type is the DMZ authorized guest user. Access rights corresponding to the network type.

In step S122b, if the subnet type of the destination address is an intranet subnet and the user type is a controlled authorized user, the user access right corresponding to the user type does not meet the access authority corresponding to the subnet type of the destination address, and the S1-U is determined. The uplink packet is disassembled, and the source IP address and the source port number of the user IP packet are converted into the device IP address and the mapped port number, and the local network packet is re-encapsulated to forward the local network packet to the VPN gateway.

Specifically, the controlled authorized user indicates that the user has access to the VPN gateway of the local network. If the user type is a controlled authorized user, the user needs to apply for the user identity authentication to the VPN gateway before obtaining the internal user identity, and the S1-U uplink packet is sent. Disassemble, convert the source IP address and source port number in the user IP packet to the device IP address and the mapped port number, and re-encapsulate the local network packet to forward the local network packet to the VPN gateway.

Step S122c: If the subnet type of the destination address is an intranet subnet and the user type is an authorized intranet user, it is determined that the user access right corresponding to the user type matches the access permission corresponding to the subnet type of the destination address.

Specifically, the authorized intranet user indicates that the user has the access permission of the intranet subnet, and only the internal user is authorized by the intranet authorization decision algorithm to access the intranet subnet of the local network. This program does not limit user access The way to authenticate users inside the local network.

In this embodiment, the subnet type is divided into a DMZ subnet and an intranet subnet, and the user type includes a DMZ authorized guest user, a controlled authorized user, and an authorized intranet user, and is specifically determined by the subnet type and user type of the destination address. Whether the access rights corresponding to the subnet type of the destination address are met, and flexible access control for each different subnet is achieved.

In one embodiment, as shown in FIG. 7, the method further includes at least one of the following steps:

Step S310: If the subnet type of the destination address is a DMZ subnet, and the user type is a non-DMZ authorized guest user, the DMZ authorizes the guest user to apply.

Step S320: If the subnet type of the destination address is an intranet subnet, and the user identity is known as the internal user, the controlled authorized user is invited to apply.

Specifically, a user who does not pass the VPN authentication cannot confirm the identity of the user and can only send the certificate to the VPN gateway for authentication. Only the controlled authorized user can initiate the application and cannot authorize the intranet user to apply.

In step S330, if the subnet type of the destination address is an intranet subnet, and the user identity is an internal user and the user type is a controlled authorized user, the intranet user is authorized to apply.

Specifically, the user can be authorized to apply for an intranet only after the user is identified as an internal user.

In this embodiment, the user type application request sent by the subnet type, the current user type, and the current user identity of the destination address is controlled, so that the user type application request can be generated hierarchically.

In an embodiment, as shown in FIG. 8, if the user access right corresponding to the user type does not meet the access authority corresponding to the subnet type of the destination address, the step of updating the user type of the user terminal according to the authorization decision algorithm includes the following: At least one of the steps:

Step S410: If the DMZ authorized guest user application is received, the DMZ guest authorization algorithm is used to authorize the DMZ guest authorization, and the DMZ guest authorization information is generated according to the configuration, and the user type authorized by the DMZ guest is modified as the DMZ authorized guest user.

Specifically, the DMZ visitor authorization information may include a user identifier and a corresponding user type. In the case that the user record table is divided into a DMZ authorized guest record table, a controlled authorized user record table, and an intranet authorized user record table, the DMZ guest authorization information may be transmitted to the DMZ authorized guest record table to update the DMZ authorized guest user. Record the table, add or change user records, and set the user type of the user record to the DMZ authorized guest user. The initiating guest user access control message is sent at the same time as the user record is updated, carrying the initiated policy and related information. The uplink rate control and the downlink rate control are mandatory policies, and the access duration and total access traffic are available. selected.

Step S420: If the controlled authorized user application is received, the controlled authorization algorithm is given according to the controlled authorization decision algorithm, and the controlled authorization information is generated according to the configuration, and the user type controlled by the authorized authorization is modified as the controlled authorized user.

Specifically, the controlled authorization information may include a user identifier and a corresponding user type. The controlled authorization information can be passed to the controlled authorized user record table, the controlled authorized user record table is updated, the user record is added or changed, and the user type recorded by the user is set as the controlled authorized user. Sending a controlled controlled user access control message to the local network access control module, carrying the initiated policy and related information. The uplink rate control and the downlink rate control are mandatory policies, and the access duration and total access traffic are optional.

Step S430: If the application for the authorized intranet user is received, the intranet authorization is given according to the intranet authorization decision algorithm, and the intranet authorization information is generated according to the configuration, and the user type authorized by the intranet is modified as the intranet authorized user.

Specifically, the intranet authorization information may include a user identifier and a corresponding user type. The intranet authorization information can be transmitted to the intranet authorized user record table, the intranet authorized user record table is updated, the user record is added or changed, and the user type recorded by the user is set as an intranet authorized user. The access control function of the authorized user of the intranet is activated, and the local network access control module stops the original controlled authorized user access control function.

