CN115426139A - Access control method based on SIM card information and communication device - Google Patents

Abstract

The application provides an access control method and a communication device based on SIM card information, wherein the method comprises the following steps: a firewall in the enterprise private network receives an access request from terminal equipment, wherein the access request comprises an IP address of the terminal equipment; and the firewall determines the SIM card information corresponding to the IP address, and then performs access control on the access request according to the access control strategy associated with the SIM card information. Because the SIM card information is bound with each terminal device, the terminal devices in the enterprise private network can be subjected to differentiated and refined access control based on the SIM card information.

Description

An access control method and communication device based on SIM card information

Cross References to Related Applications

This application claims the priority of the Chinese patent application submitted to the State Intellectual Property Office of the People's Republic of China on November 19, 2021, with the application number 202111375766.4 and the title of the invention "An access control method and communication device based on IMSI information". The entire contents are incorporated by reference in this application.

technical field

The present application relates to the technical field of wireless communication, and in particular to an access control method and a communication device based on subscriber identity module (SIM) card information.

Background technique

In response to network requirements such as higher bandwidth, lower latency, more flexible and rapid service deployment, and massive connections, multi-access edge computing (MEC) technology emerged as the times require. MEC technology can move computing and storage resources to the edge of the network closer to users, and deploy edge user plane functional network elements for local offloading, thereby achieving lower latency.

For MEC enterprise private network scenarios, enterprises usually need to deploy a firewall at the entrance of the enterprise private network for network access control. Since there are various types of terminal devices connected to the enterprise private network (such as terminals in industrial control, cameras, etc.), they need to access different application services in the enterprise private network, so enterprises need to implement access control policies based on the type of terminal devices .

To achieve the above purpose, a solution in the prior art is to apply for a static Internet protocol (internet protocol, IP) address for each terminal device. This solution is expensive, the configuration solution is not easy to change, and the management is difficult. , and with the expansion of the application scope of enterprise private networks, it will lead to a large consumption of IP addresses of operators. Another solution is to enable user authentication on the firewall of the enterprise private network, and obtain access rights by asking users to enter their user names and passwords. This scheme, no matter which authentication method is adopted, generally requires the terminal device to actively enter the user name and password. The application of the program is relatively limited.

Contents of the invention

The present application provides an access control method and communication device based on SIM card information, which are used to implement differentiated and fine-grained access control for terminal equipment in an enterprise private network.

In the first aspect, the embodiment of the present application provides an access control method based on SIM card information. The method can be executed by a firewall in the enterprise private network, or can be executed by a component (such as a chip or circuit) configured in the firewall. The firewall Based on the SIM card information, access control can be performed on the terminal device's access request to the application service in the enterprise private network, so as to protect the security of the enterprise private network.

The method includes: a firewall in the enterprise private network receives an access request from a terminal device, and the access request includes the IP address of the terminal device; the firewall determines the SIM card information corresponding to the IP address; the firewall determines the SIM card information corresponding to the SIM card information; The associated access control policy implements access control on the access request.

In the above technical solution, the firewall in the enterprise private network can perform effective access control on the access request initiated by the terminal device to access the application service in the enterprise private network according to the SIM card information. Wherein, after receiving the access request of the terminal device, the firewall may convert the IP address in the access request into corresponding SIM card information, and then perform access control.

Wherein, the SIM card is an IC card held by a mobile user of the mobile communication system, and is called a subscriber identification card. Therefore, one SIM information and one terminal device can be bound one by one (the SIM card can be changed to different devices). In view of this, in practical applications, the identity of a terminal device can be identified according to the SIM card information, and the type of a terminal device can also be indirectly known. In practical applications, IP addresses may be dynamically allocated according to needs, that is, the IP address may be a dynamic IP address, and the dynamic IP address is bound to a protocol data unit PDU session of the terminal device, but according to the dynamic IP address It may not be possible to obtain inherent attribute information such as the identity and type of the terminal device. In this way, in this application, the IP address in the access request is first converted into the SIM card information of the terminal device, and then access control is performed, which helps to achieve differentiated and refined access control based on the identity, type and other information of the terminal device, thereby Protect information security in the enterprise private network.

In a possible design, the method further includes: the firewall receives the SIM card information and the IP address of the terminal device from the charging forwarding device or session management function network element in the enterprise private network; the firewall establishes the The mapping relationship between the SIM card information and the IP address, and then the firewall can determine the SIM card information corresponding to the IP address according to the mapping relationship.

