CN116321166A - Hierarchical deployment method and device for enterprise-level MEC authentication system - Google Patents

Abstract

The invention discloses a hierarchical deployment method and device for an enterprise-level MEC authentication system, wherein the method includes: deploying a first-level system in an operator, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration, and Radius message forwarding functions ; Deploy the secondary system in the enterprise to provide APN configuration, user account configuration, client configuration and authentication service functions; the two-level system cooperates with each other through the Radius message forwarding function. The method and device realize two-level control, the first-level system implements operator network access equipment management and security policies, and the second-level system implements enterprise internal control, effectively solving the complexity and security problems of operator and enterprise user configuration.

Description

A hierarchical deployment method and device for an enterprise-level MEC authentication system

technical field

The invention relates to the field of MEC applications, in particular to a hierarchical deployment method and device for an enterprise-level MEC authentication system.

Background technique

Operators vigorously expand MEC (Mobile Edge Computing) applications to help enterprises digitally transform. In the MEC application, when a 5G user's mobile terminal accesses, the operator first performs the first authentication to obtain a network access permission; then, the enterprise authentication system performs the second authentication. The current mainstream implementation solution is that the enterprise authentication system directly connects to the operator's NAS (network access device), and realizes network access authentication through the Radius (a remote access authentication protocol) protocol. With the development of 5G services, when the SMF (session management function, a kind of NAS device) device is changed, it is necessary to modify the configuration on each enterprise authentication system, which brings a large workload to operators and enterprises and the accompanying security issues.

Contents of the invention

In order to solve the complexity and security problems of operator and enterprise user configuration, the present invention provides a hierarchical deployment method and device for an enterprise-level MEC authentication system, deploying a first-level system in the operator, and doing a good job in basic configuration and security protection, providing services for enterprises Reduce the burden, so that enterprises can concentrate on their own internal account management and control work.

To achieve the above object, the present invention adopts the following technical solutions:

In an embodiment of the present invention, a hierarchical deployment method of an enterprise-level MEC authentication system is proposed, the method comprising:

Deploy a first-level system in the carrier, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration and Radius message forwarding functions;

Deploy a secondary system in the enterprise to provide APN configuration, user account configuration, client configuration and authentication service functions;

The two-level system works in division and cooperation, and interacts through the Radius message forwarding function.

Furthermore, the configuration function of the enterprise-level authentication system is that the system forwards the Radius authentication message to the enterprise according to the APN identifier.

Furthermore, the signaling firewall configuration function allows setting the maximum concurrency limit and account blacklist of a single enterprise. The matching conditions of the account blacklist support regular expression matching rules for username/password, user number and device ID.

Further, the Radius message forwarding function is to receive the authentication request sent by the SMF, and forward it to the authentication server of the corresponding enterprise according to the APN identifier.

Furthermore, the function of the authentication service is to receive the authentication request message forwarded by the first-level system, perform internal authentication of the enterprise, and return the authentication result to the first-level system.

In an embodiment of the present invention, a hierarchical deployment device for an enterprise-level MEC authentication system is also proposed, which includes:

The first-level system function module is used to deploy the first-level system in the operator, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration and Radius message forwarding functions;

The secondary system function module is used to deploy the secondary system in the enterprise, providing APN configuration, user account configuration, client configuration and authentication service functions;

The forwarding function module is used for the division and cooperation of the two-level system, and interacts through the Radius message forwarding function.

Furthermore, the configuration function of the enterprise-level authentication system is that the system forwards the Radius authentication message to the enterprise according to the APN identification.

Furthermore, the signaling firewall configuration function allows setting the maximum concurrency limit and account blacklist of a single enterprise. The matching conditions of the account blacklist support regular expression matching rules for username/password, user number and device ID.

Further, the Radius message forwarding function is to receive the authentication request sent by the SMF, and forward it to the authentication server of the corresponding enterprise according to the APN identifier.

Furthermore, the function of the authentication service is to receive the authentication request message forwarded by the first-level system, perform internal authentication of the enterprise, and return the authentication result to the first-level system.

In an embodiment of the present invention, a computer device is also proposed, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the computer program, the aforementioned enterprise-level MEC authentication system is realized. Hierarchical deployment method.