In this embodiment, different authorization decision algorithms are adopted for user applications of different user types. And there are multiple different types of tables, and corresponding updates are made to make the authorization of the user type flexible and orderly. Authorization restrictions are allowed on access subnets, access rates, access durations, and total access traffic through different authorization decision algorithms.

In an embodiment, the user record table is divided into a DMZ authorized guest user record table, a controlled authorized user record table, and an intranet authorized user record table, and the method further includes: modifying the user of the corresponding type of the user record table according to the update of the user type recording.

Specifically, the DMZ authorized guest user record table includes a user identifier, user mobile network base station information, and visitor authorization information. Visitor authorization information, including the subnet list and next hop address allowed, the user uplink access rate, the user downlink access rate, the user access duration, and the total access quota of the user. The controlled authorized user record table includes user identification, user mobile network base station information, and controlled authorization information. Controlled authorization information, including user uplink access rate, user downlink access rate, user access duration, and user access total traffic quota. The intranet authorized user record table includes the user identifier, the user mobile network base station information, and the intranet authorization information. Intranet authorization information, including the list of subnets allowed to access and the next hop address, user uplink access rate, and user downlink access speed. Rate and other information.

In one embodiment, the user record table records the mobile network base station IP address and the mobile network base station user information, the mobile network base station user information including the mobile network base station IP address and the mobile network base station tunnel identity TEID.

Specifically, the user identifier in the user record table is the IP address of the mobile terminal in the mobile network, that is, the IP address of the mobile network base station, and the mobile network base station user information includes the IP address of the mobile network base station eNB and the mobile network base station tunnel identifier of the user terminal. TEID, the two are related. When the user record table is divided into a DMZ authorized guest record table, a controlled authorized user record table, and an intranet authorized user record table, the DMZ authorizes the guest user record table, including the user identifier, the user mobile network base station information, and the DMZ visitor authorization information. DMZ visitor authorization information, including the subnet list and next hop address allowed for access, user uplink access rate, user downlink access rate, user access duration, and user access total traffic quota. The controlled authorized user record table includes user identification, user mobile network base station information, and controlled authorization information. Controlled authorization information, including user uplink access rate, user downlink access rate, user access duration, and user access total traffic quota. The intranet authorized user record table includes the user ID, the user mobile network base station information, and the intranet authorization information. Intranet authorization information, including the list of subnets allowed to access, the next hop address, the user uplink access rate, and the user downlink access rate.

In an embodiment, the method further includes: receiving a local network downlink packet, and restoring the device IP address and the mapping port number carried in the local network downlink packet to a source IP address and a source port number of the user terminal, according to the user. The mobile network base station tunnel identifier of the terminal is packaged into an S1-U downlink message and sent to the mobile network base station.

Specifically, the local network downlink packet is a response packet sent by the local network to the user terminal, where the device IP address and the mapping port number are carried, and the source IP address and the source port number of the user terminal need to be converted to the user terminal.

In an embodiment, after the step of receiving the downlink message of the local network, the method further includes:

Apply for the corresponding type of downlink forwarding permission according to the user type corresponding to the local network downlink packet. If the application is successful, enter the source IP address and source of the user terminal to restore the device IP address and mapping port number carried in the local network downlink packet. Port number step, otherwise the local network downlink packet is discarded.

Specifically, the application request carries the number of bytes to be forwarded when applying for the corresponding type of downlink forwarding permission. If the application is successful, the local network downlink packet is disassembled, and the IP address and mapping port number of the device carried therein are obtained, and converted into a user source. The IP address and source port number are re-encapsulated into S1-U downlink packets and forwarded to the base station eNB. After receiving the S1-U downlink packet, the base station eNB converts the packet into an air interface and sends the packet to the user terminal. If no application is successful, the local network downlink packet is discarded to control the downlink packets of the local network.

In an embodiment, before step S110, the method further includes: performing configuration of each parameter and rule in advance.

Specifically, the configured parameters and rules include: local network access packet characteristics, local network domain name rules, local network subnets and routing rules, VPN gateway configuration, local network access control rules, etc., providing parameter configuration interface functions for other modules. .

In a specific embodiment, the method for accessing the local network by the user terminal is implemented by a new module, where the newly added module includes a local network packet identification module, a local network domain name proxy module, a local network access processing module, and local network access control. Module, local network access authorization module and user information management module. The user terminal queries the local network domain name timing diagram as shown in Figure 9. The local network domain name proxy module constructs a DNS query response, which is described as follows:

401. The UE sends an air interface packet carrying a user packet, that is, a DNS query message to the eNB, to query the local network domain name.

After receiving the user packet, the eNB receives the S1-U uplink packet and sends it to the local network packet identification module.

403. The local network packet identification module analyzes the content of the S1-U packet by packet, and identifies the DNS query packet.