In the above technical solution, the SIM card information and IP address of the terminal device may be the billing forwarding device in the private network of the enterprise, for example, the authentication, authentication and billing AAA server sends the terminal device to the firewall after the terminal device is authenticated by the operator. The firewall can establish a mapping relationship between the two based on the received information, and then when receiving an access request from the terminal device, it can convert from the IP address to the SIM card information according to the mapping relationship, thereby supporting subsequent access control .

In a possible design, the access request includes the application service that is requested to be accessed; the access control policy includes the application service in the private enterprise network that is allowed to be accessed by the terminal device corresponding to the SIM card information, and /or, not allowing the terminal device corresponding to the SIM card information to access the application service in the enterprise private network; in this way, the firewall performs access control on the access request according to the access control policy associated with the SIM card information, The method includes: if the application service requesting access is an application service in the enterprise private network that allows the terminal device corresponding to the SIM card information to access, then allow the access request; otherwise, block the access request.

In the above technical solution, the firewall can timely release reasonable access requests and block unreasonable access requests according to corresponding access control policies, thereby protecting the information security in the enterprise private network.

In a possible design, the method further includes: association configuration information is stored in the firewall, and the association configuration information includes an access control policy associated with information of each SIM card in the enterprise private network.

In the above technical solution, an associated access control policy can be set for each SIM card information in the enterprise private network, for example, set according to the type or role of the terminal device bound to the SIM card information, thereby effectively improving the accuracy of access control.

In the second aspect, the embodiment of the present application provides an access control method based on SIM card information. The method can be executed by the billing forwarding device in the private network of the enterprise, or can be implemented by a component configured on the billing forwarding device (such as a chip or circuit), the billing and forwarding device can be used to perform authentication, authentication and billing for terminal equipment accessing the enterprise private network, and to support the access control of the firewall in the enterprise private network.

The method includes: after the terminal equipment in the private network of the enterprise is authenticated by the operator, the charging and forwarding device receives the charging information from the network element with the session management function; the charging and forwarding device sends the terminal to the firewall in the private network of the enterprise The SIM card information and IP address of the device, the SIM card information and the IP address are obtained according to the charging information.

In a possible design, the sending of the SIM card information and IP address of the terminal device by the charging forwarding device to the firewall in the enterprise private network may be as follows: the charging forwarding device in the charging information The format of the SIM card information and the IP address is converted, and the billing information after the format conversion is sent to the firewall, wherein the SIM card information in the billing information after the format conversion can be located in the user name field.

In a possible design, the charging forwarding device in the enterprise private network receives the charging information from the session management function network element through a charging protocol, and the charging protocol is the remote user dial-up authentication service RADIUS protocol or Diameter DIAMETER protocol.

In the third aspect, the embodiment of the present application provides a communication device. The communication device may have the function of implementing the firewall in the first aspect above, or may also have the function of implementing the billing and forwarding device in the second aspect above. The communication device may be a network device, or a chip included in the network device.

The functions of the communication device may be realized by hardware, or may be realized by executing corresponding software by hardware, and the hardware or software includes one or more modules or units or means corresponding to the above functions.

In a possible design, the structure of the communication device includes a processing module and a transceiver module, wherein the processing module is configured to support the communication device to perform the function corresponding to the firewall in the first aspect above. The transceiver module is used to support communication between the communication device and other communication devices. For example, when the communication device is a firewall, the transceiver module can receive an access request from a terminal device. The communication device may further include a storage module coupled to the processing module, and the storage module stores necessary program instructions and data of the communication device. As an example, the processing module may be a processor, the communication module may be a transceiver, and the storage module may be a memory, and the memory may be integrated with the processor or configured separately from the processor.

In another possible design, the structure of the communication device includes a processor, and may also include a memory. The processor is coupled with the memory, and can be used to execute the computer program instructions stored in the memory, so that the communication device executes the method in any possible design of the first aspect or the second aspect above. Optionally, the communication device further includes a communication interface, and the processor is coupled to the communication interface. When the communication device is a network device, the communication interface may be a transceiver or an input/output interface; when the communication device is a chip included in the network device, the communication interface may be an input/output interface of the chip. Optionally, the transceiver may be a transceiver circuit, and the input/output interface may be an input/output circuit.

In a fourth aspect, an embodiment of the present application provides a chip system, including: a processor, the processor is coupled to a memory, and the memory is used to store programs or instructions, and when the programs or instructions are executed by the processor , so that the chip system implements the method in any possible design of the first aspect or the second aspect above.

Optionally, the chip system may further include an interface circuit for exchanging code instructions from the memory to the processor.

Optionally, there may be one or more processors in the chip system, and the processors may be implemented by hardware or by software. When implemented in hardware, the processor may be a logic circuit, an integrated circuit, or the like. When implemented by software, the processor may be a general-purpose processor implemented by reading software codes stored in a memory.

