WO2024140021A1 - 5g sa network internet of things terminal connection and access restriction method and system, and medium - Google Patents

Abstract

The present application relates to the technical field of Internet of things, and discloses a 5G SA network Internet of things terminal connection and access restriction method and system, and a medium. The method comprises: if a network manager receives an attachment request from an Internet of things terminal, controlling a user terminal to send a network access message; the network manager receiving the network access message, and a radio access network determining an access management module; acquiring a user subscription network slice; determining whether the access management module can process the user subscription network slice; if not, a network slice selection module acquiring an allowed slice and a target access management module; the network slice selection module sending the allowed slice to the target access management module; the target access management module acquiring a user subscription policy; and sending the user subscription policy to the Internet of things terminal, such that the Internet of things terminal accesses the target access management module. According to the present application, users are controlled to access an intranet only within a certain controllable small park range, and are prohibited from accessing services when outside this range, so that higher reliability and security are ensured.

Description

Method, system and medium for 5G SA network IoT terminal access and access restriction

This application is based on the Chinese patent application with application number 202211722173.5 and application date December 30, 2022, and claims its priority. The entire content of the application is hereby introduced as a whole into this application.

Technical Field

The present application relates to the technical field of the Internet of Things, and in particular, to a method, system and medium for 5G SA network Internet of Things terminal access and access restriction.

Background technique

In the 5G customized network scenario, for the sake of low latency and high reliability, many users will choose to reuse the network element equipment built by the operator on the access and control planes, such as AMF and SMF. On the data transmission plane, they will choose a lightweight UPF that is deployed to the campus and use a specific DNN to access internal services.

Among the existing technologies for restricting access to 5G IoT terminals, the most common one is to determine whether the user is in the list allowed to access based on the AMF ID or MME host name reported by the user, thereby implementing provincial-level regional restrictions. In the solution where the policy control module performs user access control based on the tracking area code, the tracking area code has a relatively large coverage area, making it difficult to accurately control the campus range, and the wireless side needs to re-plan and adjust the tracking area code. For operators, it is difficult to adjust the already planned tracking area codes. If the policy control module performs user session policy control based on the base station or cell level, and the user frequently reports location updates when moving, it will bring a large amount of signaling interaction, causing signaling congestion and affecting service use.

Therefore, how to simply and in real time control the access of IoT terminals so that users can only access the intranet within a small controllable campus range and are prohibited from accessing services outside this range, thereby ensuring higher reliability and security, needs to be solved urgently.

Application Contents

The technical problem to be solved by this application is to control users to access the intranet only within a certain controllable smaller campus area, and prohibit access to services outside this area, thereby ensuring higher reliability and security.

In a first aspect, an embodiment of the present application provides a method for access and access restriction of a 5G SA network IoT terminal, which is applied to a SA network IoT system, wherein the system includes an IoT terminal, a network manager, and a user terminal, wherein the network manager establishes a network connection with the IoT terminal and the user terminal respectively to realize the transmission of data information, and the network manager is provided with a radio access network, an access management module, a network slice selection module, and a policy control module, wherein the method includes:

If the network manager receives an attachment request from the IoT terminal, it controls the user terminal to send a network access message;

The network manager receives the access network message, and the radio access network determines an access management module corresponding to the access network message;

The determined access management module obtains the user subscribed network slice corresponding to the access network message from a preset slice database;

Determining whether the determined access management module can process the user-subscribed network slice;

If the determined access management module cannot process the user-subscribed network slice, the network slice selection module obtains the allowed slice and the target access management module corresponding to the user-subscribed network slice;

The network slice selection module resends the allowed slice to the target access management module;

The target access management module obtains a pre-stored user subscription policy corresponding to the allowed slice from the policy control module;

The user subscription policy is sent to the Internet of Things terminal so that the Internet of Things terminal can access the target access management module.

Preferably, the radio access network determines the access management module corresponding to the access network message, comprising:

Parsing the access network message to obtain corresponding GUAMI information;

Determining whether a matching access management module can be obtained according to the GUAMI information;

If a matching access management module can be obtained according to the GUAMI information, obtaining a matching access management module as the determined access management module;

If the matching access management module cannot be obtained according to the GUAMI information, the corresponding access management module is determined according to the request slice in the access network message.

Preferably, before determining the corresponding access management module according to the request slice in the access network message, the method further includes:

Determining whether the access network message includes a request slice;

If the access network message includes a request slice, executing the step of determining the corresponding access management module according to the request slice in the access network message;

If the access network message does not contain a requested slice, a registration request is sent to the default access management module.