In an embodiment of the present invention, a computer-readable storage medium is also provided, and the computer-readable storage medium stores a computer program for executing a hierarchical deployment method of an enterprise-level MEC authentication system.

Beneficial effect:

1. The present invention designs a hierarchical deployment scheme of an enterprise-level MEC authentication system, which has been effectively used in 5G Internet of Things services.

2. The present invention realizes the division of labor and cooperation between operators and enterprises through two-level deployment, based on the Radius forwarding protocol, and adopts technologies such as signaling firewalls, and provides a safe and efficient enterprise-level authentication service.

Description of drawings

Fig. 1 is a schematic flow chart of the hierarchical deployment method of the enterprise-level MEC authentication system of the present invention;

Fig. 2 is a schematic diagram of the SMF configuration page of an embodiment of the present invention;

Fig. 3 is a schematic diagram of an enterprise authentication system configuration page according to an embodiment of the present invention;

Fig. 4 is a schematic diagram of a signaling firewall configuration page according to an embodiment of the present invention;

Fig. 5 is a schematic diagram of an APN configuration page according to an embodiment of the present invention;

Fig. 6 is a schematic diagram of a user account configuration page according to an embodiment of the present invention;

Fig. 7 is a schematic diagram of a client configuration page according to an embodiment of the present invention;

Fig. 8 is a schematic structural diagram of the hierarchical deployment device of the enterprise-level MEC authentication system of the present invention;

Fig. 9 is a schematic structural diagram of the computer equipment of the present invention.

Detailed ways

The principle and spirit of the present invention will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and realize the present invention, but not to limit the present invention in any way. the scope of the invention. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

Those skilled in the art know that the embodiments of the present invention can be implemented as a system, device, device, method or computer program product. Therefore, the present disclosure may be embodied in the form of complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

According to the embodiment of the present invention, a hierarchical deployment method and device for an enterprise-level MEC authentication system is proposed, which realizes two-level control, the first-level system implements operator network access equipment management and security policies, and the second-level system implements enterprise internal control. It effectively solves the complexity and security problems of operator and enterprise user configuration.

The principle and spirit of the present invention will be explained in detail below with reference to several representative embodiments of the present invention.

Fig. 1 is a schematic flow chart of the hierarchical deployment method of the enterprise-level MEC authentication system of the present invention. As shown in Figure 1, the method is implemented in two stages, including:

S1. Deploy a first-level system in the operator to provide SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration and Radius message forwarding functions;

S2. Deploy a secondary system in the enterprise to provide APN (Access Point Name) configuration, user account configuration, client configuration and authentication service functions;

S3, two-level system division of labor and cooperation, interact through the Radius message forwarding function, jointly escort the enterprise MEC business, and achieve a safe and efficient business experience.

It should be noted that although the operations of the method of the present invention are described in a specific order in the above-mentioned embodiments and accompanying drawings, this does not require or imply that these operations must be performed in this specific order, or that all shown operations must be performed. operation to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution.

In order to explain the hierarchical deployment method of the above-mentioned enterprise-level MEC authentication system more clearly, a specific embodiment will be described below. However, it should be noted that this embodiment is only for better illustrating the present invention and does not constitute a Improper limitation of the invention.

This solution is applied in China Unicom's MEC project, which greatly improves the usability of the enterprise-level authentication system, reduces network security risks, and greatly promotes the development of MEC services. China Unicom MEC has undertaken multiple enterprise customers such as Sany Heavy Industry and Midea, and deployed authentication servers inside each enterprise customer. At first, these servers were directly connected to the core network SMF equipment, which brought a lot of network configuration workload. There are also great security risks. Later, the operator's first-level system is established for authentication and forwarding, and the core network SMF device IP and key are configured. The enterprise's second-level system only needs to be configured with the IP and key of the operator's first-level system. On the one hand, the core network SMF equipment and firewall no longer need to be frequently configured; on the other hand, the national certification center can also do a good job of security protection to prevent adverse effects on the core network.

The specific implementation method is as follows:

1. Introduction to carrier-level system functions

(1) The SMF configuration function, as shown in Figure 2, is used to configure the information of the SMF device, and the system only accepts the authentication request initiated by the input device.

Note: Items marked with "*" are required, others are optional. The key is input according to the ciphertext, and the transmission is encrypted.