Optionally, there may be one or more memories in the chip system. The memory can be integrated with the processor, or can be set separately from the processor. Exemplarily, the memory may be a non-transitory processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip, or may be respectively provided on different chips.

In the fifth aspect, the embodiment of the present application provides a computer-readable storage medium, on which a computer program or instruction is stored, and when the computer program or instruction is executed, any one of the above-mentioned first aspect or the second aspect is possible The method in the design is executed.

In a sixth aspect, an embodiment of the present application provides a computer program product. When the communication device executes the computer program product, the communication device executes the method in any possible design of the first aspect or the second aspect above.

In a seventh aspect, the embodiment of the present application provides a communication system, where the communication system includes a firewall and a billing and forwarding device in an enterprise private network. The communication system may also include terminal equipment. Optionally, the communication system may further include session management functional network elements, access and mobility management functional network elements, user plane functional network elements and radio access network equipment in the public network. The terminal device can access the public network or the above-mentioned enterprise private network, for example, to request access to certain application services in the enterprise private network.

Specifically, the billing forwarding device is configured to receive billing information from the session management function network element after the terminal device is authenticated by the operator, and send the user identification SIM card information of the terminal device to the firewall and IP address, the SIM card information and the IP address are obtained according to the billing information;

The firewall is configured to receive the SIM card information and the IP address of the terminal equipment from the charging forwarding device, and establish a mapping relationship between the SIM card information and the IP address;

The firewall is further configured to receive an access request from the terminal device, the access request includes the IP address of the terminal device, and according to the mapping relationship, determine the SIM card information corresponding to the IP address, according to The access control policy associated with the SIM card information performs access control on the access request.

In a possible design, the access request includes the application service that is requested to be accessed; the access control policy includes the application service in the private enterprise network that is allowed to be accessed by the terminal device corresponding to the SIM card information, and /or, the application service in the enterprise private network that is not allowed to be accessed by the terminal device corresponding to the SIM card information; the firewall is specifically used for: if the application service that requests access is allowed If the application service accessed by the terminal device allows the access request, otherwise blocks the access request.

In a possible design, association configuration information is stored in the firewall, and the association configuration information includes an access control policy associated with information of each SIM card in the enterprise private network.

In a possible design, the charging forwarding device is specifically configured to: receive the charging information from the session management function network element through a charging protocol, and the charging protocol is a remote user dial-up authentication service RADIUS protocol or DIAMETER protocol.

For the technical effects that can be achieved by any one of the above-mentioned second to sixth aspects, you can refer to the technical effects that can be achieved by any possible design in the first aspect or any possible design in the second aspect. to discuss.

Description of drawings

FIG. 1 is a schematic diagram of a network architecture of a communication system applicable to an embodiment of the present application;

FIG. 2 is an application scenario applicable to the embodiment of the present application;

FIG. 3 is a schematic flow diagram of an access control method based on SIM card information provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a communication device provided in an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a communication device provided by an embodiment of the present application.

detailed description

The embodiments of the present application will be further described in detail below in conjunction with the accompanying drawings.

Fig. 1 exemplarily shows the network architecture of a communication system applicable to the embodiment of the present application. As shown in Fig. 1, the network architecture includes terminal equipment, an operator's core The core network includes a session management function (session management function, SMF) network element, and the SMF network element is used to be responsible for the session control function of the enterprise terminal accessing the enterprise private network, such as the protocol data unit (protocol data unit, PDU) session of the user Establishment, release and update, etc. The MEC network may include radio access network equipment and user plane function (user plane function, UPF) network elements. It is responsible for the connection function of enterprise terminals accessing the enterprise private network. The UPF network element is deployed downward to the enterprise campus and is managed by the operator), firewall (firewall, FW) and is used to implement one or more enterprise applications (as shown in the figure) Enterprise applications in 1, 2, N) deployed server equipment, etc. It may also include an accounting forwarding device, wherein the accounting forwarding device may be an enterprise authentication, authorization, accounting (AAA) server, and the enterprise AAA server may be used to be responsible for authenticating the enterprise terminal and transferring the terminal device's Relevant information is forwarded to the firewall deployed in the enterprise private network. The firewall is responsible for role-based and fine-grained access control on terminal devices connected to the enterprise private network.

The above SMF can be integrated with the billing and forwarding device into a module to perform corresponding operations, the billing and forwarding device can also be integrated with a firewall into a module to perform corresponding operations, and the UPF can be integrated with the firewall into a module to perform corresponding operations. In addition, the above-mentioned operator core network and MEC network can be set on the operator-side network, and the billing forwarding device, firewall, and enterprise application can be set up on the enterprise-side network. Of course, in practical applications, the billing forwarding device and firewall can also It is set in the operator-side network, which is not specifically limited in this application.

