CN115426685A - Access control method, device, equipment and medium for 5G edge computing traffic - Google Patents

Abstract

The invention provides an access control method and device for 5G edge computing flow, electronic equipment and a computer readable storage medium, and belongs to the technical field of networks. The method comprises the following steps: acquiring signed International Mobile Subscriber Identity (IMSI) data of all terminals in an edge network, wherein the signed IMSI data comprises a mapping relation between the IMSI and an IP address; configuring an access control list of edge calculation flow according to the signed IMSI data and the control requirement; and forwarding the corresponding flow according to the access control list so as to realize access control on different service flows of different terminals. The method at least solves the problem of coarse granularity of 5G edge calculation flow control in the related technology, and is suitable for scenes of edge calculation and flow control.

Description

Access control method, device, equipment and medium for 5G edge computing traffic

technical field

The present invention relates to the field of network technology, and in particular to an access control method, device, electronic device and computer-readable storage medium for 5G edge computing traffic.

Background technique

The current mainstream 5G (5th Generation Mobile Communication Technology, fifth-generation mobile communication technology) MEC (Multi-access Edge Computing, multi-access edge computing) offloading scheme is to distinguish business traffic in the 5G network, targeting at edge nodes The business traffic is distributed to the nearest user plane function UPF to realize the nearby forwarding of business traffic.

The above solution makes the enterprise-side gateway only able to distinguish the incoming business traffic and divide traffic based on the business traffic. The granularity is relatively coarse, and fine-grained traffic control cannot be effectively implemented.

Contents of the invention

The technical problem to be solved by the present invention is to provide an access control method, device, electronic equipment, and computer-readable storage medium for 5G edge computing traffic to at least solve the problems of 5G edge computing in related technologies. The granularity of flow control is relatively coarse.

In the first aspect, the present invention provides an access control method for 5G edge computing traffic, which is applied to a 5G security gateway. The method includes: acquiring the IMSI data of all terminals in the edge network, where the IMSI data Including the mapping relationship between IMSI and IP address; configure the access control list of edge computing traffic according to the contracted IMSI data and control requirements; forward the corresponding traffic according to the access control list, so as to realize the access control of different service traffic of different terminals.

Preferably, the acquiring the IMSI data of all terminals in the edge network includes: receiving the IMSI data of all terminals in the edge network forwarded by the 5G core network session management function SMF through the user plane function UPF.

Preferably, the access control list includes an IMSI field, a source IP address field, a source port field, a destination IP address field, a destination port field, a policy field and the mapping relationship between the six fields.

Preferably, configuring the access control list of edge computing traffic according to the contracted IMSI data and control requirements specifically includes: filling the IMSI in the contracted IMSI data into the IMSI field of the access control list; adding the IP address corresponding to the IMSI in the contracted IMSI data The address is filled into the source IP address field of the access control list; the source port field, destination IP address field, destination port address and policy field in the access control list are filled according to the control requirements of different business flows corresponding to different IMSIs.

Preferably, the forwarding of the corresponding traffic according to the access control list specifically includes: receiving the service traffic of the target terminal; acquiring the field set corresponding to the business traffic of the target terminal, and combining the field set with the access control list Each field of the field is matched; in response to the field matching, the service flow of the target terminal is forwarded.

Preferably, the forwarding of corresponding traffic according to the access control list further includes: discarding the service traffic of the target terminal in response to a field mismatch, wherein the field mismatch includes at least one of the following: source port field mismatch, destination The IP address fields do not match, and the destination port fields do not match.

In the second aspect, the present invention also provides an access control device for 5G edge computing traffic, including: an acquisition module for acquiring IMSI data of all terminals in the edge network, where the IMSI data includes IMSI and IP address mapping relationship. The configuration module is connected with the acquisition module, and is used to configure the access control list of edge computing traffic according to the contracted IMSI data and control requirements. The control module is connected with the configuration module, and is used to forward traffic according to the access control list, so as to realize access control to different service traffic of different terminals.

Preferably, the acquisition module includes an acquisition unit. The acquisition unit is used to receive the IMSI data of all terminals in the edge network forwarded by the 5G core network session management function SMF through the user plane function UPF.

