CN116033377A - Method, system and medium for 5G SA network Internet of things terminal access and access restriction - Google Patents

Abstract

The invention relates to the technical field of the Internet of Things, and discloses a method, a system and a medium for accessing and restricting access to terminals of the Internet of Things in a 5GSA network. The method includes: if the network manager receives an attachment request from an Internet of Things terminal, controlling the user terminal to send an access network message; the network manager receives the access network message, and the radio access network determines the access management module; and obtains the user subscription network slice; Judging whether the access management module can handle user-subscribed network slices; if not, the network slice selection module obtains the allowed slices and the target access management module; the network slice selection module sends the allowed slices to the target access management module; target access management The module obtains the user's subscription strategy; sends the user's subscription strategy to the IoT terminal, and the IoT terminal accesses the target access management module. The present invention controls users to only access the intranet within a certain controllable small park range, and prohibits access to services outside this range, thereby ensuring higher reliability and security.

Description

Method, system and medium for 5G SA network IoT terminal access and access restriction

technical field

The present invention relates to the technical field of the Internet of Things, and in particular to a method, system and medium for accessing and restricting access to a 5G SA network Internet of Things terminal.

Background technique

In the 5G customized network scenario, due to the consideration of low latency and high reliability, many users will choose to reuse the network element equipment built by operators on the access plane and control plane, such as AMF and SMF, and choose lightweight equipment for the data transmission plane. The UPF sinks to the park where it is located, and uses a specific DNN to access internal affairs.

Among the existing 5G Internet of Things terminal access restriction technologies, it is more common to judge whether the AMF ID or MME host name reported by the user is in the list that the user is allowed to access, so as to realize regional restrictions at the provincial level. In the scheme where the policy control module controls user access based on tracking area codes, the coverage of tracking area codes is relatively large, making it difficult to accurately control the campus area, and the wireless side needs to re-plan and adjust the tracking area codes. For operators, it is difficult to adjust the planned tracking area codes. If the policy control module performs user session policy control based on the base station or cell level, frequently reporting location updates when users move will bring a lot of signaling interaction, causing congestion on the signaling plane and affecting service usage.

Therefore, how to control the access of IoT terminals in a simple and real-time manner, so that users can only access the intranet within a small controllable campus area, and prohibit access to services outside this area, so as to ensure higher reliability. Safety and security need to be addressed urgently.

Contents of the invention

The technical problem to be solved by the present invention is to control users to only access the intranet within a small controllable park area, and prohibit access to services outside this area, thereby ensuring higher reliability and security.

In the first aspect, an embodiment of the present invention provides a method for accessing and restricting access to a 5G SA network IoT terminal, the method is applied to an SA network IoT system, and the system includes an IoT terminal, a network manager, and a user terminal , the network manager respectively establishes a network connection with the IoT terminal and the user terminal to realize the transmission of data information, and the network manager is provided with a radio access network, an access management module, a network slice selection module and A policy control module, the method comprising:

If the network manager receives an attachment request from the IoT terminal, controlling the user terminal to send a network access message;

The network manager receives the access network message, and the radio access network determines an access management module corresponding to the access network message;

The determined access management module obtains the user subscription network slice corresponding to the access network message from a preset slice database;

judging whether the determined access management module can process the user-subscribed network slice;

If the determined access management module cannot process the user-subscribed network slice, the network slice selection module acquires an allowed slice and a target access management module corresponding to the user-subscribed network slice;

The network slice selection module resends the allowed slice to the target access management module;

The target access management module acquires a pre-stored user subscription policy corresponding to the permitted slice from the policy control module;

Sending the user subscription policy to the IoT terminal, so that the IoT terminal accesses the target access management module.

Preferably, the radio access network determines the access management module corresponding to the access network message, including:

Analyzing the access network message to obtain corresponding GUAMI information;

Judging whether a matching access management module can be obtained according to the GUAMI information;

If a matching access management module can be obtained according to the GUAMI information, the obtained matching one of the access management modules is a determined access management module;

If the matching access management module cannot be obtained according to the GUAMI information, the corresponding access management module is determined according to the request slice in the access network message.

Preferably, before determining the corresponding access management module according to the request slice in the access network message, the method further includes:

judging whether the access network message includes a request slice;

If the access network message includes a request slice, perform the step of determining a corresponding access management module according to the request slice in the access network message;

If the access network message does not include the request slice, then send the registration request to the default access management module.

Preferably, the target access management module acquires a pre-stored user subscription policy from the policy control module, including:

The policy control module performs switching subscription between tracking areas for a single user based on a preset tracking area code, so as to obtain the user subscription policy.

Preferably, the network manager is also provided with a session management module, the policy control module performs session policy control on users based on preset tracking area codes; the policy control module performs switching subscription between tracking areas for a single user , to obtain the user subscription policy, including:

If receiving a signal from the user terminal to switch the tracking area, actively report the location to update the access network message;

The radio access network re-determines the access management module corresponding to the updated access network message;

The newly corresponding access management module reports the updated access network information to the policy control module through a preset interface;

The policy control module performs session policy control on the tracking area code carried in the session management module.

