WO2024001120A1 - 网络隔离访问方法及通信网络系统、设备、存储介质 - Google Patents

网络隔离访问方法及通信网络系统、设备、存储介质 Download PDF

Info

Publication number
WO2024001120A1
WO2024001120A1 PCT/CN2022/142044 CN2022142044W WO2024001120A1 WO 2024001120 A1 WO2024001120 A1 WO 2024001120A1 CN 2022142044 W CN2022142044 W CN 2022142044W WO 2024001120 A1 WO2024001120 A1 WO 2024001120A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
network element
upf
interface
gateway
Prior art date
Application number
PCT/CN2022/142044
Other languages
English (en)
French (fr)
Inventor
李思含
贾聿庸
欧建南
尹君
陈洁
Original Assignee
中国电信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国电信股份有限公司 filed Critical 中国电信股份有限公司
Publication of WO2024001120A1 publication Critical patent/WO2024001120A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/088—Access security using filters or firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels

Definitions

  • the present disclosure relates to the field of communication technology, and specifically, to a network isolation access method, a communication network system, an electronic device, and a computer-readable storage medium.
  • 5G Fifth Generation Mobile Communication Technology
  • 5G Private Network is a Local Area Network (LAN) that uses 5G technology to create a private network with unified connectivity, optimized services, and secure communication methods within a specific area.
  • LAN Local Area Network
  • the purpose of the embodiments of the present disclosure is to provide a network isolation access method, a communication network system, an electronic device, and a computer-readable storage medium, thereby improving network security during intercommunication between a private network and a public network, at least to a certain extent.
  • a network isolation access method is provided, which method can be applied to a communication network system capable of simultaneously accessing a public network and a private network.
  • the communication network system at least includes a network corresponding to the public network.
  • the session management function network element SMF, the first user plane function network element UPF and the base station gNB, and the second user plane function network element UPF corresponding to the private network are deployed in the session management function network element SMF and the second user plane function a signaling interworking gateway between network elements UPF, and a user plane gateway deployed between the first user plane functional network element UPF and the second user plane functional network element UPF;
  • the method includes: the session The management function network element SMF obtains the first interface address from the second user plane function network element UPF through the signaling interworking gateway; the session management function network element SMF obtains the first interface address from the user plane gateway and the first user plane The functional network element UPF obtains the second interface address; the session management function network element SMF determines the third interface address and the fourth interface address from the first interface address and the second interface address; the session management function network The SMF forwards the third interface address to the second user plane function network element UPF through the signaling interworking gateway, and forwards the fourth interface address to the user plane gateway and the first user
  • a communication network system including a session management function network element SMF corresponding to a public network, a first user plane function network element UPF and a base station gNB, and a second user corresponding to a private network Plane function network element UPF, characterized in that the communication network system also includes: a signaling interoperability gateway, deployed between the session management function network element SMF and the second user plane function network element UPF, for the public Control plane isolation between the network and the private network; user plane gateway, deployed between the first user plane functional network element UPF and the second user plane functional network element UPF, for use between the public network and the private network User plane isolation between the private networks and support for session-level traffic filtering.
  • a signaling interoperability gateway deployed between the session management function network element SMF and the second user plane function network element UPF, for the public Control plane isolation between the network and the private network
  • user plane gateway deployed between the first user plane functional network element UPF and the second user plane functional network element UPF, for use between the public network and the private network User
  • an electronic device including: a processor; and a memory, computer-readable instructions are stored on the memory, and the computer-readable instructions are implemented when executed by the processor.
  • Network isolation access method in the first aspect is provided, including: a processor; and a memory, computer-readable instructions are stored on the memory, and the computer-readable instructions are implemented when executed by the processor.
  • a computer-readable storage medium on which a computer program is stored.
  • the computer program is executed by a processor, the network isolation access method in the first aspect is implemented.
  • Figure 1 schematically shows a schematic diagram of the composition of a communication network system according to some embodiments of the present disclosure
  • Figure 2 schematically shows a flow chart of a network isolation access method according to some embodiments of the present disclosure
  • Figure 3 schematically shows a flow chart of obtaining a first interface address from a second user plane functional network element according to some embodiments of the present disclosure
  • Figure 4 schematically illustrates a flow chart of the session management function network element allocating interface addresses according to some embodiments of the present disclosure
  • Figure 5 schematically illustrates a flow chart of implementing network isolation access by creating a user plane tunnel according to some embodiments of the present disclosure
  • Figure 6 schematically shows a structural diagram of a computer system of an electronic device according to some embodiments of the present disclosure
  • Figure 7 schematically illustrates a schematic diagram of a computer-readable storage medium according to some embodiments of the present disclosure.
  • Example embodiments will now be described more fully with reference to the accompanying drawings.
  • Example embodiments may, however, be embodied in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concepts of the example embodiments. To those skilled in the art.
  • edge UPF sinking can not only achieve low latency, but also ensure that enterprise business data does not leave the campus. and other requirements, and is deeply loved by corporate customers.
  • edge UPF sinking can not only achieve low latency, but also ensure that enterprise business data does not leave the campus. and other requirements, and is deeply loved by corporate customers.
  • enterprise users' handheld terminals there is a need to access large networks and enterprise private networks at the same time. Therefore, there is an increasingly urgent need for interoperability between enterprise-level private networks and operators' public networks. However, this also brings about network security and operator control. , national supervision and other issues.
  • C-IWF signaling interoperability gateway
  • the signaling interworking gateway only realizes network isolation on the control plane between networks.
  • the edge UPF still needs to communicate with the N9 interface of the UPF of the operator's public network through direct connection or firewall isolation.
  • the firewall does not support session-level traffic control and can only set relatively simple filtering rules.
  • Figure 1 schematically shows a schematic diagram of the composition of a communication network system according to some embodiments of the disclosure.
  • the communication network system may include the session management function network element SMF 110, the first user plane function network element UPF 120 and the base station gNB 130 corresponding to the public network, and the second user plane function network element UPF corresponding to the private network. 140.
  • the communication network system may also include:
  • the signaling interworking gateway 150 is deployed between the session management function network element SMF 110 and the second user plane function network element UPF 140, and is used for control plane isolation between the public network and the private network;
  • the user plane gateway 160 is deployed between the first user plane functional network element UPF 120 and the second user plane functional network element UPF 140. It is used for user plane isolation between the public network and the private network, and supports session-level traffic. filter.
  • the private network user first wirelessly communicates with the base station gNB 130 through a user terminal (User Equipment, UE), and then connects to the first user plane functional network element UPF 120 corresponding to the public network to access the public data network DN (Data Network) 170, when the private network user needs to access the private data network DN 180, the communication network system simultaneously inserts the second user plane functional network element UPF 140 and the user plane gateway 160 corresponding to the private network.
  • UE User Equipment
  • the session management function network element SMF 110 can issue 2 pairs of PDR (Packet Detection Rule) to the second user plane function network element UPF 140 through the signaling interworking gateway 150.
  • PDR Packet Detection Rule
  • 1 pair of PDR is used to indicate the forwarding rule of traffic accessing the private data network DN 180.
  • the forwarding rule can be that the uplink traffic is from the RAN (Radio Access Network, wireless access network) side to the second user plane functional network element UPF 140's N3 interface, and then from the N6 interface of the second user plane functional network element UPF 140 to the dedicated data network DN 180; the downstream traffic is the opposite, that is, from the dedicated data network DN 180 to the N6 interface of the second user plane functional network element UPF 140 , then from the N3 interface of the second user plane functional network element UPF 140 to the base station gNB 130 on the RAN side, and finally transmitted by the base station gNB 130 to the terminal UE of the private network user;
  • the forwarding rules may be that the uplink traffic flows from the RAN side to the N3 interface of the second user plane functional network element UPF 140, and then from the second user plane
  • the N9 interface of the functional network element UPF 140 goes to the N9 interface of the user plane gateway 160;
  • the downlink traffic is the opposite, that is, the downlink traffic goes from the N9 interface of the user plane gateway 160 to the N9 interface of the second user plane functional network element UPF 140, and then from the second
  • the N3 interface of the user plane functional network element UPF 140 is connected to the base station gNB 130 on the RAN side, and is finally transmitted by the base station gNB 130 to the terminal UE of the private network user.
  • the forwarding rules here are only illustrative examples and should not impose any special limitations on this embodiment.
  • the session management function network element SMF 110 can issue a pair of PDR to the user plane gateway 160.
  • the PDR is used to instruct the private network users to forward the traffic of the public data network DN 170.
  • the forwarding rule can be that the upstream traffic is forwarded by the second The N9 interface of the user plane functional network element UPF 140 goes to the N9 interface of the user plane gateway 160, and then from the N9 interface of the user plane gateway 160 to the N9 interface of the first user plane functional network element UPF 120; the downlink traffic is opposite, that is, the downlink traffic is The N9 interface of the first user plane functional network element UPF 120 goes to the N9 interface of the user plane gateway 160, and then from the N9 interface of the user plane gateway 160 to the N9 interface of the second user plane functional network element UPF 140; at the same time, in the user plane gateway 160 Set up corresponding security filtering mechanisms, such as session-level traffic filtering.
  • the forwarding rules here are only illustrative examples and should not impose any special limitations on this
  • the session management function network element SMF 110 can issue a pair of PDRs to the first user plane function network element UPF 120.
  • the PDR is used to instruct the private network users to forward the traffic of the public data network DN 170.
  • the forwarding rules can be The uplink traffic goes from the N9 interface of the user plane gateway 160 to the N9 interface of the first user plane functional network element UPF 120, and then from the N6 interface of the first user plane functional network element UPF 120 to the public data network DN 170; the downlink traffic is the opposite, that is, Downstream traffic can go from the public data network DN 170 to the N6 interface of the first user plane functional network element UPF 120, and then from the N9 interface of the first user plane functional network element UPF 120 to the N9 interface of the user plane gateway 160.
  • the forwarding rules here are only illustrative examples and should not impose any special limitations on this embodiment.
  • a network isolation access method is also provided, and the network isolation access method can be applied to the communication network system shown in Figure 1.
  • Figure 2 schematically shows a flow chart of a network isolation access method according to some embodiments of the present disclosure. Referring to Figure 2, the network isolation access method may include the following steps:
  • Step S210 The session management function network element SMF obtains the first interface address from the second user plane function network element UPF through the signaling interworking gateway;
  • Step S220 The session management function network element SMF obtains the second interface address from the user plane gateway and the first user plane function network element UPF;
  • Step S230 The session management function network element SMF determines a third interface address and a fourth interface address from the first interface address and the second interface address;
  • Step S240 The session management function network element SMF forwards the third interface address to the second user plane function network element UPF through the signaling interoperability gateway, and forwards the fourth interface address to the The user plane gateway and the first user plane functional network element UPF;
  • Step S250 Create a user plane tunnel between the second user plane functional network element UPF and the first user plane functional network element UPF based on the user plane gateway, the third interface address and the fourth interface address. , so that private network users can simultaneously access the public network and the private network through the user plane tunnel.
  • the signaling interworking gateway deployed between the session management function network element SMF and the second user plane function network element UPF the private network and the public network are realized.
  • Control plane isolation realizes the correct forwarding of signaling messages and improves the security and stability of inter-network access;
  • the first user plane functional network element UPF and the second user plane functional network element UPF are realized through the signaling interworking gateway Interface address allocation management between the first user plane functional network element UPF and the second user plane functional network element UPF constitutes a user plane tunnel through the user plane gateway deployed between the first user plane functional network element UPF and the second user plane functional network element UPF to avoid the first user plane functional network element UPF
  • the direct connection with the second user plane function network element UPF realizes the user plane isolation between the private network and the public network, further improving the security of inter-network access; on the other hand, all signaling between the private network and the public network
  • the processing process is completed by the signaling interworking gateway.
  • Step S210 The session management function network element SMF obtains the first interface address from the second user plane function network element UPF through the signaling interworking gateway.
