Message sending method, device and related equipment of security edge protection agent

Abstract

The disclosed embodiment provides a message sending method, device, electronic device and computer-readable medium of a security edge protection agent, which is applied to the vSEPP of a visited network, and the method includes: receiving a request message sent by a vNF of the visited network, the request message being a roaming message for roaming to a home network; querying in a local time limit cache table according to the message type in the request message and the information of the vNF to obtain a query result; if the query result is a successful query, the request message is sent to the hSEPP of the home network; wherein the time limit cache table stores the request messages that the vNF successfully sent to the hSEPP of the home network within a preset time before the current moment. The message sending method, device, electronic device and computer-readable medium of a security edge protection agent provided by the disclosed embodiment can verify the request message based on the entity of the NF and the authenticity of the request message, avoid the attack threat of forged NF and false messages, and thus ensure the security of the 5G core network.

Description

Technical Field

[0001] The present disclosure relates to the field of mobile communication security, and in particular to a message sending method, device, electronic device and computer-readable medium of a security edge protection agent. Background Art

[0002] In order to protect the security between public land mobile networks (PLMNs), the 5G network adds a security edge protection proxy (SEPP) between two PLMNs. SEPP is an important part of the 5G roaming security architecture. It is used for user roaming and communication with other PLMNs. It is responsible for message filtering, topology hiding and policy management on the control plane interface between PLMNs, and mainly serves as a border gateway between the control planes of the PLMN core network. Currently, in the standard TS 3GPP 33.501, the identification of NF is limited to the verification of the source address, destination address and identifier of the NF message, and there is no verification of the authenticity of the NF entity and the message. Therefore, there is a threat of attacks such as forged NFs and false messages, thereby undermining the security of the 5G core network.

[0003] Therefore, a new message sending method, device, electronic device and computer-readable medium for a security edge protection agent is needed.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure. Summary of the invention

[0005] In view of this, the embodiments of the present disclosure provide a message sending method, device, electronic device and computer-readable medium of a security edge protection agent, which can verify the request message based on the entity of the NF and the authenticity of the request message, avoid the attack threat of forged NF and false messages, and thus ensure the security of the 5G core network.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of an embodiment of the present disclosure, a message sending method of a security edge protection agent is proposed, which is applied to a vSEPP of a visited network, the method comprising: receiving a request message sent by a vNF of the visited network, wherein the request message is a roaming message for roaming to a home network; querying in a local time limit cache table according to the message type in the request message and the information of the vNF to obtain a query result; if the query result is a successful query, sending the request message to the hSEPP of the home network; wherein the time limit cache table stores request messages successfully sent by the vNF to the hSEPP of the home network within a preset time length before the current moment.

[0008] In an exemplary embodiment of the present disclosure, the method further includes: if the query result is a search failure, generating token information of the request message; generating a request confirmation message according to the request message, the timestamp information of the request message and the token information of the request message, and sending it to the vNF; generating an entity query message of the vNF according to the information of the vNF, the timestamp information of the request message and the token information of the request message, and sending it to the vNRF; receiving a confirmation result message returned by the vNF according to the request confirmation message, and a query result message returned by the vNRF according to the entity query message; if the request message is successfully verified according to the confirmation result message and the query result message, sending the request message to the hSEPP of the home network.

[0009] In an exemplary embodiment of the present disclosure, if the request message is successfully verified according to the confirmation result message and the query result message, the method further includes: storing the information of the vNF, the message type of the request message, the token information of the request message and the timestamp information of the request message in the time limit cache table.

[0010] In an exemplary embodiment of the present disclosure, querying in a local time limit cache table according to the message type in the request message and the information of the vNF to obtain the query result includes: verifying according to the source address, destination address, and identifier in the request message to obtain an initial verification result; if the initial verification result is passed, querying in a local time limit cache table according to the message type in the request message and the information of the vNF to obtain the query result.

[0011] In an exemplary embodiment of the present disclosure, the query result message is generated by the vNRF according to the authenticity verification result of the entity information and the token information of the request message after the vNRF verifies the authenticity of the entity information of the vNF according to the information of the vNF and the timestamp information of the request message.

[0012] In an exemplary embodiment of the present disclosure, the confirmation result message is generated by the vNF according to the sending record query result and the token information of the request message after the vNF performs a sending record query on the request message according to the request message and the timestamp information of the request message.

