WO2019062384A1 - Method and device for public network user accessing private network - Google Patents

Abstract

The present invention relates to the technical field of mobile communications, in particular to a method and device for a public network user accessing a private network, wherein the method provided by the present application may be applied to a first network element device in the core network of a private network, and specifically comprises: receiving an access request from a public network user terminal in the coverage area of a private network by means of a private network base station, the access request comprising identity information of the public network user terminal; after determining that the public network user terminal passes access authentication on the basis of pre-stored public network user information, sending an authentication request carrying the identity information to a second network element device in the core network of a public network, the authentication request being used for indicating to the second network element device to authenticate the public network user terminal; and after receiving an authentication success response from the second network element device after the authentication succeeds, sending the authentication success response to the public network user terminal by means of the private network base station. Thus, a public network user may access a private network and perform normal communication without replacing a subscriber identity module (SIM) card.

Description

Method and device for implementing public network user access private network

This application claims the priority of the Chinese patent application filed on September 26, 2017, the Chinese Patent Office, the application number is 201710884782.3, and the invention name is "a method and device for implementing a public network access private network". This is incorporated herein by reference.

Technical field

The present invention relates to the field of mobile communications technologies, and in particular, to a method and a device for implementing a public network access private network.

Background technique

With the continuous maturity of the 4th Generation Mobile Communication Technology (4G) network, some enterprises use the advanced communication mechanism under the 4G network to deploy a dedicated 4G wireless network, that is, 4G private network to realize the internal enterprise. Features such as wireless communication. Among them, the so-called private network is relative to the public network, the public network refers to the public wireless communication network operated by the telecom operators, and the private network is the wireless network built by some enterprises, which is generally not covered by the public network. Areas, such as wireless communication systems established by industrial and mining enterprises in mines or tunnels.

In the prior art, a private network user in a 4G private network environment needs to use a subscriber-specific subscriber identity card (SIM card) to implement other specializations in the 4G private network coverage area and the 4G private network environment. The network user communicates. For the public network users who use the SIM card opened on the public network, when the 4G private network base station and the public network base station use the same wireless communication mechanism, the 4G private network base station can receive the same in the 4G private network coverage area. The access request of the public network user is reported to the network side of the private network. However, because the network side device of the private network cannot know the identity information and the authentication key of the public network user, the private network side cannot determine whether the public network user has the information. The legal identity, in turn, prohibits public network users from accessing the 4G private network. Therefore, when the public network user switches to the private network coverage within the coverage of the public network, the SIM card needs to be replaced with a specific SIM card for the private network, and sometimes the terminal device customized for the private network needs to be replaced.

It can be seen that in the prior art, there is a problem that the public network user cannot access the 4G private network.

Summary of the invention

The embodiment of the present invention provides a method and a device for implementing a public network access private network, which are used to solve the problem that a public network user in the prior art cannot access a 4G private network.

The specific technical solutions provided by the embodiments of the present application are as follows:

In a first aspect, a method for implementing a public network user accessing a private network includes:

The first network element device in the core network of the private network receives the access request sent by the public network user terminal in the private network coverage area, and the access request includes the identity identifier of the public network user terminal. information;

The first network element device performs access authentication on the public network user terminal based on the pre-stored public network user information, and sends the second network element device in the public network core network after determining that the access authentication is passed. An authentication request carrying the identity information, where the authentication request is used to instruct the second network element device to use the user authentication information corresponding to the identity identification information that is pre-stored to the public network user. The terminal performs authentication;

The first network element device receives the authentication success response sent by the second network element device after the authentication succeeds, and sends the authentication success response to the public network user terminal by using the private network base station.

Optionally, the first network element device performs access authentication on the public network user terminal according to the pre-stored public network user information, including:

If the first network element device determines that the public network user information corresponding to the identity identification information is pre-stored, the first network element device determines that the public network user terminal passes the access authentication.

Optionally, the first network element device sends an authentication request that carries the identity identification information to the second network element device in the core network of the public network, including:

The first network element device replaces the address information of the private network base station carried in the access request sent by the private network base station with the preset address information, and replaces the access request after the address information Claiming authentication request;

The first network element device sends the authentication request to a second network element device in the public network core network by using a standard protocol interface pre-agreed with the second network element device.

Optionally, before the first network element device replaces the address information of the private network base station with the preset address information, the method further includes:

The first network element device establishes a mapping relationship between the identity identification information and address information of the private network base station;

The first network element device sends the authentication success response to the public network user terminal by using the private network base station, including:

The first network element device acquires the identity identification information carried in the authentication success response;

And acquiring, by the first network element device, address information of the private network base station corresponding to the identity identification information, according to the established mapping relationship;

The first network element device sends the authentication success response to the public network user terminal by using the private network base station according to the obtained address information of the private network base station.