  • the first interface address refers to the necessary interface address corresponding to the second user plane function network element UPF required for the session management function network element SMF to control the creation of a user plane tunnel, for example, the first interface address It may be the N3 interface address corresponding to the UPF of the second user plane functional network element, or the N6 interface address, N9 interface address corresponding to the UPF of the second user plane functional network element, etc. This example embodiment does not impose special limitations on this.
  • the session management function network element SMF can send interface address request information to the second user plane function network element through the signaling interworking gateway, and the second user plane function network element UPF can return the interface address to the session management function network element SMF through the signaling interworking gateway.
  • the signaling interoperability gateway can transfer the second user plane function network element UPF or session management function to the session management function network element SMF or the second user plane function network element UPF.
  • the network security information that may be included in the message sent by the functional network element SMF is hidden.
  • the network security information that may be included may be the node ID (Node ID) of the session management functional network element SMF or the second user plane functional network element UPF. It may also be the IP address corresponding to the session management function network element SMF, or the N4 interface address corresponding to the second user plane function network element UPF. This example embodiment is not limited to this.
  • Step S220 The session management function network element SMF obtains a second interface address from the user plane gateway and the first user plane function network element UPF.
  • the second interface address refers to the necessary interface address corresponding to the user plane gateway required for the session management function network element SMF to control the creation of the user plane tunnel and the first user plane function network element UPF, for example,
  • the second interface address may be the N9 interface address corresponding to the user plane gateway, or the N6 interface address, N9 interface address corresponding to the first user plane functional network element UPF, etc. This example embodiment is not limited to this.
  • Step S230 The session management function network element SMF determines a third interface address and a fourth interface address from the first interface address and the second interface address.
  • the third interface address refers to the interface address filtered by the session management function network element SMF and required by the second user plane function network element UPF when creating a user plane tunnel, for example, the third interface address It may include at least the N9 interface address of the user plane gateway and the N3 interface address of the base station gNB, and this embodiment is not limited thereto.
  • the fourth interface address refers to the interface address filtered by the session management function network element SMF and required by the user plane gateway and the first user plane function network element UPF when creating a user plane tunnel.
  • the fourth interface address may include at least the second user This embodiment is not limited to the N9 interface address corresponding to the UPF of the plane function network element, the N9 interface address corresponding to the UPF of the first user plane function network element, the N9 interface address corresponding to the user plane gateway, etc.
  • first”, “second”, “third” and “fourth interface address” in this example embodiment, “first”, “second”, “third” and “fourth” " is only used to distinguish different types of interface addresses and does not have any special meaning. It should not impose any special limitations on this example embodiment.
  • Step S240 The session management function network element SMF forwards the third interface address to the second user plane function network element UPF through the signaling interoperability gateway, and forwards the fourth interface address to the The user plane gateway and the first user plane functional network element UPF.
  • Step S250 Create a user plane tunnel between the second user plane functional network element UPF and the first user plane functional network element UPF based on the user plane gateway, the third interface address and the fourth interface address. , so that private network users can simultaneously access the public network and the private network through the user plane tunnel.
  • the User Plane Part of GTP (GTP-U) protocol is the user plane part of GTP. It is an IP/UDP-based tunnel protocol that allows tunneling in each GTP-U.
  • a unidirectional point-to-point tunnel is established between protocol entities.
  • a bidirectional tunnel can be composed of two unidirectional tunnels of UL (uplink) and DL (downlink).
  • step S210 take the application scenario in which private network users first access the public data network DN through the first user plane functional network element UPF of the public network, and then insert the second user plane functional network element UPF and the user plane gateway to access the private data network DN as an example.
  • the steps from step S210 to step S230 will be described in detail.
  • the session management function network element SMF can obtain the first interface address from the second user plane function network element UPF through the signaling interworking gateway through the steps in Figure 3.
  • Specifics may include:
  • Step S310 In the process of the private network user accessing the public network through the first user plane function network element UPF, the session management function network element SMF responds to detecting the private network user's access to the private network. Request, insert the second user plane function network element UPF and the user plane gateway, and create a PFCP session request;
  • Step S320 The session management function network element SMF sends the PFCP session request to the signaling interworking gateway;
  • Step S330 The signaling interoperability gateway hides the public network security information in the PFCP session request, and sends the hidden PFCP session request to the second user plane function network element UPF;
  • Step S340 The second user plane functional network element UPF responds to the hidden processed PFCP session request, generates PFCP response information including the first interface address, and forwards it to the signaling interworking gateway.
  • the first interface address includes the N3, N6, and N9 interface addresses corresponding to the second user plane functional network element UPF;
  • Step S350 The signaling interoperability gateway hides the dedicated network security information in the PFCP response information, and returns the hidden PFCP response information to the session management function network element SMF.
  • the session management function network element SMF detects an access request for the private network initiated by the private network user, at this time, the session management The functional network element SMF will create a PFCP (Packet Forwarding Control Protocol) session request.
  • PFCP Packet Forwarding Control Protocol
  • the PFCP session request in this embodiment can include the first PDR and the second PDR.
  • the PFCP session request can also include any number of pairs of PDRs.
  • the specific settings can be customized according to the actual application scenario. In this example embodiment Not limited to this.
  • the first PDR may be used to instruct the second user plane function network element UPF to use the first traffic forwarding rule when a private network user accesses the private network;
  • the first traffic forwarding rule may include: uplink traffic from the RAN side to the The N3 interface of the second user plane functional network element UPF, and from the N6 interface of the second user plane functional network element UPF to the dedicated network DN; the downlink traffic is the opposite, that is, the downlink traffic goes from the dedicated data network DN to the second user plane functional network element UPF The N6 interface, and then from the N3 interface of the second user plane functional network element UPF to the base station gNB on the RAN side, and finally transmitted by the base station gNB 130 to the terminal UE of the private network user.
  • the forwarding rules here are only illustrative examples and should not impose any special limitations on this embodiment.
  • the second PDR may be used to instruct the second user plane function network element UPF to use the second traffic forwarding rule when the private network user accesses the public network;
  • the second traffic forwarding rule may include: uplink traffic from the RAN side to the second traffic forwarding rule.
  • the N3 interface of the user plane functional network element UPF goes from the N9 interface of the second user plane functional network element UPF to the N9 interface of the user plane gateway; the downlink traffic is the opposite, that is, the downlink traffic goes from the N9 interface of the user plane gateway to the second user
  • the N9 interface of the second user plane functional network element UPF is then transmitted from the N3 interface of the second user plane functional network element UPF to the base station gNB on the RAN side, and finally the base station gNB transmits it to the terminal UE of the private network user.
  • the forwarding rules here are only illustrative examples and should not impose any special limitations on this embodiment.
  • the public network security information in the PFCP session request can be the node identifier in the PFCP session request, or the IP address corresponding to the session management function network element SMF. Of course, it can also be other types of information that may affect public network security. This example embodiment does not impose special limitations on this.
  • the private network security information in the PFCP response message can be the node identifier in the PFCP response message, or it can be the N4 interface address corresponding to the second user plane functional network element UPF. Of course, it can also be other types that may affect the security of the dedicated network. information, this example embodiment does not impose special limitations on this.
  • Hiding processing refers to processing through relevant methods so that the public network security information in the PFCP session request or the private network security information in the PFCP response information is not visible to the second user plane function network element UPF or the session management function network element SMF.
  • By replacing the dedicated network security information in the PFCP response information with blank information or useless information you can also encrypt the public network security information in the PFCP session request, or encrypt the dedicated network security information in the PFCP response information.
  • This embodiment There are no special restrictions on the hiding processing method.
  • SMF Before forwarding the PFCP session request created by the session management function network element SMF to the second user plane function network element UPF, or forwarding the PFCP response information fed back by the second user plane function network element UPF in response to the PFCP session request to the session management function network element.
  • SMF is forwarded through the signaling interoperability gateway, and during the forwarding process, the signaling interoperability gateway hides the relevant network security information to achieve control plane isolation between the private network and the public network, effectively improving the relationship between the private network and the public network. Network security across public networks.
  • the session management function network element SMF can directly obtain the second interface address from the user plane gateway and the first user plane function network element UPF.
  • the session management function network element SMF can create a PFCP service request and forward the PFCP service request directly to the user plane gateway and the first user plane functional network element UPF; the user plane gateway and the first user plane functional network element UPF receive responses
  • the received PFCP service request may return the second interface address, where the second interface address may include the N9 interface address corresponding to the user plane gateway and the N6 and N9 interface addresses corresponding to the first user plane functional network element UPF, etc.
  • the PFCP service request may include the third PDR and the fourth PDR; of course, the PFCP service request may also include any number of pairs of PDRs, and the settings may be customized according to actual application scenarios, and this example embodiment is not limited to this.
  • the third PDR can be used to instruct the user plane gateway to use the third traffic forwarding rule when the private network user accesses the public network;
  • the third traffic forwarding rule can include: the uplink traffic is forwarded by the second user plane functional network element UPF.
  • the N9 interface goes to the N9 interface of the user plane gateway, and from the N9 interface of the user plane gateway to the N9 interface of the first user plane functional network element UPF;
  • the downlink traffic is the opposite, that is, the downlink traffic goes from the N9 interface of the first user plane functional network element UPF to the N9 interface of the user plane gateway, and then from the N9 interface of the user plane gateway to the N9 interface of the second user plane functional network element UPF;
  • the forwarding rules here are only illustrative examples and should not cause any problems in this embodiment. Any special restrictions.
  • the session management function network element SMF can set the corresponding security filtering mechanism on the user plane gateway through the PFCP service request.
  • the security filtering rules can include session-level traffic filtering.
  • the user plane gateway can realize traffic isolation between the private network and the public network based on the user session level. Compared with the first user plane functional network element UPF and the second user plane functional network element UPF, they are directly connected through the N9 address, or Achieving network interoperability through firewall isolation can effectively improve the network security of private networks and public networks when private network users access private networks and public networks at the same time.
  • the fourth PDR may be used to instruct the first user plane function network element UPF to use the fourth traffic forwarding rule when a private network user accesses the public network;
  • the fourth traffic forwarding rule may include: the uplink traffic may be forwarded by the user plane gateway
  • the N9 interface of the first user plane functional network element UPF is connected to the N9 interface of the first user plane functional network element UPF, and the N6 interface of the first user plane functional network element UPF is connected to the public data network DN; the reverse is true for the downlink traffic, that is, the downlink traffic can be sent from the public data network DN to the public data network DN.
  • the session management function network element SMF can forward the third interface address and the fourth interface address through the steps in Figure 4.
  • the details may include:
  • Step S410 The session management function network element SMF creates a PFCP session modification request including the third interface address.
  • the third interface address includes the N9 interface address corresponding to the user plane gateway and the N3 corresponding to the base station gNB. interface address;
  • Step S420 The session management function network element SMF sends the PFCP session modification request to the signaling interoperability gateway, so that the signaling interworking gateway hides the public network security information in the PFCP session modification request. After processing, forward to the second user plane function network element UPF;
  • Step S430 The session management function network element SMF creates a PFCP session modification request including the fourth interface address.
  • the fourth interface address includes the N6 and N9 interfaces corresponding to the second user plane function network element UPF, so Describe the N6 and N9 interfaces corresponding to the first user plane functional network element UPF;
  • Step S440 The session management function network element SMF sends the PFCP session modification request to the user plane gateway and the first user plane function network element UPF.
  • the session management function network element SMF can filter the second user plane function network element UPF from the first interface address and the second interface address to create the user plane.
  • the PFCP session modification request containing the third interface address is forwarded to the second user plane function network element UPF.