Preferably, the policy control module performs policy control on the tracking area code carried in the session management module, including:

If the tracking area is coded in the allowed list of the session management module, issue a dynamic policy to ensure that the first policy is output; the first policy is a higher quality of service policy;

If the tracking area code is not in the allowed list of the session management module, issue a blocking command to ensure that the second policy is output, and then block all traffic of the user, so that the traffic of the user does not go out of the park; the second policy is the corresponding Business rules have the highest global priority.

Preferably, the determined access management module obtains the user subscription network slice corresponding to the access network message from a preset slice database, further comprising:

If the target access management module obtains the user subscription policy, judge whether the request slice, the user subscription network slice, and the allowed slice can be combined to form an intersection slice;

If an intersection slice can be formed, allow the user terminal to access;

If the intersection slice cannot be formed, deny the access of the user terminal.

In the second aspect, an embodiment of the present invention provides a system for accessing and restricting access to IoT terminals in a 5G SA network. The system includes IoT terminals, a network manager, and a user terminal, and the network manager communicates with the The Internet of Things terminal and the user terminal establish a network connection to realize the transmission of data information;

The system includes an attachment request unit configured in the Internet of Things terminal, a first sending unit configured in the user terminal, a receiving unit, a first obtaining unit, a judging unit, and a second receiving unit configured in the network manager. Two acquiring unit, second sending unit, third acquiring unit and third sending unit;

an attach request unit, configured for the network manager to receive an attach request from the IoT terminal;

A first sending unit, configured to control the user terminal to send an access network message if the network manager receives an attachment request from the IoT terminal;

a receiving unit, configured for the network manager to receive the access network message, and the radio access network determines an access management module corresponding to the access network message;

The first obtaining unit is used for the determined access management module to obtain the user subscription network slice corresponding to the access network message from a preset slice database;

A judging unit, configured to judge whether the determined access management module can process the user subscription network slice;

The second obtaining unit is configured to: if the determined access management module cannot process the user subscription network slice, the network slice selection module obtains the allowed slice and target access corresponding to the user subscription network slice into the management module;

a second sending unit, configured for the network slice selection module to resend the allowed slice to the target access management module;

A third obtaining unit, configured for the target access management module to obtain a pre-stored user subscription policy corresponding to the permitted slice from the policy control module;

A third sending unit, configured to send the user subscription policy to the IoT terminal, so that the IoT terminal accesses the target access management module.

In a third aspect, the embodiment of the present invention provides a system for accessing and restricting access to IoT terminals on a 5G SA network, the system includes an IoT terminal, a network manager, and a user terminal, and the IoT terminal includes a first memory, A first processor and a first computer program stored on the first memory and operable on the first processor, the network manager includes a second memory, a second processor, and a computer program stored on the first memory A second computer program on the second memory and operable on the second processor, the user terminal includes a third memory, a third processor, and a second computer program stored on the third memory and executable on the third processor A third computer program running on a computer, wherein the first processor executes the first computer program, the second processor executes the second computer program, and the third processor executes the The third computer program jointly implements the method for accessing and restricting access to 5G SA network IoT terminals as described in the first aspect above.

In a fourth aspect, an embodiment of the present invention also provides a computer-readable storage medium, the computer-readable storage medium stores a first computer program, a second computer program, and a third computer program, when the first computer program When executed by the first processor, the second computer program is executed by the second processor, and the third computer program is executed by the third processor, the 5G SA network Internet of Things terminal interface as described in the first aspect above is jointly implemented. methods of entry and access restrictions.

Compared with the prior art, the present invention includes at least one of the following beneficial technical effects:

If the network manager receives the attachment request from the IoT terminal, it controls the user terminal to send an access network message; the network manager receives the access network message, and the radio access network determines the connection with The access management module corresponding to the access network message; the determined access management module obtains the user subscription network slice corresponding to the access network message from a preset slice database; whether the access management module can process the user subscription network slice; if the determined access management module cannot process the user subscription network slice, the network slice selection module obtains the Allowed slices and target access management modules corresponding to the slices; the network slice selection module resends the allowed slices to the target access management module; the target access management module obtains the pre-stored A user subscription policy corresponding to the allowed slice; sending the user subscription policy to the IoT terminal, so that the IoT terminal accesses the target access management module.

The policy control module performs tracking interval switch subscription for a single user. When the user terminal switches the tracking interval, it actively reports a location update message, and the policy control module performs policy control on the tracking area code carried in the session message of the session management module: When the tracking area code is in the allowed list, dynamic control policies, such as service quality assurance, etc. are issued; when the tracking area code is not in the allowed list, all user traffic is blocked, so that user traffic does not leave the campus.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present invention. Ordinary technicians can also obtain other drawings based on these drawings on the premise of not paying creative work.