The 404 local network packet identification module identifies the DNS query packet of the local network domain name according to the configured local network domain name rule;

405. The local network packet identification module forwards the DNS query message of the local network domain name to the local network domain name proxy module, and other DNS query messages continue to be sent to the core network;

406: The local network domain name proxy module constructs a DNS query response packet, and carries a local network IP address;

407 the local network domain name proxy module acquires the user mobile network base station information from the user information management module;

408, the local network domain name proxy module packs the DNS query response packet into an S1-U packet, and sends the packet to the eNB;

409 The eNB receives the S1-U packet, and extracts the user packet, that is, the DNS query response packet, and sends the packet to the UE.

In a specific embodiment, an example of a timing diagram 10 of an uplink message of a user terminal accessing a local network DMZ subnet is described as follows:

501. The UE sends a user uplink packet from the air interface.

After receiving the user packet, the 502 eNB receives the S1-U uplink packet and sends the packet.

503. The local network packet identification module identifies the local network access packet according to the configured local network access packet characteristics and compares the packet by packet.

504: The local network packet identification module forwards the local network access packet to the local network access processing module;

505 The local network access processing module checks the destination subnet and identifies that it is a DMZ subnet;

506 The local network access processing module checks whether it is in the DMZ authorized guest user record table;

507 a local network access processing module, for a visitor who is not in the DMZ authorized guest user record table, may initiate a DMZ authorized guest user carrying the user identifier to apply for the DMZ visitor authorization information to the user information management module;

508 The local network access processing module checks whether the DMZ authorized guest user checks whether the subnet where the destination address is located is in the list of allowed subnets, and the packets are directly discarded when the unauthorized visitor or the unauthorized subnet is accessed.

509: The local network access processing module acquires a guest uplink forwarding permission from the local network access control module, and carries the number of bytes to be forwarded;

510 The local network access processing module unpacks the packet, performs port address translation, and re-encapsulates the local network packet. If the forwarding permission is not obtained, the packet is directly discarded.

511 The local network access processing module sends the packaged local network packet to the next hop address corresponding to the subnet where the destination address is located.

In a specific embodiment, the local network DMZ server returns a response message to the UE, and also needs to apply for a guest downlink forwarding permission when forwarding. FIG. 11 is an example of a sequence diagram of the user terminal accessing the local network DMZ downlink message, and the specific description is as follows:

601: The local network access processing module receives the packet of the local network DMZ, that is, the user downlink packet;

602: The local network access processing module acquires a guest downlink forwarding permission from the local network access control module, and carries the number of bytes to be forwarded;

603 The local network access processing module unpacks the packet, performs port address translation, and re-encapsulates the packet into an S1-U downlink user packet. If the forwarding permission is not obtained, the packet is directly discarded.

604: The local network access processing module sends the packaged S1-U downlink user packet to the eNB;

The 605 receives the S1-U packet, and sends the user downlink packet from the air interface to the UE.

The user terminal needs to apply for the guest authorization. The application process can be triggered in the local network domain name response process or in the local network DMZ access process. In a specific embodiment, the local network DMZ guest authorization timing diagram 12 An example is described as follows:

701: The user information management module initiates a DMZ authorized guest application to the local network access authorization module;

702: The local network access authorization module grants DMZ visitor authorization according to the DMZ guest authorization decision algorithm, and generates DMZ visitor authorization information according to the configuration;

703: The local network access authorization module returns a DMZ authorized guest user to apply for a response;

704: The user information management module checks the authorization result, saves the DMZ guest authorization information, and adds the authorized guest record table;

705. The user information management module sends a DMZ authorized guest user access control message to the local network access control module, and carries the initiated policy and related information, where the uplink rate control and the downlink rate control are mandatory policies, and the access duration and total access traffic are available. selected.

The user terminal accesses the intranet subnet of the local network and needs to perform intranet identity authentication. The specific process of intranet identity authentication can be customized according to requirements. This solution is not limited. Before the intranet identity authentication succeeds, the local network access authorization module gives controlled authorization, and the packet is forwarded to the VPN gateway, which is called controlled forwarding. At this time, the user is a controlled authorized user; the local network access authorization module knows that the user identity is an internal user. When the intranet authorization decision algorithm is given to the intranet authorization, the packet is allowed to be forwarded to the authorized subnet, which is called authorization forwarding. At this time, the user is changed to the authorized intranet user. In a specific embodiment, the timing diagram of the user terminal accessing the online line message in the local network is as shown in FIG. 13, and the specific description is as follows:

801. The UE sends a user uplink message from the air interface.

After receiving the 802 eNB, the eNB receives the S1-U uplink packet and sends the packet.

803: The local network packet identification module identifies the local network access packet according to the configured local network access packet characteristics and compares the packets by packet;

804 the local identification module forwards the local network access message to the local network access processing module;

The 805 local network access processing module checks the destination subnet and identifies that it is an intranet subnet;

806: The local network access processing module checks the controlled authorized user record table and the intranet authorized user record table;

807: The local network access processing module sends a user type update request carrying the user identifier to the user information management module for the user who does not exist in the record table, and obtains the user authorization information;

808 The local network access processing module confirms whether the user type is a controlled authorized user or an authorized intranet user, so as to perform different policy processing subsequently;

809: The local network access processing module checks whether the subnet where the destination address is located belongs to the authorized subnet list, and if not, directly discards the packet. If it belongs, the next step is entered;

810. The local network access processing module obtains the controlled uplink forwarding permission from the local network access control module to the controlled network user, carries the number of forwarding bytes, and obtains the authorized uplink forwarding permission to the local network access control module for the authorized intranet user. Carry the number of forwarded bytes.