Preferably, the target access management module obtains a pre-stored user subscription policy from the policy control module, including:

The policy control module performs switching subscription between tracking areas for a single user based on a preset tracking area code to obtain the user subscription policy.

Preferably, the network manager is further provided with a session management module, and the policy control module performs session policy control on the user based on a preset tracking area code; the policy control module performs switching subscription between tracking areas for a single user to obtain the user subscription policy, including:

If a signal of the tracking area switching sent by the user terminal is received, actively reporting the location to update the access network message;

The radio access network redetermines the access management module newly corresponding to the updated access network message;

The newly corresponding access management module reports the updated access network message to the policy control module through a preset interface;

The policy control module performs session policy control on the tracking area code carried in the session management module.

Preferably, the policy control module performs policy control on the tracking area code carried in the session management module, including:

If the tracking area code is in the allowed list of the session management module, a dynamic policy is issued to ensure the output of a first policy; the first policy is a higher quality of service policy;

If the tracking area code is not in the allowed list of the session management module, a blocking instruction is issued to Ensure the output of the second strategy, thereby blocking all user traffic, so that user traffic does not leave the campus; the second strategy has the highest global priority for the corresponding business rules.

Preferably, the determined access management module obtains the user subscribed network slice corresponding to the access network message from a preset slice database, further comprising:

If the target access management module obtains the user contract policy, it determines whether the requested slice, the user contracted network slice and the allowed slice can be combined to form an intersection slice;

If an intersection slice can be formed, allowing the user terminal to access;

If the intersection slice cannot be formed, the user terminal is denied access.

In a second aspect, an embodiment of the present application provides a system for access and access restriction of an IoT terminal in a 5G SA network, the system comprising an IoT terminal, a network manager and a user terminal, the network manager respectively establishing a network connection with the IoT terminal and the user terminal to realize the transmission of data information;

The system includes an attachment request unit configured in the Internet of Things terminal, a first sending unit configured in the user terminal, a receiving unit, a first acquiring unit, a judging unit, a second acquiring unit, a second sending unit, a third acquiring unit and a third sending unit configured in the network manager;

An attachment request unit, used for the network manager to receive an attachment request from the Internet of Things terminal;

A first sending unit, configured to control the user terminal to send a network access message if the network manager receives an attachment request from the Internet of Things terminal;

A receiving unit, configured for the network manager to receive the access network message, and the radio access network to determine an access management module corresponding to the access network message;

A first acquisition unit, configured for the determined access management module to acquire a user subscribed network slice corresponding to the access network message from a preset slice database;

A judging unit, used to judge whether the determined access management module can process the user-subscribed network slice;

A second acquisition unit is configured to, if the determined access management module cannot process the user-subscribed network slice, cause the network slice selection module to acquire an allowed slice and a target access management module corresponding to the user-subscribed network slice;

A second sending unit, configured for the network slice selection module to resend the allowed slice to the target access management module;

A third acquisition unit is used for the target access management module to acquire a pre-stored user subscription policy corresponding to the allowed slice from the policy control module;

The third sending unit is used to send the user subscription policy to the Internet of Things terminal, so that the Internet of Things terminal can access the target access management module.

In the third aspect, an embodiment of the present application further provides a system for 5G SA network IoT terminal access and access restriction, the system comprising an IoT terminal, a network manager and a user terminal, the IoT terminal comprising a first memory, a first processor and a first computer program stored on the first memory and executable on the first processor, the network manager comprising a second memory, a second processor and a second computer program stored on the second memory and executable on the second processor, the user terminal comprising a third memory, a third processor and a third computer program stored on the third memory and executable on the third processor, characterized in that the first processor executes the The first computer program, the second processor executing the second computer program, and the third processor executing the third computer program jointly implement the method for 5G SA network IoT terminal access and access restriction as described in the first aspect above.

In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a first computer program, a second computer program, and a third computer program. When the first computer program is executed by a first processor, the second computer program is executed by a second processor, and the third computer program is executed by a third processor, the method for 5G SA network IoT terminal access and access restriction as described in the first aspect above is jointly implemented.