(2) Enterprise authentication system configuration function, as shown in Figure 3, the system forwards the Radius authentication message to the enterprise according to the APN identification.

Note: Items marked with "*" are required, others are optional. The key is input according to the ciphertext, and the transmission is encrypted. The active and standby servers use the same key.

(3) The signaling firewall configuration function, as shown in Figure 4, is used to resist attacks. It can set the maximum concurrency limit and account blacklist of a single enterprise. The matching conditions of the account blacklist support user name/password, user number and Regular expression matching rules for device identification.

Note: Items marked with "*" are required, others are optional. The "User Attribute" drop-down options in "Match Condition" include: Username/Password, User Number, and Device ID.

(4) The Radius message forwarding function receives the authentication request sent by the SMF and forwards it to the authentication server of the corresponding enterprise according to the APN identifier.

2. Enterprise secondary system

(1) APN configuration function, as shown in Figure 5, the user maintains the APN information of the enterprise.

Note: Items marked with "*" are required, others are optional. "Authentication Method" drop-down options: Username/Password, User ID and Device ID.

(2) The user account configuration function, as shown in Figure 6, is used for the maintenance of enterprise 5G account information.

Explanation: The query condition "APN" drop-down selection, intelligent association. Items with "*" are required, others are optional. According to the authentication method corresponding to the selected APN, set the required items, and place the required items first:

When the authentication method is "Username/Password", the username/password must be filled.

When the authentication method is "User ID", the user ID is required.

When the authentication method is "Device ID", the device ID is required.

(3) The client configuration function, as shown in Figure 7, is used to set the information maintenance of the operator's first-level system.

Note: Items marked with "*" are required, others are optional. The key is input according to the ciphertext, and the transmission is encrypted.

(4) Authentication service function, receiving the authentication request message forwarded by the operator's first-level system, performing internal authentication of the enterprise, and returning the authentication result to the operator's first-level system.

Based on the same inventive concept, the present invention also proposes a hierarchical deployment device for an enterprise-level MEC authentication system. For the implementation of the device, reference may be made to the implementation of the above method, and repeated descriptions will not be repeated. The term "module" used hereinafter may be a combination of software and/or hardware that realizes predetermined functions. Although the devices described in the following embodiments are preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.

FIG. 8 is a schematic structural diagram of a hierarchical deployment device for an enterprise-level MEC authentication system according to the present invention. As shown in Figure 8, the device includes:

The first-level system function module 101 is used to deploy the first-level system in the operator, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration and Radius message forwarding functions;

The configuration function of the enterprise-level authentication system is that the system forwards the Radius authentication message to the enterprise according to the APN identification;

The signaling firewall configuration function allows setting the maximum concurrency limit and account blacklist of a single enterprise. The matching conditions of the account blacklist support regular expression matching rules for user name/password, user number and device identification;

The Radius message forwarding function is to receive the authentication request sent by the SMF and forward it to the authentication server of the corresponding enterprise according to the APN ID.

The secondary system function module 102 is used to deploy the secondary system in the enterprise, providing APN configuration, user account configuration, client configuration and authentication service functions;

The authentication service function is to receive the authentication request message forwarded by the first-level system, conduct internal authentication of the enterprise, and return the authentication result to the first-level system.

The forwarding function module 103 is used for the division and cooperation of the two-level system, and interacts through the Radius message forwarding function.

It should be noted that although several modules of the hierarchical deployment device of the enterprise-level MEC certification system are mentioned in the above detailed description, this division is only exemplary and not mandatory. Actually, according to the embodiment of the present invention, the features and functions of two or more modules described above may be embodied in one module. Conversely, the features and functions of one module described above may be further divided to be embodied by a plurality of modules.

Based on the foregoing inventive concepts, as shown in FIG. 8 , the present invention also proposes a computer device 200, including a memory 210, a processor 220, and a computer program 230 stored on the memory 210 and operable on the processor 220. The processor 220 When the computer program 230 is executed, the above-mentioned hierarchical deployment method of the enterprise-level MEC authentication system is realized.

Based on the aforementioned inventive concept, the present invention also proposes a computer-readable storage medium, which stores a computer program for executing the aforementioned enterprise-level MEC authentication system hierarchical deployment method.

