KR20240039819A - System and method for providing enterprise dedicated network service applying network separation structure - Google Patents

Abstract

A method in which a primary terminal operates to access a corporate dedicated network of a secondary terminal connected to the primary terminal, by using a control IP address, which is a public IP address of the user plane management device, to provide the primary terminal to the user plane management device. Transmitting a primary terminal authentication request containing information, if terminal authentication based on the primary terminal information is successful, sending a primary terminal authentication response including a data IP address of the user plane management device to the user plane management device. Receiving from, and using the data IP address, setting up a dedicated network session for transmitting and receiving user plane data of the user plane management device and the secondary terminal.

Description

System and method for providing corporate dedicated network service applying network separation structure {SYSTEM AND METHOD FOR PROVIDING ENTERPRISE DEDICATED NETWORK SERVICE APPLYING NETWORK SEPARATION STRUCTURE}

This disclosure relates to a system and method for providing a corporate dedicated network service applying a network separation structure.

The enterprise private network service, called Private LTE/5G, separates the public network such as the Internet network from the enterprise private network through EPC (Evolved Packet Core) and connects the terminal of the enterprise subscriber to the public network or enterprise private network. It is a technique to do.

This corporate network service allows corporate employees to experience the same work as in the office anywhere in the country, so the need for it is increasing as work from home and mobile work becomes more active.

Corporate employees can use corporate network services from the secondary terminal by connecting an electronic device such as a laptop (referred to as a secondary terminal) to a mobile router (referred to as a primary terminal) connected to the corporate network. The primary terminal and the secondary terminal can be connected through short-distance communication methods such as WiFi, USB (Universal Serial Bus), or UTP (Unshielded Twisted Pair).

At this time, the primary terminal can be controlled by EPC, the core system of the communication service provider, according to communication standards, but authentication control and traffic control for the secondary terminal require a separate enterprise network access control technology. Accordingly, communication service providers build devices that control access to a corporate dedicated network to enable private network access control of primary and secondary terminals.

Devices that control access to a conventional corporate network accept and process traffic from different corporate subscribers.

However, in the case of subscribers to national network projects or public institutions where security is important, traffic separation from other subscribers is required, so a method to achieve this is needed.

The present disclosure separates the management device that controls access to the corporate network of the secondary terminal connected to the primary terminal into a user plane management device that handles user plane data and a control plane management device that handles control plane data, and APN (Access Point Name) Using the information mapping the VLAN (Virtual LAN) ID and the information mapping the VLAN ID and the IP address of the user plane management device, traffic is logically distributed by multiple corporate subscribers or by multiple service slices provided by one corporate subscriber. It relates to a system and method for providing corporate dedicated network services using a network separation structure.

The present disclosure places the control plane management device at the rear of the user plane management device and restricts connection to internal communication with the user plane management device, and uses the IP address of the user plane management device accessible to the secondary terminal for authentication of the primary terminal. It relates to a system and method for providing a corporate dedicated network service with enhanced security by operating differently depending on availability.

According to one feature, a method in which a primary terminal operates to access a corporate private network of a secondary terminal connected to the primary terminal, using a control IP address that is a public IP address of a user plane management device, the user plane Transmitting a primary terminal authentication request containing primary terminal information to a management device; if terminal authentication based on the primary terminal information is successful, a primary terminal authentication response including a data IP address of the user plane management device. Receiving from the user plane management device, and using the data IP address, setting up a dedicated network session for transmitting and receiving user plane data of the user plane management device and the secondary terminal.

Between the receiving step and the setting step, a secondary terminal authentication request containing secondary terminal information is transmitted to the user plane management device using the data IP address, and the terminal based on the secondary terminal information is transmitted to the user plane management device. It may further include receiving a secondary terminal authentication response including an authentication result, and the setting step may be performed when the terminal authentication result based on the secondary terminal information is authentication success.

The data IP address may be set differently for a plurality of slices divided by service of a plurality of corporate subscribers or one corporate subscriber.

The primary terminal authentication request may include an Access Point Name (APN) for distinguishing the plurality of corporate subscribers or a slice identifier for distinguishing the plurality of slices.

The control IP address can be commonly set to a plurality of slices divided by service of a plurality of corporate subscribers or one corporate subscriber.

According to another feature, it is a corporate dedicated network service system that controls access to a dedicated network of a primary terminal and a secondary terminal connected to the primary terminal, and includes terminal authentication that determines dedicated network access rights for the primary terminal and the secondary terminal. A control plane management device that performs a control plane management device, and a user plane management device that establishes a dedicated network session for transmitting and receiving dedicated network traffic between the primary terminal and the secondary terminal, wherein the user plane management device is configured to connect a plurality of enterprise subscribers or one Each dedicated network traffic is logically separated and processed using IP addresses differently assigned to multiple slices divided by service of corporate subscribers.

The enterprise dedicated network service system further includes a network device located in the primary terminal and the user plane management device to route dedicated network traffic of the secondary terminal, wherein the network device is connected to the plurality of corporate subscribers or the plurality of corporate subscribers. Each dedicated network traffic can be logically separated and processed using VLAN IDs assigned differently for each slice.

The network device may include a VLAN ID matching the APN (Access Point Name) of the dedicated network traffic received from the primary terminal in the dedicated network traffic and transmit it to the user plane management device.

The user plane management device may receive a primary terminal authentication request from the primary terminal using a control IP address commonly assigned to the plurality of enterprise subscribers or the plurality of slices.

The control IP address can be obtained from the core network during the process of establishing a dedicated network session with the primary terminal.

The user plane management device may establish a dedicated network session with the primary terminal using data IP addresses differently assigned to each of the plurality of enterprise subscribers or the plurality of slices.