Preferably, the access control list includes an IMSI field, a source IP address field, a source port field, a destination IP address field, a destination port field, a policy field and the mapping relationship between the six fields.

Preferably, the configuration module includes: a first filling unit, connected to the obtaining unit, for filling the IMSI in the subscription IMSI data into the IMSI field of the access control list. The second filling unit is connected with the obtaining unit, and is used for filling the IP address corresponding to the IMSI in the subscribed IMSI data into the source IP address field of the access control list. The configuration unit is connected with the first filling unit and the second filling unit, and is used to fill the source port field, destination IP address field, destination port address and policy field in the access control list according to the control requirements of different business flows corresponding to different IMSIs.

In a third aspect, the present invention also provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to realize the 5G as described in the first aspect Access control methods for edge computing traffic.

In a fourth aspect, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the access control method for 5G edge computing traffic as described in the first aspect is implemented.

The access control method, device, electronic device, and computer-readable storage medium for 5G edge computing traffic provided by the present invention obtain the IMSI and their IP addresses of all terminals in the edge network through collaboration between the edge network and the 5G core network, and target all terminals The IMSI and its IP address can reasonably configure the corresponding access control policy of its business traffic, so as to realize the flexible scheduling of different business traffic of different terminals, so as to improve the performance of the edge network.

Description of drawings

1 is a schematic flow diagram of an access control method for 5G edge computing traffic according to Embodiment 1 of the present invention;

FIG. 2 is a schematic diagram of a 5G edge computing network according to Embodiment 1 of the present invention;

FIG. 3 is a schematic flow diagram of configuring an access control list for edge computing traffic;

4 is a schematic structural diagram of an access control device for 5G edge computing traffic according to Embodiment 2 of the present invention;

FIG. 5 is a schematic structural diagram of an electronic device according to Embodiment 3 of the present invention.

detailed description

In order to enable those skilled in the art to better understand the technical solution of the present invention, the implementation manner of the present invention will be further described in detail below in conjunction with the accompanying drawings.

It should be understood that the specific embodiments and drawings described here are only for explaining the present invention, rather than limiting the present invention.

It can be understood that, in the case of no conflict, each embodiment and each feature in the embodiment of the present invention can be combined with each other.

It can be understood that, for the convenience of description, only the parts related to the present invention are shown in the drawings of the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

It can be understood that each unit and module involved in the embodiments of the present invention may only correspond to one physical structure, or may be composed of multiple physical structures, or multiple units and modules may also be integrated into one physical structure.

It can be understood that, under the condition of no conflict, the functions and steps marked in the flowchart and block diagram of the present invention may occur in a sequence different from that marked in the drawings.

It can be understood that the flowcharts and block diagrams of the present invention show the system architecture, functions and operations of possible implementations of systems, devices, devices, and methods according to various embodiments of the present invention. Wherein, each block in the flowchart or block diagram may represent a unit, module, program segment, or code, which includes executable instructions for realizing specified functions. Furthermore, each block or combination of blocks in the block diagrams and flowcharts can be implemented by a hardware-based system which performs the specified function, or by a combination of hardware and computer instructions.

It can be understood that the units and modules involved in the embodiments of the present invention may be implemented by means of software or hardware, for example, the units and modules may be located in a processor.

Example 1:

As shown in FIG. 1 , this embodiment provides an access control method for 5G edge computing traffic, which is applied to a 5G security gateway. Among them, as shown in Figure 2, a 5G security gateway node is set on the edge of the user side, and the 5G security gateway node is connected to the UPF and the enterprise application respectively, and is used to receive the data traffic (that is, business traffic) and control traffic forwarded by the UPF to the edge side, By setting the traffic access control policy, the flexible scheduling of different service traffic of different terminals can be realized.

Access control methods for 5G edge computing traffic include:

Step 101, acquire the IMSI data of the subscribed International Mobile Subscriber Identity codes of all terminals in the edge network, wherein the subscribed IMSI data includes the mapping relationship between the IMSI and the IP address.