Compared with the prior art, the present invention has at least one of the following beneficial technical effects:

If the network manager receives an attachment request from the Internet of Things terminal, it controls the user terminal to send an access network message; the network manager receives the access network message, and the radio access network determines the access management module corresponding to the access network message; the determined access management module obtains the user contracted network slice corresponding to the access network message from the preset slice database; it is judged whether the determined access management module can process the user contracted network slice; if the determined access management module cannot process the user contracted network slice, the network slice selection module obtains the allowed slice and the target access management module corresponding to the user contracted network slice; the network slice selection module resends the allowed slice to the target access management module; the target access management module obtains the pre-stored user contract policy corresponding to the allowed slice from the policy control module; and the user contract policy is sent to the Internet of Things terminal to enable the Internet of Things terminal to access the target access management module.

The policy control module performs tracking interval switching subscription for a single user. When the user terminal switches the tracking interval, it actively reports the location update message. The policy control module performs policy control on the tracking area code carried in the session message of the session management module: when the tracking area code is in the allowed list, dynamic control policies are issued, such as service quality assurance; when the tracking area code is not in the allowed list, all user traffic is blocked, so that the user traffic does not leave the park.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

Figure 1 is a flow chart of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 2 is a scenario diagram of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 3 is another flow chart of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 4 is a sub-process diagram of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 5 is another sub-process diagram of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 6 is another sub-process diagram of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 7 is another sub-process diagram of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 8 is another sub-process diagram of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 9 is a schematic diagram of another application scenario of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 10 is another application scenario schematic diagram of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 11 is a schematic diagram of another application scenario of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

Figure 12 is a schematic block diagram of the system for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application.

FIG. 13 is a schematic block diagram of a computer device provided in an embodiment of the present application.

Detailed ways

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and/or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and/or combinations thereof.

It should also be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in this application specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural forms unless the context clearly indicates otherwise.

It should be further understood that the term “and/or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

Please refer to Figures 1 and 2, Figure 1 is a flow chart of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application, and Figure 2 is a schematic diagram of an application scenario of the method for 5G SA network IoT terminal access and access restriction provided in an embodiment of the present application; the method for 5G SA network IoT terminal access and access restriction is applied to an SA network IoT system 10, and the system 10 includes an IoT terminal 11, a network manager 12 and a user terminal 13, and the method for 5G SA network IoT terminal access and access restriction is executed by application software installed in the IoT terminal 11, the network manager 12 and the user terminal 13, wherein the user terminal 13 is a terminal device that is connected to the network manager 12 for wireless communication based on a SIM card, such as smart watches, smart speakers, smart phones and other smart devices, the network manager 12 is a gateway server for network bridging and management, the network manager 12 can be used to manage the transmission of network access requests, and the IoT terminal 11 is used to provide network access for the user terminal 13. The network manager 12 establishes network connections with the IoT terminal 11 and the user terminal 13 to realize the transmission of data information. The user terminal 13 can send a network access request to the network manager 12. The IoT terminal 11 can provide corresponding network services to the user terminal 13 according to the network access request processed by the network manager 12. The network manager 12 is equipped with a radio access network RAN, an access management module AMF, a network slice selection module and a policy control module PCF. As shown in Figure 1, the method includes steps S110 to S180.

S110: If the network manager receives an attachment request from the IoT terminal, it controls the user terminal 13 to send a network access message.

The network manager can receive an attachment request from an IoT terminal. If the network manager receives the attachment request, it sends a feedback signal to the user terminal 13. After receiving the feedback signal, the user terminal 13 sends a network access message to the network manager.

S120. The network manager receives the access network message, and the radio access network RAN determines an access management module AMF corresponding to the access network message.

As shown in FIG. 3 , in a specific embodiment, step S120 further includes sub-steps S111 , S112 and S113 .

S111. Determine whether the access network message contains the request slice R; S112. If the access network message contains the request slice R, execute the step of determining the corresponding access management module AMF according to the request slice R in the access network message; S113. If the access network message does not contain the request slice R, send a registration request to the default access management module AMF.

As shown in FIG. 4 , in a specific embodiment, step S120 includes sub-steps S121 , S122 , S123 , and S124 .

S121. Parse the access network message to obtain the corresponding GUAMI information; S122. Determine whether a matching access management module AMF can be obtained according to the GUAMI information; in another embodiment, the matching access management module AMF can be replaced with the system default access management module AMF; S123. If a matching access management module AMF can be obtained according to the GUAMI information, obtain a matching access management module AMF as the determined access management module AMF; S124. If a matching access management module AMF cannot be obtained according to the GUAMI information, determine the corresponding access management module AMF according to the request slice R in the access network message.