811 The local network access processing module unpacks the packet, performs port address translation, and re-encapsulates the network packet. If the packet is not forwarded, the packet is directly discarded.

812 The local network access processing module sends the packaged local network packet to the VPN gateway for the controlled authorized user, and sends the next hop address corresponding to the subnet where the destination address is located for the authorized intranet user.

The local network subnet server or the VPN gateway returns a response packet to the UE, and the downlink forwarding permission is also required to be forwarded. The process is slightly different according to different user types, and the user terminal accesses the downlink sequence of the intranet of the local network. As shown in Figure 14, the detailed description is as follows:

901: The local network access processing module receives the local network packet from the local network intranet or the VPN gateway, that is, the user downlink packet;

902 The local network access processing module checks whether the user record type is a controlled authorized user or an authorized intranet user;

903. The local network access processing module obtains the controlled downlink forwarding permission from the local network access control module to the controlled network user, carries the number of forwarding bytes, and obtains the authorized downlink forwarding permission to the local network access control module for the authorized intranet user. Carry the number of forwarded bytes.

904 The local network access processing module unpacks the packet, performs port address translation, and re-encapsulates the packet into an S1-U downlink user packet. If the forwarding permission is not obtained, the packet is directly discarded.

The 905 local network access processing module sends the packetized S1-U downlink user packet to the eNB.

The 906 eNB receives the S1-U packet and sends the user downlink packet from the air interface to the UE.

The local network access authorization module grants an authorization to the internal identity user according to the intranet authorization decision algorithm, and the intranet authorization decision algorithm can combine the current authorized intranet access number, the configured authorized intranet accessor threshold, and the current authorized intranet. Factors such as the total rate of access, the configured total intranet access rate threshold, and so on.

For users who are determined not to be authorized by the intranet, the type of the controlled authorized user record is still maintained; the user who decides to grant the intranet authorization will be changed from the original controlled authorized user type to the authorized intranet user type. Even if the intranet identity user authenticated by the local network, if the local network access authorization module does not give the intranet authorization, it is still the controlled authorized user type.

Figure 15 is a timing diagram of the intranet authorization of the local network. The user terminal notifies the VPN gateway of the user terminal, that is, the IP address of the user terminal on the mobile network, and the VPN gateway notifies the local network access authorization module. The details are as follows:

1001 When the user initially accesses the intranet of the local network, the user information management module accesses the authorization mode to the local network. The block initiates a controlled authorization user application;

1002: The local network access authorization module gives controlled authorization according to the controlled authorization decision algorithm, and generates controlled authorization information according to the configuration;

1003 The local network access authorization module returns a controlled authorized user to apply for a response;

1004 The user information management module checks the controlled authorization result, saves it as the controlled authorized user information, and adds it to the controlled authorized user record table;

The user information management module sends a controlled access authorization user access control message to the local network access control module, and carries the initiated policy and related information, where the uplink rate control and the downlink rate control are mandatory policies, and the access duration and total access traffic are available. selected;

1006 The user terminal and the local network intranet authentication system perform intranet authentication. This step is not limited.

The user terminal sends the user ID to the VPN gateway. This step is optional.

The 1008 VPN gateway notifies the local network access authorization module to carry the user identifier. This step is optional.

1009 The local network access authorization module learns that the user has passed the intranet authentication, and the user identity is an internal user;

1010: The local network access authorization module gives an intranet authorization according to an intranet authorization decision algorithm, and generates intranet authorization information according to the configuration;

1011 The local network access authorization module sends a notification to the user information management module to authorize the intranet user to carry the authorization information;

1012 The user information management module modifies the user from the controlled authorized user record to the authorized intranet user record, saves the authorization information, and joins the internal network authorized user record table, and deletes from the controlled authorized user record table;

1013 The user information management module notifies the local network access control module to activate the access control function of the authorized user of the intranet, and the local network access control module stops the original controlled authorized user access control function.

In an embodiment, as shown in FIG. 16, an apparatus for accessing a local network by a user terminal is provided, including:

The local network packet identification module 520 is configured to receive the S1-U uplink packet, and identify and intercept the local network access packet in the S1-U uplink packet.

The local network access processing module 530 is configured to determine a user type of the user terminal corresponding to the local network access message, and verify the local network access permission of the user terminal according to the user type and the destination address in the local network access message, if the verification is passed. Then, the S1-U uplink packet is disassembled, and the source IP address and the source port number in the user IP packet are converted into the device IP address and the mapped port number, and the local network packet is re-encapsulated, and the local network packet is locally encapsulated. The network packet is forwarded to the next hop address of the subnet where the destination address is located.