FIG. 1 is a schematic flow diagram of a method for accessing and restricting access to a 5G SA network IoT terminal provided by an embodiment of the present invention.

FIG. 2 is a schematic diagram of a scenario of a method for accessing and restricting access to a 5G SA network IoT terminal provided by an embodiment of the present invention.

Fig. 3 is another schematic flowchart of a method for accessing and restricting access of a 5G SA network IoT terminal provided by an embodiment of the present invention.

Fig. 4 is a schematic sub-flow diagram of a method for accessing and restricting access of a 5G SA network IoT terminal provided by an embodiment of the present invention.

FIG. 5 is a schematic diagram of another sub-flow of the method for accessing and restricting access of IoT terminals in a 5G SA network provided by an embodiment of the present invention.

Fig. 6 is a schematic diagram of another sub-flow of the method for accessing and restricting access of a 5G SA network IoT terminal provided by an embodiment of the present invention.

Fig. 7 is a schematic diagram of another sub-flow of the method for accessing and restricting access of IoT terminals in the 5G SA network provided by the embodiment of the present invention.

Fig. 8 is a schematic diagram of another sub-flow of the method for accessing and restricting access of a 5G SA network IoT terminal provided by an embodiment of the present invention.

FIG. 9 is a schematic diagram of another application scenario of a method for accessing and restricting access of a 5G SA network IoT terminal provided by an embodiment of the present invention.

FIG. 10 is a schematic diagram of another application scenario of a method for accessing and restricting access of a 5G SA network IoT terminal provided by an embodiment of the present invention.

Fig. 11 is a schematic diagram of another application scenario of a method for accessing and restricting access of a 5G SA network IoT terminal provided by an embodiment of the present invention.

FIG. 12 is a schematic block diagram of a system for accessing and restricting access of IoT terminals in a 5G SA network provided by an embodiment of the present invention.

Fig. 13 is a schematic block diagram of a computer device provided by an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

It should be understood that when used in this specification and the appended claims, the terms "comprising" and "comprises" indicate the presence of described features, integers, steps, operations, elements and/or components, but do not exclude one or Presence or addition of multiple other features, integers, steps, operations, elements, components and/or collections thereof.

It should also be understood that the terminology used in the description of the present invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the present invention. As used in this specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural referents unless the context clearly dictates otherwise.

It should also be further understood that the term "and/or" used in the description of the present invention and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations .

Please refer to Fig. 1 and Fig. 2, Fig. 1 is a schematic flowchart of a method for accessing and restricting access of a 5G SA network IoT terminal provided by an embodiment of the present invention, Fig. 2 is a schematic flow diagram of a 5G SA network IoT terminal access provided by an embodiment of the present invention Schematic diagram of the application scenario of the method for entry and access restriction; the method for 5G SA network Internet of Things terminal access and access restriction is applied in the SA network Internet of Things system 10, and the system 10 includes an Internet of Things terminal 11, a network manager 12 and a user Terminal 13, the 5G SA network Internet of Things terminal access and access restriction method is executed by the application software installed in the Internet of Things terminal 11, network manager 12 and user terminal 13, wherein the user terminal 13 is based on the SIM card A terminal device wirelessly connected to the network manager 12, such as smart watches, smart speakers, smart phones and other smart devices, the network manager 12 is also a gateway server for network bridging and management. The network manager 12 can be used for The network access request is transmitted and managed, and the IoT terminal 11 is a platform server for providing network information services for the user terminal 13 . The network manager 12 respectively establishes a network connection with the IoT terminal 11 and the user terminal 13 to realize the transmission of data information, the user terminal 13 can send a network access request to the network manager 12, and the IoT terminal 11 can process according to the network manager 12 The network access request provides corresponding network services for the user terminal 13, and the network manager 12 is equipped with a radio access network RAN, an access management module AMF, a network slice selection module and a policy control module PCF. As shown in FIG. 1, the method includes steps S110-S180. .

S110. If the network manager receives the attachment request from the IoT terminal, control the user terminal 13 to send a network access message.

The network manager can receive an attachment request from an IoT terminal, and if the network manager receives the attachment request, it will send a feedback signal to the user terminal 13, and the user terminal 13 will send a network access message to the network manager after receiving the feedback signal.

S120. The network manager receives the access network message, and the radio access network RAN determines an access management module AMF corresponding to the access network message.

As shown in FIG. 3 , in a specific embodiment, sub-steps S111 , S112 and S113 are also included before step S120 .

S111. Determine whether the request slice R is included in the access network message; S112. If the request slice R is included in the access network message, perform the determination of the corresponding slice R according to the request slice R in the access network message. Steps of the access management module AMF; S113, if the request slice R is not included in the access network message, send a registration request to the default access management module AMF.