Among them, the access management module AMF is the main functional unit of the 5G (fifth generation mobile communication technology) core network, which is used to complete the access and mobility management of terminal users; GUAMI information is the unique identifier of the access management module AMF. Among them, in the case of 5G access, the AN parameters (access network parameters) in the access network message include GUAMI information, request slice R, etc.

S130. The determined access management module AMF obtains the user subscribed network slice S corresponding to the access network message from a preset slice database.

The network manager also has a unified data management module (UDM). By providing a management framework that can uniformly manage basic IT facilities such as network, security, and storage, the unified data management module (UDM) creates a unified management center for the IT system, helping users to more effectively manage, utilize, and protect data assets. The preset slice database is located in the unified data management module (UDM). The slice database contains three types: request slice R (optional), contract network slice S, and allowed slice A.

As shown in FIG. 5 , in a specific embodiment, step S130 includes steps S131, S132, and S133.

S131. If the target access management module AMF obtains the user contract policy, it determines whether the requested slice R, the user contracted network slice S and the allowed slice A can be combined to form an intersection slice; S132. If an intersection slice can be formed, the user terminal 13 is allowed to access; S133. If an intersection slice cannot be formed, the user terminal 13 is denied access. The slice accessed by the final user terminal 13 is the intersection of the requested slice R (if any), the contracted network slice S and the allowed slice A. If there is no result after the intersection of the three, the user terminal 13 is denied access and the access process fails.

S140. Determine whether the determined access management module AMF can process the user-subscribed network slice S.

If the determined access management module AMF can process the user's contracted network slice S, the target access management module AMF obtains the pre-stored user contract policy corresponding to the allowed slice A from the policy control module PCF, and sends the user contract policy to the IoT terminal, so that the IoT terminal can access the target access management module AMF. The policy control module PCF is similar to the PCRF (Policy and Charging Rules Function) in the 4G network element, and is mainly used for billing, dynamic policy control, etc.

S150. If the determined access management module AMF cannot process the network slice S contracted by the user, the network slice selection module obtains the allowed slice A and the target access management module AMF corresponding to the network slice S contracted by the user.

S160. The network slice selection module resends the allowed slice A to the target access management module AMF.

S170. The target access management module AMF obtains the pre-stored user subscription policy corresponding to the allowed slice A from the policy control module PCF.

As shown in FIG6 , in a specific embodiment, step S170 is specifically step 171: the policy control module PCF performs switching subscription between tracking areas TA for a single user based on a preset tracking area code TAC to obtain the user subscription policy. More specifically, the policy control module PCF performs session policy control on the user based on the preset tracking area code TAC; the session policy control is that the policy control module PCF performs switching subscription between tracking areas TA for a single user to obtain the user subscription policy.

Among them, the Tracking Area Code (TAC) is the area used for paging and location update. Its regulation should ensure that the paging channel capacity is not limited, while the location update overhead at the area boundary is minimized and easy to manage. Reasonable planning of the Tracking Area Code (TAC) can balance the paging load and location update signaling process and effectively control the system signaling load.

As shown in FIG7 , a session management module SMF is also provided in the network manager. The session management module SMF is mainly responsible for interacting with the separated data plane, creating, updating and deleting PDU sessions, and managing the session environment with the user plane function UPF. Among them, a PDU session refers to the process of communication between a user terminal 13 and a data network DN; the user plane function UPF is a basic component of the 5G core network infrastructure system architecture defined by 3GPP (the Third Generation Partnership Project). Operators can rate limit, charge and legally intercept user data transmission based on the user plane function UPF, and record the traffic usage. The 5G user plane function UPF can sink on demand, reduce network latency, increase transmission rate, access the user intranet, and the traffic does not leave the park, meeting the needs of users at different levels. The user plane function UPF can sink as a result of the separation of the 5G control plane and the user plane, and is a reflection of the great progress of 5G technology compared to 4G technology.

In a specific embodiment, step S171 includes sub-steps S1711, S1712, S1713 and S1714.

S1711. If a signal indicating that the user terminal 13 switches the tracking area TA is received, the location is actively reported to update the access network message; S1712. The radio access network RAN redetermines the access management module AMF that newly corresponds to the updated access network message; S1713. The newly corresponding access management module AMF reports the updated access network message to the policy control module PCF through a preset interface; S1714. The policy control module PCF performs session policy control on the tracking area code TAC carried in the session management module SMF.