If primary terminal authentication is successful, the user plane management device may receive the data IP address from the control plane management device and transmit it to the primary terminal.

The user plane management device may receive a secondary terminal authentication request using the data IP address and transmit the secondary terminal authentication request to the control plane management device.

The user plane management device may perform internal network communication with the control plane management device using core IP addresses differently assigned to each of the plurality of enterprise subscribers or the plurality of slices.

The user plane management device stores identifier-core IP information matching a plurality of network separation identifiers divided by the plurality of corporate subscribers or the plurality of slices and a plurality of internal core IP addresses, and receives it from the primary terminal. You can select a core IP address that matches the network isolation identifier identified from the dedicated network traffic.

The user plane management device includes a plurality of internal network interoperating nodes that transmit and receive terminal authentication-related data with the control plane management device using respective core IP addresses distinguished for each of the plurality of enterprise subscribers or the plurality of slices, the plurality of internal network interconnection nodes A plurality of data processing nodes that establish a dedicated network session with the primary terminal using corporate subscribers or respective data IP addresses distinguished for each of the plurality of slices and receive an authentication request for the secondary terminal, and the control It may include a gateway node that communicates with the primary terminal using an IP address.

According to another feature, a method of operating a user plane management device that controls access to a dedicated network of a primary terminal and a secondary terminal connected to the primary terminal, using a control IP address that is a public IP address of the user plane management device. Thus, receiving a primary terminal authentication request including primary terminal information from the primary terminal, requesting the primary terminal authentication to a control plane management device that performs primary terminal authentication based on the primary terminal information. transmitting, if the first terminal authentication is successful, receiving a first terminal authentication response including a data IP address of the user plane management device from the control plane management device, receiving the first terminal authentication response from the control plane management device. Transmitting to a primary terminal, and establishing a dedicated network session for transmitting and receiving user plane data of the secondary terminal using the data IP address with the primary terminal.

In the forwarding step, the primary terminal authentication request may be transmitted to the control plane management device using a core IP address matching the VLAN ID included in the primary terminal authentication request.

The data IP address may be assigned according to the core IP address by the control plane management device.

The VLAN ID may be added by a network device located between the primary terminal and the user plane management device.

According to an embodiment, in a mobile communication environment that provides enterprise dedicated network services to secondary terminals connected to the primary terminal, the dedicated network access management device is divided into a control plane management device that handles the control plane and a user plane management device that handles the user plane. And, by providing a network separation structure that processes traffic by logically dividing it by corporate subscriber or service slice using VLAN, it efficiently provides the dedicated network service desired by corporate subscribers and at the same time, a control plane management device that handles subscription/authentication information. can be protected from the outside.

1 is a configuration diagram of a corporate dedicated network service system according to an embodiment.
Figure 2 shows the network separation structure of a corporate dedicated network service system according to an embodiment.
Figure 3 shows the flow of authentication traffic of the primary terminal in the network separation structure of Figure 2.
FIG. 4 shows the flow of authentication traffic of a secondary terminal in the network separation structure of FIG. 2.
FIG. 5 shows the flow of user traffic of a secondary terminal in the network separation structure of FIG. 2.
Figure 6 is a flowchart showing the primary terminal authentication procedure according to an embodiment.
Figure 7 is a flowchart showing a secondary terminal authentication procedure according to an embodiment.
Figure 8 shows a corporate dedicated network system applying a network separation structure according to another embodiment.
Figure 9 shows a failure monitoring structure of a network separation structure according to an embodiment.

Below, with reference to the attached drawings, embodiments of the present disclosure will be described in detail so that those skilled in the art can easily practice them. However, the present disclosure may be implemented in many different forms and is not limited to the embodiments described herein. In order to clearly explain the present disclosure in the drawings, parts that are not related to the description are omitted, and similar parts are given similar reference numerals throughout the specification.

Throughout the specification, when a part is said to “include” a certain element, this means that it may further include other elements rather than excluding other elements, unless specifically stated to the contrary.

In addition, terms such as "... unit", "... unit", and "... module" used in the specification refer to a unit that processes at least one function or operation, which may be implemented through hardware or software or a combination of hardware and software. You can.

The devices described in the present invention are composed of hardware including at least one processor, a memory device, a communication device, etc., and a program that is executed in conjunction with the hardware is stored in a designated location. The hardware has a configuration and performance capable of executing the method of the present invention. The program includes instructions that implement the operating method of the present invention described with reference to the drawings, and executes the present invention by combining it with hardware such as a processor and memory device.

In this specification, “transmission or provision” may include not only direct transmission or provision, but also indirect transmission or provision through another device or by using a circuitous route.

In this specification, expressions described as singular may be interpreted as singular or plural, unless explicit expressions such as “one” or “single” are used.

In this specification, the same reference numbers refer to the same elements regardless of the drawings, and “and/or” includes each and all combinations of one or more of the mentioned elements.

In this specification, terms including ordinal numbers, such as first, second, etc., may be used to describe various components, but the components are not limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, a first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component without departing from the scope of the present disclosure.

In the flowcharts described herein with reference to the drawings, the order of operations may be changed, several operations may be merged, certain operations may be divided, and certain operations may not be performed.

In the specification, the corporate dedicated network service provides mobile communication services with restricted external access to corporate subscriber terminals. The corporate dedicated network service separates the public network and dedicated network through the core network of the telecommunication company network. A private network provides mobile communication services with limited external access to specific subscribers, and may be called, for example, a private network or an intranet. At this time, since the embodiment targets corporate subscribers, it is called a corporate dedicated network. A corporate network is distinguished from a public network such as an Internet network that provides mobile communication services to an unspecified number of people.