  • the session management function network element SMF directly forwards the PFCP session modification request containing the fourth interface address to the user plane gateway and the first user plane.
  • Functional network element UPF is forwarded to the second user plane function network element UPF.
  • a user plane tunnel is created between the second user plane functional network element UPF and the first user plane functional network element UPF based on the user plane gateway, the third interface address and the fourth interface address, so that private network users can pass through the user plane tunnel. Simultaneous access to public and private networks, and user plane isolation between public and private networks through user plane gateways, session-level traffic filtering between public and private networks through user plane gateways, further improving public and private networks Network security.
  • Figure 5 schematically illustrates a flowchart of implementing network isolation access by creating a user plane tunnel according to some embodiments of the present disclosure.
  • step S510 the private network user normally accesses the public network through the first user plane functional network element UPF 120;
  • Step S520 the private network user initiates a private network access request, and the session management function network element SMF 110 responds to the private network access request and can initiate a PFCP session establishment request to the signaling interoperability gateway 150.
  • the PFCP session establishment request can include at least 2 pairs of PDRs. , a pair of PDRs can be used to indicate the forwarding rules for traffic accessing the private network, and the other pair of PDRs can be used to indicate the forwarding rules for traffic accessing the public network;
  • Step S530 the signaling interworking gateway 150 forwards the PFCP session establishment request to the second user plane function network element UPF 140, and at the same time identifies the node ID in the message and the IP address corresponding to the session management function network element SMF 110 and other public network security The information is hidden.
  • public network security information such as the node ID in the message and the IP address corresponding to the session management function network element SMF 110 can be replaced with blank information or useless information;
  • Step S540 the second user plane functional network element UPF 140 feeds back a PFCP response message to the signaling interoperability gateway 150, where the PFCP response message may include the N3, N6, and N9 interface addresses corresponding to the second user plane functional network element UPF 140;
  • Step S550 the signaling interworking gateway 150 forwards the PFCP response message to the session management function network element SMF 110, and at the same time identifies the node ID in the message and the N4 interface address corresponding to the second user plane function network element UPF 140 and other dedicated network security The information is hidden. It should be noted that the signaling interworking gateway 150 cannot replace the N3, N6, N9 and other interface address information corresponding to the second user plane functional network element UPF 140;
  • Step S560 the session management function network element SMF 110 continues to initiate a PFCP service request to the user plane gateway 160 and the first user plane function network element UPF 120 to issue forwarding rules for traffic accessing the public network through the PFCP service request, and obtain the user The N9 interface address corresponding to the plane gateway 160 and the N6 and N9 interface addresses corresponding to the first user plane functional network element UPF 120;
  • Step S570 the session management function network element SMF 110 issues a PFCP session modification request to the signaling interoperability gateway 150.
  • the PFCP session modification request may include the N9 interface address of the user plane gateway 160 and the N3 interface address of the base station gNB;
  • Step S580 the signaling interworking gateway 150 forwards the PFCP session modification request to the second user plane function network element UPF 140, and replaces the node identifier in the PFCP session modification request and the IP address corresponding to the session management function network element SMF 110 and other public networks.
  • Step S590 the session management function network element SMF 110 continues to issue a PFCP session modification request to the user plane gateway 160 and the first user plane function network element UPF 120.
  • the PFCP session modification request may include the user plane gateway 160 and the first user plane function.
  • the interface address required by the network element UPF 120 when creating a user plane tunnel can include the N6 and N9 interfaces corresponding to the second user plane functional network element UPF, and the N6 and N9 interfaces corresponding to the first user plane functional network element UPF;
  • the user plane tunnel is established. Private network users can access the private network and the public network at the same time through the user plane tunnel, while ensuring the security of the private network and the public network.
  • the session management function network element SMF obtains the first interface address from the second user plane function network element UPF through the signaling interworking gateway; the session management function network element SMF obtains the first interface address from the user plane gateway and the first user plane function network element UPF.
  • the session management function network element SMF determines the third interface address and the fourth interface address from the first interface address and the second interface address; the session management function network element SMF passes the third interface address through the signaling interworking gateway forward to the second user plane functional network element UPF, and forward the fourth interface address to the user plane gateway and the first user plane functional network element UPF; between the second user plane functional network element UPF and the first user plane functional network element UPF Create a user plane tunnel based on the user plane gateway, the third interface address, and the fourth interface address, so that private network users can access the public network and the private network simultaneously through the user plane tunnel.
  • the signaling interworking gateway deployed between the session management function network element SMF and the second user plane function network element UPF the control plane isolation between the private network and the public network is realized, and the correct forwarding of signaling messages is achieved. Improve the security and stability of access between networks; on the other hand, the interface address allocation management between the first user plane functional network element UPF and the second user plane functional network element UPF is implemented through the signaling interworking gateway, and is deployed on The user plane gateway between the first user plane functional network element UPF and the second user plane functional network element UPF forms a user plane tunnel to avoid direct connection between the first user plane functional network element UPF and the second user plane functional network element UPF.
  • an electronic device capable of implementing the above network isolation access method is also provided.
  • FIG. 6 An electronic device 600 according to such an embodiment of the present disclosure is described below with reference to FIG. 6 .
  • the electronic device 600 shown in FIG. 6 is only an example and should not bring any limitations to the functions and scope of use of the embodiments of the present disclosure.
  • the electronic device 601 may be used to implement the communications network systems and methods disclosed herein.
  • the electronic device 601 may be an element in a communication network infrastructure.
  • the electronic device 601 may be a base station (e.g., NodeB, enhanced NodeB (eNodeB)), next-generation base station (sometimes referred to as gNodeB). or gNB)), home subscriber server (HSS), gateway (GW) (e.g., packet gateway (PGW) or serving gateway (SGW)) or evolved packet core (evolved packet core (EPC) various other nodes or functions within the network.
  • a base station e.g., NodeB, enhanced NodeB (eNodeB)
  • next-generation base station sometimes referred to as gNodeB). or gNB
  • HSS home subscriber server
  • gateway e.g., packet gateway (PGW) or serving gateway (SGW)
  • EPC evolved packet core
  • the electronic device 601 may be a device connected to the network infrastructure through a wireless interface.
  • the electronic device 601 may be a mobile phone, a smartphone, or other devices that may be classified as user equipment (User Equipment, UE). equipment.
  • User Equipment User Equipment
  • the electronic device 601 may also be a Machine Type Communications (MTC) device (also known as a machine-to-machine (M2M) device) or other such device that may be classified as a UE.
  • MTC Machine Type Communications
  • M2M machine-to-machine
  • a device (although it does not provide direct services to users).
  • the electronic device 601 may also be a mobile device (MD), a term used to represent a device connected to a mobile network, regardless of whether the device itself is designed or capable of being moved.
  • MD mobile device
  • a particular device may use all of the components shown or only a subset of these components, and the degree of integration may vary between devices.
  • a device may include multiple instances of components, such as multiple processors, multiple memories, multiple transmitters, multiple receivers, etc.
  • Electronic device 601 may generally include a processor 602, such as a central processing unit (CPU), and may also include a dedicated processor (eg, graphics processing unit (GPU) or other such processor), Memory 603, network interface 604, and bus 605 for connecting various components in the electronic device 601.
  • Electronic device 601 may also optionally include components such as mass storage device 606, video adapter 607, and I/O interface 608 (shown as dashed lines).
  • Memory 603 may include any type of non-transitory system memory that can be read by processor 602, such as static random access memory (SRAM), dynamic random access memory (DRAM), Same as DRAM (synchronous DRAM, SDRAM), read-only memory (read-only memory, ROM) or a combination thereof.
  • memory 603 may include more than one type of memory, such as ROM used when booting and DRAM used when executing programs to store programs and data.
  • Bus 605 may be any type of one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, or a video bus.
  • the electronic device 601 may also include one or more network interfaces 604, which may include at least one of a wired network interface and a wireless network interface.
  • the network interface 604 may include a wired network interface connected to the network 609, or may include a wireless access network interface 610 connected to other devices through wireless links.
  • the radio access network interface 610 may be omitted for nodes or functions that serve as elements of the core network (CN) rather than elements located at the wireless edge (eg, eNB).
  • CN core network
  • eNB wireless edge
  • the wireless access network interface 610 may exist and may be supplemented by other wireless interfaces such as a Wi-Fi network interface.
  • Network interface 604 enables electronic device 601 to communicate with remote entities (eg, entities connected to network 609).
  • Mass storage 606 may include any type of non-transitory storage device for storing data, programs, and other information and making such data, programs, and other information accessible via bus 605 .
  • the mass storage 606 may include one or more of a solid state drive, a hard disk drive, a magnetic disk drive, and an optical disk drive.
  • mass storage 606 may be remote from electronic device 601 and accessible through a network interface such as interface 604.
  • bulk storage 606 is distinct from included memory 603 and may typically perform storage tasks that are not sensitive to high latency, but may generally provide less or no volatility.
  • mass storage 606 may be integrated with memory 603 to form heterogeneous memory.
  • Optional video adapter 607 and I/O interface 608 provide interfaces to couple electronic device 601 to external input and output devices.
  • input and output devices include a display 611 coupled to a video adapter 607 and one or more I/O devices 612 (eg, a touch screen) coupled to an I/O interface 608 .
  • I/O devices 612 eg, a touch screen
  • Other devices may be coupled to electronic device 601 and more or fewer interfaces may be used.
  • a serial interface such as a universal serial bus (USB) (not shown) may be used to provide an interface to external devices.
  • USB universal serial bus
  • electronic device 601 may be a stand-alone device, while in other embodiments, electronic device 601 may be located within a data center.
  • a data center can be understood as a collection of computing resources (usually in the form of servers) that can be used as collective computing and storage resources.
  • multiple servers can be connected together to provide a pool of computing resources on which virtualized entities can be instantiated.
  • Data centers can be interconnected to form a network that includes pools of computing and storage resources that are connected to each other through connection resources.
  • Connection resources can be physical connections such as Ethernet or optical communication links, and can also include wireless communication channels.
  • the links can be grouped together using any of a number of techniques including forming a link aggregation group (LAG).
  • LAG link aggregation group
  • any or all computing resources, storage resources, and connectivity resources may be partitioned between different subnets, in some cases in the form of resource slices. If you slice resources across multiple connected data centers or other collections of nodes, you can create different network slices.
  • the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to cause a computing device (which may be a personal computer, a server, a terminal device, a network device, etc.) to execute a method according to an embodiment of the present disclosure.
  • a computing device which may be a personal computer, a server, a terminal device, a network device, etc.
  • a computer-readable storage medium is also provided, on which a program product capable of implementing the method described above in this specification is stored.
  • various aspects of the present disclosure may also be implemented in the form of a program product, which includes program code.
  • the program product is run on a terminal device, the program code is used to cause the The terminal device performs the steps according to various exemplary embodiments of the present disclosure described in the above-mentioned "Exemplary Method" section of this specification.
  • a program product 700 for implementing the above network isolation access method according to an embodiment of the present disclosure is described. It can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be in Run on terminal devices such as personal computers.
  • CD-ROM compact disk read-only memory
  • the program product of the present disclosure is not limited thereto.
  • a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.
  • the program product may take the form of any combination of one or more readable media.
  • the readable medium may be a readable signal medium or a readable storage medium.
  • the readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: electrical connection with one or more conductors, portable disk, hard disk, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave carrying readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above.
  • a readable signal medium may also be any readable medium other than a readable storage medium that can send, propagate, or transport the program for use by or in connection with an instruction execution system, apparatus, or device.
  • Program code embodied on a readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.
  • Program code for performing operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., as well as conventional procedural Programming language—such as "C" or a similar programming language.
  • the program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server execute on.
  • the remote computing device may be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device, such as provided by an Internet service. (business comes via Internet connection).
  • LAN local area network
  • WAN wide area network
  • the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , including several instructions to cause a computing device (which may be a personal computer, a server, a touch terminal, a network device, etc.) to execute a method according to an embodiment of the present disclosure.
  • a computing device which may be a personal computer, a server, a touch terminal, a network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