As shown in FIG. 8 , in a specific embodiment, step S1714 includes sub-steps S1715 and S1716 .

S1715. If the tracking area code TAC is in the allowed list of the session management module SMF, a dynamic policy is issued to ensure the output of the first policy; the first policy is a higher quality of service policy; S1716. If the tracking area code TAC is not in the allowed list of the session management module SMF, a blocking instruction is issued to ensure the output of the second policy, thereby blocking all user traffic, so that user traffic does not leave the campus; the second policy has the highest global priority for the corresponding business rules.

S180. Send the user subscription policy to the Internet of Things terminal so that the Internet of Things terminal accesses the target access management module AMF.

Since the number of slices that can be configured in the 5G core network and wireless base stations is limited, it is impossible to control access to one slice for each customer. Therefore, in this application, a smaller number of public slices are selected for access restriction, and allowed slices A are added to the base stations and core network elements related to the campus. The slices supported by each tracking area code TAC are configured through the network slice selection module, and the access management module AMF subscribes to the information of the tracking area code TAC and the slices through the network slice selection module to obtain the slices configured under the tracking area code TAC. Since the range of the tracking area code TAC is generally large, fewer public slices can meet the needs of most users.

The policy control module PCF performs switching subscription between tracking areas TA for a single user. When the user terminal 13 switches between tracking areas TA, it actively reports a location update message. The policy control module PCF performs policy control on the tracking area code TAC carried in the session message of the session management module SMF: when the tracking area code TAC is in the allowed list, dynamic control policies are issued, such as service quality assurance; when the tracking area code TAC is not in the allowed list, all user traffic is blocked, so that the user traffic does not leave the campus.

The main scenarios involved are listed below:

As shown in Figure 9, scenario 1: Park 1 is defined as the coverage area of base station 3, and base station 1, base station 2 and base station 3 are all in the same tracking area code TAC.

In this scenario, only the access restriction at the tracking area code TAC level configured by the policy control module PCF will accurately control access to only campus 1. Therefore, base station 1 or base station 2 configures the default slice A0, base station 3 configures the campus public slice A1, and the policy control module PCF configures the corresponding session control policy according to the tracking area code TAC1.

For users in this park, the contracted network slice is S1. In this scenario, S1=A1, and the slice R requested by user terminal 13 is empty by default. Therefore, in this scenario, the slice A1 is finally allowed, and users who have signed up for S1 can complete the registration and access process normally. After the session is established, when the policy control module PCF determines that the tracking area code TAC1 is in the allowed list, it issues a higher priority service policy. When the user moves to an area outside the base station 3, the slice A1 is finally allowed to be empty, and the user access is denied.

For users outside the park, the contracted network slice is S2, and the user terminal 13 requests that the slice R is empty. Finally, slice A1 is allowed to be empty, user access is denied, and registration fails.

According to the above analysis results, in this scenario, it can be ensured that non-campus users cannot access the user intranet no matter where they are. Users in the campus can access the intranet when they are in the campus and enjoy higher service quality. When they move out of the campus, access is denied, thereby achieving two-way secure access restriction.

If different customers configure the same slice, the terminal may access through other base stations outside the park. In this scenario, the location restriction of the tracking area code TAC needs to be superimposed, that is, the tracking area code TAC location control policy is issued through the policy control module PCF to achieve regional restrictions in different parks under the same slice (without re-adjusting the tracking area code TAC).

As shown in Figure 10, scenario 2: Park 1 is defined as the coverage area of base station 3, park 2 is defined as the coverage area of base station 4, and base station 1, base station 2 and base station 3 are all in the same tracking area code TAC.

Base station 1 and base station 2 are configured with the default slice A0, base station 3 and base station 4 are configured with the campus public slice A1, and at the same time, the policy control module PCF configures corresponding session control policies according to the tracking area code TAC1 and the tracking area code TAC2, and configures the tracking area code TAC that users in campus 1 are allowed to access to be tracking area code TAC1, and the tracking area code TAC that users in campus 2 are allowed to access to be tracking area code TAC2.

For users in Park 1 and Park 2, the network slice they have signed up for is S1. In this scenario, S1 = A1, and the slice R requested by the user terminal 13 is empty by default. Therefore, in this scenario, Park 1 and Park 2 finally allow the slice to be A1, and users who have signed up for S1 can complete the registration and access process normally.