At this time, the telecommunication company network may be a 3G network, a Long Term Evolution (LTE) network, or a 5G network, and the explanation will use the 5G network as an example.

In this specification, the 5G network includes a Radio Access network (RAN) through which primary terminals wirelessly access, and a Core Network consisting of a plurality of network functions. The core network has an Access and Mobility Management Function (AMF), a Session Management Function (SMF), and creates a PDU (Packet Data Unit) session through the SMF and a data network (Data Network, DN). User Plane Function (UPF), which is connected to and processes traffic, Policy Control Function (PCF), which controls charging and quality of service policies, and Unified Data Management function, which manages subscriber information. , UDM), Unified Data Repository (UDR), and Network Exposure function (NEF).

In this specification, a terminal directly connected to the 5G network may be referred to as a primary terminal or a higher-level terminal, and a terminal connected to the primary terminal and accessing the 5G network may be referred to as a secondary terminal or lower-level terminal. The secondary terminal is not limited to lower level terminals directly connected to the primary terminal, and may be an nth terminal. The primary terminal may be a mobile router such as a wireless egg, or a mobile terminal equipped with a mobile routing function, and in the description, it can mainly be described as a mobile router. The secondary terminal is a terminal that can be connected to the primary terminal through short-distance communication, and can mainly be described as a laptop in the description.

1 is a configuration diagram of a corporate dedicated network service system according to an embodiment.

Referring to FIG. 1, the enterprise dedicated network service system 100 includes a control plane management device (Control plane) 101, a user plane management device (102), an enterprise dedicated switch 103, and an enterprise dedicated UPF (104). ), wireless access network 105, primary terminal 106, secondary terminal 107, and core system 108.

The control plane management device 101, the user plane management device 102, and the enterprise dedicated UPF 104 are dedicated for connecting the secondary terminal 107 connected to the primary terminal 106 to the enterprise dedicated network 109, 110. It's equipment. In particular, the control plane management device 101 and the user plane management device 102 are enterprise-specific equipment that performs authentication and access control for access to the enterprise-specific networks 109 and 110.

The control plane management device 101 controls control plane data related to access control to the corporate network, such as authentication to determine whether the primary terminal 106 and the secondary terminal 107 are authorized to access the corporate network 109 and 110. Process. Additionally, the control plane management devices 101 and 105 may perform IP allocation to the secondary terminal 107, secondary terminal status management, etc.

The user plane management device 102 processes user plane data transmitted and received from the secondary terminal 107 to the enterprise dedicated network 109 and 110 through the primary terminal 106 through a dedicated network session connected to the primary terminal 106. do. The user plane management device 102 routes uplink data and downlink data between the secondary terminal 107 and the enterprise dedicated network (109, 110).

The enterprise-only switch 103 may be an L3 switch located between the user plane management device 102 and the enterprise-only UPF 104.

The corporate UPF 104 is a core device that connects the primary terminal 106 to a dedicated network session according to the 5G standard.

The primary terminal 106 is directly connected to the network and connected to at least one secondary terminal 107 through short-distance communication.

The primary terminal 106 routes dedicated network traffic transmitted and received between at least one secondary terminal 107 and the user plane management device 102.

For example, the primary terminal 106 may be a mobile router connected to a 5G network, or a mobile terminal equipped with a mobile routing function.

The primary terminal 106 may connect to a base station (e.g., gNB) 105 of a radio access network (RAN) and transmit traffic to the enterprise-specific UPF 104 and the user plane management device 102.

The secondary terminal 107 is a device connected to the primary terminal 106 and may be, for example, an electronic device such as a laptop.

Here, the secondary terminal 107 may be connected to the primary terminal 106 in various ways, for example, WiFi, USB (Universal Serial Bus), UTP (Unshielded Twisted Pair), etc.

The secondary terminal 107 may be a terminal managed by the control plane management device 101 to authenticate a dedicated network connection, and may be, for example, a business device registered with the control plane management device 101 or a device registered by a user. .

The core system 108 is composed of core devices and connects the primary terminal 106 with the enterprise-only UPF 104 based on subscriber information of the primary terminal 106. Since this connection process uses known technology, detailed description is omitted.

At this time, the dedicated network traffic of corporate subscriber A and corporate subscriber B is all physically processed by the same user plane management device 102 and the same corporate UPF 104, but is distinguished for each corporate subscriber by applying a logical network separation structure. It is processed.

In an embodiment of the present invention, the IP address of the user plane management device 102 is divided into corporate subscribers, and the APN (Access Point Name) and VLAN (Virtual LAN) ID, which are logical network separation identifiers, are assigned and operated differently for each corporate subscriber. By doing so, it provides a network separation structure that separates and processes dedicated network traffic for each corporate subscriber. This network separation structure will be described in detail through FIGS. 2 to 5.

Figure 2 shows the network separation structure of the corporate dedicated network service system according to an embodiment, Figure 3 shows the flow of authentication traffic of the primary terminal in the network separation structure of Figure 2, and Figure 4 shows the network separation structure of Figure 2. It shows the flow of authentication traffic of the secondary terminal, and FIG. 5 shows the flow of user traffic of the secondary terminal in the network separation structure of FIG. 2.

At this time, the detailed configuration related to the network separation structure in the corporate dedicated network service system of FIG. 1 is shown.

First, referring to FIG. 2, the control plane management device 101 is located behind the user plane management device 102 and communicates internally with the user plane management device 102. Accordingly, the IP address of the control plane management device 101 (hereinafter collectively referred to as 'Core IP-C') is an IP address allocated for internal communication with the user plane management device 102 and is not disclosed to the outside.

The user plane management device 102 uses a plurality of IP addresses and includes a plurality of nodes using each IP address.

The plurality of IP addresses includes a control IP address, a data IP address, and a core IP address (hereinafter collectively referred to as 'Core IP-U').