Among them, the operator-side network may also be referred to as an operator network or a public network, and the enterprise-side network may also be referred to as an enterprise private network, enterprise private network, campus network, or non-public network.

Wherein, the terminal equipment may also be called user equipment (user equipment, UE), mobile station, mobile terminal, and so on. Terminal devices can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things (internet of things, IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wear, smart transportation, smart city, etc. Terminal devices can be mobile phones, tablet computers, computers with wireless transceiver functions, wearable devices, vehicles, drones, helicopters, airplanes, ships, robots, robotic arms, smart home devices, etc. This application does not limit the specific technology and specific equipment form adopted by the terminal equipment.

The wireless access network equipment can be a base station (base station), an evolved base station (evolved NodeB, eNodeB), a transmission reception point (transmission reception point, TRP), and a next generation base station (next generation NodeB, gNB) in a 5G mobile communication system , a next-generation base station in a 6G mobile communication system, a base station in a future mobile communication system, or an access node in a wireless fidelity (WiFi) system, etc.; it can also be a module or unit that completes some functions of the base station, for example, It can be a centralized unit (central unit, CU) or a distributed unit (distributed unit, DU). The radio access network equipment may be a macro base station, a micro base station or an indoor station, or a relay node or a donor node. This application does not limit the specific technology and specific equipment form adopted by the radio access network equipment.

It should be noted that the above-mentioned network element or function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform). Optionally, the foregoing network element or function may be implemented by one device, or jointly implemented by multiple devices, or may be a functional module in one device, which is not specifically limited in this application.

It should also be understood that the session management function network element and the user plane function network element in this application may be the SMF and UPF in FIG. This application is not limited to this. For ease of description, in the embodiments of the present application, SMF and UPF will be used as an example of the session management functional network element and the user plane functional network element respectively to introduce the technical solution provided by the present application.

Fig. 2 exemplarily shows a possible application scenario of the embodiment of the present application. As shown in Fig. 2 , terminal devices accessing the enterprise private network are of different types, assume different roles, and may need to access different Application service (application). For example, terminal devices may include cameras, industrial control terminals, virtual reality terminals, unmanned driving terminals, Internet of Things terminals, and so on. Enterprises often need to set different access control policies for these accesses. For example, for terminal device 1 (such as a camera), only App1 (video server) is allowed to be accessed, and App2 (production server) cannot be accessed.

FIG. 3 exemplarily shows an access control method based on SIM card information provided by an embodiment of the present application. This method can be executed through data interaction between terminal equipment, SMF, and firewall. Of course, in actual application, when there are multiple firewalls, it can also be executed through data interaction with the billing and forwarding device, as shown in Figure 3 , the method includes:

In step 301, the charging forwarding device receives charging information from the SMF network element after the terminal equipment is authenticated by the operator.

Step 302, the billing and forwarding device sends the SIM card information and IP address of the terminal device to the firewall in the enterprise private network, and the SIM card information and IP address are obtained according to the billing information.

Correspondingly, the firewall receives the SIM card information and IP address of the terminal equipment from the charging forwarding device.

Taking the scenario of using MEC technology to build an enterprise private network in a 5G network as an example, the terminal device can initiate a request to access the enterprise private network after connecting to the 5G network. The SMF network element in the 5G network can receive the request and authenticate the terminal device to confirm whether the terminal device can access the enterprise network.

Further, the SMF network element can send charging information to the charging forwarding device or the firewall based on the charging protocol, and the charging information is used for charging the terminal equipment and meeting other statistical requirements. The accounting protocol may be the RADIUS protocol or the DIAMETER protocol, which is not limited. The charging information may include the SIM card information and IP address of the terminal device. The SIM card information refers to identification information of a SIM card installed in a terminal device, and different terminal devices (or different SIM cards) have different SIM card information. The IP address refers to the IP address allocated to the terminal device by the SMF network element mentioned above after the terminal device is authenticated.

Subsequently, the charging forwarding device may forward the SIM card information and IP address of the terminal equipment in the charging information to the firewall. It should be noted that the format and requirements of the information exchanged between the SMF and the charging forwarding device cannot be directly recognized by the firewall. If the charging forwarding device transparently forwards the charging information received from the SMF network element to the firewall, it may As a result, the firewall cannot correctly interpret the SIM card information and IP address in the billing information, and thus cannot perform effective network access control. Therefore, in order to facilitate the interpretation of information by the firewall, the billing forwarding device can convert the format and requirements of the SIM card information and IP address in the billing information into a format and requirements that can be interpreted by the firewall, and then forward it to the firewall. For example, the charging forwarding device may fill in the SIM card information into the user name of the charging information.