In this scenario, the access restrictions of Park 1 under the tracking area code TAC1 are consistent with those in Scenario 1. If the user of Park 1 moves to Park 2, a location reporting event is triggered. Since their park public slices are the same, the user of Park 1 can still access Park 2 normally. After entering the session establishment process, the policy control module PCF determines that the tracking area code TAC2 reported by it is not in the list of allowed access, and sends a traffic blocking policy, which shows that the access is normal, but the intranet of Park 1 cannot be accessed. Move back to Park 1, report the location update to the policy control module PCF, and restore its normal service use in real time.

For users in Park 2, they can only access services normally within the coverage area of Base Station 4. The blocking reasons in other situations are the same as those in Park 1.

According to the above analysis results, in this scenario, it can be ensured that when users of this park move to different parks under the same slice, they cannot access the intranet. They can only access the intranet when they are within the park and enjoy higher service quality.

As shown in Figure 11, scenario three: Park 1 is defined as the coverage range of base station 3, and Park 2 is defined as the coverage range of base station 4 and base station 5, and base station 1, base station 2, base station 3, base station 4, and base station 5 are all under the same tracking area code TAC.

Base stations 1 and 2 are configured with the default slice A0, base station 3 is configured with the campus public slice A1, and base stations 4 and 5 are configured with the campus public slice A2. At the same time, the policy control module PCF configures the corresponding session control policy according to the tracking area code TAC1, and configures the tracking area code TAC allowed to be accessed by users in campus 1 and campus 2 to be tracking area code TAC1.

For users in Park 1, the contracted network slice is S1. In this scenario, S1 = A1, and the terminal request slice R is empty by default. For users in Park 2, the contracted network slice is S2. In this scenario, S1 = A2, and the terminal request slice R is empty by default. Therefore, in this scenario, the slice allowed in Park 1 is A1, and the slice allowed in Park 2 is A2.

In this scenario, if users in Park 1 move to Park 2, the users in Park 1 will Similarly, if users in Park 1 move to Park 2, users in Park 2 cannot access the network normally because their slices are different.

The analysis of campus 1 and campus 2 accessing areas outside tracking area code TAC1 is the same as scenario 1 and is not repeated here.

According to the above analysis results, in this scenario, it can be ensured that users in different parks under the same tracking area code TAC cannot access the intranet when they move to different parks under the same tracking area code TAC. They can only access the intranet when they are in the same park and enjoy higher service quality.

The embodiment of the present application also provides a system for 5G SA network IoT terminal access and access restriction, which is used to execute any embodiment of the aforementioned 5G SA network IoT terminal access and access restriction method. Specifically, please refer to Figure 12, which is a schematic block diagram of the system for 5G SA network IoT terminal access and access restriction provided in the embodiment of the present application.

As shown in FIG12 , the system includes an Internet of Things terminal 11, a network manager 12 and a user terminal 13. The network manager 12 establishes network connections with the Internet of Things terminal 11 and the user terminal 13 to achieve data information transmission. The system includes an attachment request unit 111 configured in the Internet of Things terminal 11, a first sending unit 131 configured in the user terminal 13, a receiving unit 121, a first obtaining unit 122, a judging unit 123, a second obtaining unit 124, a second sending unit 125, a third obtaining unit 126 and a third sending unit 127 configured in the network manager 12.

The attachment request unit 111 is used for the network manager 12 to receive an attachment request from the Internet of Things terminal 11.

The first sending unit 131 is configured to control the user terminal 13 to send a network access message if the network manager 12 receives an attachment request from the IoT terminal 11 .

The receiving unit 121 is used for the network manager 12 to receive an access network message, and the radio access network RAN determines an access management module AMF corresponding to the access network message.

The first acquisition unit 122 is used for the determined access management module AMF to obtain the user contracted network slice S corresponding to the access network message from a preset slice database.

The judgment unit 123 is used to determine whether the determined access management module AMF can process the user's contracted network slice S.

The second acquisition unit 124 is used for the network slice selection module to obtain the allowed slice A and the target access management module AMF corresponding to the user-contracted network slice S if the determined access management module AMF cannot process the user-contracted network slice S.

The second sending unit 125 is used for the network slice selection module to allow slice A to be resent to the target access management module AMF.

The third acquisition unit 126 is used for the target access management module AMF to obtain the pre-stored user subscription policy corresponding to the allowed slice A from the policy control module PCF.

The third sending unit 127 is used to send the user subscription policy to the Internet of Things terminal 11, so that the Internet of Things terminal 11 accesses the target access management module AMF.