提供了一种网络隔离访问方法及通信网络系统、设备、存储介质，涉及通信技术领域。网络隔离访问方法包括：SMF通过信令互通网关从第二UPF获取第一接口地址(S210)，然后从用户面网关和第一UPF获取第二接口地址(S220)，并从第一接口地址和第二接口地址中确定第三接口地址和第四接口地址(S230)，进而将第三接口地址通过信令互通网关转发给第二UPF，以及将第四接口地址转发给用户面网关和第一UPF(S240)；第二UPF和第一UPF之间基于用户面网关、第三接口地址和第四接口地址创建用户面隧道(S250)。本技术方案可以通过信令互通网关实现网络间的控制面隔离，通过用户面网关实现网络间的用户面隔离，提升同时访问专用网络和公用网络的安全性。

Description

网络隔离访问方法及通信网络系统、设备、存储介质
相关申请的交叉引用
本申请要求于2022年06月29日提交的申请号为202210763282.5、名称为“网络隔离访问方法及通信网络系统、设备、存储介质”的中国专利申请的优先权，该中国专利申请的全部内容通过引用结合在本申请中。
技术领域
本公开涉及通信技术领域，具体而言，涉及一种网络隔离访问方法、通信网络系统、电子设备以及计算机可读存储介质。
背景技术
随着互联网技术的飞速发展，第五代移动通信技术(5th Generation Mobile Communication Technology，下文简称5G)越来越被广泛应用。其中，5G专用网络(Private 5G Network)是一种局域网(Local Area Network，LAN)，通过使用5G技术创建具有统一连接性、优化服务和特定区域内安全通信方式的专用网络。
由于5G专网业务的迅速发展，专用网络与运营商的公用网络之间的互通需求日益迫切，目前，相关技术方案中，网络间没有有效的隔离访问措施，导致互通时网络安全性较差。
需要说明的是，在上述背景技术部分公开的信息仅用于加强对本公开的背景的理解，因此可以包括不构成对本领域普通技术人员已知的现有技术的信息。
发明内容
本公开实施例的目的在于提供一种网络隔离访问方法、通信网络系统、电子设备以及计算机可读存储介质，进而至少在一定程度上提升专用网络与公用网络之间互通时的网络安全性。
根据本公开实施例的第一方面，提供了一种网络隔离访问方法，该方法可以应用于能够同时访问公用网络和专用网络的通信网络系统，所述通信网络系统至少包含所述公用网络对应的会话管理功能网元SMF、第一用户面功能网元UPF和基站gNB，所述专用网络对应的第二用户面功能网元UPF，部署在所述会话管理功能网元SMF和第二用户面功能网元UPF之间的信令互通网关，以及部署在所述第一用户面功能网元UPF和所述第二用户面功能网元UPF之间的用户面网关；所述方法包括：所述会话管理功能网元SMF通过所述信令互通网关从所述第二用户面功能网元UPF获取第一接口地址；所述会话管理功能网元SMF从所述用户面网关和所述第一用户面功能网元UPF获取第二接口地址；所述会话管理功能网元SMF从所述第一接口地址和所述第二接口地址中确定第三接口地址和 第四接口地址；所述会话管理功能网元SMF将所述第三接口地址通过所述信令互通网关转发给所述第二用户面功能网元UPF，以及将所述第四接口地址转发给所述用户面网关和所述第一用户面功能网元UPF；所述第二用户面功能网元UPF和所述第一用户面功能网元UPF之间基于所述用户面网关、所述第三接口地址和所述第四接口地址创建用户面隧道，以使专网用户通过所述用户面隧道同时访问所述公用网络和所述专用网络。
根据本公开实施例的第二方面，提供了一种通信网络系统，包括公用网络对应的会话管理功能网元SMF、第一用户面功能网元UPF和基站gNB，以及专用网络对应的第二用户面功能网元UPF，其特征在于，所述通信网络系统还包括：信令互通网关，部署在所述会话管理功能网元SMF和第二用户面功能网元UPF之间，用于所述公用网络与所述专用网络之间的控制面隔离；用户面网关，部署在所述第一用户面功能网元UPF和所述第二用户面功能网元UPF之间，用于所述公用网络与所述专用网络之间的用户面隔离，并且支持基于会话级别的流量过滤。
根据本公开实施例的第三方面，提供了一种电子设备，包括：处理器；以及存储器，所述存储器上存储有计算机可读指令，所述计算机可读指令被所述处理器执行时实现第一方面中的网络隔离访问方法。
根据本公开实施例的第四方面，提供一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现第一方面中的网络隔离访问方法。
应当理解的是，以上的一般描述和后文的细节描述仅是示例性和解释性的，并不能限制本公开。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理。显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。在附图中：
图1示意性示出了根据本公开的一些实施例的通信网络系统的构成示意图；
图2示意性示出了根据本公开的一些实施例的网络隔离访问方法的流程示意图；
图3示意性示出了根据本公开的一些实施例的从第二用户面功能网元获取第一接口地址的流程示意图；
图4示意性示出了根据本公开的一些实施例的会话管理功能网元分配接口地址的流程示意图；
图5示意性示出了根据本公开的一些实施例的通过创建用户面隧道实现网络隔离访问的流程示意图；
图6示意性示出了根据本公开的一些实施例的电子设备的计算机系统的结构示意图；
图7示意性示出了根据本公开的一些实施例的计算机可读存储介质的示意图。
在附图中，相同或对应的标号表示相同或对应的部分。
具体实施方式
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式实施，且不应被理解为限于在此阐述的范例；相反，提供这些实施方式使得本公开将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。
此外，所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多实施例中。在下面的描述中，提供许多具体细节从而给出对本公开的实施例的充分理解。然而，本领域技术人员将意识到，可以实践本公开的技术方案而没有特定细节中的一个或更多，或者可以采用其它的方法、组元、装置、步骤等。在其它情况下，不详细示出或描述公知方法、装置、实现或者操作以避免模糊本公开的各方面。
此外，附图仅为示意性图解，并非一定是按比例绘制。附图中所示的方框图仅仅是功能实体，不一定必须与物理上独立的实体相对应。即，可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
随着5G定制专用网络的日益成熟，越来越多的企业园区可能部署专网网元，边缘UPF下沉作为其中成本最低的方式不仅可以实现低时延，还可以满足企业业务数据不出园区等要求，深受企业客户喜爱。对于企业用户的手持终端，存在同时访问大网与企业专网的需求，因此，企业级的专用网络与运营商的公用网络的互通需求日益迫切，但这也带来了网络安全、运营商管控、国家监管等问题。
为了解决这些问题，在相关技术方案中，提出了信令互通网关(C-IWF)的概念，在专用网络与公用网络之间部署信令互通网关，专用网络与公用网络之间的信令消息都需要经过信令互通网关进行转发，以此实现网络隔离、拓扑隐藏、网络安全等功能，既保障了大网和专网的安全性，又简化了网络对接的复杂度。
但是，这种技术方案中，信令互通网关仅实现了网络间在控制面上的网络隔离，在一些场景中，例如在边缘UPF下沉的场景下，如果客户需要使用UL CL(Uplink Classifier，上行分类器)特性，边缘UPF仍然需要和运营商的公用网络的UPF的N9接口采用直连或防火墙隔离的方式互通，防火墙不支持会话级的流量控制，只能设定较为简单的过滤规则，网络间互通时，存在网络安全性问题。
基于相关技术中的一个或者多个问题，本公开首先提供了一种通信网络系统，图1示意性示出了根据本公开的一些实施例的通信网络系统的构成示意图。
参考图1所示，通信网络系统可以包括公用网络对应的会话管理功能网元SMF 110、第一用户面功能网元UPF 120和基站gNB 130，以及专用网络对应的第二用户面功能网元UPF 140。
进一步的，通信网络系统还可以包括：
信令互通网关150，部署在会话管理功能网元SMF 110和第二用户面功能网元UPF 140之间，用于公用网络与专用网络之间的控制面隔离；
用户面网关160，部署在第一用户面功能网元UPF 120和第二用户面功能网元UPF 140之间，用于公用网络与专用网络之间的用户面隔离，并且支持基于会话级别的流量过滤。
在一示例性应用场景中，假设专网用户首先通过用户终端(User Equipment，UE)与基站gNB 130无线通信，进而连接到公用网络对应的第一用户面功能网元UPF 120访问公用数据网络DN(Data Network)170，当该专网用户需要访问专用数据网络DN 180时，通信网络系统同时插入专用网络对应的第二用户面功能网元UPF 140与用户面网关160，具体的转发规则如下：
会话管理功能网元SMF 110可以通过信令互通网关150向第二用户面功能网元UPF 140下发2对PDR(Packet Detection Rule，包检测规则)。
其中，1对PDR用于指示访问专用数据网络DN 180的流量的转发规则，例如，转发规则可以是上行流量由RAN(Radio Access Network，无线接入网)侧到第二用户面功能网元UPF 140的N3接口，再由第二用户面功能网元UPF 140的N6接口到专用数据网络DN 180；下行流量相反，即由专用数据网络DN 180到第二用户面功能网元UPF 140的N6接口，再由第二用户面功能网元UPF 140的N3接口到RAN侧的基站gNB 130，最后由基站gNB 130传输到专网用户的终端UE；
另1对PDR用于指示访问公用数据网络DN 170的流量的转发规则，例如，转发规则可以是上行流量由RAN侧到第二用户面功能网元UPF 140的N3接口，再由第二用户面功能网元UPF 140的N9接口到用户面网关160的N9接口；下行流量相反，即下行流量由用户面网关160的N9接口到第二用户面功能网元UPF 140的N9接口，然后由第二用户面功能网元UPF 140的N3接口到RAN侧的基站gNB 130，最后由基站gNB 130传输到专网用户的终端UE。当然，此处的转发规则仅是示意性举例说明，并不应对本实施例造成任何特殊限定。