In a second aspect, a method for implementing a public network user accessing a private network includes:

The second network element device in the core network of the public network receives the authentication request sent by the first network element device in the core network of the private network; wherein the authentication request includes the public network user terminal that is in the coverage of the private network. Identity identification information, and the authentication request is that the first network element device performs access authentication on the public network user terminal based on the pre-stored public network user information, and determines that the access authentication is passed;

The second network element device authenticates the public network user terminal based on the user authentication information corresponding to the identity identification information, and after the authentication succeeds, the first network element device Send authentication successfully responded.

In a third aspect, an implementation device for accessing a private network by a public network user includes:

a receiving unit, configured to receive an access request sent by a public network user terminal in a private network coverage area, where the access request includes identity information of the public network user terminal;

The first processing unit is configured to perform access authentication on the public network user terminal based on the pre-stored public network user information, and send the second network element device in the public network core network after determining that the access authentication is passed An authentication request carrying the identity information, where the authentication request is used to instruct the second network element device to use the user authentication information corresponding to the identity identification information that is pre-stored to the public network user. The terminal performs authentication;

The second processing unit is configured to receive an authentication success response sent by the second network element device after the authentication succeeds, and send the authentication success response to the public network user terminal by using the private network base station.

Optionally, when performing the access authentication on the public network user terminal based on the pre-stored public network user information, the first processing unit is configured to:

If it is determined that the public network user information corresponding to the identity information is pre-stored, the public network user terminal is determined to pass the access authentication.

Optionally, when the second network element device in the public network core network sends the authentication request that carries the identity information, the first processing unit is configured to:

And replacing the address information of the private network base station carried in the access request sent by the private network base station with the preset address information, and using the access request after replacing the address information as the authentication request;

And transmitting, by the standard protocol interface pre-agreed with the second network element device, the authentication request to the second network element device in the public network core network.

Optionally, the device further includes an establishing unit, where the establishing unit is configured to: before replacing the address information of the private network base station with the preset address information, perform the following operations:

Establishing a mapping relationship between the identity information and the address information of the private network base station;

When the private network base station sends the authentication success response to the public network user terminal, the second processing unit is configured to:

Obtaining the identity identification information carried in the authentication success response;

Obtaining address information of the private network base station corresponding to the identity identification information, based on the established mapping relationship;

And sending, by the private network base station, the authentication success response to the public network user terminal according to the obtained address information of the private network base station.

In a fourth aspect, an implementation device for accessing a private network by a public network user includes:

a receiving unit, configured to receive an authentication request sent by a first network element device in a private network core network, where the authentication request includes identity identification information of a public network user terminal that is in a private network coverage area, and The authentication request is performed by the first network element device performing access authentication on the public network user terminal based on the pre-stored public network user information, and determining that the access authentication is passed;

An authentication unit, configured to authenticate the public network user terminal based on the user authentication information corresponding to the identity identification information, and send the information to the first network element device after the authentication succeeds The authentication was successfully responded.

A fifth aspect, an electronic device, comprising: one or more processors; and one or more computer readable media, wherein the readable medium stores a program for implementing a public network user access private network, where The steps of the method of any of the second aspects are carried out when the program is executed by the one or more processors.

In a sixth aspect, a computer readable medium having stored thereon a program for implementing a public network user access private network, wherein when the program is executed by one or more processors, causing the processor to execute The method of any of the second aspects.

A seventh aspect, an electronic device, comprising: one or more processors; and one or more computer readable media, wherein the readable medium stores a program for implementing a public network user access private network, wherein The steps of the method as described in the third aspect are implemented when the program is executed by the one or more processors.

In an eighth aspect, a computer readable medium storing, on the readable medium, a program for implementing a public network user access private network, wherein when the program is executed by one or more processors, causing the processor to execute A method as described in the third aspect.

The beneficial effects of the embodiments of the present application are as follows: the public network user information is pre-stored in the first network element device in the private network core network, and is received by the public network user terminal that is in the coverage of the private network through the private network base station. After the access request, the public network user terminal can perform access authentication according to the public network user information stored in advance. Further, after determining that the access authentication is successful, the identity information of the public network user terminal may be reported to the second network element device in the core network of the public network, and the second network element device is based on the pre-stored and The user authentication information corresponding to the identity information is used to authenticate the public network user terminal. Therefore, in the present application, the access authentication of the public network user terminal is completed in the first network element device of the private network core network, and the public network is completed in the second network element device of the public network core network. The authentication of the user terminal and the result of the authentication are notified to the first network element device, so that the private network can complete the access and authentication of the public network user terminal, thereby enabling the public network user not to replace the SIM card. In the case of accessing the private network and performing normal communication.