In this embodiment, the operator provides an MEC network to industry customers, and deploys UPF network elements on its edge side. The structure of the IMSI (International Mobile Subscriber Identity, International Mobile Subscriber Identity) data obtained through communication and interaction between the 5G security gateway and the 5G core network elements is shown in Table 1.

Table 1 Structure of contracted IMSI data

IMSI IP

Specifically, the acquiring the IMSI data of all terminals in the edge network includes: the 5G security gateway receives the IMSI data of all terminals in the edge network forwarded by the 5G core network session management function SMF through the user plane function UPF. For example, when a user purchases terminals IMSI-A and IMSI-B, the SMF on the 5G core network side sends the IP address mapping relationship corresponding to the IMSI belonging to the edge network to the 5G security gateway on the user side through UPF. At this time, the contracted IMSI data in the 5G security gateway is shown in Table 2.

Table 2 Structure of contracted IMSI data

IMSI IP IMSI-A IP-A IMSI-B IP-B

Step 102, configuring an access control list for edge computing traffic according to the contracted IMSI data and control requirements.

In this embodiment, the access control table is configured according to the contracted IMSI data to implement scheduling of different terminal service flows. Based on this, the access control table is configured according to the existing service flow partitioning method to implement different services for different terminals at the edge Traffic is scheduled to achieve more flexible scheduling and finer-grained access control.

Optionally, in order to completely distinguish terminals and different service flows of terminals, the access control list set in the 5G security gateway includes IMSI field, source IP address field, source port field, destination IP address field, destination port field, policy field and its The mapping relationship between the six fields.

Optionally, as shown in Figure 3, step 102: configuring the access control list of edge computing traffic according to the contracted IMSI data and control requirements, specifically includes:

Step 1021: Fill the IMSI in the subscription IMSI data into the IMSI field of the access control list.

Step 1022, filling the source IP address field of the access control list with the IP address corresponding to the IMSI in the subscribed IMSI data.

Step 1023, filling the source port field, destination IP address field, destination port address and policy field in the access control list according to the control requirements of different service flows corresponding to different IMSIs.

In this embodiment, the edge network administrator may use an automatic control program to configure policies in the access control list of the 5G security gateway, so as to implement fine-grained access control on different service flows of different terminals. For example, for IMSI-A and IP-A terminals, set the source port as S-A, destination IP as IP-C, and destination port as D-C to pass; for IMSI-B and IP-B terminals, set the source port as S-B, the destination IP is IP-D, and the destination port is D-D. The policy configuration is pass, and the access control list in the configured 5G security gateway is shown in Table 3.

Table 3 Access Control List in 5G Security Gateway

IMSI source IP source port Destination IP destination port Strategy IMSI-A IP-A SP-A IP-C DP-C pass IMSI-B IP-B SP-B IP-D DP-D pass

Step 103, forward corresponding traffic according to the access control list, so as to implement access control on different service traffic of different terminals.

In this embodiment, when the service traffic of the target terminal accesses the edge computing MEC network, on the 5G core network side, the traffic is distributed to the UPF network element corresponding to the MEC through the SMF, and the UPF network element forwards it to the 5G network element in the edge network. security gateway. The 5G security gateway implements policy control on business traffic according to the access control list.

Specifically, the forwarding of the corresponding traffic according to the access control list includes: receiving the service traffic of the target terminal; acquiring the field set corresponding to the service traffic of the target terminal, and combining the field set with each field in the access control list field matching; in response to the field matching, forwarding the service flow of the target terminal.

Optionally, the forwarding the corresponding traffic according to the access control list further includes: discarding the service traffic of the target terminal in response to field mismatch. Wherein, the field mismatch includes at least one of the following: source port field mismatch, destination IP address field mismatch, and destination port field mismatch.

In this embodiment, for example, for the target terminal IMSI-A, if the service traffic of the target terminal passes through the 5G security gateway, the field matches the access control list in the gateway, that is, the source port is SP-A, and the destination IP is IP- C. The destination port is DP-C, and the 5G security gateway performs forwarding. If the fields do not match, for example, the destination port of IMSI-A is DP-D, the service traffic is discarded or ignored. For the target terminal IMSI-B, if the service traffic of the target terminal passes through the 5G security gateway, the field matches the access control list in the gateway, that is, the source port is SP-B, the destination IP is IP-D, and the destination port is DP- D, the 5G security gateway forwards the service traffic. If the fields do not match, for example, the destination port of IMSI-B is DP-C, the service traffic is discarded or ignored.