The above-mentioned method for 5G SA network IoT terminal access and access restriction can be implemented in the form of a computer program. The IoT terminal 11 and the network manager 12 in the system for 5G SA network IoT terminal access and access restriction can be implemented as computer devices. The computer program can be implemented in the computer shown in FIG. Run on the machine device.

Here, the Internet of Things terminal 11 includes a first memory, a first processor, and a first computer program stored in the first memory and executable on the first processor, the network manager 12 includes a second memory, a second processor, and a second computer program stored in the second memory and executable on the second processor, the user terminal 13 includes a third memory, a third processor, and a third computer program stored in the third memory and executable on the third processor, and when the first processor executes the first computer program, the second processor executes the second computer program, and the third processor executes the third computer program, they jointly implement the method for 5G SA network Internet of Things terminal access and access restriction as described above.

Please refer to Figure 13, which is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device can be a method for executing 5G SA network IoT terminal access and access restriction to enable the network manager to determine whether the user terminal can access the intranet based on the attachment request of the IoT terminal and the access network message sent by the user terminal.

13 , the computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a system bus 501 , wherein the memory may include a storage medium 503 and an internal memory 504 .

The storage medium 503 can store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, the processor 502 can execute a method for accessing and restricting access to a 5G SA network IoT terminal, wherein the storage medium 503 can be a volatile storage medium or a non-volatile storage medium.

The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute the method of 5G SA network IoT terminal access and access restriction.

The network interface 505 is used for network communication to provide data information transmission, and the network communication is wired network communication and/or wireless network communication. It can be understood by those skilled in the art that the structure shown in FIG. 10 is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

Among them, the processor 502 is used to run the computer program 5032 stored in the memory to implement the corresponding functions in the above-mentioned 5G SA network IoT terminal access and access restriction method.

Those skilled in the art will appreciate that the embodiment of the computer device shown in FIG13 does not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such an embodiment, the structure and function of the memory and the processor are consistent with the embodiment shown in FIG13, and will not be described in detail here.

It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

In another embodiment of the present application, a computer readable storage medium is provided. The computer-readable storage medium may be volatile or non-volatile. The computer-readable storage medium stores a first computer program, a second computer program, or a third computer program, which together implements the steps included in the above-mentioned SIM card-based Internet of Things directional traffic management method when the first computer program is executed by the first processor, the second computer program is executed by the second processor, and the third computer program is executed by the third processor.

In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and units can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, and units with the same function may be combined into one unit. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be electrical, mechanical or other forms of connection.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or partly contributed to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a computer-readable storage medium, including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned computer-readable storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), disk or CD-ROM and other media that can store program codes.

The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims (10)