DRAWINGS

FIG. 1 is a schematic diagram of interaction between a private network side network element device and a public network side network element device according to an embodiment of the present disclosure;

2 is a schematic diagram of different functions implemented by a base station proxy module in a private network and a public network according to an embodiment of the present application;

FIG. 3 is a flowchart of a method for implementing a public network user access private network according to an embodiment of the present disclosure;

4 is a schematic diagram of a scenario in which a public network user terminal completes network access and authentication according to an embodiment of the present disclosure;

FIG. 5 is a schematic diagram 1 of an implementation device for accessing a private network by a public network user according to an embodiment of the present disclosure;

FIG. 6 is a schematic diagram 2 of an implementation device for accessing a private network by a public network user according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram 3 of an implementation device for accessing a private network by a public network user according to an embodiment of the present disclosure.

Detailed ways

The present invention will be further described in detail with reference to the accompanying drawings, in which FIG. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

In order to solve the problem that the public network user in the prior art cannot access the 4G private network, the present application proposes a method and a device for implementing the public network user access private network, which can be installed with the SIM opened on the public network. The public network user terminal of the card can be used not only in the public network, but also in the private network without replacing the SIM card. If the public network user terminal is to be used inside the private network, the public network user terminal first needs to complete the access and authentication process in the private network. Therefore, in the embodiment of the present application, the first network element device in the Evolved Packet Core (EPC) network of the private network LTE system is improved, so that the first network element device can complete the request for access. The network user terminal performs authentication, and the second network element device in the EPC network of the public network LTE system is improved, so that the private network EPC network and the public network EPC network can be connected, and then the second network in the public network EPC network. The meta-device completes the authentication of the public network user terminal that is requested to access, so that the public network user terminal is successfully registered and used in the private network.

It should be noted that in the description of the embodiments of the present application, the terms “first”, “second” and the like are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can it be understood as an indication. Or suggest the order.

The preferred embodiments of the present application are described in detail below with reference to the accompanying drawings.

First, referring to FIG. 1 , a schematic diagram of interaction between a private network side network element device and a public network side network element device provided by an embodiment of the present application.

The private network EPC network side includes a first network element device, and the public network EPC network side includes a second network element device, and the private network IP Multimedia Subsystem (IMS) network side includes a third network element device, and a public network IMS network. The side includes a fourth network element device.

The following describes the interaction process between the first network element device on the EPC network side of the private network and the second network element device on the EPC network side of the public network.

The first network element device may be configured to: receive an access request sent by a public network user terminal in a private network coverage area by using a private network base station, where the access request includes identity information of the public network user terminal; Network user information, performing access authentication on the public network user terminal; and after determining that the access authentication is passed, sending an authentication request carrying the identity identification information to the second network element device; receiving the second network element device After the sent authentication succeeds, the authentication success response is sent to the public network user terminal through the private network base station.

The second network element device may be configured to: after receiving the authentication request, perform authentication on the public network user terminal based on the pre-stored user authentication information corresponding to the identity identification information; and after the authentication succeeds, The first network element device sends an authentication success response.

In this embodiment, the first network element device may include a first mobility management entity (MME), a first home subscriber server (HSS), a base station proxy module, and the like; The second network element device may include a second MME, a second HSS, and the like.

The first MME can interact with the first HSS to implement access authentication for the public network user terminal requesting access to the private network. Specifically, the first MME in the first network element device may be used to report the identity identification information of the public network user terminal that requests the access to the private network to the first HSS, where the designated allowed access is pre-stored in the first HSS. The public network user information of the network is used for access authentication of the public network user terminal requesting access to the private network. The identity information of the public network user terminal may be an International Mobile Subscriber Identity (IMSI) information stored in a SIM card used by the public network user terminal.

The base station proxy module is mainly used to implement communication with the second network element device on the public network EPC network side through a standard protocol interface that is open to the public network EPC network side. It can be deployed in the first MME or as a separate network element device in the EPC network, without affecting the implementation of its functions.

Specifically, referring to FIG. 2, different functions implemented by the base station proxy module in the private network and the public network are shown.

For the private network, multiple base stations of the enterprise private network can be mapped to the same base station, that is, the base station proxy module, and the base station proxy module replaces the source address information carried in the information sent by the different private network base stations with its own address information, and The replaced address information is used as source address information to send information to the second network element device in the public network. And, before the address information is replaced, the base station proxy module may establish a mapping relationship between the identity information of the public network user terminal and the address information of the private network base station, so as to pass the response information fed back by the second network element device to the public network user terminal. The private network base station having the mapping relationship is sent to the public network user terminal. The mapping relationship established may specifically be a mapping relationship between the IMSI information of the public network user terminal and the Internet Protocol Address (IP address) information of the private network base station.