In step 303, the firewall establishes a mapping relationship between the SIM card information and the IP address of the terminal device.

In this application, associated configuration information may be stored in the firewall, and the associated configuration information includes the access control policy associated with each SIM card information in the enterprise private network. That is, the present application can set an associated access control policy for each SIM card information in the enterprise private network, and generate corresponding associated configuration information. It should be noted that the associated configuration information may be generated by the firewall and configured in the firewall, or may be generated by other network elements (such as the charging forwarding device in the enterprise private network, the OAM network element of the management plane, etc.) and then notified to the firewall. This application does not make specific limitations.

It should be noted that, when the present application sets the access control policy associated with the SIM card information, the type or role of the terminal device corresponding to the SIM card information may be considered. For example, control certain types of terminal devices to allow access to a certain type of application services, while other types of terminal devices are not allowed to access this type of application services, so as to achieve fine-grained access control based on terminal types or roles. In this way, when the firewall receives an access request from a terminal device for an application service in the enterprise private network, the firewall can map the IP address carried in the access request to the SIM card information according to the mapping relationship, and then according to the SIM card information The associated access control policy performs access control on this access. This process will be described in detail through steps 304 to 306 described below.

Step 304, the firewall receives an access request from the terminal device, where the access request includes the IP address of the terminal device.

Exemplarily, the access request includes information such as source IP address, destination IP address, source port number, destination port number, and protocol type, and the IP address of the terminal device refers to the source IP address in the access request.

Step 305, the firewall determines the SIM card information corresponding to the IP address of the terminal device in the access request according to the above mapping relationship.

Step 306, the firewall performs access control on the access request according to the access control policy associated with the SIM card information.

Exemplarily, the access request may include the application service that the terminal device requests to access, for example, the access request may carry some information related to the application service that the terminal device requests to access (such as protocol type, destination IP address, destination port number, etc.), In this way, the firewall can determine which application services the terminal device requests to access according to information such as the protocol type, destination IP address, and destination port number carried in the access request. The access control policy associated with the SIM card information may include: allowing the terminal device corresponding to the SIM card information to access one or more application services in the enterprise private network, and/or not allowing the terminal device corresponding to the SIM card information to access One or more application services in the enterprise private network. In this way, the firewall performs access control on the access request of the terminal device according to the access control policy associated with the SIM card information. If the application service is used, the access request is allowed (for example, the access request is forwarded to the corresponding application server), otherwise the access request is blocked.

In the MEC-based enterprise private network scenario, in the above technical solution, the enterprise can set a reasonable access control policy for the SIM card information corresponding to the terminal device in the firewall according to the type or role of the terminal device. , and transmit the mapping relationship between the IP address of the terminal device and the SIM card information to the firewall, so that the firewall can perform refined access control on the terminal device's access to the enterprise private network based on the SIM card information and the preset access control policy.

The above technical solution also has the following beneficial effects: First, there is no need to bind the terminal device with a static IP address, which reduces the consumption of IP addresses for operators. Second, there is no need for terminal devices to enter user names and passwords, and the applicable scenarios are more extensive, especially IoT scenarios where the capabilities of terminal devices are limited. Third, it can reduce the complexity of coordination and cooperation between operators and enterprises.

The embodiment of the present application also provides a communication device. Please refer to FIG. 4 , which is a schematic structural diagram of a communication device provided in the embodiment of the present application. The communication device 400 includes: a transceiver module 410 and a processing module 420 . The communication device can be used to realize the function of the firewall in the enterprise private network in the above method embodiment, or can be used to realize the function of the authentication, authentication and accounting AAA server in the enterprise private network in the above method embodiment. The communication device may be a network device, or a device capable of supporting the network device to implement the corresponding functions in the foregoing method embodiments (for example, a chip included in the network device), or the like.

Exemplarily, when the communication device executes the operations or steps corresponding to the firewall in the enterprise private network in the method embodiment shown in FIG. Including the IP address of the terminal equipment; processing module 420, used to determine the International Mobile Subscriber Identity code SIM card information corresponding to the IP address, and according to the access control policy associated with the SIM card information, perform the access request Access control.

In a possible design, the transceiving module 410 is also configured to: receive the SIM card information and the IP address of the terminal device from the charging forwarding device in the enterprise private network; the processing module 420 is also configured to: It is used to establish a mapping relationship between the SIM card information and the IP address, and determine the SIM card information corresponding to the IP address according to the mapping relationship.