In an embodiment, the local network message identification module 520 is further configured to receive the S1-U uplink message, and identify and intercept the DNS query message of the local network domain name in the S1-U uplink message. As shown in FIG. 17, the device further includes:

The local network domain name proxy module 540 is configured to construct a DNS response packet carrying the local network IP address according to the DNS query message of the local network domain name, and return the DNS response packet to the terminal, and the local network IP address is carried as the destination address in the local network. Access to the message.

In an embodiment, as shown in FIG. 18, the local network access processing module 530 includes:

The information determining unit 531 is configured to extract a user identifier carried in the local network access packet, determine a user type corresponding to the user identifier, and determine a subnet and a subnet type where the destination address is located.

The first verification unit 532 is configured to determine whether the user access right corresponding to the user type meets the access authority corresponding to the subnet type of the destination address, and if yes, enter the second verification unit.

The second verification unit 533 is configured to determine whether the subnet where the destination address is located is a subnet that is allowed to access, and if yes, the local network access authority is verified, otherwise the local network access authority fails to pass the verification.

In an embodiment, as shown in FIG. 19, the apparatus further includes:

The local network access control module 550 is configured to determine, according to the current access status, whether to provide a forwarding permission for the local network access message, and if the local network access message obtains the forwarding permission, enter the local network access processing module to uplink the S1-U. If the local network access packet is not forwarded, the local network access packet is discarded.

In an embodiment, as shown in FIG. 20, the device further includes:

The local network access authorization module 560 is configured to update the user type of the user terminal according to the authorization decision algorithm if the user access right corresponding to the user type does not meet the access right corresponding to the subnet type of the destination address.

In an embodiment, the local network access processing module 530 is further configured to query the user record table according to the user identifier of the user terminal carried in the local network access message, and obtain the user record if the user identifier is in the user record table. The user type recorded in the table. If the user ID is in the user record table, the user type is a non-privileged user.

In an embodiment, the local network is divided into a DMZ zone and an intranet. The subnet type is divided into a DMZ subnet and an intranet subnet. The user types include DMZ authorized guest users, controlled authorized users, and authorized intranet users. As indicated at 21, the first verification unit 532 includes at least one of the following units:

The DMZ subnet verification unit 532a is configured to determine, if the subnet type of the destination address is a DMZ subnet, and the user type is a DMZ authorized guest user, determine that the user access right corresponding to the user type matches the access permission corresponding to the subnet type of the destination address. .

The internal network subnet first verification unit 532b is configured to determine that the user access type corresponding to the user type does not meet the destination address if the subnet type of the destination address is an intranet subnet and the user type is a controlled authorized user. The access rights corresponding to the network type are used to disassemble the S1-U uplink packet, convert the source IP address and the source port number in the user IP packet to the device IP address and the mapping port number, and re-encapsulate the cost network packet. Forward local network packets to the VPN gateway.

The intranet subnet second verification unit 532c is configured to: if the subnet type of the destination address is an intranet subnet, and the user type is an authorized intranet user, determine that the user access right corresponding to the user type matches the subnet type of the destination address. Access rights.

In an embodiment, as shown in FIG. 22, the local network access processing module 530 further includes:

Authorization application unit 534, the authorization application unit includes at least one of the following units:

The DMZ authorization application unit 534a is configured to initiate a DMZ authorized guest application if the subnet type of the destination address is a DMZ subnet and the user type is a non-DMZ authorized guest user.

The controlled authorization application unit 534b is configured to initiate a controlled authorized user application if the subnet type of the destination address is an intranet subnet and the user identity is known as an internal user.

The authorized intranet application unit 534c is configured to initiate an authorized intranet user to apply if the subnet type of the destination address is an intranet subnet and the user identity is an internal user and the user type is a controlled authorized user.

In one embodiment, as shown in FIG. 23, the local network access authorization module 560 includes at least one of the following units:

The DMZ authorization unit 560a is configured to: when receiving the DMZ authorized guest user application, grant the DMZ guest authorization according to the DMZ guest authorization decision algorithm, and generate DMZ guest authorization information according to the configuration, and modify the user type authorized by the DMZ guest to be the DMZ authorized guest user. .

The controlled authorization unit 560b is configured to, according to the controlled authorization decision algorithm, grant controlled authorization according to the controlled authorization decision algorithm, and generate controlled authorization information according to the configuration, and modify the type of the user through the controlled authorization to be controlled. Authorized user.

The authorized intranet unit 560c is configured to, if receiving an application for authorizing the intranet user, grant the intranet authorization according to the intranet authorization decision algorithm, and generate the intranet authorization information according to the configuration, and modify the type of the user authorized by the intranet. Authorize users for the intranet.

In an embodiment, the user record table is divided into a DMZ authorized guest user record table, a controlled authorized user record table, and an intranet authorized user record table. As shown in FIG. 24, the device further includes:

The user information management module 570 is configured to modify the user record of the corresponding type of user record table according to the update of the user type.