会话管理功能网元SMF 110可以向用户面网关160下发1对PDR，该PDR用于指示专网用户访问公用数据网络DN 170的流量的转发规则，例如，转发规则可以是上行流量由第二用户面功能网元UPF 140的N9接口到用户面网关160的N9接口，再由用户面网关160的N9接口到第一用户面功能网元UPF 120的N9接口；下行流量相反，即下行流量由第一用户面功能网元UPF 120的N9接口到用户面网关160的N9接口，然后由用户面网关160的N9接口到第二用户面功能网元UPF 140的N9接口；同时在用户面网关160设置相应的安全过滤机制，如针对会话级别的流量过滤。当然，此处的转发规则仅是示意性举例说明，并不应对本实施例造成任何特殊限定。
会话管理功能网元SMF 110可以向第一用户面功能网元UPF 120下发1对PDR，该PDR用于指示专网用户访问公用数据网络DN 170的流量的转发规则，例如，转发规则可 以是上行流量由用户面网关160的N9接口到第一用户面功能网元UPF 120的N9接口，再由第一用户面功能网元UPF 120的N6接口到公用数据网络DN 170；下行流量相反，即下行流量可以由公用数据网络DN 170到第一用户面功能网元UPF 120的N6接口，然后由第一用户面功能网元UPF 120的N9接口到用户面网关160的N9接口。当然，此处的转发规则仅是示意性举例说明，并不应对本实施例造成任何特殊限定。
在本示例实施例中，还提供了一种网络隔离访问方法，该网络隔离访问方法可以应用于图1所示的通信网络系统。图2示意性示出了根据本公开的一些实施例的网络隔离访问方法的流程示意图。参考图2所示，该网络隔离访问方法可以包括以下步骤：
步骤S210，所述会话管理功能网元SMF通过所述信令互通网关从所述第二用户面功能网元UPF获取第一接口地址；
步骤S220，所述会话管理功能网元SMF从所述用户面网关和所述第一用户面功能网元UPF获取第二接口地址；
步骤S230，所述会话管理功能网元SMF从所述第一接口地址和所述第二接口地址中确定第三接口地址和第四接口地址；
步骤S240，所述会话管理功能网元SMF将所述第三接口地址通过所述信令互通网关转发给所述第二用户面功能网元UPF，以及将所述第四接口地址转发给所述用户面网关和所述第一用户面功能网元UPF；
步骤S250，所述第二用户面功能网元UPF和所述第一用户面功能网元UPF之间基于所述用户面网关、所述第三接口地址和所述第四接口地址创建用户面隧道，以使专网用户通过所述用户面隧道同时访问所述公用网络和所述专用网络。
根据本示例实施例中的网络隔离访问方法，一方面，通过部署在会话管理功能网元SMF与第二用户面功能网元UPF之间的信令互通网关，实现专用网络与公用网络之间的控制面隔离，实现信令消息的正确转发，提升网络间访问的安全性和稳定性；另一方面，通过信令互通网关实现第一用户面功能网元UPF与第二用户面功能网元UPF之间的接口地址分配管理，并通过部署在第一用户面功能网元UPF与第二用户面功能网元UPF之间的用户面网关，构成用户面隧道，避免第一用户面功能网元UPF与第二用户面功能网元UPF的直连，实现专用网络与公用网络之间的用户面隔离，进一步提升网络间访问的安全性；再一方面，专用网络和公用网络之间所有的信令处理过程均由信令互通网关完成，专用网络和公用网络的网元均只需支持标准接口协议，无需定制开发，有效降低硬件成本。
下面，将对本示例实施例中的网络隔离访问方法进行进一步的说明。
步骤S210，所述会话管理功能网元SMF通过所述信令互通网关从所述第二用户面功能网元UPF获取第一接口地址。
在本公开的一个示例实施例中，第一接口地址是指会话管理功能网元SMF控制创建用户面隧道所需求的第二用户面功能网元UPF对应的必要接口地址，例如，第一接口地址可以是第二用户面功能网元UPF对应的N3接口地址，也可以是第二用户面功能网元 UPF对应的N6接口地址、N9接口地址等，本示例实施例对此不做特殊限定。
会话管理功能网元SMF可以通过信令互通网关向第二用户面功能网元发送接口地址请求信息，第二用户面功能网元UPF可以通过信令互通网关向会话管理功能网元SMF返回接口地址响应信息，在这两个过程中，信令互通网关可以在向会话管理功能网元SMF或者第二用户面功能网元UPF传递消息的过程中，将第二用户面功能网元UPF或者会话管理功能网元SMF发送的消息中可能包含的网络安全信息进行隐藏，例如，可能包含的网络安全信息可以是会话管理功能网元SMF或者第二用户面功能网元UPF的节点标识(Node ID)，也可以是会话管理功能网元SMF对应的IP地址，或者第二用户面功能网元UPF对应的N4接口地址，本示例实施例不以此为限。
步骤S220，所述会话管理功能网元SMF从所述用户面网关和所述第一用户面功能网元UPF获取第二接口地址。
在本公开的一个示例实施例中，第二接口地址是指会话管理功能网元SMF控制创建用户面隧道所需求的用户面网关和第一用户面功能网元UPF对应的必要接口地址，例如，第二接口地址可以是用户面网关对应的N9接口地址，也可以是第一用户面功能网元UPF对应的N6接口地址、N9接口地址等，本示例实施例不以此为限。
步骤S230，所述会话管理功能网元SMF从所述第一接口地址和所述第二接口地址中确定第三接口地址和第四接口地址。
在本公开的一个示例实施例中，第三接口地址是指会话管理功能网元SMF筛选的、创建用户面隧道时第二用户面功能网元UPF所需的接口地址，例如，第三接口地址可以至少包括用户面网关的N9接口地址和基站gNB的N3接口地址，本实施例不以此为限。
第四接口地址是指会话管理功能网元SMF筛选的、创建用户面隧道时用户面网关和第一用户面功能网元UPF所需的接口地址，例如，第四接口地址可以至少包括第二用户面功能网元UPF对应的N9接口地址、第一用户面功能网元UPF对应的N9接口地址、用户面网关对应的N9接口地址等，本实施例不以此为限。
需要说明的是，本示例实施例“第一接口地址”“第二接口地址”“第三接口地址”“第四接口地址”中的“第一”“第二”“第三”“第四”仅用于区分不同类型的接口地址，没有任何特殊含义，并不应对本示例实施例造成任何特殊限定。
步骤S240，所述会话管理功能网元SMF将所述第三接口地址通过所述信令互通网关转发给所述第二用户面功能网元UPF，以及将所述第四接口地址转发给所述用户面网关和所述第一用户面功能网元UPF。
步骤S250，所述第二用户面功能网元UPF和所述第一用户面功能网元UPF之间基于所述用户面网关、所述第三接口地址和所述第四接口地址创建用户面隧道，以使专网用户通过所述用户面隧道同时访问所述公用网络和所述专用网络。
在本公开的一个示例实施例中，用户面隧道(User Plane Part of GTP，GTP-U)协议，是GTP的用户面部分，是一个的基于IP/UDP的隧道协议，允许在各个GTP-U协议实体 (Protocol Entity)之间建立单向的点对点隧道，例如，可以由UL(上行链路)和DL(下行链路)的两条单向隧道组成的一个双向隧道。
下面，以专网用户首先通过公用网络的第一用户面功能网元UPF访问公用数据网络DN，然后插入第二用户面功能网元UPF以及用户面网关访问专用数据网络DN的应用场景为例，对步骤S210至步骤S230中的步骤进行详细说明。
在本公开的一个示例实施例中，可以通过图3中的步骤实现会话管理功能网元SMF通过信令互通网关从第二用户面功能网元UPF获取第一接口地址，参考图3所示，具体可以包括：
步骤S310，在所述专网用户通过所述第一用户面功能网元UPF访问公用网络的过程中，所述会话管理功能网元SMF响应检测到所述专网用户针对所述专用网络的访问请求，插入所述第二用户面功能网元UPF以及所述用户面网关，并创建PFCP会话请求；
步骤S320，所述会话管理功能网元SMF将所述PFCP会话请求发送给所述信令互通网关；
步骤S330，所述信令互通网关将所述PFCP会话请求中的公用网络安全信息进行隐藏处理，并将隐藏处理后的PFCP会话请求发送给所述第二用户面功能网元UPF；
步骤S340，所述第二用户面功能网元UPF响应所述隐藏处理后的PFCP会话请求，生成包含所述第一接口地址的PFCP响应信息，并转发给所述所述信令互通网关，所述第一接口地址包括所述第二用户面功能网元UPF对应的N3、N6、N9接口地址；
步骤S350，所述信令互通网关将所述PFCP响应信息中的专用网络安全信息进行隐藏处理，并将隐藏处理后的PFCP响应信息返回给所述会话管理功能网元SMF。
其中，在专网用户通过第一用户面功能网元UPF访问公用网络数据DN的过程中，若会话管理功能网元SMF检测到专网用户发起的针对专用网络的访问请求，此时，会话管理功能网元SMF会创建PFCP(Packet Forwarding Control Protocol，包转发控制协议)会话请求。
具体的，本实施例中的PFCP会话请求可以包括第一PDR和第二PDR，当然，PFCP会话请求也可以包含任意数量对的PDR，具体可以根据实际应用场景进行自定义设置，本示例实施例不以此为限。
示例性的，第一PDR可以用于指示第二用户面功能网元UPF在专网用户访问专用网络时的第一流量转发规则；该第一流量转发规则可以包括：上行流量由RAN侧到第二用户面功能网元UPF的N3接口，并由第二用户面功能网元UPF的N6接口到专用网络DN；下行流量相反，即下行流量由专用数据网络DN到第二用户面功能网元UPF的N6接口，再由第二用户面功能网元UPF的N3接口到RAN侧的基站gNB，最后由基站gNB 130传输到专网用户的终端UE。当然，此处的转发规则仅是示意性举例说明，并不应对本实施例造成任何特殊限定。
示例性的，第二PDR可以用于指示第二用户面功能网元UPF在专网用户访问公用网 络时的第二流量转发规则；第二流量转发规则可以包括：上行流量由RAN侧到第二用户面功能网元UPF的N3接口，并由第二用户面功能网元UPF的N9接口到用户面网关的N9接口；下行流量相反，即下行流量由由用户面网关的N9接口到第二用户面功能网元UPF的N9接口，然后由第二用户面功能网元UPF的N3接口到RAN侧的基站gNB，最后由基站gNB传输到专网用户的终端UE。当然，此处的转发规则仅是示意性举例说明，并不应对本实施例造成任何特殊限定。
PFCP会话请求中的公用网络安全信息可以是PFCP会话请求中的节点标识，也可以是会话管理功能网元SMF对应的IP地址，当然，还可以是其他类型的、可能影响公用网络安全的信息，本示例实施例对此不做特殊限定。
PFCP响应信息中的专用网络安全信息可以是PFCP响应信息中的节点标识，也可以是第二用户面功能网元UPF对应的N4接口地址，当然，还可以是其他类型的、可能影响专用网络安全的信息，本示例实施例对此不做特殊限定。