As shown in FIG. 4 , in a specific embodiment, step S120 includes sub-steps S121 , S122 , S123 and S124 .

S121. Analyze the access network message to obtain the corresponding GUAMI information; S122. Determine whether the matching access management module AMF can be obtained according to the GUAMI information; in another embodiment, the matching access management module AMF The management module AMF can be replaced with the default access management module AMF of the system; S123, if a matching access management module AMF can be obtained according to the GUAMI information, obtaining a matching access management module AMF is a determined access Management module AMF; S124. If the matching access management module AMF cannot be obtained according to the GUAMI information, determine the corresponding access management module AMF according to the request slice R in the access network message.

Among them, the access management module AMF is the main functional unit of the 5G (fifth generation mobile communication technology) core network, which is used to complete the access and mobility management of end users; the GUAMI information is the unique identifier of the access management module AMF. Wherein, in the case of 5G access, the AN parameter (access network parameter) in the access network message includes GUAMI information, request slice R, and the like.

S130. The determined access management module AMF obtains the user subscription network slice S corresponding to the access network message from a preset slice database.

Among them, the network manager is also equipped with a unified data management module UDM. By providing a management structure that can manage basic IT facilities such as network, security, and storage in a unified manner, the unified data management module UDM creates a unified management center for the IT system and helps users realize data management. More effective management, utilization and protection of assets. The preset slice database is located in the unified data management module UDM, and the slice database includes three types: request slice R (optional), contract network slice S, and allow slice A.

As shown in FIG. 5 , in a specific embodiment, steps S131 , S132 and S133 are included after step S130 .

S131. If the target access management module AMF obtains the user subscription policy, judge whether the request slice R, the user subscription network slice S, and the allowed slice A can be combined to form an intersection slice; S132. If yes If the intersection slice is formed, the user terminal 13 is allowed to access; S133, if the intersection slice cannot be formed, the user terminal 13 is denied access. The slice accessed by the end user terminal 13 is the intersection of the request slice R (if any), the contracted network slice S, and the allowed slice A. If there is no result after the intersection of the three slices, the user terminal 13 is denied access. Process failed.

S140. Determine whether the determined access management module AMF can process the user subscription network slice S.

If the determined access management module AMF can process the user subscription network slice S, the target access management module AMF obtains the pre-stored user subscription policy corresponding to the allowed slice A from the policy control module PCF, and uses the user subscription policy Send to the IoT terminal, so that the IoT terminal accesses the target access management module AMF. The policy control module PCF is similar to the PCRF (policy and charging rule function) in 4G network elements, and is mainly used for charging and dynamic policy control.

S150. If the determined access management module AMF cannot process the user-subscribed network slice S, the network slice selection module acquires the allowed slice A corresponding to the user-subscribed network slice S and the target access management module AMF.

S160. The network slice selection module resends the allowed slice A to the target access management module AMF.

S170. The target access management module AMF acquires a pre-stored user subscription policy corresponding to the permitted slice A from the policy control module PCF.

As shown in Figure 6, in a specific embodiment, step S170 is specifically step 171: the policy control module PCF performs switching subscription between tracking areas TA for a single user based on the preset tracking area code TAC, so as to obtain the Describe the user subscription policy. More specifically, the policy control module PCF performs session policy control on users based on the preset tracking area code TAC; the session policy control is that the policy control module PCF performs switching subscription between tracking areas TA for a single user to obtain user subscription policies.

Among them, the tracking area code TAC is an area used for paging and location update. Its planning should ensure that the capacity of the paging channel is not limited, and at the same time, the location update overhead for the area border is minimal, and it is required to be easy to manage. The reasonable planning of the tracking area code TAC can balance the paging load and location update signaling process, and effectively control the system signaling load.

As shown in Figure 7, there is also a session management module SMF in the network manager. The session management module SMF is mainly responsible for interacting with the separated data plane, creating, updating and deleting PDU sessions, and managing the session environment with the user plane function UPF. Among them, a PDU session refers to a communication process between a user terminal 13 and the data network DN; the user plane function UPF is a basic component of the 5G core network infrastructure system architecture defined by 3GPP (Third Generation Partnership Project), Operators can perform rate limit, billing, and legal interception on user data transmission according to the user plane function UPF, and record traffic usage. The 5G user plane function UPF can be lowered on demand to reduce network delay Enter the user's intranet, and the traffic does not leave the campus, meeting the needs of users at different levels. The sinking of the user plane function UPF is the result of the separation of the 5G control plane and the user plane, and it is the embodiment of the huge progress of 5G technology compared with 4G technology.

In a specific embodiment, step S171 includes sub-steps S1711, S1712, S1713 and S1714.