[0013] In an exemplary embodiment of the present disclosure, a query is performed in a local time limit cache table according to the message type in the request message and the information of the vNF, and the query result is obtained, including: matching in the time limit cache table according to the message type in the request message and the information of the vNF, to obtain the successfully matched historical messages, the timestamp information of the historical messages and the token information of the historical messages; performing token verification according to the token information of the historical messages and the sent messages of the vSEPP; performing time verification on the historical messages according to the timestamp information of the historical messages; if the results of the token verification and the time verification are both passed, it is determined that the query result of the request message is a successful query.

[0014] According to a second aspect of an embodiment of the present disclosure, a message sending device of a security edge protection agent is proposed, which is applied to a vSEPP of a visited network, and the device includes: a message receiving module, used to receive a request message sent by a vNF of the visited network, wherein the request message is a roaming message for roaming to a home network; a message query module, used to query in a local time limit cache table according to the message type in the request message and the information of the vNF to obtain a query result; a message sending module, used to send the request message to the hSEPP of the home network if the query result is a successful query; wherein the time limit cache table stores request messages successfully sent by the vNF to the hSEPP of the home network within a preset time length before the current moment.

[0015] According to the third aspect of an embodiment of the present disclosure, an electronic device is proposed, which includes: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the message sending method of the security edge protection agent described in any one of the above items.

[0016] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable medium is provided, on which a computer program is stored. When the program is executed by a processor, the message sending method of the security edge protection agent as described in any one of the above items is implemented.

[0017] According to the message sending method, device, electronic device and computer-readable medium of the security edge protection agent provided by certain embodiments of the present disclosure, request messages successfully sent to the hSEPP of the home network by different vNFs within a preset time period before the current moment are stored locally in advance, and when a request message for roaming to the home network sent by the vNF of the visited network is received, the local time limit cache table is queried according to the message type in the request message and the information of the vNF, and the request message can be verified based on the entity of the NF and the authenticity of the request message, and the request message is sent to the hSEPP of the home network when the query result is a success, thereby avoiding the attack threat of forged NF and false messages, thereby ensuring the security of the 5G core network.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. The drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can also be obtained based on these drawings without creative work.

[0020] Figure 1 The present invention is a system block diagram showing a method and device for sending a message of a security edge protection agent according to an exemplary embodiment.

[0021] Figure 2 The present invention is a flowchart showing a message sending method of a security edge protection agent according to an exemplary embodiment.

[0022] Figure 3 The present invention is a flowchart showing a message sending method of a security edge protection agent according to another exemplary embodiment.

[0023] Figure 4 It is a schematic diagram of a time limit cache table according to an exemplary embodiment.

[0024] Figure 5 The present invention is a flowchart of a message sending method of a security edge protection agent according to yet another exemplary embodiment.

[0025] Figure 6 The present invention is a flowchart showing a message sending method of a security edge protection agent according to yet another exemplary embodiment.

[0026] Figure 7 The present invention is an interactive flow chart of a message sending method of a security edge protection agent according to yet another exemplary embodiment.

[0027] Figure 8 The invention is a block diagram showing a message sending device of a security edge protection agent according to an exemplary embodiment.

[0028] Fig. 9 A block diagram schematically shows an electronic device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that the present invention will be comprehensive and complete and fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0030] The described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present invention. However, those skilled in the art will appreciate that the technical solution of the present invention may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring various aspects of the present invention.

[0031] The accompanying drawings are only schematic illustrations of the present invention, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some block diagrams shown in the accompanying drawings do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0032] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and steps, nor must they be executed in the order described. For example, some steps can be decomposed, and some steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0033] Exemplary embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0034] Figure 1 The present invention is a system block diagram showing a method and device for sending a message of a security edge protection agent according to an exemplary embodiment.

[0035] The system of the message sending method and device of the security edge protection agent may include a visited network 110 and a home network 120. The visited network 110 may include a security edge protection agent vSEPP (reference numeral 111), a network function vNF (reference numeral 112), and a network warehouse function vNRF (reference numeral 113) of the visited network 110. The home network 120 may include a security edge protection agent vSEPP (reference numeral 121) and a network function vNF (reference numeral 122) of the home network 120. Among them, in the visited network 110 or the home network 120, its network functions may be, for example but not limited to, access and mobility management (Core Access and Mobility Management Function, AMF), session management (Session Management Function, SMF), user plane function (User plane Function, UPF), unified data management (Unified Data Management, UDM), policy control function (Policy Control function, PCF), authentication server function (Authentication Server Function, AUSF), network exposure (Network Exposure Function, NEF), network slice selection function (Network Slice Selection Function, NSSF), etc.