The user plane management device 102 includes a gateway node using a control IP address, a plurality of data processing nodes using a plurality of data IP addresses divided by corporate subscriber, and a plurality of core IP-Us divided by corporate subscriber. Includes multiple internal network interconnection nodes.

The control IP address is an IP address that is exposed to the outside world. The primary terminals 106, 106a, and 106b connect to the gateway node of the user plane management device 102 using the control IP address before terminal authentication to determine access authority to the dedicated network is completed.

At this time, the control IP address is commonly used by multiple corporate subscribers.

The primary terminals 106, 106a, 106b acquire a control IP address in the process of performing a network connection procedure with the core system 108, or use a domain name and DNS (DNS) to obtain a control IP address. Domain Name Server) information can be obtained. The primary terminal (106, 106a, 106b) can obtain a control IP address matching the domain name using DNS information.

The data IP address is included in the terminal authentication response of the control plane management device 101 and provided to the primary terminals 106, 106a, and 106b when the primary terminals 106, 106a, and 106b succeed in terminal authentication. Authentication traffic and user traffic from the secondary terminals 107, 107a, and 107b are delivered to the user plane management device 102 using the data IP address.

At this time, data IP addresses are allocated and operated differently for each corporate subscriber. Therefore, the authentication traffic and user traffic of enterprise #1's secondary terminal 107a are processed by data processing node #1 using data IP #1, and the authentication traffic and user traffic of enterprise #2's secondary terminal 107b are processed by data processing node #1 using data IP #1. User traffic is processed by data processing node #2 using data IP #2.

Data processing node #1 establishes a tunneling session with the primary terminal (106a) of enterprise #1, and transmits and receives user traffic between the secondary terminal (107a) and the dedicated network (109) of enterprise #1 through the established tunneling session. Routing.

Data processing node #2 establishes a tunneling session with the primary terminal (106b) of enterprise #2, and transmits and receives user traffic between the secondary terminal (107b) and the dedicated network (110) of enterprise #2 through the established tunneling session. Routing.

Core IP-U is an IP address used by the user plane management device 102 to transmit and receive authentication traffic with the control plane management device 101.

Core IP-U is operated differently for each corporate subscriber. Accordingly, the internal network interconnection node of company #1 transmits and receives authentication traffic to and from the control plane management device 101 using core IP-U #1. And the internal network interconnection node of company #2 transmits and receives authentication traffic to the control plane management device 101 using core IP-U #2.

In this way, the user plane management device 102 communicates with the primary terminals 106a and 106b using the control IP address before the authentication of the primary terminals 106a and 106b is completed. The data IP address of the user plane management device 102 is disclosed to the primary terminals 106a and 106b after the authentication of the primary terminals 106a and 106b is completed to collect authentication traffic/users of the secondary terminals 107a and 107b. Used to process traffic.

The IP address of the control plane management device 101 is an internal network IP address that is not disclosed to the primary terminals 106a and 106b, and is disclosed only to the user plane management device 102. Accordingly, external intrusion into the user plane management device 102 that processes subscription/authentication information can be blocked at the source, and security can be strengthened.

In addition, the user plane management device 102 operates different data IP addresses and core IP-Us for each corporate subscriber, so that authentication traffic of the primary terminals 106a and 106b, authentication traffic of the secondary terminals 107a and 107b User traffic, that is, dedicated network traffic, is processed separately for each corporate subscriber.

Additionally, dedicated network traffic is processed separately by corporate network using APN and VLAN ID. In the section between the primary terminals (106, 106a, 106b) and the corporate UPF (104), dedicated network traffic is logically divided and processed for each corporate subscriber using APN. In the section between the corporate UPF (104) and the corporate switch (103), and the section between the corporate switch (103) and the user plane management device (102), dedicated network traffic is logically divided by corporate subscriber using VLAN ID. and processed.

Additionally, dedicated network traffic is logically classified and processed for each corporate subscriber using IP addresses, that is, data IP address and core IP-U, inside the user plane management device 102.

In addition, dedicated network traffic is logically divided and processed for each corporate subscriber in the section between the user plane management device 102 and the control plane management device 101 using the core IP-U of the user plane management device 102.

Private network traffic includes control plane data and user plane data related to authentication.

The enterprise-only UPF 104 records the VLAN ID #1 of enterprise #1 in the VLAN tag field of the dedicated network traffic based on the APN #1 of the dedicated network traffic received from the primary terminal 106a of enterprise #1. Since the packet structure to which the VLAN tag field is applied is already a known technology, detailed description is omitted.

The enterprise-only UPF 104 records the VLAN ID #2 of enterprise #2 in the VLAN tag field of the dedicated network traffic based on the APN #2 of the dedicated network traffic received from the primary terminal 106b of enterprise #2.

In this way, APN and VLAN ID are assigned differently to each corporate subscriber and are used as a network separator to logically divide the corporate network. To this end, the corporate UPF 104 stores and manages a mapping table that divides the APN and VLAN ID for each corporate subscriber. As an example of a mapping table, it can be configured as shown in Table 1.

Company identifier
(LTEID) APNs VLAN ID LTEID_A APNID_A VLANID_A LTEID_B APNID_B VLANID_B LTEID_C APNID_C VLANID_C

The enterprise-only UPF (104) transmits dedicated network traffic containing each VLAN ID matching each APN to the enterprise-only switch (103).

The enterprise dedicated switch 103 routes dedicated network traffic including each VLAN ID received from the corporate UPF 104 to the user plane management device 102.

At this time, when the dedicated network traffic is authentication traffic for the primary terminals 106a and 106b, the destination IP is set to the control IP address. Accordingly, authentication traffic is delivered to the gateway node of the user plane management device 102.