For the public network, the base station proxy module can be regarded as a public network base station that establishes a communication connection with the second network element device after the open standard protocol interface, and is used to report related information of the public network user terminal to the second network. Meta device. The standard protocol interface opened between the first network element device and the second network element device may be an S1 interface, and the communication connection established between the second network element device and the base station proxy module may be a flow control transmission protocol. , SCTP) link, of course, in the specific implementation, other standard protocol interfaces may be opened according to actual needs, or communication connections under different transmission protocols may be established, which is not limited in this application.

Specifically, the base station proxy module may obtain the authentication result information obtained by the interaction between the first MEE and the first HSS, and after determining that the public network user terminal access authentication is passed, the special information carried in the access request sent by the private network base station is carried. The address information of the network base station is replaced with its own address information, and the access request after the replacement address is used as an authentication request, and is sent to the second network element device through the open S1 interface and based on the established communication connection, so as to implement the second network. The meta device completes the authentication of the public network user terminal.

After receiving the authentication success response sent by the second network element device to the public network user terminal after successful authentication, the base station proxy module may map the relationship between the identity information of the public network user terminal and the address information of the private network base station according to the established public network user terminal. The destination address information carried in the authentication success response is replaced by the address information of the base station proxy module with the address information of the private network base station corresponding to the identity identification information, and the authentication success response of the replaced address is sent to the private network base station. And then forwarded by the private network base station to the public network user terminal.

With reference to FIG. 1, the interaction process between the third network element device on the private network IMS network side and the fourth network element device on the public network IMS network side is introduced.

In order to implement the communication between the private network and the public network, in the embodiment of the present application, the third network element device on the IMS network side of the private network and the fourth network element device on the IMS network side of the public network can pass the standard protocol interface. The SIP interface is docked.

After successfully accessing the private network, the public network user terminal may further send an IMS network registration request to the third network element device through the private network base station and the first network element device. Correspondingly, after the third network element device successfully registers the public network user terminal to the IMS network on the private network side, the third network element device can also send the IMS to the fourth network element device by using a Session Initiation Protocol (SIP) interface. The network registration request is configured to enable the fourth network element device to successfully register the public network user terminal to the IMS network on the public network side. In this way, when the public network user terminal is in the private network coverage, it can not only perform voice call services with other public network users in the private network coverage, but also access the public network IMS network through the private network IMS network. Perform voice communication and other communication services with other public network user terminals that are within the coverage of the public network. Moreover, the process of accessing the public network IMS network by the private network IMS network by the private network IMS network is not perceptible to the user side, and the public network user terminal can implement the public network and the specialization without additional operations. Roaming between networks.

Based on the foregoing description of the interaction process between the private network side network element device and the network element side network element device, the embodiment of the present application further provides a public network user access private network implementation method, and the specific method flowchart can refer to As shown in Figure 3, the following steps are included:

Step 301: The first network element device in the private network core network receives an access request sent by the public network user terminal in the private network coverage area through the private network base station, where the access request includes the public network user terminal. Identity information.

And receiving, by the first MME in the first network element device, an access request that is sent by the public network user terminal in the private network coverage area and carrying the identity identification information of the public network user terminal, and accessing The request is reported to the first HSS in the first network element device, and the first HSS performs access authentication on the public network user terminal. The specified public network user information allowed to access the private network may be pre-stored in the first HSS.

Step 302: The first network element device performs access authentication on the public network user terminal based on the pre-stored public network user information, and after determining that the access authentication is passed, the second network in the public network core network is determined. The meta device sends an authentication request carrying the identity information.

The access authentication of the public network user terminal may be performed by the first HSS based on the pre-stored public network user information. If it is determined that the public network user information corresponding to the identity identification information is pre-stored in the local area, the public network user terminal is determined to pass the access authentication, and if it is determined that the public network corresponding to the identity identification information is not pre-stored locally, The user information determines that the public network user terminal does not pass the access authentication. After the first HSS performs the access authentication, the first MME may send the authentication result information to the base station proxy module, where the authentication result information is used to indicate whether the public network user terminal having the identity identification information passes the access authentication.

Further, the base station proxy module may determine, according to the authentication result information, whether the public network user terminal passes the access authentication. And after determining that the access authentication is passed, sending an authentication request carrying the identity identification information to the second network element device in the core network of the public network.

Here, in the embodiment of the present application, the first network element device and the second network element device are in the embodiment of the present application, and the information of the public network user terminal cannot be authenticated. The interface between the private network EPC network and the public network EPC network can be interconnected through the open standard protocol interface S1 interface. Then, the second network element device in the public network EPC network completes the authentication of the public network user terminal.