S1711. If receiving a signal from the user terminal 13 to switch the tracking area TA, actively report the location to update the access network message; S1712. The radio access network RAN re-determines and updates the access network information. The access management module AMF newly corresponding to the incoming network message; S1713. The newly corresponding access management module AMF reports the updated access network message to the policy control module PCF through a preset interface; S1714 . The policy control module PCF performs session policy control on the tracking area code TAC carried in the session management module SMF.

As shown in FIG. 8, in a specific embodiment, step S1714 includes sub-steps S1715 and S1716.

S1715. If the tracking area code TAC is in the allowed list of the session management module SMF, issue a dynamic policy to ensure that the first policy is output; the first policy is a higher quality of service policy; S1716. If the The tracking area code TAC is not in the allowed list of the session management module SMF, and a blocking command is issued to ensure that the second policy is output, and then all traffic of the user is blocked, so that the user traffic does not leave the park; the second policy is the corresponding business The rule has the highest global priority.

S180. Send the user subscription policy to the IoT terminal, so that the IoT terminal accesses the target access management module AMF.

Due to the limited number of configurable slices in the 5G core network and wireless base stations, access control cannot be performed on one slice for each customer. Therefore, in the present invention, a small number of public slices are selected for access restriction, and allowed slices A are added to base stations and core network elements related to the campus. The network slice selection module configures slices supported by each tracking area code TAC, and the access management module AMF subscribes to the tracking area code TAC and slice information through the network slice selection module, and obtains the slice configured under the tracking area code TAC. Since the range of the tracking area coding TAC is generally large, fewer common slices can meet the needs of most users.

The policy control module PCF performs switching subscription between tracking areas TA for a single user. When the user terminal 13 switches between tracking areas TA, it actively reports a location update message, which is carried in the session message of the session management module SMF by the policy control module PCF Tracking area code TAC for policy control: when the tracking area code TAC is in the allowed list, issue dynamic control policies, such as service quality assurance, etc.; when the tracking area code TAC is not in the allowed list, block all user traffic , so that user traffic does not leave the campus.

Examples of the main scenarios involved are as follows:

As shown in Figure 9, Scenario 1: Campus 1 is defined as the coverage area of base station 3, and base station 1, base station 2, and base station 3 are all under the same tracking area code TAC.

In this scenario, only using the PCF configuration of the policy control module to perform tracking area encoding and TAC-level access restrictions will precisely control its access to campus 1 only. Therefore, base station 1 or base station 2 configures the default slice A0, and base station 3 configures the campus public slice A1, and the policy control module PCF configures the corresponding session control policy according to the tracking area code TAC1.

For users in the park, the network slice is S1. In this scenario, S1=A1, and the slice R requested by the user terminal 13 is empty by default. Therefore, in this scenario, the slice is finally allowed to be A1, and users who subscribe to S1 can complete the registration and access process normally. After the session is established, when the policy control module PCF judges that the tracking area code TAC1 is in the allowed list, it issues a higher priority service policy. When the user moves to an area other than base station 3, slice A1 is finally allowed to be empty, and user access is denied.

For users outside the local park, the contracted network slice is S2, the user terminal 13 requests slice R to be empty, and finally allows slice A1 to be empty, rejects user access, and fails to register.

According to the above analysis results, in this scenario, it can be guaranteed that non-campus users cannot access the user intranet no matter where they come from. Campus users can access the intranet when they are in the campus and enjoy higher service quality. When outside the campus, access is denied, thereby implementing two-way security access restrictions.

If different customers configure the same slice, terminals may access through other base stations outside the campus. In this scenario, it is necessary to superimpose the position restriction of the tracking area code TAC, that is, through the policy control module PCF to issue the tracking area code TAC position control policy to realize the area restriction of different campuses under the same slice (no need to readjust the tracking area code TAC).

As shown in Figure 10, Scenario 2: Park 1 is defined as the coverage of base station 3, and park 2 is defined as the coverage of base station 4, and base station 1, base station 2, and base station 3 are all under the same tracking area code TAC.

Base station 1 and base station 2 are configured with default slice A0, and base station 3 and base station 4 are configured with park public slice A1. At the same time, the policy control module PCF configures corresponding session control policies according to tracking area code TAC1 and tracking area code TAC2, and configures park 1 users to allow The access tracking area code TAC is tracking area code TAC1, and the tracking area code TAC that park 2 users are allowed to access is tracking area code TAC2.

For users in Park 1 and Park 2, the subscribed network slice is S1. In this scenario, S1=A1, and the slice R requested by the user terminal 13 is empty by default. Therefore, in this scenario, Park 1 and Park 2 finally allow the slice to be A1, and users who subscribe to S1 can complete the registration and access process normally.

In this scenario, the access restrictions under the tracking area code TAC1 of Campus 1 are the same as those in Scenario 1. If a user in Park 1 moves to Park 2, a location reporting event is triggered. Because the public slices in the parks are the same, users in Park 1 can still access Park 2 normally. After entering the session establishment process, the policy control module PCF judges that the tracking area code TAC2 reported by it is not in the access-allowed list, and issues a traffic blocking policy. It shows that the access is normal, but the intranet of campus 1 cannot be accessed. Move back to campus 1, report the location update to the policy control module PCF, and restore its normal service in real time.