In a possible design, the access request includes the application service that is requested to be accessed; the access control policy includes the application service in the private enterprise network that is allowed to be accessed by the terminal device corresponding to the SIM card information, and /or, not allowing the terminal device corresponding to the SIM card information to access the application service in the enterprise private network; the processing module 420 is specifically configured to: according to the access control policy associated with the SIM card information, Perform access control on access requests, including: if the application service requesting access is an application service in the enterprise private network that allows the terminal device corresponding to the SIM card information to access, then allow the access request, otherwise block the access ask.

In a possible design, association configuration information is stored in the processing module, and the association configuration information includes an access control policy associated with information of each SIM card in the enterprise private network.

Exemplarily, when the communication device executes the operations or steps corresponding to the billing and forwarding device in the enterprise private network in the method embodiment shown in FIG. The charging information of the session management function network element; the processing module 420 is used to send the international mobile subscriber identity code SIM card information and IP address of the terminal device to the firewall in the enterprise private network through the transceiver module 410, so The SIM card information and the IP address are obtained according to the billing information.

In a possible design, the transceiver module 410 is specifically configured to receive the charging information from the session management function network element through a charging protocol, where the charging protocol is the Remote User Dialing Authentication Service RADIUS protocol or DIAMETER protocol.

The processing module 420 involved in the communication device may be implemented by at least one processor or processor-related circuit components, and the transceiver module 410 may be implemented by at least one transceiver or transceiver-related circuit components or a communication interface. The operations and/or functions of the modules in the communication device are respectively for realizing the corresponding flow of the method shown in FIG. 3 , and for the sake of brevity, details are not repeated here. Optionally, the communication device may further include a storage module, which may be used to store data and/or instructions, and the transceiver module 410 and/or processing module 420 may read the data and/or instructions in the access module, Thus, the communication device implements the corresponding method. The storage module can be implemented, for example, by at least one memory.

The above-mentioned storage module, processing module and transceiver module may exist separately, or may be integrated in whole or in part, such as integration of a storage module and a processing module, or integration of a processing module and a transceiver module.

Please refer to FIG. 5 , which is another schematic structural diagram of a communication device provided in an embodiment of the present application. The communication device can be used to implement the corresponding function of the firewall in the enterprise private network in the above method embodiment, or can be used to realize the function of the billing and forwarding device in the enterprise private network in the above method embodiment. The communication device may be a network device or a device capable of supporting the network device to implement the corresponding functions in the foregoing method embodiments (for example, a chip included in the network device), or the like.

The communication device 500 may include a processor 501 and a memory 502 . Wherein, the memory 502 is used to store program instructions and/or data, and the processor 501 is used to execute the program instructions stored in the memory 502, so as to implement the methods in the above method embodiments.

Optionally, the memory 502 is coupled to the processor 501, and the coupling is an indirect coupling or a communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used between devices, units or modules information interaction.

Optionally, the communication device 500 may further include a communication interface 503. The communication interface 503 is used to communicate with other devices through a transmission medium, for example, to transmit signals received from other communication devices to the processor 501, or from the processor The signal at 501 is transmitted to other communication devices. The communication interface 503 may be a transceiver, or an interface circuit, such as a transceiver circuit, a transceiver chip, and the like.

In one embodiment, the communication interface 503 may be specifically used to execute the actions of the above-mentioned transceiver module 410, and the processor 501 may be specifically used to execute the above-mentioned actions of the processing module 420, which will not be repeated in this application.

The specific connection medium among the processor 501, the memory 502, and the communication interface 503 is not limited in the embodiment of the present application. In the embodiment of the present application, in FIG. 5, the processor 501, the memory 502, and the communication interface 503 are connected through a bus 504. The bus is represented by a thick line in FIG. 5, and the connection mode between other components is only for schematic illustration. , is not limited. The bus can be divided into address bus, data bus, control bus and so on. For ease of representation, only one thick line is used in FIG. 5 , but it does not mean that there is only one bus or one type of bus.

The embodiment of the present application also provides a chip system, including: a processor, the processor is coupled with a memory, and the memory is used to store programs or instructions, and when the programs or instructions are executed by the processor, the The chip system implements the method corresponding to the firewall in the enterprise private network in the above method embodiment, or implements the method corresponding to the charging forwarding device in the enterprise private network in the above method embodiment.

Optionally, there may be one or more processors in the chip system. The processor can be realized by hardware or by software. When implemented in hardware, the processor may be a logic circuit, an integrated circuit, or the like. When implemented by software, the processor may be a general-purpose processor implemented by reading software codes stored in a memory.

Optionally, there may be one or more memories in the chip system. The memory can be integrated with the processor, or can be set separately from the processor, which is not limited in this application. Exemplarily, the memory can be a non-transitory processor, such as a read-only memory (read-only memory, ROM), which can be integrated with the processor on the same chip, or can be respectively arranged on different chips. The type of the memory, and the arrangement of the memory and the processor are not specifically limited.