The base station proxy module sends the authentication request that carries the identity identification information to the second network element device in the public network core network, which may include: the base station proxy module sends the access request sent by the private network base station. The address information of the private network base station that is carried is replaced with the preset address information, and the access request after the replacement of the address information is used as the authentication request, and the standard protocol interface pre-agreed with the second network element device is used. Sending the authentication request to the second network element device in the public network core network.

And the base station proxy module may further establish a mapping relationship between the identity identification information and the address information of the private network base station, so as to be subsequently received, before replacing the address information of the private network base station with the preset address information. After the information about the identity information carried by the second network element device is carried, the private network base station having the mapping relationship with the identity information is sent to the public network user terminal having the identity identification information. .

Step 303: The second network element device authenticates the public network user terminal according to the user authentication information corresponding to the identity identification information, and after the authentication succeeds, the first The NE device sends an authentication success response.

Specifically, the second MME in the second network element device may receive an authentication request that is sent by the base station proxy module and that carries the identity identification information, and forward the received authentication request to the second HSS. The second HSS in the public network EPC network pre-stores the user authentication information of the public network user, so the second HSS may perform the public network user terminal on the public network user terminal based on the user authentication information corresponding to the identity identification information that is stored in advance. The authentication succeeds, and after the authentication is passed, the second MME sends an authentication success response to the base station proxy module of the first network element device. At this point, the authentication of the public network user terminal can be completed.

In addition, the second network element device on the EPC network side of the public network may carry the network authentication information when the authentication success response is sent, so that the public network user terminal can use the network authentication information to the network after receiving the authentication success response. The side is authenticated. Here, the authentication process of the specific network side and the user side can refer to the prior art, and is not specifically described in this application.

Step 304: The first network element device receives an authentication success response sent by the second network element device after the authentication succeeds, and sends the authentication success to the public network user terminal by using the private network base station. response.

Specifically, the first network element device sends the authentication success response to the public network user terminal by using the private network base station, which may include: the base station proxy module acquiring the identity identifier carried in the authentication success response. Obtaining, according to the mapping relationship between the identifier information and the address information of the private network base station, the address information of the private network base station corresponding to the identity identification information; The address information of the network base station is sent by the private network base station to the public network user terminal for the authentication success response.

Therefore, in the present application, the access authentication of the public network user terminal is completed in the first network element device of the private network core network, and the public network is completed in the second network element device of the public network core network. The authentication of the user terminal and the result of the authentication are notified to the first network element device, so that the private network can complete the access and authentication of the public network user terminal, thereby enabling the public network user not to replace the SIM card. In the case of accessing the private network and performing normal communication.

In the following, with reference to the foregoing embodiments, a specific embodiment is described in detail for the process of accessing the 4G private network and the authentication of the public network user terminal. For details, refer to the scenario shown in FIG. 4:

Among them, 1 to 9 shown in the figure indicate the network access and authentication process of the public network user terminal, specifically:

1 The public network user terminal sends an access request carrying the IMSI to the 4G private network base station.

The 24G private network base station forwards the access request to the first MME in the private network EPC.

The first MME in the private network EPC sends the IMSI of the public network user terminal to the first HSS, and the first HSS performs access authentication;

The first HSS determines whether the IMSI of the public network user terminal is stored in advance, and if yes, notifying the first MME to allow the public network user terminal to access the private network; otherwise, notifying the first MME that the public network user terminal is not allowed to access the network. Private Network;

The first MME notifies the base station proxy module of the access authentication result, and the base station proxy module sends the IMSI to the second MME in the operator EPC through the open S1 interface after determining that the public network user terminal is allowed to access the private network. Authentication request.

Here, it should be noted that when the base station proxy module sends the authentication request, the source IP address, that is, the IP address information of the 4G private network base station is changed to the IP address of the base station proxy module, so that the private network does not directly access the operator. The network achieves the purpose of reducing the difficulty of security maintenance of private network equipment. Moreover, in order to subsequently receive the information sent by the operator EPC network, it can identify which 4G private network base station to send to the public network user terminal, and after receiving the access request forwarded by the 4G private network base station, Establish a mapping relationship between the IMSI of the public network user terminal and the IP address of the 4G private network base station.

4 The second MME sends the IMSI of the public network user terminal to the second HSS in the carrier network.

The second HSS authenticates the public network user terminal according to the user authentication information corresponding to the IMSI of the public network user terminal, and if the authentication succeeds, the network authentication information is carried back to the second MME. And the authentication success response of the IMSI of the public network user terminal.

