Flow filtering method and flow filtering device

Abstract

A flow filtering method and a flow filtering device are applied to flow detection of a 5G private network, and the method comprises the following steps: determining a tunnel slice corresponding relationship between a tunnel with slices and slice information according to flow data transmitted by a control signaling interface N2 and a session control interface N4; wherein the slice information comprises a slice filtering identifier used for identifying whether a stream transmitted in the tunnel needs to be filtered or not; for each service data stream in service data transmitted by a user data interface N3, slice information corresponding to the service data stream is determined according to tunnel information in the service data stream and the tunnel slice corresponding relation; and judging whether the service data flow needs to be filtered or not according to the slice filtering identifier in the slice information corresponding to the service data flow. According to the scheme, a user can filter the traffic only by configuring the filter slice, so that the bypass security detection equipment can detect more 5G private network traffic, and the resource utilization efficiency of the bypass security detection equipment is improved.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of network security technology, and in particular, to a traffic filtering method and a traffic filtering device. Background Art

[0002] With the rapid development of 5G technology, the application of 5G private networks in fields such as industrial Internet and smart cities is becoming increasingly widespread. However, the security issues of 5G private networks are also becoming increasingly prominent, and deploying bypass security detection devices has become an important means to discover and respond to security risks. The bypass security detection device accesses the 5G private network traffic through the traffic mirroring method, and can monitor and analyze the network traffic in real time to identify potential security threats. The traffic in the 5G private network is divided into signaling data plane and service data plane. Among them, the traffic protocol of the signaling data plane is relatively fixed, while the traffic protocols of the service data plane are diverse and the traffic scale is huge, which poses extremely high requirements on the processing performance of the bypass security detection device.

[0003] In the 5G private network, the traffic of the service data plane is mainly transmitted through tunnels using the N3 interface. There are many types of these traffic protocols. If security detection is performed on all traffic, it will occupy a large amount of resources of the bypass security detection device. However, there is a large amount of low-risk traffic or traffic that cannot be detected by the current detection device in the actual service data traffic. If these traffic can be effectively filtered, it will greatly save the resources of the security detection device and improve its processing efficiency.

[0004] Traditional traffic filtering technologies, such as the setting based on iptables rules, usually perform classification filtering through five-tuple information such as port numbers and IP addresses. However, this method relies on manual configuration and management, lacks flexibility, and is difficult to adapt to the dynamic characteristics of 5G private networks. In 5G private networks, the IP addresses of terminals are dynamically allocated, and traffic filtering based on five-tuples may lead to mis-filtering. In addition, 5G networks adopt slicing technology, and traditional traffic filtering technologies cannot perform traffic screening for slices, making it difficult to meet the refined security management requirements of 5G private networks.

[0005] Therefore, there is an urgent need for a traffic filtering method that can adapt to the characteristics of 5G private networks to improve the resource utilization efficiency of bypass security detection devices. Summary of the Invention

[0006] The following is an overview of the subject matter described in detail in this article. This overview is not intended to limit the scope of protection of the claims.

[0007] This application provides a traffic filtering method and a traffic filtering device, which implement a traffic filtering solution that adapts to the characteristics of 5G private networks and can improve the resource utilization efficiency of bypass security detection devices.

[0008] An embodiment of the present application provides a traffic filtering method, which is applied to traffic detection in a 5G private network. The 5G private network includes at least the following interfaces: a control signaling interface N2, a session control interface N4, and a user data interface N3. The method includes: According to the traffic data transmitted by the control signaling interface N2 and the session control interface N4, determine the tunnel slice correspondence between the existing slice tunnels and slice information; wherein, the slice information includes a slice filtering identifier for identifying whether the traffic transmitted in the tunnel needs to be filtered; For each service data flow in the service data transmitted by the user data interface N3, determine the slice information corresponding to the service data flow according to the tunnel information in the service data flow and the tunnel slice correspondence, and determine whether the service data flow needs to be filtered according to the slice filtering identifier in the slice information corresponding to the service data flow.

[0009] An embodiment of the present application further provides a traffic filtering method device, including: a memory and a processor; the memory is used to store a program for traffic filtering; the processor is used to read the program for traffic filtering and execute the traffic filtering method as described in any embodiment of the present application.

[0010] Compared with the related art, a traffic filtering method and a traffic filtering device provided by an embodiment of the present application are adapted to the characteristics of the 5G private network. According to the traffic data transmitted by the control signaling interface N2 and the session control interface N4, determine the tunnel slice correspondence between the existing slice tunnels and slice information, and then the slice information corresponding to the service data flow transmitted by the user data interface N3 can be quickly found by using the tunnel slice correspondence. Then, it can be determined whether the service data flow needs to be filtered according to the slice filtering identifier in the slice information. Through this solution, users only need to configure the filtering slices to achieve traffic filtering, enabling the bypass security detection device to detect more 5G private network traffic, improving the resource utilization efficiency of the bypass security detection device, and thereby improving the accuracy and comprehensiveness of network security detection.

[0011] Other features and advantages of the present application will be described in the following description, and some of them will become obvious from the description, or be understood by implementing the present application. Other advantages of the present application can be achieved and obtained through the solutions described in the description and the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings are used to provide an understanding of the technical solution of the present application, and constitute a part of the description. They are used together with the embodiments of the present application to explain the technical solution of the present application, and do not constitute a limitation to the technical solution of the present application.