Exemplarily, the chip system may be a field programmable gate array (field programmable gate array, FPGA), an application specific integrated circuit (ASIC), or a system chip (system on chip, SoC), or It can be a central processor unit (CPU), a network processor (network processor, NP), a digital signal processing circuit (digital signal processor, DSP), or a microcontroller (micro controller unit) , MCU), and may also be a programmable controller (programmable logic device, PLD) or other integrated chips.

It should be understood that each step in the foregoing method embodiments may be implemented by an integrated logic circuit of hardware in a processor or instructions in the form of software. The method steps disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

The embodiment of the present application also provides a computer-readable storage medium, where a computer program or instruction is stored in the computer storage medium, and when the computer program or instruction is executed, the communication device executes the method in the foregoing method embodiment.

The embodiment of the present application further provides a computer program product, which enables the communication device to execute the method in the foregoing method embodiments when the communication device reads and executes the computer program product.

The embodiment of the present application also provides a communication system, which includes a firewall in an enterprise private network and an AAA server for authentication, authentication and accounting. The communication system may also include terminal equipment. Optionally, the communication system may further include session management functional network elements, access and mobility management functional network elements, user plane functional network elements and radio access network equipment in the public network. The terminal device can access the public network or the above-mentioned enterprise private network, for example, to request access to certain application services in the enterprise private network. The foregoing network elements or functional entities may cooperate with each other to implement the methods in the foregoing method embodiments.

It should be understood that the processor mentioned in the embodiment of the present application may be a CPU, or other general-purpose processors, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. A general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.

It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Wherein, the non-volatile memory can be ROM, programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically erasable programmable read-only memory (electrically EPROM) , EEPROM) or flash memory. Volatile memory can be random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, many forms of RAM are available, such as static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM ) and direct memory bus random access memory (direct rambus RAM, DRRAM).

It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components, the memory (storage module) is integrated in the processor.

It should be noted that the memories described herein are intended to include, but are not limited to, these and any other suitable types of memories.

It should be understood that the various numbers involved in the various embodiments of the present application are only for the convenience of description, and the size of the serial numbers of the above-mentioned processes or steps does not mean the sequence of execution, the execution of each process or steps The order should be determined by its functions and internal logic, and should not constitute any limitation to the implementation process of the embodiment of the present invention.

Those skilled in the art can appreciate that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

If the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media capable of storing program codes such as U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk.

In each embodiment of the present application, if there is no special explanation and logical conflict, the terms and/or descriptions between different embodiments are consistent and can be referred to each other, and the technical features in different embodiments are based on their inherent Logical relationships can be combined to form new embodiments.

Claims (19)

1. An access control method based on SIM card information, the method comprising:

a firewall in an enterprise private network receives an access request from terminal equipment, wherein the access request comprises an Internet Protocol (IP) address of the terminal equipment;

the firewall determines the SIM card information of the user identity corresponding to the IP address;

and the firewall performs access control on the access request according to the access control strategy associated with the SIM card information.

2. The method of claim 1, further comprising:

the firewall receives SIM card information and the IP address of the terminal equipment from a charging forwarding device or a session management function network element in the enterprise private network;

the firewall establishes a mapping relation between the SIM card information and the IP address;

the firewall determines the SIM card information corresponding to the IP address, and the method comprises the following steps:

and the firewall determines the SIM card information corresponding to the IP address according to the mapping relation.

3. The method according to claim 1 or 2, wherein the access request includes an application service requesting access;

the access control strategy comprises application services in the enterprise private network which are allowed to be accessed by the terminal equipment corresponding to the SIM card information, and/or application services in the enterprise private network which are not allowed to be accessed by the terminal equipment corresponding to the SIM card information;

the firewall performs access control on the access request according to the access control policy associated with the SIM card information, and the access control method comprises the following steps:

and if the application service requested to be accessed is the application service in the enterprise private network which allows the terminal equipment corresponding to the SIM card information to access, allowing the access request by the firewall, and otherwise blocking the access request.

4. The method according to any one of claims 1 to 3, further comprising:

and storing associated configuration information in the firewall, wherein the associated configuration information comprises an access control strategy associated with each SIM card information in the private network of the enterprise.

5. A method for controlling access to SIM card information, the method comprising:

after the terminal equipment passes the operator authentication, a charging forwarding device in the enterprise private network receives charging information from a session management function network element;

the charging forwarding device in the private enterprise network sends user identity identification (SIM) card information and an Internet Protocol (IP) address of a terminal device to a plurality of firewalls in the private enterprise network, wherein the SIM card information and the IP address are obtained according to the charging information.