In one embodiment, an apparatus for accessing a local network by a user terminal is provided, including a processor and a memory storing executable instructions of the processor, when the instructions are executed by the processor, performing the following operations:

Receives the uplink packet of the user plane S1-U, and identifies and intercepts the local network access packet in the uplink packet of the S1-U.

The user type of the user terminal corresponding to the local network access packet is determined, and the local network access right of the user terminal is verified according to the user type and the destination address in the local network access message.

If the authentication succeeds, the S1-U upstream packet is disassembled, and the source IP address and source port number in the user IP packet are translated into the device IP address and the mapped port number, and the local network packet is re-encapsulated. The network packet is forwarded to the next hop address of the subnet where the destination address is located.

In one embodiment, when the instructions are executed by the processor, the following operations are also performed:

The S1-U uplink packet is received, and the DNS query packet of the local network domain name in the S1-U uplink packet is identified and intercepted.

A DNS response packet carrying the local network IP address is configured according to the DNS query packet of the local network domain name, and the DNS response packet is returned to the terminal, and the local network IP address is carried as the destination address in the local network access packet.

In an embodiment, the user type of the user terminal corresponding to the local network access message is determined by the processor, and the local network access permission of the user terminal is verified according to the user type and the destination address in the local network access message. The operations include:

Extracting a user identifier carried in the local network access packet, and determining a user type corresponding to the user identifier;

Determine the subnet and subnet type where the destination address is located;

Determine whether the user access right corresponding to the user type matches the access permission corresponding to the subnet type of the destination address. If yes, determine whether the subnet where the destination address is located is a subnet that is allowed to access.

If it is a subnet that is allowed to access, the local network access permission is verified, otherwise the local network access permission Did not pass verification.

In an embodiment, the local network is divided into a DMZ zone and an intranet, and the subnet type of the destination address is divided into a DMZ subnet and an intranet subnet, and the user types include a DMZ authorized guest user, a controlled authorized user, and an authorized intranet user. The operation performed by the processor to determine whether the user access right corresponding to the user type meets the access right corresponding to the subnet type of the destination address includes at least one of the following operations:

If the subnet type of the destination address is DMZ subnet and the user type is the DMZ authorized guest user, the user access right corresponding to the user type matches the access permission corresponding to the subnet type of the destination address.

If the subnet type of the destination address is the intranet subnet and the user type is the controlled authorization user, the user access right corresponding to the user type does not match the access permission corresponding to the subnet type of the destination address, and the S1-U is uplinked. The packet is disassembled, and the source IP address and the source port number in the user IP packet are converted into the device IP address and the mapped port number, and the local network packet is re-encapsulated to forward the local network packet to the VPN gateway.

If the subnet type of the destination address is the intranet subnet and the user type is the authorized intranet user, the user access right corresponding to the user type matches the access permission corresponding to the subnet type of the destination address.

In one embodiment, a mobile network base station is provided, the mobile network base station comprising the user terminal of any of the above embodiments accessing a local network.

Specifically, the device that accesses the local network by the user terminal is deployed on the mobile network base station, and no new equipment is needed, and only the mobile network base station eNB needs to perform software upgrade. As shown in FIG. 25, a schematic diagram of an internal structure after a user terminal accesses a local network device is deployed in a mobile network base station in a specific embodiment.

In an embodiment, as shown in FIG. 26, a system for a user terminal to access a local network is provided. The system includes a base station eNB 610 and a server 620, and the server includes the user terminal according to any one of the foregoing embodiments to access a local network. Device 621.

Specifically, the device that accesses the local network by the user terminal is deployed on the server, and no modification is needed to the existing base station, so that the transparent deployment is implemented. As shown in FIG. 27, the internal structure of a system in which a user terminal accesses a local network in this embodiment is shown.

In an embodiment, a system for a user terminal to access a local network is provided. The system includes a base station eNB and a server. The base station eNB is configured to receive an S1-U uplink packet, and identify and intercept the local network in the S1-U uplink packet. The access packet is sent to the server, and the server is configured to determine the user type of the user terminal corresponding to the local network access packet, and determine the local network access permission of the user terminal according to the user type, such as If the local network access permission is to allow access to the subnet where the destination address of the local network access packet is located, the S1-U upstream packet is disassembled, and the source IP address and source port number in the user IP packet are converted to the device IP address. Address and map the port number, and re-encapsulate the local network packet to forward the local network packet to the next hop address of the subnet where the destination address is located.

Specifically, the local network packet identification module is deployed on the mobile network base station, and other modules are deployed on one server, and only the packets conforming to the local network packet characteristics and the local network domain name characteristics are forwarded to the server for processing, and the new device can be reduced. Processing overhead. As shown in FIG. 28, the internal structure of a system in which a user terminal accesses a local network in this embodiment is shown.

A person skilled in the art can understand that all or part of the process of implementing the above embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium, such as the present invention. In an embodiment, the program can be stored in a storage medium of the computer system and executed by at least one processor in the computer system to implement a process comprising an embodiment of the methods as described above. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The technical features of the above-described embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction between the combinations of these technical features, All should be considered as the scope of this manual.