The access control method for 5G edge computing traffic in this embodiment configures the access control table according to the contracted IMSI data to implement scheduling of different terminal service traffic. Based on this, the access control table is further configured according to the existing business traffic partitioning method to achieve Scheduling different business flows of different terminals on the edge side, so as to achieve more flexible scheduling and finer-grained access control in edge computing. In addition, by reasonably configuring the fields in the access control table to completely distinguish terminals and different service flows of terminals, so as to distinguish service flows from the terminal dimension, access control can be performed on different service flows of different terminals, avoiding coarse-grained Access control policies lead to edge network congestion, thereby improving edge network performance.

Example 2:

As shown in Figure 4, this embodiment provides an access control device for 5G edge computing traffic, including:

The acquiring module 31 is configured to acquire IMSI data of the subscribed International Mobile Subscriber Identity of all terminals in the edge network, wherein the subscribed IMSI data includes the mapping relationship between IMSI and IP address.

The configuration module 32 is connected with the acquisition module 31 and configured to configure the access control list of edge computing traffic according to the contracted IMSI data and control requirements.

The control module 33 is connected with the configuration module 32, and is configured to forward traffic according to the access control list, so as to implement access control to different service traffic of different terminals.

Optionally, the acquisition module includes an acquisition unit. The acquisition unit is used to receive the IMSI data of all terminals in the edge network forwarded by the 5G core network session management function SMF through the user plane function UPF.

Optionally, the access control list includes an IMSI field, a source IP address field, a source port field, a destination IP address field, a destination port field, a policy field and a mapping relationship among the six fields.

Optionally, configuration modules include:

The first filling unit is connected with the obtaining unit, and is used for filling the IMSI in the subscription IMSI data into the IMSI field of the access control list.

The second filling unit is connected with the obtaining unit, and is used for filling the IP address corresponding to the IMSI in the subscribed IMSI data into the source IP address field of the access control list.

The configuration unit is connected with the first filling unit and the second filling unit, and is used to fill the source port field, destination IP address field, destination port address and policy field in the access control list according to the control requirements of different business flows corresponding to different IMSIs.

Optionally, the control module includes:

The receiving unit is configured to receive the service flow of the target terminal.

The matching unit is connected with the receiving unit, and is used to obtain the field set corresponding to the service flow of the target terminal, and match the field set with each field in the access control list.

A processing unit, connected to the matching unit, configured to forward the service flow of the target terminal in response to field matching.

Optionally, the processing unit is further configured to discard the service flow of the target terminal in response to field mismatch. The field mismatch includes at least one of the following: source port field mismatch, destination IP address field mismatch, and destination port field mismatch.

The access control device for 5G edge computing traffic in this embodiment is used to configure the access control table according to the contracted IMSI data to realize the scheduling of different terminal service traffic. Based on this, it is also used to configure access according to the existing business traffic partition mode The control table is used to realize the scheduling of different business flows of different terminals on the edge side, so as to realize more flexible scheduling and finer-grained access control in edge computing. In addition, by reasonably configuring the fields in the access control table to completely distinguish terminals and different service flows of terminals, so as to distinguish service flows from the terminal dimension, access control can be performed on different service flows of different terminals, avoiding coarse-grained Access control policies lead to edge network congestion, thereby improving edge network performance.

Example 3:

As shown in Figure 5, this embodiment provides an electronic device, including a memory 41 and a processor 42, the memory 41 stores a computer program, and the processor 42 is set to run the computer program to implement the The access control method for 5G edge computing traffic described in Example 1.

Example 4:

This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the access control method for 5G edge computing traffic as described in Embodiment 1 is implemented.

The electronic device in Embodiment 3 and the computer-readable storage medium in Embodiment 4 can distinguish service traffic from the terminal dimension, thereby performing access control on the traffic of different services of different terminals, and avoiding coarse-grained access control policies that cause the edge network to Congestion, thereby improving edge network performance.