If the dedicated network traffic is authentication/user traffic of the secondary terminals 107a and 107b connected to the primary terminals 106a and 106b that have successfully authenticated the terminal, the destination IP is set to the data IP address. Accordingly, authentication/user traffic is routed to the data processing nodes of the user plane management device 102.

The user plane management device 102 stores and manages a table mapping data IP addresses and core IP-Us for each VLAN ID. As an example of a mapping table, it may be structured as shown in Table 2.

Company identifier
(LTEID) VLAN ID data IP address Internal network linked IP address (Core IP-U) LTEID_A VLANID_A Data IP_1 Core IP_1 LTEID_B VLANID_B Data IP_2 Core IP_2 LTEID_C VLANID_C Data IP_2 CoreIP_3

The gateway node of the user plane management device 102 and the data processing node select a core IP-U corresponding to the VLAN ID of the dedicated network traffic received from the enterprise dedicated switch 103, and internally use the selected core IP-U. Delivers dedicated network traffic to network-interconnected nodes. Then, the internal network interworking node processes authentication in conjunction with the control plane management device 101 using the corresponding core IP-U.

The control plane management device 101 can manage the core IP-U of the user plane management device 102 divided by corporate subscriber as shown in Table 3.

Company identifier
(LTEID) Core IP-U data IP address LTEID_A Core IP_1 Data IP Address #1 LTEID_B Core IP_2 Data IP Address #2 LTEID_C CoreIP_3 Data IP Address #3

The control plane management device 101 processes authentication traffic separately for each corporate subscriber, referring to Table 3. That is, the control plane management device 101 checks the data IP address matching the core IP-U included in the source IP address of the primary terminal authentication request received from the internal network interconnection node from Table 3, and the confirmed data IP address is The included primary terminal authentication response can be transmitted to the internal network interconnection node.

In the network separation structure described above, traffic paths for each type of dedicated network traffic are shown in Figures 3, 4, and 5.

Referring to Figure 3, the authentication traffic of the primary terminal (106a) of enterprise #1 is 'enterprise-only UPF (104) ↔ enterprise-only switch (103) ↔ gateway node (control IP address) of the user plane management device (102). It is transmitted and received through the path of ↔ the internal network interconnection node (Core IP-U #1) of the user plane management device 102 ↔ the control plane management device 101.

The authentication traffic of Enterprise #2's primary terminal (106b) is 'enterprise dedicated UPF (104) ↔ enterprise dedicated switch (103) ↔ gateway node (control IP address) of user plane management device (102) ↔ user plane management device ( 102)'s internal network interconnection node (Core IP-U #2) ↔ Control plane management device 101'.

Referring to Figure 4, the authentication traffic of the secondary terminal (107a) of enterprise #1 is 'enterprise-only UPF (104) ↔ enterprise-only switch (103) ↔ data processing node (data IP address) of the user plane management device (102). #1) ↔ The internal network interconnection node (Core IP-U #1) of the user plane management device 102 ↔ Control plane management device 101 is transmitted and received.

The authentication traffic of the secondary terminal (107b) of enterprise #2 is 'enterprise-only UPF (104) ↔ enterprise-only switch (103) ↔ data processing node (data IP address #2) of the user plane management device (102) ↔ user plane. It is transmitted and received through the path of the internal network interconnection node (Core IP-U #2) of the management device 102 ↔ control plane management device 101.

Referring to Figure 5, the user traffic of the secondary terminal 107a of enterprise #1 is 'enterprise-only UPF 104 ↔ enterprise-only switch 103 ↔ data processing node (data IP address) of the user plane management device 102. #1) ↔ It is transmitted and received through the path of ‘Corporate #1 dedicated network (109)’.

The user traffic of the secondary terminal (107b) of enterprise #2 is 'enterprise-only UPF (104) ↔ enterprise-only switch (103) ↔ data processing node (data IP address #2) of the user plane management device (102) ↔ enterprise # 2 It is transmitted and received through the path of ‘dedicated network 110’.

Each authentication/user traffic of Enterprise #1 and Enterprise #2 is processed separately based on APN and VLAN ID in the enterprise-only UPF (104) ↔ enterprise-only switch (103), and is processed separately by the control plane management device (101) and the user. It is processed by changing the IP address in the plane management device 102.

Figure 6 is a flowchart showing the primary terminal authentication procedure according to an embodiment.

Referring to FIG. 6, the primary terminal 106 transmits a primary terminal authentication request to the enterprise-only UPF 104 (S101).

In S101, the primary terminal authentication request includes a company identifier, APN, and primary terminal information used for primary terminal authentication, and the destination IP is set to the control IP address.

Primary terminal information is a terminal identifier and may include IMSI (International Mobile Subscriber Identity), MSISDN (Mobile Station International ISDN Number), MAC address (Media Access Control Address), etc.

According to the embodiment, a domain name corresponding to the control IP address may be set in the primary terminal 106. Before S101, the primary terminal 106 may proceed with a dedicated network session creation procedure with the core system 108 and obtain a DNS (Domain Name Server) address from the core system 108 during this process. The primary terminal 106 may obtain a control IP address corresponding to the domain name by transmitting a DNS query for the domain name to the DNS address.

The enterprise-only UPF 104 extracts the VLAN ID matching the APN of the primary terminal authentication request from the APN-VLAN DB as shown in Table 1 (S102).

The enterprise-only UPF 104 records the VLAN ID extracted in S102 in the VLAN tag field of the primary terminal authentication request (S103). At this time, the APN may be removed from the primary terminal authentication request received at S101 and replaced with a VLAN ID matching the APN.