6: The second MME sends the authentication success response to the base station proxy module.

The base station proxy module obtains the IMSI carried in the authentication success response, and obtains the IP address of the 4G private network base station corresponding to the IMSI based on the mapping relationship between the established IMSI and the IP address of the 4G private network base station, according to the obtained IP address, The authentication success response is sent to the public network user terminal through the 4G private network base station.

The public network user terminal can complete the authentication on the network side based on the network authentication information carried in the authentication success response.

At this point, the network access and authentication process of the public network user terminal after being switched from the carrier network to the private network can be completed. When the public network user terminal is switched back to the carrier network by the private network, the public network user terminal can be directly used in the operator network because the authentication of the public network user terminal has been completed in the carrier network.

In addition, in order to enable the public network user terminal to use the 2th Generation Mobile Communication Technology (2G) network and the 3th Generation Mobile Communication Technology (3G) network in the carrier network, The following operations can be performed:

The second MME in the carrier network can also register relevant information about the public network user terminal for implementing 2G and 3G communication into the operator Mobile Switching Center (MSC).

8 The operator MSC may send a registration success response to the second MME after the registration is successful.

The second MME returns a registration success response to the public network user terminal through the private network base station proxy module and the 4G private network base station.

In addition, for the public network user terminal that has successfully accessed the private network, the registration process of the IMS service may also be initiated to the IMS network of the private network, including:

A. The public network user terminal sends an IMS network registration request to the private network IMS network side through the 4G private network base station and the private network EPC.

B. After the public network IMS network is successfully registered in the IMS network on the private network side, the private network EPC and the 4G private network base station can send a registration success response to the public network user terminal.

C. The private network IMS network side can forward the IMS network registration request to the IMS network in the operator through an open SIP interface.

D. After completing the registration of the public network user terminal, the IMS network side of the operator feeds back the registration success response to the private network IMS network side.

Based on the above, it can be seen that the public network user terminal can perform arbitrary handover in the private network and the operator network without affecting normal communication. Moreover, the public network user terminal can communicate with the public network user terminal in the operator network even if it is within the coverage of the private network.

Based on the foregoing embodiment, referring to FIG. 5, in the embodiment of the present application, an implementation device for accessing a private network of a public network user (for example, a first network element device of a private network core network) is provided, and at least includes a receiving unit. 50, a first processing unit 51 and a second processing unit 52, wherein

The receiving unit 50 is configured to receive, by the public network user terminal, the access request sent by the private network base station, where the access request includes the identity identification information of the public network user terminal;

The first processing unit 51 is configured to perform access authentication on the public network user terminal based on the pre-stored public network user information, and after determining that the access authentication is passed, to the second network element device in the public network core network. Sending an authentication request carrying the identity information, where the authentication request is used to instruct the second network element device to perform user authentication information corresponding to the identity identification information, which is pre-stored, on the public network. User terminal performs authentication;

The second processing unit 52 is configured to receive an authentication success response sent by the second network element device after the authentication succeeds, and send the authentication success response to the public network user terminal by using the private network base station.

Optionally, when performing the access authentication on the public network user terminal based on the pre-stored public network user information, the first processing unit 51 is configured to:

If it is determined that the public network user information corresponding to the identity information is pre-stored, the public network user terminal is determined to pass the access authentication.

Optionally, when the second network element device in the public network core network sends the authentication request that carries the identity information, the first processing unit 51 is configured to:

And replacing the address information of the private network base station carried in the access request sent by the private network base station with the preset address information, and using the access request after replacing the address information as the authentication request;

And transmitting, by the standard protocol interface pre-agreed with the second network element device, the authentication request to the second network element device in the public network core network.

Optionally, the device further includes an establishing unit 53, where the establishing unit 53 is configured to perform the following operations before replacing the address information of the private network base station with the preset address information:

Establishing a mapping relationship between the identity information and the address information of the private network base station;

When the private network base station sends the authentication success response to the public network user terminal, the second processing unit 52 is configured to:

Obtaining the identity identification information carried in the authentication success response;

Obtaining address information of the private network base station corresponding to the identity identification information, based on the established mapping relationship;

And sending, by the private network base station, the authentication success response to the public network user terminal according to the obtained address information of the private network base station.

Based on the foregoing embodiment, referring to FIG. 6, in the embodiment of the present application, a device for implementing a public network access private network (for example, a second network element device of a public network core network) is provided, and at least includes a receiving unit. 60 and an authentication unit 61, wherein

The receiving unit 60 is configured to receive an authentication request sent by the first network element device in the private network core network, where the authentication request includes the identity identification information of the public network user terminal that is in the coverage of the private network, and The authentication request is that the first network element device performs access authentication on the public network user terminal based on the pre-stored public network user information, and determines that the access authentication is passed;

The authentication unit 61 is configured to perform authentication on the public network user terminal based on the user authentication information corresponding to the identity identification information, and after the authentication succeeds, to the first network element device. Send authentication successfully responded.