A method for access and access restriction of a 5G SA network Internet of Things terminal, characterized in that the method is applied to an SA network Internet of Things system, the system comprising an Internet of Things terminal, a network manager and a user terminal, the network manager respectively establishing a network connection with the Internet of Things terminal and the user terminal to realize the transmission of data information, the network manager is provided with a radio access network, an access management module, a network slice selection module and a policy control module, the method comprising: If the network manager receives an attachment request from the IoT terminal, it controls the user terminal to send a network access message; The network manager receives the access network message, and the radio access network determines an access management module corresponding to the access network message; The determined access management module obtains the user subscribed network slice corresponding to the access network message from a preset slice database; Determining whether the determined access management module can process the user-subscribed network slice; If the determined access management module cannot process the user-subscribed network slice, the network slice selection module obtains the allowed slice and the target access management module corresponding to the user-subscribed network slice; The network slice selection module resends the allowed slice to the target access management module; The target access management module obtains a pre-stored user subscription policy corresponding to the allowed slice from the policy control module; The user subscription policy is sent to the Internet of Things terminal so that the Internet of Things terminal can access the target access management module. The method for 5G SA network IoT terminal access and access restriction according to claim 1 is characterized in that the radio access network determines the access management module corresponding to the access network message, including: Parsing the access network message to obtain corresponding GUAMI information; Determining whether a matching access management module can be obtained according to the GUAMI information; If a matching access management module can be obtained according to the GUAMI information, obtaining a matching access management module as the determined access management module; If the matching access management module cannot be obtained according to the GUAMI information, the corresponding access management module is determined according to the request slice in the access network message. The method for 5G SA network IoT terminal access and access restriction according to claim 2 is characterized in that before determining the corresponding access management module according to the request slice in the access network message, it also includes: Determining whether the access network message includes a requested slice; If the access network message includes a request slice, executing the step of determining the corresponding access management module according to the request slice in the access network message; If the access network message does not contain a requested slice, a registration request is sent to the default access management module. The method for 5G SA network IoT terminal access and access restriction according to claim 1 is characterized in that the target access management module obtains a pre-stored user subscription policy from the policy control module, comprising: The policy control module performs switching subscription between tracking areas for a single user based on a preset tracking area code to obtain the user subscription policy. According to the method for 5G SA network IoT terminal access and access restriction according to claim 4, it is characterized in that the network manager is also provided with a session management module, and the policy control module performs session policy control on the user based on the preset tracking area code; the policy control module performs switching subscription between tracking areas for a single user to obtain the user signing policy, including: If a signal of the tracking area switching sent by the user terminal is received, actively reporting the location to update the access network message; The radio access network redetermines the access management module newly corresponding to the updated access network message; The newly corresponding access management module reports the updated access network message to the policy control module through a preset interface; The policy control module performs session policy control on the tracking area code carried in the session management module. The method for 5G SA network IoT terminal access and access restriction according to claim 5 is characterized in that the policy control module performs policy control on the tracking area code carried in the session management module, including: If the tracking area code is in the allowed list of the session management module, a dynamic policy is issued to ensure the output of a first policy; the first policy is a higher quality of service policy; If the tracking area code is not in the allowed list of the session management module, a blocking instruction is issued to ensure the output of the second policy, thereby blocking all user traffic, so that the user traffic does not leave the campus; the second policy has the highest global priority for the corresponding business rules. The method for 5G SA network IoT terminal access and access restriction according to claim 2 is characterized in that the determined access management module obtains the user contracted network slice corresponding to the access network message from a preset slice database, and further includes: If the target access management module obtains the user contract policy, it determines whether the requested slice, the user contracted network slice and the allowed slice can be combined to form an intersection slice; If an intersection slice can be formed, allowing the user terminal to access; If the intersection slice cannot be formed, the user terminal is denied access. A system for access and access restriction of 5G SA network Internet of Things terminals, characterized in that the system comprises an Internet of Things terminal, a network manager and a user terminal, and the network manager establishes a network connection with the Internet of Things terminal and the user terminal respectively to realize the transmission of data information; The system includes an attachment request unit configured in the Internet of Things terminal, a first sending unit configured in the user terminal, a receiving unit, a first acquiring unit, a judging unit, a second acquiring unit, a second sending unit, a third acquiring unit and a third sending unit configured in the network manager; An attachment request unit, used for the network manager to receive an attachment request from the Internet of Things terminal; A first sending unit, configured to control the user terminal to send a network access message if the network manager receives an attachment request from the Internet of Things terminal; A receiving unit is used for the network manager to receive the access network message, the radio access The network determines an access management module corresponding to the access network message; A first acquisition unit, configured for the determined access management module to acquire a user subscribed network slice corresponding to the access network message from a preset slice database; A judging unit, used to judge whether the determined access management module can process the user-subscribed network slice; A second acquisition unit is configured to, if the determined access management module cannot process the user-subscribed network slice, cause the network slice selection module to acquire an allowed slice and a target access management module corresponding to the user-subscribed network slice; A second sending unit, configured for the network slice selection module to resend the allowed slice to the target access management module; A third acquisition unit is used for the target access management module to acquire a pre-stored user subscription policy corresponding to the allowed slice from the policy control module; The third sending unit is used to send the user subscription policy to the Internet of Things terminal, so that the Internet of Things terminal can access the target access management module. A system for 5G SA network IoT terminal access and access restriction, characterized in that the system includes an IoT terminal, a network manager and a user terminal, the IoT terminal includes a first memory, a first processor and a first computer program stored in the first memory and executable on the first processor, the network manager includes a second memory, a second processor and a second computer program stored in the second memory and executable on the second processor, the user terminal includes a third memory, a third processor and a third computer program stored in the third memory and executable on the third processor, characterized in that when the first processor executes the first computer program, the second processor executes the second computer program and the third processor executes the third computer program, they jointly implement the method for 5G SA network IoT terminal access and access restriction as described in any one of claims 1 to 7. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a first computer program, a second computer program and a third computer program, which, when the first computer program is executed by a first processor, the second computer program is executed by a second processor and the third computer program is executed by a third processor, jointly implement the method for 5G SA network Internet of Things terminal access and access restriction as described in any one of claims 1 to 7.