[0013] Figure 1 It is a brief flowchart of the traffic filtering method for the embodiment of the present application; Figure 2 This is a flowchart of the traffic filtering method according to an embodiment of the present application; Figure 3 This is a schematic diagram of the slice tunnel structure according to an embodiment of the present application; Figure 4 This is a schematic diagram of the flow structure according to an embodiment of the present application; Figure 5 This is a schematic diagram of the traffic filtering device according to an embodiment of the present application; Figure 6 This is a schematic diagram of the traffic filtering system according to an embodiment of the present application. Detailed implementation manners

[0014] The present application describes multiple embodiments, but the description is exemplary rather than restrictive, and it is obvious to those of ordinary skill in the art that there can be more embodiments and implementation solutions within the scope covered by the embodiments described in the present application. Although many possible feature combinations are shown in the drawings and discussed in the detailed implementation manners, many other combination ways of the disclosed features are also possible. Unless specifically restricted, any feature or element of any embodiment can be combined with any other feature or element in any other embodiment, or can replace any other feature or element in any other embodiment.

[0015] The present application includes and contemplates combinations with features and elements known to those of ordinary skill in the art. The embodiments, features, and elements already disclosed in the present application can also be combined with any conventional features or elements to form unique invention solutions. Any feature or element of any embodiment can also be combined with features or elements from other invention solutions to form another unique invention solution. Therefore, it should be understood that any feature shown and / or discussed in the present application can be implemented alone or in any appropriate combination. Therefore, the embodiments are not subject to other restrictions except those made according to the appended claims and their equivalent replacements. In addition, various modifications and changes can be made within the protection scope of the appended claims.

[0016] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not depend on the specific sequence of steps described herein, the method or process should not be limited to the specific sequence of steps described. As will be understood by those of ordinary skill in the art, other step sequences are possible. Therefore, the specific sequence of steps set forth in the specification should not be construed as a limitation on the claims. In addition, the claims directed to the method and / or process should not be limited to performing their steps in the order written, and those skilled in the art can easily understand that these orders can be changed and still remain within the spirit and scope of the embodiments of the present application.

[0017] An embodiment of the present application provides a traffic filtering method, which is applied to traffic detection in a 5G private network. The 5G private network includes at least the following interfaces: a control signaling interface N2, a session control interface N4, and a user data interface N3; as Figure 1 shown, the method may include the following steps: Step S110: Determine the tunnel slice correspondence between the tunnel with slices and the slice information according to the traffic data transmitted by the control signaling interface N2 and the session control interface N4; wherein, the slice information includes a slice filtering identifier for identifying whether the traffic transmitted in the tunnel needs to be filtered; Step S120: For each service data flow in the service data transmitted by the user data interface N3, determine the slice information corresponding to the service data flow according to the tunnel information in the service data flow and the tunnel slice correspondence, and determine whether the service data flow needs to be filtered according to the slice filtering identifier in the slice information corresponding to the service data flow.

[0018] Among them, the control signaling interface N2 can also be called the N2 interface, the session control interface N4 can also be called the N4 interface, and the user data interface N3 can also be called the N3 interface.

[0019] The traffic filtering implemented in this embodiment belongs to the filtering of service plane traffic. After the user configures the filtering slice, the operator provides independent network services for different services through the 5G network slice, and some service traffic that does not need to be detected can be filtered through slice identification.

[0020] The traffic filtering method of this embodiment determines the tunnel slice correspondence between the tunnel with slices and the slice information according to the traffic data transmitted by the N2 and N4 interfaces, and then can quickly determine the slice information corresponding to each service data flow in the service data transmitted by the N3 interface by using the tunnel slice correspondence. Furthermore, it can be determined whether the service data flow needs to be filtered according to the corresponding slice information. This solution adapts to the characteristics of the 5G private network. Through this solution, the user only needs to configure the filtering slice to achieve traffic filtering, enabling the bypass security detection device to detect more 5G private network traffic, improving the resource utilization efficiency of the bypass security detection device, and thereby indirectly improving the accuracy and comprehensiveness of network security detection.

[0021] In an exemplary embodiment, the determining the tunnel slice correspondence between the tunnel with slices and the slice information according to the traffic data transmitted by the control signaling interface N2 and the session control interface N4 may include: Determine the uplink tunnel slice correspondence relationship according to the slice information and the uplink tunnel information in the control signaling data transmitted through the control signaling interface N2, where the uplink tunnel slice correspondence relationship is the correspondence relationship between the tunnel endpoint identifier (TEID) of the uplink tunnel with slices and the slice information; Determine the correspondence relationship between the uplink tunnel information and the downlink tunnel information according to the uplink tunnel information and the downlink tunnel information in the session control data transmitted through the session control interface N4; Determine the downlink tunnel slice correspondence relationship according to the correspondence relationship between the uplink tunnel information and the downlink tunnel information and the uplink tunnel slice correspondence relationship, where the downlink tunnel slice correspondence relationship is the correspondence relationship between the tunnel endpoint identifier (TEID) of the downlink tunnel with slices and the slice information; Obtain the tunnel slice correspondence relationship according to the uplink tunnel slice correspondence relationship and the downlink tunnel slice correspondence relationship.

[0022] The traffic filtering method of this embodiment determines the uplink tunnel slice correspondence relationship according to the slice information and the uplink tunnel information in the control signaling data transmitted through the N2 interface, and establishes the downlink tunnel slice correspondence relationship between the slice information and the downlink tunnel information according to the uplink tunnel information in the traffic data transmitted through the N2 and N4 interfaces. Thus, for the traffic in either the uplink tunnel or the downlink tunnel, the slice information corresponding to the traffic can be obtained according to the tunnel slice correspondence relationship, and then it can be determined whether the traffic needs to be filtered according to the slice filtering identifier in the slice information.