Referring to FIG. 7, an embodiment of the present application further provides an implementation device for a public network user access private network, that is, an electronic device, including: one or more processors 500; and one or more computer readable media For example, the memory 520.

When the device shown in Figure 7 is used to implement the function of the first network element device in the private network core network:

The processor 500 is configured to read a program in the memory 520 and perform the following process:

Receiving, by the public network user terminal, the access request sent by the private network base station, where the access request includes the identity identification information of the public network user terminal;

Performing access authentication on the public network user terminal based on the pre-stored public network user information, and transmitting the identity identification information to the second network element device in the core network of the public network after determining that the access authentication is passed. The authentication request is used to instruct the second network element device to perform authentication on the public network user terminal based on pre-stored user authentication information corresponding to the identity identification information;

Receiving an authentication success response sent by the second network element device after the authentication succeeds, and sending the authentication success response to the public network user terminal by using the private network base station.

The transceiver 510 is configured to receive and transmit data under the control of the processor 500.

Optionally, performing access authentication on the public network user terminal based on the pre-stored public network user information, including:

If it is determined that the public network user information corresponding to the identity information is pre-stored, the public network user terminal is determined to pass the access authentication.

Optionally, the sending, by the second network element device in the public network, the authentication request that carries the identity information, includes:

The address information of the private network base station carried in the access request sent by the private network base station is replaced with preset address information, and the access request after replacing the address information is used as the authentication request;

And transmitting, by the standard protocol interface pre-agreed with the second network element device, the authentication request to the second network element device in the public network core network.

Optionally, before the replacement of the address information of the private network base station with the preset address information, the method further includes:

Establishing a mapping relationship between the identity information and the address information of the private network base station;

Sending, by the private network base station, the authentication success response to the public network user terminal, including:

Obtaining the identity identification information carried in the authentication success response;

Obtaining address information of the private network base station corresponding to the identity identification information, based on the established mapping relationship;

And sending, by the private network base station, the authentication success response to the public network user terminal according to the obtained address information of the private network base station.

When the device shown in Figure 7 is used to implement the second network element device function of the public network core network:

The processor 500 is configured to read a program in the memory 520 and perform the following process:

Receiving an authentication request sent by the first network element device in the core network of the private network; wherein the authentication request includes identity identification information of the public network user terminal that is in the coverage of the private network, and the authentication request is The first network element device performs access authentication on the public network user terminal based on the pre-stored public network user information, and determines that the access authentication is sent after the access authentication is passed;

And authenticating the public network user terminal according to the user authentication information corresponding to the identity identification information, and sending an authentication success response to the first network element device after the authentication succeeds.

Here, in FIG. 7, the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 500 and various circuits of memory represented by memory 520. The bus architecture can also link various other circuits, such as peripherals, voltage regulators, and power management circuits, as is well known in the art and, therefore, will not be further described herein. The bus interface provides an interface. Transceiver 510 can be a plurality of components, including a transmitter and a transceiver, providing means for communicating with various other devices on a transmission medium. The processor 500 is responsible for managing the bus architecture and general processing, and the memory 520 can store data used by the processor 500 when performing operations.

The processor 500 can be a central buried device (CPU), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (Complex Programmable Logic Device). , CPLD).

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Thus, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware. Moreover, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

While the preferred embodiment of the present application has been described, it will be apparent that those skilled in the art can make further changes and modifications to the embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and the modifications and

It is apparent that those skilled in the art can make various modifications and variations to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. Thus, it is intended that the present invention cover the modifications and variations of the embodiments of the present invention.

Claims (14)