The enterprise UPF 104 transmits a primary terminal authentication request including the VLAN ID to the user plane management device 102 via the enterprise switch 103 (S104). At this time, the primary terminal authentication request of S104 includes the company identifier, VLAN ID, and primary terminal information.

In S104, the primary terminal authentication request is received by the gateway node of the user plane management device 102 using the destination IP and control IP addresses.

The gateway node of the user plane management device 102 checks the core IP-U, which is the IP address of the internal network interconnection node, matching the VLAN ID of the primary terminal authentication request from the VLAN ID-IP DB as shown in Table 2 (S105) .

The gateway node of the user plane management device 102 transmits a primary terminal authentication request with the VLAN tag field removed to the internal network interworking node using the core IP-U confirmed in S105 (S106). At this time, the gateway node converts the destination IP from control IP to core IP-U and transmits it.

The internal network interconnection node converts the destination IP of the primary terminal authentication request received in S106 into core IP-C, which is the IP address of the control plane management device 101, and then transmits it to the control plane management device 101 ( S107). At this time, the source IP of the primary terminal authentication request is set to the core IP-U of the internal network interworking node, and the destination IP is set to the core IP-C.

The control plane management device 101 performs primary terminal authentication to determine whether the primary terminal 106 has permission to access the corporate network, based on the primary terminal information obtained from the primary terminal authentication request received in S107 ( S108).

At this time, the control plane management device 101 can process the primary terminal authentication procedure separately for each corporate subscriber according to the core IP-U included in the source IP of the primary terminal authentication request. For example, the terminal authentication method or information used for terminal authentication can be classified and processed according to the authentication policy set for each corporate subscriber.

The control plane management device 101 determines whether the primary terminal authentication of S108 is successful (S109), and if the primary terminal authentication is successful, it assigns a data IP address matching the core IP address of the internal network interworking node (S110) ). Then, the data IP address of the user plane management device 102 allocated in S110 is included in the primary terminal authentication response and transmitted to the internal network interconnection node (S111).

In S110, the control plane management device 101 manages a data IP DB that stores a data IP address matching each core IP-U or a data IP address set to a corporate identifier matching the core IP-U, and stores the data IP DB. You can assign a data IP address using .

The internal network interconnection node transmits the primary terminal authentication response received from the control plane management device 101 to the gateway node (S112).

The gateway node transmits the primary terminal authentication response to the enterprise-only UPF (104) (S113).

The enterprise-only UPF 104 delivers the primary terminal authentication response to the primary terminal 106 (S114). Through S114, the primary terminal 106 can obtain the data IP address of the user plane management device 102.

On the other hand, if the primary terminal authentication of S108 fails, a primary terminal authentication failure response is transmitted (S115, S116, S117, S118). At this time, the primary terminal authentication failure response does not include the data IP address. Accordingly, the primary terminal 106 cannot connect to the data processing node of the user plane management device 102.

FIG. 7 is a flowchart showing a secondary terminal authentication procedure according to an embodiment, and shows operations after acquiring a data IP address through S113 of FIG. 6.

Referring to FIG. 7, the primary terminal 106 receives a dedicated network connection request from the secondary terminal 107 (S201). S201's dedicated network connection request includes secondary terminal information used for secondary terminal authentication. For example, the secondary terminal information may be the MAC address of the secondary terminal 107.

The primary terminal 106 transmits a secondary terminal authentication request to the enterprise-only UPF 104 (S202).

In S202, the secondary terminal authentication request includes a company identifier, APN, and secondary terminal information, and the destination IP is set to the data IP address obtained in S114 of FIG. 6.

The enterprise-only UPF 104 extracts the VLAN ID matching the APN of the secondary terminal authentication request from the APN-VLAN DB as shown in Table 1 (S203).

The enterprise-only UPF 104 records the VLAN ID extracted in S203 in the VLAN tag field of the secondary terminal authentication request (S204).

The enterprise UPF 104 transmits a secondary terminal authentication request including the VLAN ID to the user plane management device 102 via the enterprise switch 103 (S205). In S205, the secondary terminal authentication request is received by the data processing node of the user plane management device 102 corresponding to the destination IP.

The data processing node of the user plane management device 102 checks the core IP address matching the VLAN ID of the secondary terminal authentication request from the VLAN ID-IP DB as shown in Table 2 (S206).

The data processing node of the user plane management device 102 transmits a secondary terminal authentication request with the VLAN tag field removed to the internal network interworking node using the core IP address confirmed in S206 (S207). At this time, the data processing node converts the destination IP from a data IP address to a core IP-U and transmits it.

The internal network interworking node converts the destination IP of the secondary terminal authentication request received in S207 into the core IP-C of the control plane management device 101 and then transmits it to the control plane management device 101 (S208). The source IP of the secondary terminal authentication request of S208 is set to Core IP-U, and the destination IP is set to Core IP-C.

The control plane management device 101 performs terminal authentication to determine whether the secondary terminal 107 has permission to access the corporate network, based on the secondary terminal information obtained from the secondary terminal authentication request received in S208 (S209). .

At this time, the control plane management device 101 can process the secondary terminal authentication procedure separately for each corporate subscriber according to the source IP of the secondary terminal authentication request. For example, the terminal authentication method or information used for terminal authentication can be classified and processed according to the authentication policy set for each corporate subscriber.

The control plane management device 101 transmits a secondary terminal authentication response containing the terminal authentication result to the internal network interconnection node (S210).

The internal network interconnection node transmits the secondary terminal authentication response received from the control plane management device 101 to the data processing node (S211).

The data processing node transmits the secondary terminal authentication response to the enterprise-only UPF 104 (S212).

The enterprise-only UPF 104 delivers the secondary terminal authentication response to the primary terminal 106 (S213).