[0023] In an example of this embodiment, the obtaining the tunnel slice correspondence relationship according to the uplink tunnel slice correspondence relationship and the downlink tunnel slice correspondence relationship may include: combining the uplink tunnel slice correspondence relationship and the downlink tunnel slice correspondence relationship to generate the correspondence relationship between the tunnel endpoint identifier (TEID) and the slice information, and using this correspondence relationship as the tunnel slice correspondence relationship; The determining the slice information corresponding to the service data flow according to the tunnel information in the service data flow and the tunnel slice correspondence relationship includes: obtaining the tunnel endpoint identifier (TEID) of the service data flow according to the tunnel information in the service data flow; determining the slice information corresponding to the service data flow according to the tunnel endpoint identifier (TEID) and the tunnel slice correspondence relationship.

[0024] In the traffic filtering method of this example, the corresponding relationships of the uplink tunnel slices and the downlink tunnel slices are combined to generate the corresponding relationship between the tunnel endpoint identifier (TEID) and the slice information, and this corresponding relationship is used as the corresponding relationship of the tunnel slices. Then, according to the tunnel endpoint identifier (TEID) in the service data stream and the corresponding relationship of the tunnel slices, the corresponding slice information can be quickly found, and the service data stream in the N3 interface can be filtered according to the slice information. This solution enables the N3 interface service data traffic to support slice traffic filtering.

[0025] In an example of this embodiment, the service data stream includes an uplink service data stream and a downlink service data stream; determining the slice information corresponding to the service data stream according to the tunnel information in the service data stream and the corresponding relationship of the tunnel slices may include: For each uplink service data stream, determine the slice information corresponding to the uplink service data stream according to the uplink tunnel endpoint identifier (TEID) of the uplink service data stream and the corresponding relationship of the uplink tunnel slices; For each downlink service data stream, determine the slice information corresponding to the downlink service data stream according to the downlink tunnel endpoint identifier (TEID) of the downlink service data stream and the corresponding relationship of the downlink tunnel slices.

[0026] It can be seen from the filtering method of this example that it is also possible not to combine the corresponding relationships of the uplink tunnel slices and the downlink tunnel slices, but to query the corresponding slice information for the service data stream in the uplink tunnel using the uplink tunnel endpoint identifier (TEID) and the corresponding relationship of the uplink tunnel slices, and query the corresponding slice information for the service data stream in the downlink tunnel using the downlink tunnel endpoint identifier (TEID) and the corresponding relationship of the downlink tunnel slices. In this way, the slice information corresponding to the service traffic in the uplink tunnel and the downlink tunnel can still be obtained, and then the service data stream in the N3 interface can be filtered according to the slice information.

[0027] In an exemplary embodiment, determining the slice information corresponding to the service data stream according to the tunnel information in the service data stream and the corresponding relationship of the tunnel slices, and determining whether the service data stream needs to be filtered according to the slice filtering flag in the slice information corresponding to the service data stream may include: Determine the flow ID of the service data stream according to the five-tuple information in the service data stream, and determine the service flow object corresponding to the service data stream according to the flow ID. Among them, the service flow object at least includes the following fields: flow ID, tunnel endpoint identifier (TEID), tunnel destination IP, slice information, flow filtering flag, and the flow filtering flag field is defaulted to no filtering; Determine whether the service data flow needs to be filtered according to the flow filtering identification field in the service flow object corresponding to the service data flow, including: when the flow filtering identification field in the service flow object corresponding to the service data flow indicates that no filtering is required, determine whether there is slice information corresponding to the service data flow according to the tunnel endpoint identifier TEID in the service data flow and the corresponding relationship between the tunnel slices, and when there is corresponding slice information, determine whether the service data flow needs to be filtered according to the slice filtering identification in the corresponding slice information, update the slice information field in the corresponding service flow object according to the corresponding slice information, and set the flow filtering identification field in the corresponding service flow object according to the slice filtering identification in the slice information corresponding to the service data flow; when the flow filtering identification field in the service flow object corresponding to the service data flow indicates that filtering is required, filter the service data flow.

[0028] Exemplarily, the five-tuple information includes source IP, destination IP, source port, destination port, and protocol.

[0029] In an example of this embodiment, the determining the service flow object corresponding to the service data flow according to the flow ID may include: In the case where the service flow object corresponding to the service data flow cannot be found according to the flow ID, initialize a service flow object as the corresponding service flow object according to the flow ID, and update the tunnel endpoint identifier TEID, tunnel destination IP, number of bytes of the request direction message, and number of bytes of the response direction message in the service flow object according to the information carried in the service data flow; In the case where the service flow object corresponding to the service data flow is found according to the flow ID, update the number of bytes of the request direction message and the number of bytes of the response direction message in the corresponding service flow object according to the information carried in the service data flow.

[0030] The traffic filtering method of this embodiment uses the five-tuple information in the service data flow to determine the flow ID of the service data flow, generates or confirms the service flow object corresponding to the service data flow, and uses the service flow object to integrate the uplink tunnel traffic and the downlink tunnel traffic together, realizing the complete filtering of the service data flow in the N3 interface (the traffic in the uplink tunnel and the downlink tunnel), and solving the technical problem that "the 5G private network N3 interface uses tunnel transmission, there are uplink and downlink tunnels for the same session, although these two tunnels are for the same session but are not the same flow in the N3 interface, and complete filtering cannot be performed according to the traditional technology".