隐藏处理是指通过相关方式处理、以使PFCP会话请求中的公用网络安全信息或者PFCP响应信息中的专用网络安全信息对于第二用户面功能网元UPF或者会话管理功能网元SMF不可见的处理方式，例如，可以直接删除PFCP会话请求中的公用网络安全信息，或者直接删除PFCP响应信息中的专用网络安全信息，也可以通过空白信息或者无用信息替换PFCP会话请求中的公用网络安全信息，或者通过空白信息或者无用信息替换PFCP响应信息中的专用网络安全信息，还可以对PFCP会话请求中的公用网络安全信息进行加密，或者对PFCP响应信息中的专用网络安全信息进行加密，本实施例对隐藏处理的方式不做任何特殊限定。
在将会话管理功能网元SMF创建的PFCP会话请求转发给第二用户面功能网元UPF，或者将第二用户面功能网元UPF响应PFCP会话请求反馈的PFCP响应信息转发给会话管理功能网元SMF时，均通过信令互通网关进行转发，并且信令互通网关在转发过程中，将相关的网络安全信息进行隐藏处理，实现专用网络与公用网络之间的控制面隔离，有效提升专用网络与公用网络间的网络安全性。
在本公开的一个示例实施例中，会话管理功能网元SMF可以直接从用户面网关和第一用户面功能网元UPF获取第二接口地址。
具体的，会话管理功能网元SMF可以创建PFCP业务请求，并将PFCP业务请求直接转发到用户面网关和第一用户面功能网元UPF；用户面网关和第一用户面功能网元UPF响应接收到的PFCP业务请求，可以返回第二接口地址，其中，第二接口地址可以包括用户面网关对应的N9接口地址以及第一用户面功能网元UPF对应的的N6、N9接口地址等。
其中，PFCP业务请求可以包括第三PDR和第四PDR；当然，PFCP业务请求也可以包含任意数量对的PDR，具体可以根据实际应用场景进行自定义设置，本示例实施例不以此为限。
示例性的，第三PDR可以用于指示用户面网关在专网用户访问公用网络时的第三流 量转发规则；该第三流量转发规则可以包括：上行流量由第二用户面功能网元UPF的N9接口到用户面网关的N9接口，并由用户面网关的N9接口到第一用户面功能网元UPF的N9接口；下行流量相反，即下行流量由第一用户面功能网元UPF的N9接口到用户面网关的N9接口，然后由用户面网关的N9接口到第二用户面功能网元UPF的N9接口；当然，此处的转发规则仅是示意性举例说明，并不应对本实施例造成任何特殊限定。
可选的，会话管理功能网元SMF可以通过PFCP业务请求在用户面网关设置相应的安全过滤机制，安全过滤规则可以包括基于会话级别的流量过滤。通过用户面网关能够实现专用网络和公用网络之间基于用户会话级别的流量隔离，相比于第一用户面功能网元UPF和第二用户面功能网元UPF之间通过N9地址直连，或者通过防火墙隔离的方式实现网络互通，能够有效提升专网用户同时访问专用网络和公用网络时，专用网络和公用网络的网络安全性。
示例性的，第四PDR可以用于指示第一用户面功能网元UPF在专网用户访问公用网络时的第四流量转发规则；该第四流量转发规则可以包括：上行流量可以由用户面网关的N9接口到第一用户面功能网元UPF的N9接口，并由第一用户面功能网元UPF的N6接口到公用数据网络DN；下行流量相反，即下行流量可以由公用数据网络DN到第一用户面功能网元UPF的N6接口，然后由第一用户面功能网元UPF的N9接口到用户面网关的N9接口。当然，此处的转发规则仅是示意性举例说明，并不应对本实施例造成任何特殊限定。
在本公开的一个示例实施例中，可以通过图4中的步骤实现会话管理功能网元SMF转发第三接口地址和第四接口地址，参考图4所示，具体可以包括：
步骤S410，所述会话管理功能网元SMF创建包含所述第三接口地址的PFCP会话修改请求，所述第三接口地址包括所述用户面网关对应的N9接口地址以及所述基站gNB对应的N3接口地址；
步骤S420，所述会话管理功能网元SMF将所述PFCP会话修改请求发送给所述信令互通网关，以使所述信令互通网关将所述PFCP会话修改请求中的公用网络安全信息进行隐藏处理后，转发给所述第二用户面功能网元UPF；
步骤S430，所述会话管理功能网元SMF创建包含所述第四接口地址的PFCP会话修改请求，所述第四接口地址包括所述第二用户面功能网元UPF对应的N6、N9接口，所述第一用户面功能网元UPF对应的N6、N9接口；
步骤S440，所述会话管理功能网元SMF将所述PFCP会话修改请求发送给所述用户面网关和所述第一用户面功能网元UPF。
其中，会话管理功能网元SMF在接收到返回的第一接口地址和第二接口地址之后，可以从第一接口地址和第二接口地址中筛选第二用户面功能网元UPF用于创建用户面隧道时所需的第三接口地址，以及筛选用户面网关和第一用户面功能网元UPF用于创建用户面隧道时所需的第四接口地址，会话管理功能网元SMF通过信令互通网关将包含第三 接口地址的PFCP会话修改请求转发给第二用户面功能网元UPF，会话管理功能网元SMF直接将包含第四接口地址的PFCP会话修改请求转发给用户面网关和第一用户面功能网元UPF。
进一步的，第二用户面功能网元UPF和第一用户面功能网元UPF之间基于用户面网关、第三接口地址和第四接口地址创建用户面隧道，以使专网用户通过用户面隧道同时访问公用网络和专用网络，并通过用户面网关公用网络和专用网络之间的用户面隔离，通过用户面网关实现公用网络和专用网络之间基于会话级别的流量过滤，进一步提升公用网络和专用网络的网络安全性。
图5示意性示出了根据本公开的一些实施例的通过创建用户面隧道实现网络隔离访问的流程示意图。
参考图5所示，步骤S510，专网用户通过第一用户面功能网元UPF 120正常访问公用网络；
步骤S520，专网用户发起专用网络访问请求，会话管理功能网元SMF 110响应专用网络访问请求，可以向信令互通网关150发起PFCP会话建立请求，该PFCP会话建立请求中至少可以包括2对PDR，一对PDR可以用于指示访问专用网络的流量的转发规则，另一对PDR可以用于指示访问公用网络的流量的转发规则；
步骤S530，信令互通网关150将PFCP会话建立请求转发给第二用户面功能网元UPF 140，同时对消息中的节点标识Node ID以及会话管理功能网元SMF 110对应的IP地址等公用网络安全信息进行隐藏处理，例如，可以通过空白信息或者无用信息对消息中的节点标识Node ID以及会话管理功能网元SMF 110对应的IP地址等公用网络安全信息进行替换；
步骤S540，第二用户面功能网元UPF 140反馈PFCP响应消息给信令互通网关150，其中PFCP响应消息中可以包含第二用户面功能网元UPF 140对应的的N3、N6、N9接口地址；
步骤S550，信令互通网关150将PFCP响应消息转发给会话管理功能网元SMF 110，同时对消息中的节点标识Node ID以及第二用户面功能网元UPF 140对应的N4接口地址等专用网络安全信息进行隐藏处理，需要说明的是，信令互通网关150不能替换第二用户面功能网元UPF 140对应的N3、N6、N9等接口地址信息；
步骤S560，会话管理功能网元SMF 110继续向用户面网关160和第一用户面功能网元UPF 120发起PFCP业务请求，以通过PFCP业务请求下发访问公用网络的流量的转发规则，并获取用户面网关160对应的N9接口地址以及第一用户面功能网元UPF 120对应的N6、N9接口地址；
步骤S570，会话管理功能网元SMF 110向信令互通网关150下发PFCP会话修改请求，PFCP会话修改请求可以包含用户面网关160的N9接口地址以及基站gNB的N3接口地址；
步骤S580，信令互通网关150将PFCP会话修改请求转发给第二用户面功能网元UPF 140，并替换PFCP会话修改请求中的节点标识以及会话管理功能网元SMF 110对应的IP地址等公用网络安全信息，但应保持用户面网关160的N9接口地址以及基站gNB的N3接口地址不变；
步骤S590，会话管理功能网元SMF 110继续向用户面网关160和第一用户面功能网元UPF 120下发PFCP会话修改请求，该PFCP会话修改请求可以包含用户面网关160和第一用户面功能网元UPF 120在创建用户面隧道时所需的接口地址，例如，可以包含第二用户面功能网元UPF对应的N6、N9接口，第一用户面功能网元UPF对应的N6、N9接口；用户面隧道建立完成，专网用户通过该用户面隧道可以同时访问专用网络和公用网络，同时保证专用网络和公用网络的安全性。
综上所述，会话管理功能网元SMF通过信令互通网关从第二用户面功能网元UPF获取第一接口地址；会话管理功能网元SMF从用户面网关和第一用户面功能网元UPF获取第二接口地址；会话管理功能网元SMF从第一接口地址和第二接口地址中确定第三接口地址和第四接口地址；会话管理功能网元SMF将第三接口地址通过信令互通网关转发给第二用户面功能网元UPF，以及将第四接口地址转发给用户面网关和第一用户面功能网元UPF；第二用户面功能网元UPF和第一用户面功能网元UPF之间基于用户面网关、第三接口地址和第四接口地址创建用户面隧道，以使专网用户通过用户面隧道同时访问公用网络和专用网络。一方面，通过部署在会话管理功能网元SMF与第二用户面功能网元UPF之间的信令互通网关，实现专用网络与公用网络之间的控制面隔离，实现信令消息的正确转发，提升网络间访问的安全性和稳定性；另一方面，通过信令互通网关实现第一用户面功能网元UPF与第二用户面功能网元UPF之间的接口地址分配管理，并通过部署在第一用户面功能网元UPF与第二用户面功能网元UPF之间的用户面网关，构成用户面隧道，避免第一用户面功能网元UPF与第二用户面功能网元UPF的直连，实现专用网络与公用网络之间的用户面隔离，进一步提升网络间访问的安全性；再一方面，专用网络和公用网络之间所有的信令处理过程均由信令互通网关完成，专用网络和公用网络的网元均只需支持标准接口协议，无需定制开发，有效降低硬件成本。
需要说明的是，尽管在附图中以特定顺序描述了本公开中方法的各个步骤，但是，这并非要求或者暗示必须按照该特定顺序来执行这些步骤，或是必须执行全部所示的步骤才能实现期望的结果。附加的或备选的，可以省略某些步骤，将多个步骤合并为一个步骤执行，以及/或者将一个步骤分解为多个步骤执行等。
此外，在本公开的示例性实施例中，还提供了一种能够实现上述网络隔离访问方法的电子设备。
所属技术领域的技术人员能够理解，本公开的各个方面可以实现为系统、方法或程序产品。因此，本公开的各个方面可以具体实现为以下形式，即：完全的硬件实施例、完全的软件实施例(包括固件、微代码等)，或硬件和软件方面结合的实施例，这里可以统称 为“电路”、“模块”或“系统”。
下面参照图6来描述根据本公开的这种实施例的电子设备600。图6所示的电子设备600仅仅是一个示例，不应对本公开实施例的功能和使用范围带来任何限制。