The primary terminal 106 transmits a dedicated network connection response to the secondary terminal 107 (S214).

The primary terminal 106 determines whether the secondary terminal authentication response of S213 includes a successful terminal authentication result (S215), and if it is determined to be a successful terminal authentication result, the data processing node of the user plane management device 102 and the dedicated network session Set (S216). Therefore, when both the primary terminal authentication and the secondary terminal authentication are successfully completed, the user traffic of the secondary terminal 107 is transmitted to and received from the corporate private network 109 and 110 through the data processing node of the user plane management device 102. do.

Figure 8 shows a corporate dedicated network system applying a network separation structure according to another embodiment.

Referring to FIG. 8, one corporate subscriber can be processed separately for each of a plurality of slices. A plurality of slices can be divided by service. For example, a business network, an Internet network, and a video conference network can be divided by slice. In this case, the slice identifier and VLAN ID to distinguish each slice can be mapped, and the data IP address and core IP address of the user plane management device 102 can be distinguished and operated for each VLAN ID.

Since the embodiment of FIG. 8 is the same as the content described in FIGS. 1 to 7, overlapping descriptions will be omitted. That is, the difference from FIGS. 1 to 7 is that a slice identifier is used instead of an APN to logically divide each slice into a plurality of slices within a corporate subscriber to process dedicated network traffic.

Meanwhile, Figure 9 shows a failure monitoring structure of a network separation structure according to an embodiment.

Referring to FIG. 9, the enterprise dedicated switch 103 described in FIGS. 2 to 8 includes dedicated network switches 103-1(a) and 103-1(b) and aggregation switches 103-2(a) and 103- 2(b)). However, this is only a configuration example to show that VLAN links logically divided by enterprise are formed with complex paths. Accordingly, the configuration of the enterprise switch 103 can be implemented in various ways depending on the operation structure of the business operator and is not limited to the example in the drawing.

The dedicated network switches 103-1(a) and 103-1(b) are L3 switches, with one end connected to the enterprise-only UPF 104 and the other end connected to the aggregation switches 103-2(a) and 103-2( It is connected to b)).

The aggregation switches 103-2(a) and 103-2(b) are L2 switches, one end of which is connected to the dedicated network switches 103-1(a) and 103-1(b), and the other end of which is used for user plane management. Connected to devices 102(a) and 102(b).

Dedicated network switches (103-1(a), 103-1(b)), aggregation switches (103-2(a), 103-2(b)), user plane management devices (102(a), 102(b) ) is logically divided into corporate subscriber units and connected through each VLAN link matching the VLAN ID.

To prepare for failures, the dedicated network switches (103-1(a), 103-1(b)), aggregation switches (103-2(a), 103-2(b)), and user plane management device 102 are each master. Consisting of devices 103-1(a), 103-2(a), 102(a) and slave devices 103-1(b), 103-2(b), 102(b), and interconnected It is done. Basically, it is connected between the master devices 103-1(a), 103-2(a), and 102(1), and depending on whether there is a failure, the slave devices 103-1(b) and 103-2( b), can be connected to 102(b)).

The master device does not have to be connected only to the master device. For example, a dedicated network switch can be a master device, and an aggregation switch can be connected as a slave device.

Additionally, as a logical line for monitoring failures, a monitoring link using a monitoring VLAN ID is additionally connected. That is, the monitoring link is a dedicated network switch (103-1(a), 103-1(b)), an aggregation switch (103-2(a), 103-2(b)), and a user plane management device (102(a)). , 102(b)) are connected in series.

At this time, in addition to the configurations described in FIGS. 2 to 8, a fault management node for monitoring the presence of a fault may be added to the user plane management devices 102(a) and 102(b).

The fault management node transmits periodic health check signals to the dedicated network switches (103-1(a), 103-1(b)) and aggregation switches (103-2(a), 103-2(b)). If a normal response arrives, the active node operation is maintained, and if a normal response does not arrive, standby mode operation is performed.

The fault management node is connected to the aggregation switch (103-2(a), 103-2(b)) and a monitoring link, and the aggregation switch (103-2(a), 103-2(b)) is connected to the dedicated network switch (103-2(b)). It is connected to -1(a), 103-1(b)) through a monitoring link.

The failure management node periodically transmits a health check message to the aggregation switches 103-2(a) and 103-2(b) and receives a response. The aggregation switches 103-2(a) and 103-2(b) transmit a status check message to the dedicated network switches 103-1(a) and 103-1(b), and when a response is received, the response is disabled. Delivered to the management node. Through this process, the fault management node manages each switch ((103-1(a), 103-2(a), 102(a), (103-1(b), 103-2(b), 102(b) You can check the status of )).

The failure management node performs a status check in active mode and determines whether there is a failure based on the status check result. If the fault management node determines that the faulty switch is the master switch, it transfers the switch to the slave switch. For example, if a health check response is not received from the aggregation switch (master) 103-2(a) within a specified time, the fault management node may connect the user plane management device (master) 102(a) to the aggregation switch ( It is possible to disconnect from the master (103-2(a)) and connect to the aggregation switch (slace) (103-2(b)).

Thereafter, the failure management node periodically performs a status check on the aggregation switch (slace) 103-2(b) in standby mode, and if no response is received as a result of the status check, it may be determined to be a failure. In this case, it can be considered a failure of the aggregation switches 103-2(a) and 103-2(b) and a failure of the VLAN links of all corporate subscribers.

Therefore, even if there are n VLAN links of corporate subscribers, efficient monitoring is possible by minimizing the load of monitoring all of them.

The embodiments of the present disclosure described above are not only implemented through devices and methods, but may also be implemented through programs that implement functions corresponding to the configurations of the embodiments of the present disclosure or recording media on which the programs are recorded.