[0031] In an exemplary embodiment, after determining whether the service data flow needs to be filtered according to the slice filtering identification in the slice information corresponding to the service data flow, if the slice filtering identification in the slice information corresponding to the service data flow indicates that no filtering is required, the method may further include: Filter the service data stream according to the traffic type of the service data stream; and / or filter the service data stream according to the depth of traffic detection.

[0032] The traffic filtering method of this embodiment realizes the filtering of security plane traffic. Security plane traffic filtering refers to analyzing traffic with no security detection value, such as encrypted and undecipherable traffic, audio and video traffic, and traffic reaching the depth of traffic detection. These traffic types are of little significance even if security detection is performed. Filtering these traffic types helps improve the processing performance of the bypass security detection device.

[0033] In an example of this embodiment, the filtering of the service data stream according to the traffic type of the service data stream may include: Perform application protocol identification on the service data stream to determine whether the service data stream is a traffic type that needs to be filtered. The traffic types that need to be filtered include audio and video traffic and unresolvable encrypted traffic, but are not limited thereto and can be configured according to actual requirements; In the case where the service data stream is a traffic type that needs to be filtered, filter the service data stream and set the flow filtering identification field in the service data stream.

[0034] Exemplarily, application protocol identification can be performed on the service data stream, and the traffic type of the service data stream can be determined according to the type of the protocol.

[0035] Exemplarily, the application protocol identification can be performed according to the port or packet characteristics, and the specific identification process can refer to the prior art.

[0036] The traffic filtering method of this example supports traffic protocol identification. By performing application protocol identification on the service data stream, it can be determined whether the service data stream is a traffic type that needs to be filtered, and thus the filtering of audio and video traffic, unresolvable encrypted traffic, etc. can be realized. In addition, when it is determined that the service data stream is a traffic type that needs to be filtered, the flow filtering identification field in the service data stream is set to need filtering. When a packet belonging to the service data stream is received next time, filtering can be directly performed according to the flow filtering identification field without further judgment, improving the filtering efficiency.

[0037] In an example of this embodiment, the service flow object further includes the following fields: the number of bytes of the request direction packet and the number of bytes of the response direction packet; the method may further include: during the process of performing traffic detection on the service data transmitted by the user data interface N3, updating the values of the number of bytes of the request direction packet and the number of bytes of the response direction packet fields of the service flow object corresponding to each service data stream; Filtering the service data stream according to the depth of traffic detection may include: determining whether the upper limit of traffic detection depth is reached according to the relationship between the number of request - direction reported bytes and the number of response - direction reported bytes fields of the service flow object corresponding to the service data stream and the preset upper limit value of traffic detection depth; in the case where the upper limit of traffic detection depth is reached, filtering the service data stream and setting the flow filtering identification field in the service data stream.

[0038] The traffic filtering method of this example supports flow detection depth identification. During the process of traffic detection of the service data transmitted through the N3 interface, the values of the number of request - direction reported bytes and the number of response - direction reported bytes fields of the service flow object corresponding to each service data stream are updated, realizing the statistics of the detected data bytes during the flow data detection process. In this way, when the detected data bytes reach the preset upper limit value of traffic detection depth, the flow is no longer filtered. Additionally, after reaching the upper limit of traffic detection depth, the flow filtering identification field in the service data stream is set to need filtering. When a packet belonging to this service data stream is received next time, it can be directly filtered according to the flow filtering identification field without re - judgment, improving the filtering efficiency.

[0039] In summary, the traffic filtering method of this embodiment realizes the comprehensive filtering of traffic on the service plane and the security plane. This solution only requires the user to configure the filtering slice, realizes traffic filtering with little user intervention, and does not produce mis - filtering problems, which can greatly improve the resource utilization efficiency and processing performance of the bypass security detection device.

[0040] The following is a complete example of the traffic filtering method of the embodiment of this application. As Figure 2 shown, it may include the following steps: Step S210: Parse the traffic of the N2 and N4 interfaces, and determine the tunnel - slice correspondence relationship between the existing slice tunnels and the slice information according to the traffic data transmitted through the N2 interface and the N4 interface; wherein, the slice information includes a slice filtering identifier for identifying whether the flow transmitted in the tunnel needs to be filtered.

[0041] Exemplarily, this step S210 may include steps S211 - S215: Step S211: Parse the traffic of the N2 interface, and parse the slice information and the uplink tunnel information according to the terminal registration signaling in the traffic.

[0042] Step S212: Parse the traffic of the N4 interface, and parse the uplink tunnel information, the downlink tunnel information, and the terminal permanent identity information according to the terminal PDU session establishment and modification signaling in the traffic.

[0043] It should be noted that steps S211 and S212 are executed in parallel and there is no sequence.

[0044] Step S213: Correlate the uplink tunnel information parsed from the N2 interface and the uplink tunnel information parsed from the N4 interface to obtain the correspondence between the downlink tunnel information parsed from the N4 interface and the slice information parsed from the N2 interface, that is, the downlink tunnel slice correspondence.