6. The method of claim 5, wherein the receiving the charging information from the session management function network element by the charging forwarding device in the private enterprise network comprises:

and the charging forwarding device in the enterprise private network receives charging information from a session management function network element through a charging protocol, wherein the charging protocol is a Remote Authentication Dial In User Service (RADIUS) protocol or a DIAMETER protocol.

7. A communication device deployed in a private enterprise network, the communication device comprising:

a transceiver module, configured to receive an access request from a terminal device, where the access request includes an internet protocol IP address of the terminal device;

the processing module is used for determining the information of the subscriber identity module SIM card corresponding to the IP address;

and the processing module is further used for performing access control on the access request according to the access control strategy associated with the SIM card information.

8. The apparatus of claim 7, wherein the transceiver module is further configured to:

receiving SIM card information and the IP address of the terminal equipment from a charging forwarding device or a session management function network element in the enterprise private network;

the processing module is further configured to: and establishing a mapping relation between the SIM card information and the IP address, and determining the SIM card information corresponding to the IP address according to the mapping relation.

9. The apparatus according to claim 7 or 8, wherein the access request includes an application service requesting access;

the access control strategy comprises application services in the enterprise private network which are allowed to be accessed by the terminal equipment corresponding to the SIM card information, and/or application services in the enterprise private network which are not allowed to be accessed by the terminal equipment corresponding to the SIM card information;

the processing module is specifically configured to:

and if the application service requested to be accessed is the application service in the enterprise private network which allows the terminal equipment corresponding to the SIM card information to access, allowing the access request, otherwise blocking the access request.

10. The apparatus according to any of claims 7 to 9, wherein the communication apparatus stores therein associated configuration information, the associated configuration information comprising an access control policy associated with each SIM card information within the private enterprise network.

11. A communication device deployed in a private enterprise network, the communication device comprising:

the receiving and sending module is used for receiving the charging information from the session management function network element after the terminal equipment passes the operator authentication;

and the processing module is used for sending the subscriber identity identification SIM card information and the IP address of the terminal equipment to a firewall in the enterprise private network through the transceiving module, and the SIM card information and the IP address are obtained according to the charging information.

12. The apparatus of claim 11, wherein the transceiver module is specifically configured to:

and receiving the charging information from the session management function network element through a charging protocol, wherein the charging protocol is a Remote Authentication Dial In User Service (RADIUS) protocol or a DIAMETER protocol.

13. A communications device comprising a processor and a memory, the processor and the memory coupled, the memory storing computer program instructions, the processor implementing the method of any of claims 1 to 4 by executing the computer program instructions.

14. A communications device comprising a processor and a memory, the processor and the memory coupled, the memory storing computer program instructions, the processor implementing the method of any of claims 5 to 6 by executing the computer program instructions.

15. A communication system, characterized in that the communication system comprises a firewall and a charging forwarding apparatus in a private enterprise network; wherein,

the charging forwarding device is used for receiving charging information from a session management function network element after the terminal equipment passes operator authentication, and sending user identity identification (SIM) card information and an IP address of the terminal equipment to the firewall, wherein the SIM card information and the IP address are obtained according to the charging information;

the firewall is configured to receive SIM card information and the IP address of the terminal device from the charging forwarding apparatus, and establish a mapping relationship between the SIM card information and the IP address;

the firewall is further configured to receive an access request from the terminal device, where the access request includes an IP address of the terminal device, determine, according to the mapping relationship, SIM card information corresponding to the IP address, and perform access control on the access request according to an access control policy associated with the SIM card information.

16. The system of claim 15, wherein the access request includes an application service requesting access;

the access control strategy comprises application services in the enterprise private network which are allowed to be accessed by the terminal equipment corresponding to the SIM card information, and/or application services in the enterprise private network which are not allowed to be accessed by the terminal equipment corresponding to the SIM card information;

the firewall is specifically configured to:

and if the application service requested to be accessed is the application service in the enterprise intranet which allows the terminal equipment corresponding to the SIM card information to access, allowing the access request, otherwise blocking the access request.

17. The system according to claim 15 or 16, wherein the firewall stores therein associated configuration information, the associated configuration information including access control policies associated with each SIM card information in the private network of the enterprise.

18. The system according to any one of claims 15 to 17, wherein the charging forwarding device is specifically configured to:

and receiving the charging information from the session management function network element through a charging protocol, wherein the charging protocol is a Remote Authentication Dial In User Service (RADIUS) protocol or a DIAMETER (DIAMETER) protocol.

19. A computer-readable storage medium, having stored therein program instructions, which when executed by a communication apparatus, cause the method of any one of claims 1 to 6 to be implemented.

Images