In the MEC (Mobile Edge Computing) application scenario of a telecom operator, in addition to the operator's network access authentication, the enterprise-level authentication system also provides secondary authentication, providing enterprises with more flexible authority control. The hierarchical deployment method and device of the enterprise-level MEC authentication system proposed by the present invention have been effectively used in the 5G Internet of Things business; through the two-level deployment method, based on the Radius forwarding protocol, technologies such as signaling firewalls are used to realize the operator's The division of labor and cooperation with enterprises provides a safe and efficient enterprise-level authentication service.

Although the spirit and principles of the invention have been described with reference to a number of specific embodiments, it should be understood that the invention is not limited to the specific embodiments disclosed, nor does division of aspects imply that features in these aspects cannot be combined to achieve optimal performance. Benefit, this division is only for the convenience of expression. The present invention is intended to cover various modifications and equivalent arrangements encompassed within the spirit and scope of the appended claims.

For the limitation of the protection scope of the present invention, those skilled in the art should understand that on the basis of the technical solution of the present invention, various modifications or deformations that those skilled in the art can make without creative labor are still within the protection scope of the present invention within.

Claims (12)

1. A method for hierarchical deployment of an enterprise-level MEC authentication system, characterized in that the method comprises: Deploy a first-level system in the carrier, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration and Radius message forwarding functions; Deploy a secondary system in the enterprise to provide APN configuration, user account configuration, client configuration and authentication service functions; The two-level system works in division and cooperation, and interacts through the Radius message forwarding function. 2. The hierarchical deployment method of the enterprise-level MEC authentication system according to claim 1, wherein the enterprise-level authentication system configuration function is that the system forwards the Radius authentication message to the enterprise according to the APN mark. 3. The hierarchical deployment method of the enterprise-level MEC authentication system according to claim 1, wherein the signaling firewall configuration function is to allow setting the maximum concurrency limit and account blacklist of a single enterprise, and the matching conditions of the account blacklist Supports regular expression matching rules for username/password, user number, and device ID. 4. The hierarchical deployment method of the enterprise-level MEC authentication system according to claim 1, wherein the Radius message forwarding function is to receive the authentication request sent by the SMF, and forward it to the authentication server of the corresponding enterprise according to the APN mark. 5. The hierarchical deployment method of the enterprise-level MEC authentication system according to claim 1, wherein the authentication service function is to receive the authentication request message forwarded by the first-level system, carry out internal authentication of the enterprise, and return the authentication result to a level system. 6. A hierarchical deployment device for an enterprise-level MEC authentication system, characterized in that the device comprises: The first-level system function module is used to deploy the first-level system in the operator, providing SMF configuration, enterprise-level authentication system configuration, signaling firewall configuration and Radius message forwarding functions; The secondary system function module is used to deploy the secondary system in the enterprise, providing APN configuration, user account configuration, client configuration and authentication service functions; The forwarding function module is used for the division and cooperation of the two-level system, and interacts through the Radius message forwarding function. 7. The enterprise-level MEC authentication system hierarchical deployment device according to claim 6, wherein the enterprise-level authentication system configuration function is that the system forwards the Radius authentication message to the enterprise according to the APN identification. 8. The enterprise-level MEC authentication system hierarchical deployment device according to claim 6, wherein the signaling firewall configuration function is to allow setting the maximum concurrency limit and account blacklist of a single enterprise, and the matching conditions of the account blacklist Supports regular expression matching rules for username/password, user number, and device ID. 9. The hierarchical deployment device of the enterprise-level MEC authentication system according to claim 6, wherein the Radius message forwarding function is to receive the authentication request sent by the SMF, and forward it to the authentication server of the corresponding enterprise according to the APN mark. 10. The enterprise-level MEC authentication system hierarchical deployment device according to claim 6, wherein the authentication service function is to receive the authentication request message forwarded by the first-level system, carry out internal authentication of the enterprise, and return the authentication result to a level system. 11. A computer device, comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, characterized in that, when the processor executes the computer program, any one of claims 1-5 is realized. method described in the item. 12. A computer-readable storage medium, wherein a computer program for executing the method according to any one of claims 1-5 is stored in the computer-readable storage medium.

Images