[0045] Exemplarily, the correlating the uplink tunnel information parsed from the N2 interface and the uplink tunnel information parsed from the N4 interface to obtain the correspondence between the downlink tunnel information parsed from the N4 interface and the slice information parsed from the N2 interface may include: Based on the uplink tunnel information parsed from the N2 interface and the uplink tunnel information parsed from the N4 interface, correlate the "slice information and uplink tunnel information obtained from the N2 interface" with the "uplink tunnel information and downlink tunnel information obtained from the N4 interface" to generate a slice tunnel structure object (the structure of the tunnel structure object may refer to Figure 3 ) In this way, the correspondence between the "downlink tunnel information parsed from the N4 interface" and the "slice information parsed from the N2 interface" is established through this slice tunnel structure object.

[0046] Exemplarily, the uplink tunnel information includes the uplink tunnel TEID and the uplink tunnel IP, and the downlink tunnel information includes the downlink tunnel TEID and the downlink tunnel IP; wherein, the uplink tunnel TEID refers to the tunnel endpoint identifier TEID of the uplink tunnel, and the downlink tunnel TEID refers to the tunnel endpoint identifier TEID of the downlink tunnel.

[0047] It should be noted that in this application, the SST (Slice / Service Type) and SD (Slice Differentiator) fields are two components of the S-NSSAI (Single Network Slice Selection Assistance Information) and are used to identify network slices. The values of the SST and SD fields can be obtained from the slice information.

[0048] Step S214: Use the correspondence between the tunnel endpoint identifier TEID of the uplink tunnel information parsed from the N2 interface and the slice information as the uplink tunnel slice correspondence.

[0049] It should be noted that Step S213 and Step S214 are not in a sequential order.

[0050] Step S215: Using the tunnel endpoint identifier (TEID) of the uplink tunnel information as the key and the slice information as the value, write the corresponding relationship between the uplink tunnel slices into the tunnel slice corresponding relationship hash table; using the tunnel endpoint identifier (TEID) of the downlink tunnel information as the key and the slice information as the value, also write the corresponding relationship between the downlink tunnel slices into the tunnel slice corresponding relationship hash table. In this way, a tunnel slice corresponding relationship hash table that stores the corresponding relationship between the tunnel endpoint identifier (TEID) and the slice information is generated. Whether it is the traffic in the uplink tunnel or the traffic in the downlink tunnel, the corresponding slice information can be obtained by looking up the tunnel endpoint identifier (TEID) in this tunnel slice corresponding relationship hash table.

[0051] It should be noted that when inserting the corresponding relationship into the tunnel slice corresponding relationship hash table according to the tunnel endpoint identifier (TEID), if the key of this tunnel endpoint identifier (TEID) already exists in the tunnel slice corresponding relationship hash table, directly update the value of this node or remove this node and then insert it.

[0052] Exemplarily, if the slice tunnel structure object as shown in Figure 3 is generated in step S213, a tunnel slice corresponding relationship hash table can also be generated with the tunnel endpoint identifier (TEID) (uplink or downlink) as the key and the slice tunnel structure object as the value.

[0053] After this step S210, the corresponding relationship between the tunnel slices is obtained. According to this corresponding relationship between the tunnel slices, it is possible to quickly find out which slice the traffic transmitted by the tunnel uses, and then it is possible to determine whether the traffic transmitted by the tunnel needs to be filtered according to the slice information of the slice. Step S220: Analyze the N3 interface traffic and determine the service flow object corresponding to the service data stream according to the five-tuple information in each service data stream transmitted by N3.

[0054] Exemplarily, the structure of the service flow object can refer to Figure 4 , and may include: flow ID, source IP, destination IP, source port, destination port, number of bytes of the request direction message, number of bytes of the response direction message, application layer protocol, flow filtering flag, SST, SD, tunnel endpoint identifier (TEID), tunnel destination IP field. This application does not limit the fields in the flow information structure, and can add and remove them according to the actual situation.

[0055] Exemplarily, this step S220 may include steps S221 - S223: Step S221: Analyze the N3 interface traffic and determine the flow ID of the service data stream according to the five-tuple information in each service data stream transmitted by N3; Step S222: Search for the service flow object corresponding to the service data flow according to the flow ID of the service data flow. The service flow object may include the following fields: flow ID, tunnel endpoint identifier TEID, tunnel destination IP, slice information, flow filtering flag, number of bytes in the request direction message, and number of bytes in the response direction message. The flow filtering flag field is defaulted to no filtering required.

[0056] Step S223: If there is no service flow object corresponding to the service data flow, initialize a service flow object, generate the flow ID of the service flow object according to the five-tuple information of the service data flow, and then update the tunnel endpoint identifier TEID, tunnel destination IP, number of bytes in the request direction message, and number of bytes in the response direction message in the corresponding service flow object according to the information carried in the service data flow; if there is a service flow object corresponding to the service data flow, update the number of bytes in the request direction message and the number of bytes in the response direction message in the corresponding service flow object according to the information carried in the service data flow.

[0057] Exemplarily, the number of bytes in the request direction message and the number of bytes in the response direction message are counted according to the number of bytes of each message in the corresponding direction. Each time a message is processed, the number of bytes of the message is added to the number of bytes in the corresponding direction. For example, the number of bytes in the request direction message is the sum of the current number of bytes in the request direction message and the current number of bytes of the message.

[0058] Exemplarily, the tunnel information (including tunnel endpoint identifier TEID and tunnel destination IP) carried in the service data flow can be obtained in the following way: after parsing the GTPU protocol (GPRS Tunnelling Protocol for UserPlane), record the tunnel number and destination IP address of GTPU as the tunnel information of the current message (the tunnel number of GTPU is used as the tunnel endpoint identifier TEID, and the destination IP address is used as the tunnel destination IP), and re-decode the GTPU tunnel payload data from the IP layer.