Although the embodiments of the present disclosure have been described in detail above, the scope of the rights of the present disclosure is not limited thereto, and various modifications and improvements made by those skilled in the art using the basic concept of the present disclosure defined in the following claims are also possible. It falls within the scope of rights.

Claims (20)

A method in which a primary terminal operates to connect a secondary terminal connected to the primary terminal to a corporate dedicated network,
Transmitting a primary terminal authentication request containing primary terminal information to the user plane management device using a control IP address that is a public IP address of the user plane management device,
If terminal authentication based on the primary terminal information is successful, receiving a primary terminal authentication response including a data IP address of the user plane management device from the user plane management device, and
Setting up a dedicated network session for transmitting and receiving user plane data of the user plane management device and the secondary terminal using the data IP address.
Method, including. In paragraph 1:
Between the receiving step and the setting step,
Using the data IP address, transmit a secondary terminal authentication request containing secondary terminal information to the user plane management device, and receive a secondary terminal authentication response containing a terminal authentication result based on the secondary terminal information. It further includes steps of:
The setting steps are:
A method performed when the terminal authentication result based on the secondary terminal information is authentication success. In paragraph 1:
The data IP address is,
A method that is set differently for a plurality of slices divided by service of a plurality of corporate subscribers or one corporate subscriber. In paragraph 3,
The first terminal authentication request is,
A method including an Access Point Name (APN) for distinguishing the plurality of corporate subscribers or a slice identifier for distinguishing the plurality of slices. In paragraph 1:
The control IP address is,
A method commonly set for a plurality of slices divided by service of a plurality of corporate subscribers or one corporate subscriber. A corporate dedicated network service system that controls access to a dedicated network of a primary terminal and a secondary terminal connected to the primary terminal,
A control plane management device that performs terminal authentication to determine dedicated network access rights for the primary terminal and the secondary terminal, and
A user plane management device that establishes a dedicated network session for transmitting and receiving dedicated network traffic between the primary terminal and the secondary terminal,
The user plane management device,
A corporate dedicated network service system that logically separates and processes each dedicated network traffic using IP addresses differently assigned to a plurality of slices divided by service of multiple corporate subscribers or one corporate subscriber. In paragraph 6:
Further comprising a network device located in the primary terminal and the user plane management device to route dedicated network traffic of the secondary terminal,
The network device is,
A corporate dedicated network service system that logically separates and processes each dedicated network traffic using VLAN IDs differently assigned to each of the plurality of corporate subscribers or the plurality of slices. In paragraph 7:
The network device is,
A corporate dedicated network service system that includes a VLAN ID matching the APN (Access Point Name) of the dedicated network traffic received from the primary terminal in the dedicated network traffic and transmits it to the user plane management device. In paragraph 7:
The user plane management device,
A corporate dedicated network service system that receives a primary terminal authentication request from the primary terminal using a control IP address commonly assigned to the plurality of corporate subscribers or the plurality of slices. In paragraph 9:
The control IP address is,
A corporate dedicated network service system that the primary terminal obtains from the core network in the process of establishing a dedicated network session with the core network. In paragraph 9:
The user plane management device,
A corporate dedicated network service system that establishes a dedicated network session with the primary terminal using data IP addresses differently assigned to the plurality of corporate subscribers or the plurality of slices. In paragraph 11:
The user plane management device,
An enterprise dedicated network service system that receives the data IP address from the control plane management device and transmits it to the primary terminal when primary terminal authentication is successful. In paragraph 11:
The user plane management device,
An enterprise dedicated network service system that receives a secondary terminal authentication request using the data IP address and transmits the secondary terminal authentication request to the control plane management device. In paragraph 11:
The user plane management device,
An enterprise dedicated network service system that performs internal network communication with the control plane management device using core IP addresses differently assigned to each of the plurality of corporate subscribers or the plurality of slices. In paragraph 14:
The user plane management device,
Stores identifier-core IP information that matches a plurality of network separation identifiers for each of the plurality of enterprise subscribers or the plurality of slices and a plurality of internal core IP addresses, and confirms network separation from dedicated network traffic received from the primary terminal. A corporate dedicated network service system that selects a core IP address matching an identifier. In paragraph 14:
The user plane management device,
A plurality of internal network interworking nodes that transmit and receive terminal authentication-related data with the control plane management device using each core IP address divided by the plurality of corporate subscribers or the plurality of slices,
A plurality of data processing nodes that establish a dedicated network session with the primary terminal using each data IP address distinguished for each of the plurality of enterprise subscribers or the plurality of slices and receive an authentication request for the secondary terminal, and
An enterprise dedicated network service system comprising a gateway node that communicates with the primary terminal using the control IP address. A method of operating a user plane management device that controls access to a dedicated network of a primary terminal and a secondary terminal connected to the primary terminal, comprising:
Receiving a primary terminal authentication request containing primary terminal information from the primary terminal using a control IP address that is a public IP address of the user plane management device,
Forwarding the primary terminal authentication request to a control plane management device that performs primary terminal authentication based on the primary terminal information,
If the primary terminal authentication is successful, receiving a primary terminal authentication response including a data IP address of the user plane management device from the control plane management device,
transmitting the primary terminal authentication response to the primary terminal, and
Establishing a dedicated network session for transmitting and receiving user plane data of the secondary terminal using the primary terminal and the data IP address
Method, including. In paragraph 17:
The delivery step is,
Method for transmitting the primary terminal authentication request to the control plane management device using a core IP address matching the VLAN ID included in the primary terminal authentication request. In paragraph 18:
The data IP address is,
Allocated according to the core IP address by the control plane management device. In paragraph 18:
The VLAN ID is,
Added by a network device located between the primary terminal and the user plane management device.

Images