The above-described embodiments are merely illustrative of several embodiments of the present invention, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of the invention should be determined by the appended claims.

Industrial applicability

The technical solutions provided by the embodiments of the present invention can be applied to the field of communications technologies. In the embodiment of the present invention, the local network access packet in the S1-U uplink packet is identified and intercepted by receiving the S1-U uplink packet, and the intercepted local network access packet is not sent to the core network to reduce access. The path node determines the user type of the user terminal corresponding to the local network access packet, and verifies the local network access authority of the user terminal according to the user type and the destination address in the local network access packet; if the verification succeeds, the S1-U is uplinked. Message disassembly, user IP The source IP address and the source port number in the packet are translated into the device IP address and the mapped port number, and the local network packet is re-encapsulated to forward the local network packet to the next hop address of the subnet where the destination address is located. Only the local network access packets that pass the authentication will be forwarded, ensuring the security of the local network information, so that the user terminal can quickly and securely access the local network.

Claims

A method for a user terminal to access a local network, the method comprising:

Receiving an uplink packet of the user plane S1-U, and identifying and intercepting the local network access packet in the uplink packet of the S1-U;

Determining a user type of the user terminal corresponding to the local network access message, and verifying the local network access right of the user terminal according to the user type and the destination address in the local network access message;

If the verification succeeds, the S1-U uplink packet is disassembled, and the source IP address and the source port number in the user network protocol IP packet are converted into a device IP address and a mapped port number, and the cost network report is re-encapsulated. And forwarding the local network packet to a next hop address of a subnet where the destination address is located.
The method of claim 1 wherein the method further comprises:

Receiving an S1-U uplink packet, and identifying and intercepting a domain name system DNS query message of the local network domain name in the S1-U uplink packet;

Constructing a DNS response packet carrying the local network IP address according to the DNS query packet of the local network domain name, and returning the DNS response packet to the terminal, where the local network IP address is used as the destination address to carry the local network access packet. in.
The method according to claim 1, wherein the determining the user type of the user terminal corresponding to the local network access message, and verifying the user according to the user type and the destination address in the local network access message The steps for the local network access of the terminal include:

Extracting a user identifier carried in the local network access packet, and determining a user type corresponding to the user identifier;

Determining the subnet and subnet type of the destination address;

Determining whether the user access right corresponding to the user type meets the access right corresponding to the subnet type of the destination address, and if yes, determining whether the subnet where the destination address is located is a subnet that is allowed to access;

If it is a subnet that is allowed to access, the local network access right is verified, otherwise the local network access authority is not verified.
The method of claim 1, wherein the step of disassembling the S1-U uplink message further comprises:

Determining whether to provide a forwarding permission for the local network access message according to the current access status, if After the local network access packet obtains the forwarding permission, the step of disassembling the S1-U uplink packet is entered;

If the local network access message does not obtain a forwarding permission, the local network access message is discarded.
The method according to claim 3, wherein the local network is divided into an demilitarized zone DMZ zone and an intranet, and the subnet type in which the destination address is located is divided into a DMZ subnet and an intranet subnet, and the user type includes a DMZ authorized visitor. The user, the controlled authorized user, and the authorized intranet user, the step of determining whether the user access right corresponding to the user type meets the access right corresponding to the subnet type of the destination address includes at least one of the following steps:

If the subnet type of the destination address is a DMZ subnet, and the user type is a DMZ authorized guest user, determining that the user access right corresponding to the user type meets the access authority corresponding to the subnet type of the destination address;

If the subnet type of the destination address is an intranet subnet, and the user type is a controlled authorization user, it is determined that the user access right corresponding to the user type does not meet the access permission corresponding to the subnet type of the destination address. The S1-U uplink packet is disassembled, and the source IP address and the source port number in the user IP packet are converted into a device IP address and a mapped port number, and the local network packet is re-encapsulated, and the local network packet is The network message is forwarded to the virtual private network VPN gateway;

If the subnet type of the destination address is an intranet subnet, and the user type is an authorized intranet user, it is determined that the user access right corresponding to the user type meets the access permission corresponding to the subnet type of the destination address.
The method of claim 1 wherein the method further comprises:

Receiving the local network downlink packet, and restoring the device IP address and the mapping port number carried in the local network downlink packet to the source IP address and the source port number of the user terminal, and packing the S1 according to the mobile network base station tunnel identifier of the user terminal The -U downlink message is sent to the mobile network base station.
The method according to claim 6, wherein after the step of receiving the downlink message of the local network, the method further includes:

Applying a corresponding type of downlink forwarding permission according to the user type corresponding to the local network downlink packet, and if the application is successful, the device enters the source IP address and the mapping port number carried in the local network downlink packet to be the source of the user terminal. The IP address and source port number, otherwise the local network downlink packet is discarded.
A device for a user terminal to access a local network, wherein the device includes:

The local network packet identification module is configured to receive the user plane S1-U uplink packet, identify and intercept the Local network access packets in the S1-U uplink packet;

a local network access processing module, configured to determine a user type of the user terminal corresponding to the local network access message, and verify local network access of the user terminal according to the user type and a destination address in the local network access message Privilege, if the authentication is passed, the S1-U uplink packet is disassembled, and the source IP address and the source port number in the user network protocol IP packet are converted into the device IP address and the mapped port number, and the cost is re-packaged. The network packet forwards the local network packet to the next hop address of the subnet where the destination address is located.
The device according to claim 8, wherein the local network message identification module is further configured to receive an S1-U uplink message, and identify and intercept a domain name system DNS of a local network domain name in the S1-U uplink message. Query message;

The device also includes:

The local network domain name proxy module is configured to construct a DNS response packet carrying a local network IP address according to the DNS query message of the local network domain name, and return the DNS response packet to the terminal, where the local network IP address is used as a destination. The address is carried in the local network access message.
The apparatus of claim 8, wherein the local network access processing module comprises:

The information determining unit is configured to extract a user identifier carried in the local network access packet, determine a user type corresponding to the user identifier, and determine a subnet and a subnet type of the destination address;

The first verification unit is configured to determine whether the user access right corresponding to the user type meets the access right corresponding to the subnet type of the destination address, and if yes, enter the second verification unit;

The second verification unit is configured to determine whether the subnet where the destination address is located is a subnet that is allowed to access, and if yes, the local network access authority is verified, otherwise the local network access permission fails to pass the verification.
The apparatus of claim 8 wherein said apparatus further comprises:

The local network access control module is configured to determine, according to the current access status, whether to provide a forwarding permission for the local network access message, and if the local network access message obtains a forwarding permission, enter the local network access processing module The S1-U uplink packet is disassembled, and if the local network access packet does not obtain the forwarding permission, the local network access packet is discarded.
An apparatus for a user terminal to access a local network, wherein the processor and the memory storing the processor-executable instructions perform the following operations when the instructions are executed by the processor:

Receiving an uplink packet of the user plane S1-U, identifying and intercepting the local network access in the uplink packet of the S1-U Question message

Determining a user type of the user terminal corresponding to the local network access message, and verifying the local network access right of the user terminal according to the user type and the destination address in the local network access message;

If the verification succeeds, the S1-U uplink packet is disassembled, and the source IP address and the source port number in the user IP packet are converted into the device IP address and the mapped port number, and the cost network packet is re-encapsulated. Forwarding the local network packet to the next hop address of the subnet where the destination address is located.
The apparatus of claim 12, wherein when the instruction is executed by the processor, the following operations are also performed:

Receiving an S1-U uplink packet, and identifying and intercepting a domain name system DNS query message of the local network domain name in the S1-U uplink packet;

Constructing a DNS response packet carrying the local network IP address according to the DNS query packet of the local network domain name, and returning the DNS response packet to the terminal, where the local network IP address is used as the destination address to carry the local network access packet. in.
The device according to claim 12, wherein the user type determined by the processor to determine the user terminal corresponding to the local network access message is based on the user type and the destination in the local network access message The operations of verifying the local network access rights of the user terminal by the address include:

Extracting a user identifier carried in the local network access packet, and determining a user type corresponding to the user identifier;

Determining the subnet and subnet type of the destination address;

Determining whether the user access right corresponding to the user type meets the access right corresponding to the subnet type of the destination address, and if yes, determining whether the subnet where the destination address is located is a subnet that is allowed to access;

If it is a subnet that is allowed to access, the local network access right is verified, otherwise the local network access authority is not verified.
The device according to claim 14, wherein the local network is divided into an LDZ zone and an intranet, and the subnet type of the destination address is divided into a DMZ subnet and an intranet subnet, and the user type includes a DMZ authorized visitor. The user, the controlled authorized user, and the authorized intranet user, and the operation performed by the processor to determine whether the user access right corresponding to the user type meets the access right corresponding to the subnet type of the destination address includes the following operations. at least one:

If the subnet type of the destination address is a DMZ subnet, and the user type is DMZ authorized access Determining, by the guest user, that the user access right corresponding to the user type meets the access right corresponding to the subnet type of the destination address;

If the subnet type of the destination address is an intranet subnet, and the user type is a controlled authorization user, it is determined that the user access right corresponding to the user type does not meet the access permission corresponding to the subnet type of the destination address. The S1-U uplink packet is disassembled, and the source IP address and the source port number in the user IP packet are converted into a device IP address and a mapped port number, and the local network packet is re-encapsulated, and the local network packet is The network message is forwarded to the virtual private network VPN gateway;

If the subnet type of the destination address is an intranet subnet, and the user type is an authorized intranet user, it is determined that the user access right corresponding to the user type meets the access permission corresponding to the subnet type of the destination address.
A computer storage medium having stored therein one or more programs executable by a computer, the one or more programs being executed by the computer to cause the computer to perform as in claims 1-7 A method of accessing a local network by a user terminal according to any one of the preceding claims.