Users in Campus 2 can only access services normally within the coverage of Base Station 4, and the reasons for congestion in other cases are the same as those in Campus 1.

According to the above analysis results, in this scenario, it can be ensured that when users in this campus move to different campuses under the same slice, they will not be able to access and access. Users can only access the intranet when they are in the campus, enjoying a higher quality of service.

As shown in Figure 11, Scenario 3: Park 1 is defined as the coverage area of base station 3, and park 2 is defined as the coverage area of base station 4 and base station 5, and base station 1, base station 2, base station 3, base station 4, and base station 5 are all in the same tracking Region coded under TAC.

Base stations 1 and 2 are configured with the default slice A0, base station 3 is configured with the campus public slice A1, and base stations 4 and 5 are configured with the campus public slice A2. 2 The tracking area codes TAC that users are allowed to access are all tracking area codes TAC1.

For users in campus 1, the subscribed network slice is S1. In this scenario, S1=A1, and the terminal request slice R is empty by default. For users in campus 2, the subscribed network slice is S2. In this scenario, S1=A2, and the terminal request slice R is empty by default. Therefore, in this scenario, the slice A1 is allowed in Park 1, and the slice A2 is allowed in Park 2.

In this scenario, if a user in Park 1 moves to Park 2, the user in Park 1 cannot access the network because the slices are different. Similarly, if a user in Park 1 moves to Park 2, the user in Park 2 cannot access it normally because the slices are different.

The analysis of Park 1 and Park 2’s access to areas other than TAC1 is the same as Scenario 1, and will not be repeated here.

According to the above analysis results, in this scenario, users in different campuses under the same tracking area code TAC can be guaranteed that when they move to different campuses under the same tracking area code TAC, they cannot access the intranet and can only access the intranet when they are in the same campus. Network, enjoy a higher quality of service.

The embodiment of the present invention also provides a 5G SA network Internet of Things terminal access and access restriction system, the 5G SA network Internet of Things terminal access and access restriction system is used to perform the aforementioned 5G SA network Internet of Things terminal access and access restriction Any embodiment of the method of access restriction. Specifically, please refer to FIG. 12. FIG. 12 is a schematic block diagram of a system for accessing and restricting access to IoT terminals in a 5G SA network provided by an embodiment of the present invention.

As shown in FIG. 12 , the system includes an IoT terminal 11 , a network manager 12 and a user terminal 13 , and the network manager 12 respectively establishes network connections with the IoT terminal 11 and the user terminal 13 to realize the transmission of data information. Wherein, the system includes an attachment request unit 111 configured in the IoT terminal 11, a first sending unit 131 configured in the user terminal 13, a receiving unit 121, a first acquiring unit 122, and a judging unit configured in the network manager 12 123 . The second acquiring unit 124 , the second sending unit 125 , the third acquiring unit 126 and the third sending unit 127 .

The attach request unit 111 is used for the network manager 12 to receive the attach request from the IoT terminal 11 .

The first sending unit 131 is configured to control the user terminal 13 to send a network access message if the network manager 12 receives an attachment request from the IoT terminal 11 .

The receiving unit 121 is used for the network manager 12 to receive an access network message, and the radio access network RAN determines an access management module AMF corresponding to the access network message.

The first obtaining unit 122 is used for the determined access management module AMF to obtain the user subscription network slice S corresponding to the access network message from the preset slice database.

The judging unit 123 is configured to judge whether the determined access management module AMF can process the user subscription network slice S.

The second acquisition unit 124 is configured to acquire the allowed slice A corresponding to the user-subscribed network slice S and the target access management module if the determined access management module AMF cannot process the user-subscribed network slice S AMF.

The second sending unit 125 is used for the network slice selection module to resend the allowed slice A to the target access management module AMF.

The third obtaining unit 126 is used for the target access management module AMF to obtain the pre-stored user subscription policy corresponding to the allowed slice A from the policy control module PCF.

The third sending unit 127 is configured to send the user subscription policy to the IoT terminal 11, so that the IoT terminal 11 accesses the target access management module AMF.

The above-mentioned method for accessing and restricting access to IoT terminals in the 5G SA network can be implemented in the form of a computer program, and the IoT terminal 11 and the network manager 12 in the system for accessing and restricting access to IoT terminals in the 5G SA network can be implemented as Computer equipment, the computer program can run on the computer equipment shown in Figure 13.