如图6所示，图6是在计算和通信环境内示出的电子设备601的组成框图，电子设备601可以用于实现本文公开的通信网络系统和方法。在一些实施例中，电子设备601可以是通信网络基础设施中的元件，例如，电子设备601可以是基站(例如，NodeB、增强型基站(enhanced NodeB，eNodeB)、下一代基站(有时称为gNodeB或gNB))、归属用户服务器(home subscriber server，HSS)、网关(gateway，GW)(例如，分组网关(packet gateway，PGW)或服务网关(serving gateway，SGW))或演进型分组核心(evolved packet core，EPC)网络内的各种其它节点或功能。
在其它实施例中，电子设备601可以是通过无线接口连接到网络基础设施的设备，例如，电子设备601可以是手机、智能机或其它可以归类为用户设备(User Equipment，UE)的这种设备。
在一些实施例中，电子设备601还可以是机器类通信(Machine Type Communications，MTC)设备(也称为机器到机器(machine-to-machine，M2M)设备)或其它可以归类为UE的这种设备(虽然不向用户提供直接服务)。
在一些实施例中，电子设备601也可以为移动设备(mobile device，MD)，即用于表示连接到移动网络的设备的术语，不管设备本身是否设计成或能够移动。特定设备可以使用所示出的所有组件或仅使用这些组件的子集，且设备之间的集成程度可能不同。此外，一种设备可以包括组件的多个实例，例如，多个处理器、多个存储器、多个发射器、多个接收器等。
电子设备601通常可以包括处理器602，例如中央处理单元(Central Processing Unit，CPU)，并且还可以包括专用处理器(例如，图形处理单元(Graphics Processing Unit，GPU)或其它这种处理器)、存储器603、网络接口604和用于连接电子设备601中各个组件的总线605。电子设备601还可以可选地包括大容量存储设备606、视频适配器607和I/O接口608(如虚线所示)等组件。
存储器603可以包括任何类型的可由处理器602读取的非瞬时性系统存储器，例如，静态随机存取存储器(static random access memory，SRAM)、动态随机存取存储器(dynamic random access memory，DRAM)、同DRAM(synchronous DRAM，SDRAM)、只读存储器(read-only memory，ROM)或其组合。在具体实施例中，存储器603可以包括一种以上类型的存储器，例如，在开机时使用的ROM以及在执行程序时使用的存储程序和数据的DRAM。总线605可以是任何类型的几种总线架构中的一个或多个，包括内存总线或内存控制器、外围总线或视频总线。
电子设备601还可以包括一个或多个网络接口604，一个或多个网络接口604可以包括有线网络接口和无线网络接口中的至少一种。如图6所示，网络接口604可以包括连接 到网络609的有线网络接口，也可以包括通过无线链路连接到其它设备的无线接入网接口610。当电子设备601是网络基础设施时，对于用作核心网(core network，CN)的元件而不是位于无线边缘的元件(例如eNB)的节点或功能，可以省略无线接入网接口610。当电子设备601是位于网络的无线边缘的基础设施时，有线网络接口和无线网络接口都可以包括在内。当电子设备601是无线连接的设备(例如用户设备UE)时，无线接入网络接口610可以存在，并且可以由Wi-Fi网络接口等其它无线接口作为补充。网络接口604使得电子设备601可以与远程实体(例如连接到网络609的实体)进行通信。
大容量存储器606可以包括任何类型的非瞬时性存储设备，用于存储数据、程序和其它信息并使这些数据、程序和其它信息可通过总线605访问。例如，大容量存储器606可以包括固态硬盘、硬盘驱动器、磁盘驱动器、光盘驱动器中的一种或多种。在一些实施例中，大容量存储器606可以在电子设备601远端，并可通过接口604等网络接口访问。在所示的实施例中，大容量存储器606不同于包括在内的存储器603，并且通常可以执行对高延迟不敏感的存储任务，但一般可以提供较小或不提供易失性。在一些实施例中，大容量存储器606可以与存储器603集成以形成异构存储器。
可选的视频适配器607和I/O接口608(如虚线所示)提供接口以将电子设备601耦合到外部输入和输出设备。输入和输出设备的示例包括与视频适配器607耦合的显示器611和与I/O接口608耦合的一个或多个I/O设备612(例如触摸屏)。其它设备可以与电子设备601耦合，并且可以使用更多或更少的接口。例如，通用串行总线(universal serial bus，USB)(未示出)等串行接口可以用于为外部设备提供接口。本领域技术人员将理解，在电子设备601是数据中心的一部分的实施例中，I/O接口608和视频适配器607可以虚拟化并通过网络接口604提供。
在一些实施例中，电子设备601可以是独立式设备，而在其它实施例中，电子设备601可以位于数据中心内。在本领域中，数据中心可以理解为可以用作集体计算和存储资源的计算资源(通常以服务器的形式)的集合。在数据中心内，多个服务器可以连接在一起提供计算资源池，虚拟化实体可以在该计算资源池上实例化。数据中心之间可以互联，形成包括计算和存储资源池的网络，这些资源池通过连接资源相互连接。连接资源可以是以太网或光通信链路等物理连接，并且还可以包括无线通信信道。如果两个不同的数据中心通过多个不同的通信信道连接，则可以使用包括形成链路聚合组(link aggregation group，LAG)的多种技术中的任一种技术将链路组合在一起。应当理解，可以将任何或所有计算资源、存储资源和连接资源(以及网络内的其它资源)划分在不同的子网之间，在一些情况下，以资源片的形式划分。如果对跨多个连接的数据中心或其它节点集合的资源进行切片，则可以创建不同的网络切片。
通过以上的实施例的描述，本领域的技术人员易于理解，这里描述的示例实施例可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本公开实施例的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介 质(可以是CD-ROM，U盘，移动硬盘等)中或网络上，包括若干指令以使得一台计算设备(可以是个人计算机、服务器、终端装置、或者网络设备等)执行根据本公开实施例的方法。
在本公开的示例性实施例中，还提供了一种计算机可读存储介质，其上存储有能够实现本说明书上述方法的程序产品。在一些可能的实施例中，本公开的各个方面还可以实现为一种程序产品的形式，其包括程序代码，当所述程序产品在终端设备上运行时，所述程序代码用于使所述终端设备执行本说明书上述“示例性方法”部分中描述的根据本公开各种示例性实施例的步骤。
参考图7所示，描述了根据本公开的实施例的用于实现上述网络隔离访问方法的程序产品700，其可以采用便携式紧凑盘只读存储器(CD-ROM)并包括程序代码，并可以在终端设备，例如个人电脑上运行。然而，本公开的程序产品不限于此，在本文件中，可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。
所述程序产品可以采用一个或多个可读介质的任意组合。可读介质可以是可读信号介质或者可读存储介质。可读存储介质例如可以为但不限于电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。可读存储介质的更具体的例子(非穷举的列表)包括：具有一个或多个导线的电连接、便携式盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。
计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了可读程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。可读信号介质还可以是可读存储介质以外的任何可读介质，该可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。
可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于无线、有线、光缆、RF等等，或者上述的任意合适的组合。
可以以一种或多种程序设计语言的任意组合来编写用于执行本公开操作的程序代码，所述程序设计语言包括面向对象的程序设计语言—诸如Java、C++等，还包括常规的过程式程序设计语言—诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算设备上执行、部分地在用户设备上执行、作为一个独立的软件包执行、部分在用户计算设备上部分在远程计算设备上执行、或者完全在远程计算设备或服务器上执行。在涉及远程计算设备的情形中，远程计算设备可以通过任意种类的网络，包括局域网(LAN)或广域网(WAN)，连接到用户计算设备，或者，可以连接到外部计算设备(例如利用因特网服务提供商来通过因特网连接)。
此外，上述附图仅是根据本公开示例性实施例的方法所包括的处理的示意性说明，而 不是限制目的。易于理解，上述附图所示的处理并不表明或限制这些处理的时间顺序。另外，也易于理解，这些处理可以是例如在多个模块中同步或异步执行的。
通过以上的实施例的描述，本领域的技术人员易于理解，这里描述的示例实施例可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本公开实施例的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质(可以是CD-ROM，U盘，移动硬盘等)中或网络上，包括若干指令以使得一台计算设备(可以是个人计算机、服务器、触控终端、或者网络设备等)执行根据本公开实施例的方法。
本领域技术人员在考虑说明书及实践这里公开的发明后，将容易想到本公开的其它实施例。本申请旨在涵盖本公开的任何变型、用途或者适应性变化，这些变型、用途或者适应性变化遵循本公开的一般性原理并包括本公开未公开的本技术领域中的公知常识或惯用技术手段。说明书和实施例仅被视为示例性的，本公开的真正范围和精神由权利要求指出。
应当理解的是，本公开并不局限于上面已经描述并在附图中示出的精确结构，并且可以在不脱离其范围进行各种修改和改变。本公开的范围仅由所附的权利要求来限制。