A method for implementing a public network access private network, which is characterized by: The first network element device in the core network of the private network receives the access request sent by the public network user terminal in the private network coverage area, and the access request includes the identity identifier of the public network user terminal. information; The first network element device performs access authentication on the public network user terminal based on the pre-stored public network user information, and sends the second network element device in the public network core network after determining that the access authentication is passed. An authentication request carrying the identity information, where the authentication request is used to instruct the second network element device to use the user authentication information corresponding to the identity identification information that is pre-stored to the public network user. The terminal performs authentication; The first network element device receives the authentication success response sent by the second network element device after the authentication succeeds, and sends the authentication success response to the public network user terminal by using the private network base station. The method according to claim 1, wherein the first network element device performs access authentication on the public network user terminal based on the pre-stored public network user information, including: If the first network element device determines that the public network user information corresponding to the identity identification information is pre-stored, the first network element device determines that the public network user terminal passes the access authentication. The method of claim 1, wherein the first network element device sends an authentication request carrying the identity identification information to the second network element device in the public network core network, including: The first network element device replaces the address information of the private network base station carried in the access request sent by the private network base station with the preset address information, and replaces the access request after the address information Claiming authentication request; The first network element device sends the authentication request to a second network element device in the public network core network by using a standard protocol interface pre-agreed with the second network element device. The method of claim 3, wherein the method further includes: before the first network element device replaces the address information of the private network base station with the preset address information, the method further includes: The first network element device establishes a mapping relationship between the identity identification information and address information of the private network base station; The first network element device sends the authentication success response to the public network user terminal by using the private network base station, including: The first network element device acquires the identity identification information carried in the authentication success response; And acquiring, by the first network element device, address information of the private network base station corresponding to the identity identification information, according to the established mapping relationship; The first network element device sends the authentication success response to the public network user terminal by using the private network base station according to the obtained address information of the private network base station. A method for implementing a public network access private network, which is characterized by: The second network element device in the core network of the public network receives the authentication request sent by the first network element device in the core network of the private network; wherein the authentication request includes the public network user terminal that is in the coverage of the private network. Identity identification information, and the authentication request is that the first network element device performs access authentication on the public network user terminal based on the pre-stored public network user information, and determines that the access authentication is passed; The second network element device authenticates the public network user terminal based on the user authentication information corresponding to the identity identification information, and after the authentication succeeds, the first network element device Send authentication successfully responded. An implementation device for accessing a private network by a public network user, which is characterized by: a receiving unit, configured to receive an access request sent by a public network user terminal in a private network coverage area, where the access request includes identity information of the public network user terminal; The first processing unit is configured to perform access authentication on the public network user terminal based on the pre-stored public network user information, and send the second network element device in the public network core network after determining that the access authentication is passed An authentication request carrying the identity information, where the authentication request is used to instruct the second network element device to use the user authentication information corresponding to the identity identification information that is pre-stored to the public network user. The terminal performs authentication; The second processing unit is configured to receive an authentication success response sent by the second network element device after the authentication succeeds, and send the authentication success response to the public network user terminal by using the private network base station. The device according to claim 6, wherein when the public network user terminal performs access authentication based on the pre-stored public network user information, the first processing unit is configured to: If it is determined that the public network user information corresponding to the identity information is pre-stored, the public network user terminal is determined to pass the access authentication. The device according to claim 6, wherein when the authentication request carrying the identity identification information is sent to the second network element device in the public network, the first processing unit is configured to: And replacing the address information of the private network base station carried in the access request sent by the private network base station with the preset address information, and using the access request after replacing the address information as the authentication request; And transmitting, by the standard protocol interface pre-agreed with the second network element device, the authentication request to the second network element device in the public network core network. The device according to claim 8, wherein the device further comprises an establishing unit, wherein the establishing unit is configured to perform the following operations before replacing the address information of the private network base station with the preset address information: Establishing a mapping relationship between the identity information and the address information of the private network base station; When the private network base station sends the authentication success response to the public network user terminal, the second processing unit is configured to: Obtaining the identity identification information carried in the authentication success response; Obtaining address information of the private network base station corresponding to the identity identification information, based on the established mapping relationship; And sending, by the private network base station, the authentication success response to the public network user terminal according to the obtained address information of the private network base station. An implementation device for accessing a private network by a public network user, which is characterized by: a receiving unit, configured to receive an authentication request sent by a first network element device in a private network core network, where the authentication request includes identity identification information of a public network user terminal that is in a private network coverage area, and The authentication request is performed by the first network element device performing access authentication on the public network user terminal based on the pre-stored public network user information, and determining that the access authentication is passed; An authentication unit, configured to authenticate the public network user terminal based on the user authentication information corresponding to the identity identification information, and send the information to the first network element device after the authentication succeeds The authentication was successfully responded. An electronic device, comprising: one or more processors; One or more computer readable media having stored thereon a program for implementing a public network user access private network, wherein the program is executed by the one or more processors, as claimed The method of any one of 1 to 4. A computer readable medium, wherein the readable medium stores a program for implementing a public network user access private network, wherein when the program is executed by one or more processors, causing the processor to execute A method according to any one of claims 1 to 4. An electronic device, comprising: one or more processors; One or more computer readable media having stored thereon a program for implementing a public network user access private network, wherein the program is executed by the one or more processors, as claimed The steps of the method described in 5. A computer readable medium, wherein the readable medium stores a program for implementing a public network user access private network, wherein when the program is executed by one or more processors, causing the processor to execute The method of claim 5.

Images