[0059] Exemplarily, generating the flow ID of the service flow object according to the five-tuple information of the service data flow includes: performing a hash calculation on the five-tuple information obtained from the tunnel payload data of the service data flow to obtain a hash value, and using the hash value as the flow ID of the service data flow; that is, calculating the flow ID according to the five-tuple information of the tunnel payload as the flow unique identifier. In this way, the corresponding service data flow can be obtained according to the flow unique identifier.

[0060] Step S230: Determine whether the service data flow needs to be filtered according to the flow filtering identifier in the service flow object corresponding to each service data flow; if the flow filtering identifier field in the service flow object corresponding to the service data flow indicates that filtering is required, directly filter the service data flow and end the process; if the flow filtering identifier field corresponding to the service data flow indicates that filtering is not required, proceed to step S240.

[0061] Step S240: According to the tunnel information in the service flow object corresponding to each service data flow and the tunnel slice correspondence obtained in step S210, check whether there is slice information corresponding to the service data flow; if there is corresponding slice information and it is filtering slice information (filtering slice information means that when the slice filtering identifier used to identify whether the flow transmitted in the tunnel needs to be filtered in the slice information is "yes", then the slice information is filtering slice information), filter the service data flow, update the corresponding slice information to the slice information field of the service flow object corresponding to the service data flow, and set the flow filtering identifier field in the service data flow, and end the process; otherwise, proceed to step S250.

[0062] Exemplarily, determining the slice information corresponding to the service data flow according to the tunnel information in the service flow object corresponding to the service data flow and the tunnel slice correspondence obtained in step S210 may refer to: According to the tunnel endpoint identifier (TEID) in the tunnel information in the service flow object corresponding to the service data flow and the tunnel slice correspondence hash table in S215, searching to obtain the slice information corresponding to the service data flow.

[0063] In step S240, updating the corresponding slice information to the slice information field of the service flow object corresponding to the service data flow and setting the flow filtering identifier field in the service data flow. In this way, for the service data flow with the flow filtering identifier set, next time it can directly determine whether filtering is required according to the flow filtering identifier field in the corresponding service flow object (that is, "Determine whether the service data flow needs to be filtered according to the flow filtering identifier in the service flow object corresponding to each service data flow" mentioned in step S230), without decoding and detecting the packets in the flow again.

[0064] Step S250: Filter the service data flow according to the traffic type of the service data flow; if filtering is required, filter the service data flow and set the flow filtering identifier field in the service data flow, and end the process; if filtering is not required, proceed to step S260.

[0065] Exemplarily, step S250 may include: identifying the application protocol of the service data stream to determine whether the service data stream is a traffic type that needs to be filtered. The traffic types that need to be filtered may include audio and video traffic and encrypted traffic that cannot be parsed. In the case where the service data stream is a traffic type that needs to be filtered, filter the service data stream and set the flow filtering identification field in the service data stream.

[0066] Step S260: Filter the service data stream according to the depth of traffic detection.

[0067] Exemplarily, step S260 may include: determining whether the upper limit of the traffic detection depth is reached according to the relationship between the values of the request direction byte count and the response direction byte count fields of the service flow object corresponding to the service data stream and the preset upper limit value of the traffic detection depth. In the case where the upper limit of the traffic detection depth is reached, filter the service data stream and set the flow filtering identification field in the service data stream.

[0068] In summary, the traffic filtering method of this embodiment determines whether traffic needs to be filtered through the following three checkpoints. If any checkpoint fails, the traffic is filtered, which improves the resource utilization efficiency and processing performance of the bypass security detection device, and at the same time ensures the accuracy and comprehensiveness of network security detection. The three checkpoints are as follows: Checkpoint 1, associate the tunnel slice correspondence through the N2 and N4 interfaces, integrate the service data transmitted by the upstream tunnel and the downstream tunnel of the N3 interface into the same service flow object, and then use the tunnel slice correspondence and tunnel information to determine the slice information. If the slice is configured by the user as a filtered slice, it can be determined whether the service data stream needs to be filtered according to the slice filtering identification in the slice information (at the same time, update the filtering identification in the service flow object. After that, for the packets of the service data stream, filtering can be directly performed according to the filtering identification in the corresponding service flow object); Checkpoint 2, use the load session application identification information to filter traffic such as audio and video traffic and encrypted but unresolvable traffic that has no security detection value; Checkpoint 3, filter when the traffic detection depth reaches the upper limit.

[0069] An embodiment of the present application further provides a traffic filtering device, as Figure 5 shown, including: a memory and a processor; The memory is used to store a program for traffic filtering; The processor is used to read the program for traffic filtering and execute the traffic filtering method as described in any embodiment of the present application.

[0070] An embodiment of the present application further provides a non-transitory computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein the computer program can implement the traffic filtering method as described in any embodiment of the present application when executed by a processor.