Claims (10)

  1. 一种网络隔离访问方法，应用于能够同时访问公用网络和专用网络的通信网络系统，所述通信网络系统至少包含所述公用网络对应的会话管理功能网元SMF、第一用户面功能网元UPF和基站gNB，所述专用网络对应的第二用户面功能网元UPF，部署在所述会话管理功能网元SMF和第二用户面功能网元UPF之间的信令互通网关，以及部署在所述第一用户面功能网元UPF和所述第二用户面功能网元UPF之间的用户面网关；
    所述方法包括：
    所述会话管理功能网元SMF通过所述信令互通网关从所述第二用户面功能网元UPF获取第一接口地址；
    所述会话管理功能网元SMF从所述用户面网关和所述第一用户面功能网元UPF获取第二接口地址；
    所述会话管理功能网元SMF从所述第一接口地址和所述第二接口地址中确定第三接口地址和第四接口地址；
    所述会话管理功能网元SMF将所述第三接口地址通过所述信令互通网关转发给所述第二用户面功能网元UPF，以及将所述第四接口地址转发给所述用户面网关和所述第一用户面功能网元UPF；
    所述第二用户面功能网元UPF和所述第一用户面功能网元UPF之间基于所述用户面网关、所述第三接口地址和所述第四接口地址创建用户面隧道，以使专网用户通过所述用户面隧道同时访问所述公用网络和所述专用网络。
  2. 根据权利要求1所述的网络隔离访问方法，其特征在于，所述会话管理功能网元SMF通过所述信令互通网关从所述第二用户面功能网元UPF获取第一接口地址，包括：
    在所述专网用户通过所述第一用户面功能网元UPF访问公用网络的过程中，所述会话管理功能网元SMF响应检测到所述专网用户针对所述专用网络的访问请求，插入所述第二用户面功能网元UPF以及所述用户面网关，并创建PFCP会话请求；
    所述会话管理功能网元SMF将所述PFCP会话请求发送给所述信令互通网关；
    所述信令互通网关将所述PFCP会话请求中的公用网络安全信息进行隐藏处理，并将隐藏处理后的PFCP会话请求发送给所述第二用户面功能网元UPF；
    所述第二用户面功能网元UPF响应所述隐藏处理后的PFCP会话请求，生成包含所述第一接口地址的PFCP响应信息，并转发给所述所述信令互通网关，所述第一接口地址包括所述第二用户面功能网元UPF对应的N3、N6、N9接口地址；
    所述信令互通网关将所述PFCP响应信息中的专用网络安全信息进行隐藏处理，并将隐藏处理后的PFCP响应信息返回给所述会话管理功能网元SMF。
  3. 根据权利要求2所述的网络隔离访问方法，其特征在于，所述PFCP会话请求包括第一PDR和第二PDR；
    其中，所述第一PDR用于指示所述第二用户面功能网元UPF在所述专网用户访问所述专用网络时的第一流量转发规则；
    所述第一流量转发规则包括上行流量由RAN侧到所述第二用户面功能网元UPF的N3接口，并由所述第二用户面功能网元UPF的N6接口到专用网络DN，下行流量相反；
    所述第二PDR用于指示所述第二用户面功能网元UPF在所述专网用户访问所述公用网络时的第二流量转发规则；
    所述第二流量转发规则包括上行流量由RAN侧到所述第二用户面功能网元UPF的N3接口，并由所述第二用户面功能网元UPF的N9接口到所述用户面网关的N9接口，下行流量相反。
  4. 根据权利要求1所述的网络隔离访问方法，其特征在于，所述会话管理功能网元SMF从所述用户面网关和所述第一用户面功能网元UPF获取第二接口地址，包括：
    所述会话管理功能网元SMF创建PFCP业务请求，并将所述PFCP业务请求发送到所述用户面网关和所述第一用户面功能网元UPF；
    所述用户面网关和所述第一用户面功能网元UPF响应所述PFCP业务请求，返回所述第二接口地址，所述第二接口地址包括所述用户面网关对应的N9接口地址以及所述第一用户面功能网元UPF对应的的N6、N9接口地址。
  5. 根据权利要求4所述的网络隔离访问方法，其特征在于，所述PFCP业务请求包括第三PDR和第四PDR；
    所述第三PDR用于指示所述用户面网关在所述专网用户访问所述公用网络时的第三流量转发规则；
    所述第三流量转发规则包括上行流量由第二用户面功能网元UPF的N9接口到所述用户面网关的N9接口，并由所述用户面网关的N9接口到所述第一用户面功能网元UPF的N9接口，下行流量相反；
    所述第四PDR用于指示所述第一用户面功能网元UPF在所述专网用户访问所述公用网络时的第四流量转发规则；
    所述第四流量转发规则包括上行流量由所述用户面网关的N9接口到所述第一用户面功能网元UPF的N9接口，并由所述第一用户面功能网元UPF的N6接口到公用网络DN，下行流量相反。
  6. 根据权利要求4所述的网络隔离访问方法，其特征在于，所述方法还包括：
    所述会话管理功能网元SMF通过所述PFCP业务请求设置所述用户面网关对应的安全过滤规则，所述安全过滤规则包括基于会话级别的流量过滤。
  7. 根据权利要求1所述的网络隔离访问方法，其特征在于，所述会话管理功能网元SMF将所述第三接口地址通过所述信令互通网关转发给所述第二用户面功能网元UPF，以及将所述第四接口地址转发给所述用户面网关和所述第一用户面功能网元UPF，包括：
    所述会话管理功能网元SMF创建包含所述第三接口地址的PFCP会话修改请求，所 述第三接口地址包括所述用户面网关对应的N9接口地址以及所述基站gNB对应的N3接口地址；
    所述会话管理功能网元SMF将所述PFCP会话修改请求发送给所述信令互通网关，以使所述信令互通网关将所述PFCP会话修改请求中的公用网络安全信息进行隐藏处理后，转发给所述第二用户面功能网元UPF；
    所述会话管理功能网元SMF创建包含所述第四接口地址的PFCP会话修改请求，所述第四接口地址包括所述第二用户面功能网元UPF对应的N6、N9接口，所述第一用户面功能网元UPF对应的N6、N9接口；
    所述会话管理功能网元SMF将所述PFCP会话修改请求发送给所述用户面网关和所述第一用户面功能网元UPF。
  8. 一种通信网络系统，包括公用网络对应的会话管理功能网元SMF、第一用户面功能网元UPF和基站gNB，以及专用网络对应的第二用户面功能网元UPF，其特征在于，所述通信网络系统还包括：
    信令互通网关，部署在所述会话管理功能网元SMF和第二用户面功能网元UPF之间，用于所述公用网络与所述专用网络之间的控制面隔离；
    用户面网关，部署在所述第一用户面功能网元UPF和所述第二用户面功能网元UPF之间，用于所述公用网络与所述专用网络之间的用户面隔离，并且支持基于会话级别的流量过滤。
  9. 一种电子设备，包括：
    处理器；以及
    存储器，所述存储器上存储有计算机可读指令，所述计算机可读指令被所述处理器执行时实现如权利要求1至7中任一项所述的网络隔离访问方法。
  10. 一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现如权利要求1至7中任一项所述的网络隔离访问方法。
PCT/CN2022/142044 2022-06-29 2022-12-26 网络隔离访问方法及通信网络系统、设备、存储介质 WO2024001120A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210763282.5A CN117320011A (zh) 2022-06-29 2022-06-29 网络隔离访问方法及通信网络系统、设备、存储介质
CN202210763282.5 2022-06-29

Publications (1)

Publication Number Publication Date
WO2024001120A1 true WO2024001120A1 (zh) 2024-01-04

Family

ID=89296035

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/142044 WO2024001120A1 (zh) 2022-06-29 2022-12-26 网络隔离访问方法及通信网络系统、设备、存储介质

Country Status (2)

Country Link
CN (1) CN117320011A (zh)
WO (1) WO2024001120A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020222537A1 (ko) * 2019-04-30 2020-11-05 주식회사 케이티 1차 단말을 통하여 전용망에 접속하는 2차 단말의 전용망 접속을 제어하는 서버 및 그 1차 단말
US20200351989A1 (en) * 2019-05-01 2020-11-05 T-Mobile Usa, Inc. Proxy based network access
CN113133131A (zh) * 2019-12-31 2021-07-16 华为技术有限公司 一种通信方法及装置
CN114007194A (zh) * 2021-11-03 2022-02-01 中国电信股份有限公司 订阅消息发送方法、装置、电子设备及存储介质
CN114726829A (zh) * 2022-04-02 2022-07-08 中国电信股份有限公司 通信方法、用户面网关及通信系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020222537A1 (ko) * 2019-04-30 2020-11-05 주식회사 케이티 1차 단말을 통하여 전용망에 접속하는 2차 단말의 전용망 접속을 제어하는 서버 및 그 1차 단말
US20200351989A1 (en) * 2019-05-01 2020-11-05 T-Mobile Usa, Inc. Proxy based network access
CN113133131A (zh) * 2019-12-31 2021-07-16 华为技术有限公司 一种通信方法及装置
CN114007194A (zh) * 2021-11-03 2022-02-01 中国电信股份有限公司 订阅消息发送方法、装置、电子设备及存储介质
CN114726829A (zh) * 2022-04-02 2022-07-08 中国电信股份有限公司 通信方法、用户面网关及通信系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
NOKIA, NOKIA SHANGHAI BELL: "5G LAN group communication with UPF autonomous traffic forwarding", SA WG2 MEETING #132, S2-1903312, 2 April 2019 (2019-04-02), XP051719475 *

Also Published As

Publication number Publication date
CN117320011A (zh) 2023-12-29

Similar Documents

Publication Publication Date Title
US11612013B2 (en) Data transmission method, device, and system
CN104205667B (zh) 用于触发多个无线设备的技术和配置
EP3832577A1 (en) Advertising, discovering, and using services through virtual access point interfaces
JP5891559B2 (ja) インスタントメッセージングの方法、端末、サーバ及びシステム
CN109996345B (zh) 会话建立方法、设备及系统
US10034173B2 (en) MTC service management using NFV
WO2018090491A1 (zh) 一种指示方法及相关设备
WO2018201761A1 (zh) 一种系统信息传输方法及相关设备
WO2019120073A1 (zh) 数据传输方法、设备及系统
WO2020233249A1 (zh) 一种报文传输方法以及相关装置
EP4221005A1 (en) Multipath transmission method and communication apparatus
JP7086853B2 (ja) ネットワークアクセス方法、その関連機器およびシステム
EP3799514A1 (en) RATE CONTROL METHOD, DEVICE AND SYSTEM

EP3528465B1 (en) Service discovery method, and service discovery device
WO2019010808A1 (zh) 传输控制方法及装置
WO2020078248A1 (zh) 无线通信方法及设备
WO2019201127A1 (zh) 数据传输方法及装置
WO2024001120A1 (zh) 网络隔离访问方法及通信网络系统、设备、存储介质
CN107006046B (zh) 一种数据传输方法及相关设备、系统
WO2018107368A1 (zh) 数据传输的连接建立方法及装置
WO2019233381A1 (zh) 用户面数据处理方法及装置
WO2018210020A1 (zh) 数据传输方法、系统及传输装置
JP2022543342A (ja) サイドリンクの実装方法及び関連製品
WO2024061145A1 (zh) 网关信息的使用方法、装置、终端及网络侧设备
WO2024021833A1 (zh) 一种热点设备的管理方法、通信装置及通信系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22949196

Country of ref document: EP

Kind code of ref document: A1