Here, the IoT terminal 11 includes a first memory, a first processor, and a first computer program stored on the first memory and operable on the first processor, and the network manager 12 includes a second memory, a second processor and a second computer program stored on the second memory and operable on the second processor, the user terminal 13 includes a third memory, a third processor and a second computer program stored on the third memory and operable on the third processor When the third computer program is running, the first processor executes the first computer program, the second processor executes the second computer program, and the third processor executes the third computer program to jointly realize the above-mentioned 5G SA network IoT terminal access and access-restricted methods.

Please refer to FIG. 13 . FIG. 13 is a schematic block diagram of a computer device provided by an embodiment of the present invention. The computer device may be a method for implementing 5G SA network Internet of Things terminal access and access restrictions, so that the network manager can judge whether the user terminal can access the Internet according to the attachment request of the Internet of Things terminal and the access network message sent by the user terminal. net.

Referring to FIG. 13 , the computer device 500 includes a processor 502 connected through a system bus 501 , a memory and a network interface 505 , where the memory may include a storage medium 503 and an internal memory 504 .

The storage medium 503 can store an operating system 5031 and a computer program 5032 . When the computer program 5032 is executed, it can make the processor 502 execute the method for 5G SA network IoT terminal access and access restriction, wherein the storage medium 503 can be a volatile storage medium or a non-volatile storage medium.

The processor 502 is used to provide calculation and control capabilities and support the operation of the entire computer device 500 .

The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute the method of 5G SA network IoT terminal access and access restriction.

The network interface 505 is used for network communication to provide transmission of data information, and the network communication is wired network communication and/or wireless network communication. Those skilled in the art can understand that the structure shown in FIG. 10 is only a block diagram of a partial structure related to the solution of the present invention, and does not constitute a limitation to the computer device 500 on which the solution of the present invention is applied. The specific computer device 500 may include more or fewer components than shown, or combine certain components, or have a different arrangement of components.

Wherein, the processor 502 is configured to run the computer program 5032 stored in the memory, so as to realize the corresponding functions in the above-mentioned method for 5G SA network Internet of Things terminal access and access restriction.

Those skilled in the art can understand that the embodiment of the computer device shown in FIG. 13 does not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or less components than those shown in the illustration. Or combine certain components, or different component arrangements. For example, in some embodiments, the computer device may only include a memory and a processor. In such an embodiment, the structures and functions of the memory and the processor are consistent with those of the embodiment shown in FIG. 13 , and will not be repeated here.

It should be understood that, in the embodiment of the present invention, the processor 502 may be a central processing unit (Central Processing Unit, CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), dedicated integrated Circuit (Application Specific Integrated Circuit, ASIC), off-the-shelf programmable gate array (Field-Programmable GateArray, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Wherein, the general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

In another embodiment of the invention a computer readable storage medium is provided. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium. The computer-readable storage medium stores a first computer program, a second computer program or a third computer program, when the first computer program is executed by the first processor, the second computer program is executed by the second processor, and When the third computer program is executed by the third processor, the above-mentioned steps included in the SIM card-based Internet of Things directional traffic management method are implemented together.

In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and units can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only logical function division. In actual implementation, there may be other division methods, and units with the same function may also be combined into one Units such as multiple units or components may be combined or integrated into another system, or some features may be omitted, or not implemented. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of software products, and the computer software products are stored in a computer. The readable storage medium includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned computer-readable storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), magnetic disk or optical disk and other media that can store program codes.