[0071] An embodiment of the present application also provides a traffic filtering system (which can also be called a 5G private network bypass security detection traffic filtering system). As Figure 6 shown, it may include: A traffic parsing module, responsible for parsing the traffic of the N2, N4, and N3 interfaces, including: parsing the N4 interface traffic, determining the correspondence between the upstream tunnel information and the downstream tunnel information according to the upstream tunnel information and the downstream tunnel information in the N4 interface traffic; parsing the N2 interface traffic, determining the upstream tunnel slice correspondence according to the slice information and the upstream tunnel information in the N2 interface traffic; parsing the N3 interface traffic, and determining the service flow object corresponding to the service data stream according to the five-tuple information in the N3 traffic; A slice tunnel association module, responsible for generating a slice tunnel structure object according to the traffic data transmitted by the N2 interface and the N4 interface, including: determining the downstream tunnel slice correspondence according to the correspondence between the upstream tunnel information and the downstream tunnel information and the upstream tunnel slice correspondence, and then combining the upstream tunnel slice correspondence and the downstream tunnel slice correspondence to generate the correspondence between the tunnel endpoint identifier TEID and the slice information, and using this correspondence as the tunnel slice correspondence; exemplarily, a tunnel slice correspondence hash table can be generated; A tunnel processing module, responsible for stripping the N3 interface tunnel and sending the tunnel load data to the traffic parsing module; A slice lookup module, responsible for finding the corresponding slice for the N3 interface load data session through the tunnel, and then setting the flow filtering flag according to the slice filtering flag, including: determining whether there is slice information corresponding to the service data stream according to the tunnel endpoint identifier TEID in the service data stream and the tunnel slice correspondence, and when there is corresponding slice information, judging whether the service data stream needs to be filtered according to the slice filtering flag in the corresponding slice information, updating the slice information field in the corresponding service flow object according to the corresponding slice information, and setting the flow filtering flag field in the corresponding service flow object according to the slice filtering flag in the slice information corresponding to the service data stream; A flow structure management module, responsible for flow structure lookup and management, and summarizing the request and response messages of the session into one flow structure, including: determining the flow ID of the service data stream according to the five-tuple information in the service data stream, and determining the service flow object corresponding to the service data stream according to the flow ID; A traffic filtering module, responsible for traffic filtering according to the flow filtering flag and performing discard processing on the traffic, including: judging whether the service data stream needs to be filtered according to the flow filtering flag field in the service flow object corresponding to the service data stream.

[0072] In summary, the traffic filtering solution of the present application utilizes the 5G private network slice identification and terminal service traffic slice association technology. By stripping the terminal service traffic tunnel, after parsing the payload data, the flow identifier is recalculated according to the five-tuple to perform the uplink and downlink combination of user traffic; after session combination, application protocol identification is performed to determine whether the traffic is encrypted traffic, audio and video traffic, and traffic reaching the flow detection depth; when it is determined that the current flow needs to be filtered, a filtering mark is added to the flow, and subsequent packets are directly discarded. For this solution, users only need to turn on the traffic filtering switch after configuring the filtering slice to automatically filter the traffic.

[0073] Generally speaking, the technical solution of the present application has the following advantages compared with the prior art: (1) It can quickly find the corresponding slice information through the tunnel slice correspondence relationship in the case of a large number of sessions at the N3 interface; (2) It realizes the integration of the N3 interface uplink tunnel traffic and the downlink tunnel traffic onto the same flow; (3) It supports slice traffic filtering for the N3 interface service data traffic; (4) For the N3 interface service data traffic, it supports the filtering of audio and video traffic, encrypted traffic that cannot be decrypted, and traffic exceeding the flow detection depth.

[0074] Those of ordinary skill in the art can understand that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, and their appropriate combinations. In the hardware implementation, the division of the functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component can have multiple functions, or a function or step can be executed by several physical components in cooperation. Some components or all components can be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include a computer storage medium (or non-temporary medium) and a communication medium (or temporary medium). As is well known to those of ordinary skill in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cassette, tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, as is well known to those of ordinary skill in the art, a communication medium typically includes computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium.

[0075] In the description of this specification, the descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0076] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present application. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. A traffic filtering method, applied to traffic detection in 5G private networks, characterized in that: The 5G private network includes at least the following interfaces: a control signaling interface N2, a session control interface N4, and a user data interface N3. The method includes: Determine, according to the traffic data transmitted by the control signaling interface N2 and the session control interface N4, a tunnel-slice correspondence between a tunnel having a slice and slice information; wherein the slice information includes a slice filter identifier for identifying whether a flow transmitted in the tunnel needs to be filtered; For each service data flow in the service data transmitted by the user data interface N3, the slice information corresponding to the service data flow is determined based on the tunnel information in the service data flow and the corresponding relationship between the tunnel slices, and whether the service data flow needs to be filtered is determined based on the slice filter identifier in the slice information corresponding to the service data flow.

2. The flow filtering method according to claim 1, characterized in that: The determining, according to the traffic data transmitted by the control signaling interface N2 and the session control interface N4, a tunnel-slice correspondence relationship between a tunnel having a slice and slice information includes: Determine, according to the slice information and the uplink tunnel information in the control signaling data transmitted by the control signaling interface N2, an uplink tunnel slice correspondence relationship, wherein the uplink tunnel slice correspondence relationship is a correspondence relationship between a tunnel endpoint identifier TEID of an uplink tunnel where a slice exists and the slice information; Determine a correspondence between the uplink tunnel information and the downlink tunnel information according to the uplink tunnel information and the downlink tunnel information in the session control data transmitted by the session control interface N4; Determine a downlink tunnel slice correspondence relationship according to the correspondence relationship between the uplink tunnel information and the downlink tunnel information and the uplink tunnel slice correspondence relationship, where the downlink tunnel slice correspondence relationship is a correspondence relationship between a tunnel endpoint identifier TEID of a downlink tunnel with a slice and the slice information; The tunnel slice correspondence relationship is obtained according to the uplink tunnel slice correspondence relationship and the downlink tunnel slice correspondence relationship.