It can be understood that, the above embodiments are only exemplary embodiments adopted for illustrating the principle of the present invention, but the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also regarded as the protection scope of the present invention.

Claims (10)

1. An access control method for 5G edge computing traffic, characterized in that it is applied to a 5G security gateway, and the method comprises: Obtain the IMSI data of the contracted International Mobile Subscriber Identity code of all terminals in the edge network, wherein the contracted IMSI data includes the mapping relationship between the IMSI and the IP address; Configure the access control list of edge computing traffic according to the contracted IMSI data and control requirements; The corresponding traffic is forwarded according to the access control list, so as to implement access control on different service traffic of different terminals. 2. The access control method for 5G edge computing traffic according to claim 1, wherein the acquisition of the contracted International Mobile Subscriber Identity (IMSI) data of all terminals in the edge network specifically includes: Receive the subscription IMSI data of all terminals in the edge network forwarded by the 5G core network session management function SMF through the user plane function UPF. 3. The access control method for 5G edge computing traffic according to claim 1, wherein the access control list includes an IMSI field, a source IP address field, a source port field, a destination IP address field, a destination port field, a policy field and The mapping relationship between its six fields, The access control list for configuring edge computing traffic according to the contracted IMSI data and control requirements specifically includes: Fill the IMSI in the contracted IMSI data into the IMSI field of the access control list; Fill the IP address corresponding to the IMSI in the contracted IMSI data into the source IP address field of the access control list; Fill in the source port field, destination IP address field, destination port address, and policy field in the access control list according to the control requirements of different service flows corresponding to different IMSIs. 4. The access control method for 5G edge computing traffic according to claim 1, wherein the forwarding of corresponding traffic according to the access control list specifically includes: Receive the business traffic of the target terminal; Obtaining a field set corresponding to the service flow of the target terminal, and matching the field set with each field in the access control list; In response to field matching, forward the service flow of the target terminal. 5. The access control method for 5G edge computing traffic according to claim 1, wherein the forwarding of corresponding traffic according to the access control list further comprises: Discarding the service traffic of the target terminal in response to a field mismatch, where the field mismatch includes at least one of the following: source port field mismatch, destination IP address field mismatch, and destination port field mismatch. 6. An access control device for 5G edge computing traffic, characterized in that it comprises: The obtaining module is used to obtain the contracted International Mobile Subscriber Identity code IMSI data of all terminals in the edge network, wherein the contracted IMSI data includes the mapping relationship between IMSI and IP address, The configuration module is connected with the acquisition module, and is used to configure the access control list of edge computing traffic according to the contracted IMSI data and control requirements, The control module is connected with the configuration module, and is used to forward traffic according to the access control list, so as to realize access control to different service traffic of different terminals. 7. The access control device for 5G edge computing traffic according to claim 6, wherein the acquisition module includes an acquisition unit, The acquisition unit is used to receive the IMSI data of all terminals in the edge network forwarded by the 5G core network session management function SMF through the user plane function UPF. 8. The access control device for 5G edge computing traffic according to claim 1, wherein the access control list includes an IMSI field, a source IP address field, a source port field, a destination IP address field, a destination port field, a policy field and The mapping relationship between its six fields, Configuration modules include: The first filling unit is connected to the obtaining unit, and is used to fill the IMSI in the contracted IMSI data into the IMSI field of the access control list, The second filling unit is connected to the obtaining unit, and is used to fill the IP address corresponding to the IMSI in the contracted IMSI data into the source IP address field of the access control list, The configuration unit is connected with the first filling unit and the second filling unit, and is used to fill the source port field, destination IP address field, destination port address and policy field in the access control list according to the control requirements of different business flows corresponding to different IMSIs. 9. An electronic device, characterized in that it comprises a memory and a processor, a computer program is stored in the memory, and the processor is configured to run the computer program to achieve any one of claims 1-5 The access control method for the 5G edge computing traffic. 10. A computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the access to the 5G edge computing traffic as claimed in any one of claims 1-5 is realized Control Method.

Images