The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person familiar with the technical field can easily think of various equivalents within the technical scope disclosed in the present invention. Modifications or replacements shall all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. A method for 5GSA network Internet of Things terminal access and access restriction, characterized in that the method is applied to the SA network Internet of Things system, and the system includes an Internet of Things terminal, a network manager and a user terminal, and the network The manager establishes a network connection with the IoT terminal and the user terminal respectively to realize the transmission of data information, and the network manager is provided with a radio access network, an access management module, a network slice selection module and a policy control module, The methods include: If the network manager receives an attachment request from the IoT terminal, controlling the user terminal to send a network access message; The network manager receives the access network message, and the radio access network determines an access management module corresponding to the access network message; The determined access management module obtains the user subscription network slice corresponding to the access network message from a preset slice database; judging whether the determined access management module can process the user-subscribed network slice; If the determined access management module cannot process the user-subscribed network slice, the network slice selection module acquires an allowed slice and a target access management module corresponding to the user-subscribed network slice; The network slice selection module resends the allowed slice to the target access management module; The target access management module acquires a pre-stored user subscription policy corresponding to the permitted slice from the policy control module; Sending the user subscription policy to the IoT terminal, so that the IoT terminal accesses the target access management module. 2. The method for 5GSA network Internet of Things terminal access and access restriction according to claim 1, wherein the radio access network determines the access management module corresponding to the access network message, including: Analyzing the access network message to obtain corresponding GUAMI information; Judging whether a matching access management module can be obtained according to the GUAMI information; If a matching access management module can be obtained according to the GUAMI information, the obtained matching one of the access management modules is a determined access management module; If the matching access management module cannot be obtained according to the GUAMI information, the corresponding access management module is determined according to the request slice in the access network message. 3. The method for 5GSA network Internet of Things terminal access and access restriction according to claim 2, characterized in that before determining the corresponding access management module according to the request slice in the access network message, further comprising : judging whether the access network message includes a request slice; If the access network message includes a request slice, perform the step of determining a corresponding access management module according to the request slice in the access network message; If the access network message does not include the request slice, then send the registration request to the default access management module. 4. The method for 5GSA network Internet of Things terminal access and access restriction according to claim 1, wherein the target access management module obtains a pre-stored user subscription policy from the policy control module, including: The policy control module performs switching subscription between tracking areas for a single user based on a preset tracking area code, so as to obtain the user subscription policy. 5. The method for 5GSA network Internet of Things terminal access and access restriction according to claim 4, characterized in that, the network manager is also provided with a session management module, and the policy control module is based on preset tracking area coding Perform session policy control on the user; the policy control module performs switching subscription between tracking areas for a single user, so as to obtain the user subscription policy, including: If receiving a signal from the user terminal to switch the tracking area, actively report the location to update the access network message; The radio access network re-determines the access management module corresponding to the updated access network message; The newly corresponding access management module reports the updated access network information to the policy control module through a preset interface; The policy control module performs session policy control on the tracking area code carried in the session management module. 6. The method for 5GSA network Internet of Things terminal access and access restriction according to claim 5, wherein the policy control module carries out policy control to the tracking area code carried in the session management module, including : If the tracking area is coded in the allowed list of the session management module, issue a dynamic policy to ensure that the first policy is output; the first policy is a higher quality of service policy; If the tracking area code is not in the allowed list of the session management module, issue a blocking command to ensure that the second policy is output, and then block all traffic of the user, so that the traffic of the user does not go out of the park; the second policy is the corresponding Business rules have the highest global priority. 7. The method for 5GSA network Internet of Things terminal access and access restriction according to claim 2, characterized in that, the determined access management module acquires information related to the access network from a preset slice database. The user subscription network slice corresponding to the message also includes: If the target access management module obtains the user subscription policy, judge whether the request slice, the user subscription network slice, and the allowed slice can be combined to form an intersection slice; If an intersection slice can be formed, allow the user terminal to access; If the intersection slice cannot be formed, deny the access of the user terminal. 8. A system for 5GSA network Internet of Things terminal access and access restriction, characterized in that the system includes an Internet of Things terminal, a network manager and a user terminal, and the network manager communicates with the Internet of Things terminal and the user terminal respectively Establishing a network connection with the user terminal to realize the transmission of data information; The system includes an attachment request unit configured in the Internet of Things terminal, a first sending unit configured in the user terminal, a receiving unit, a first obtaining unit, a judging unit, and a second receiving unit configured in the network manager. Two acquiring unit, second sending unit, third acquiring unit and third sending unit; an attach request unit, configured for the network manager to receive an attach request from the IoT terminal; A first sending unit, configured to control the user terminal to send an access network message if the network manager receives an attachment request from the IoT terminal; a receiving unit, configured for the network manager to receive the access network message, and the radio access network determines an access management module corresponding to the access network message; The first obtaining unit is used for the determined access management module to obtain the user subscription network slice corresponding to the access network message from a preset slice database; A judging unit, configured to judge whether the determined access management module can process the user subscription network slice; The second obtaining unit is configured to: if the determined access management module cannot process the user subscription network slice, the network slice selection module obtains the allowed slice and target access corresponding to the user subscription network slice into the management module; a second sending unit, configured for the network slice selection module to resend the allowed slice to the target access management module; A third obtaining unit, configured for the target access management module to obtain a pre-stored user subscription policy corresponding to the permitted slice from the policy control module; A third sending unit, configured to send the user subscription policy to the IoT terminal, so that the IoT terminal accesses the target access management module. 9. A system for 5GSA network Internet of Things terminal access and access restriction, characterized in that the system includes an Internet of Things terminal, a network manager and a user terminal, and the Internet of Things terminal includes a first memory and a first processor and a first computer program stored on said first memory and operable on said first processor, said network manager comprising a second memory, a second processor, and a computer program stored on said second memory and A second computer program operable on the second processor, the user terminal comprising a third memory, a third processor, and a computer program stored on the third memory and operable on the third processor A third computer program, wherein the first processor executes the first computer program, the second processor executes the second computer program, and the third processor executes the third computer program jointly realize the method for accessing and accessing restriction of the 5GSA network Internet of Things terminal as described in any one of claims 1 to 7. 10. A computer-readable storage medium, wherein the computer-readable storage medium stores a first computer program, a second computer program and a third computer program, and when the first computer program is executed by the first processor When executing, the second computer program is executed by the second processor and the third computer program is executed by the third processor, the 5GSA network Internet of Things terminal access and Method of access restriction.

Images