3. The flow filtering method according to claim 2, characterized in that: The obtaining the tunnel slice correspondence relationship according to the uplink tunnel slice correspondence relationship and the downlink tunnel slice correspondence relationship includes: combining the uplink tunnel slice correspondence relationship and the downlink tunnel slice correspondence relationship to generate a correspondence relationship between a tunnel endpoint identifier TEID and slice information, and using the correspondence relationship as the tunnel slice correspondence relationship; The method of determining the slice information corresponding to the business data flow according to the tunnel information in the business data flow and the corresponding relationship between the tunnel slices includes: obtaining the tunnel endpoint identifier TEID of the business data flow according to the tunnel information in the business data flow; and determining the slice information corresponding to the business data flow according to the tunnel endpoint identifier TEID and the corresponding relationship between the tunnel slices.

4. The flow filtering method according to claim 2, characterized in that: The service data flow includes an uplink service data flow and a downlink service data flow; The determining the slice information corresponding to the service data flow according to the tunnel information in the service data flow and the tunnel slice correspondence relationship includes: For each uplink service data flow, determine the slice information corresponding to the uplink service data flow according to the uplink tunnel endpoint identifier TEID of the uplink service data flow and the uplink tunnel slice correspondence; For each downlink service data flow, the slice information corresponding to the downlink service data flow is determined according to the correspondence between the downlink tunnel endpoint identifier TEID of the downlink service data flow and the downlink tunnel slice.

5. The flow filtering method according to claim 3, characterized in that: The determining the slice information corresponding to the service data flow according to the tunnel information in the service data flow and the tunnel slice correspondence relationship, and judging whether the service data flow needs to be filtered according to the slice filter identifier in the slice information corresponding to the service data flow, includes: Determine the flow ID of the service data flow according to the five-tuple information in the service data flow, and determine the service flow object corresponding to the service data flow according to the flow ID, wherein the service flow object includes at least the following fields: flow ID, tunnel endpoint identifier TEID, tunnel destination IP, slice information, flow filter identifier, and the flow filter identifier field defaults to no filtering; Determine whether the business data flow needs to be filtered according to the flow filter identification field in the business flow object corresponding to the business data flow, including: when the flow filter identification field of the business flow object corresponding to the business data flow indicates that no filtering is required, determine whether there is slice information corresponding to the business data flow according to the correspondence between the tunnel endpoint identifier TEID in the business data flow and the tunnel slice, and when the corresponding slice information exists, determine whether the business data flow needs to be filtered according to the slice filter identification in the corresponding slice information, and update the slice information field in the corresponding business flow object according to the corresponding slice information, and set the flow filter identification field in the corresponding business flow object according to the slice filter identification in the slice information corresponding to the business data flow; when the flow filter identification field of the business flow object corresponding to the business data flow indicates that filtering is required, filter the business data flow.

6. The flow filtering method according to claim 5, characterized in that: The determining, according to the flow ID, the service flow object corresponding to the service data flow includes: If the service flow object corresponding to the service data flow is not found according to the flow ID, a service flow object is initialized according to the flow ID as the corresponding service flow object, and the tunnel endpoint identifier TEID, tunnel destination IP, number of bytes of request direction messages, and number of bytes of response direction messages in the service flow object are updated according to the information carried in the service data flow; When the service flow object corresponding to the service data flow is found according to the flow ID, the number of bytes of request direction messages and the number of bytes of response direction messages in the corresponding service flow object are updated according to the information carried in the service data flow.

7. The flow filtering method according to claim 5, characterized in that: After determining whether the service data flow needs to be filtered according to the slice filter identifier in the slice information corresponding to the service data flow, if the slice filter identifier in the slice information corresponding to the service data flow indicates that no filtering is required, the method further includes: The business data flow is filtered according to the traffic type of the business data flow; and / or, the business data flow is filtered according to the depth of traffic detection.

8. The flow filtering method according to claim 7, characterized in that: The filtering of the service data flow according to the traffic type of the service data flow includes: Perform application protocol identification on the service data flow to determine whether the service data flow is a traffic type that needs to be filtered, where the traffic type that needs to be filtered includes audio and video traffic and encrypted traffic that cannot be parsed; In the case that the service data flow is a traffic type that needs to be filtered, the service data flow is filtered, and a flow filter identification field in the service data flow is set.

9. The flow filtering method according to claim 7, characterized in that: The service flow object also includes the following fields: the number of bytes of the request direction message and the number of bytes of the response direction message; the method also includes: in the process of performing flow detection on the service data transmitted by the user data interface N3, updating the values ​​of the number of bytes of the request direction message and the number of bytes of the response direction message of the service flow object corresponding to each service data flow; The filtering of the business data flow according to the depth of traffic detection includes: determining whether the upper limit of the traffic detection depth is reached according to the relationship between the values ​​of the request direction message byte number and the response direction message byte number fields of the business flow object corresponding to the business data flow and the preset traffic detection depth upper limit value; when the traffic detection depth upper limit is reached, filtering the business data flow and setting the flow filter identification field in the business data flow.

10. A flow filtering device, comprising: A memory and a processor, characterized in that: The memory is used to store a program for traffic filtering; The processor is used to read the program for traffic filtering and execute the traffic filtering method as described in any one of claims 1 to 9.

Images