[0036] The security edge protection agent vSEPP111 of the visited network 110 can be used to receive a request message sent by the vNF of the visited network, wherein the request message is a roaming message for roaming to the home network; query the local time limit cache table according to the message type in the request message and the information of the vNF to obtain the query result; if the query result is a successful query, send the request message to the hSEPP of the home network; wherein the time limit cache table stores the request messages successfully sent by the vNF to the hSEPP of the home network within a preset time before the current moment.

[0037] Figure 2 The flowchart of a method for sending a message of a security edge protection agent according to an exemplary embodiment is shown. The method for sending a message of a security edge protection agent provided by the embodiment of the present disclosure can be Figure 1 The security edge protection agent vSEPP111 of the visited network 110 executes the message sending method provided by the security edge protection agent in the embodiment of the present disclosure, which may include steps S202 to S206.

[0038] like Figure 2As shown, in step S202, a request message sent by a vNF of a visited network is received, where the request message is a roaming message for roaming to a home network.

[0039] In the disclosed embodiment, the vNF of the visited network is, for example, a vPCF, and the request message sent by the vNF is, for example, a policy request message for requesting a policy from the hPCF of the home network.

[0040] In step S204, a query is performed in a local time limit cache table according to the message type in the request message and the information of the vNF to obtain a query result.

[0041] Continuing with the above example, the message type is, for example, a policy request message. The information of the vNF is, for example, the information of the vPCF. The time limit cache table stores the request message that the vNF successfully sends to the hSEPP of the home network within a preset time period before the current moment. For example, the time limit cache table can store. For example, the vNF information and message type of the request message that the vNF successfully sends to the hSEPP of the home network within a preset time period before the current moment can be stored. Among them, when querying in the local time limit cache table, the time limit cache table can be matched according to the message type and the vNF information. If a message with the same message type and vNF information is matched, the query is successful, otherwise the query fails.

[0042] In step S206, if the query result is successful, the request message is sent to the hSEPP of the home network.

[0043] According to the message sending method of the security edge protection agent provided by the embodiment of the present disclosure, the request messages successfully sent to the hSEPP of the home network by different vNFs within a preset time before the current moment are stored locally in advance, and when a request message for roaming to the home network sent by the vNF of the visited network is received, the local time limit cache table is queried according to the message type in the request message and the information of the vNF, and the request message can be verified based on the entity of the NF and the authenticity of the request message, and the request message is sent to the hSEPP of the home network when the query result is a success, thereby avoiding the attack threat of forged NF and false messages, thereby ensuring the security of the 5G core network.

[0044] Figure 3 The flowchart of a message sending method of a security edge protection agent according to another exemplary embodiment is shown. The message sending method of a security edge protection agent provided by the embodiment of the present disclosure may include steps S302 to S314.

[0045] like Figure 3As shown, in step S302, a request message sent by a vNF of a visited network is received, where the request message is a roaming message for roaming to a home network.

[0046] In the embodiment of the present disclosure, steps similar to step S202 may be taken and will not be repeated here.

[0047] In step S304, a query is performed in a local time limit cache table according to the message type in the request message and the information of the vNF to obtain a query result.

[0048] If the query result is successful, the request message is sent to the hSEPP of the home network.

[0049] Furthermore, verification can be performed based on the source address, destination address, and identifier in the request message to obtain an initial verification result; if the initial verification result is passed, the query result is obtained by querying the local time limit cache table based on the message type in the request message and the information of the vNF.

[0050] In step S306, if the query result is a search failure, token information of the request message is generated.

[0051] A message identification code may be generated, for example, by a random number as token information of the request message.

[0052] In step S308, a request confirmation message is generated according to the request message, the timestamp information of the request message and the token information of the request message, and sent to the vNF.

[0053] The request confirmation message may be used to request the vNF to query whether the request message has been sent.

[0054] In step S310, an entity query message of the vNF is generated according to the information of the vNF, the timestamp information of the request message and the token information of the request message, and sent to the vNRF.

[0055] The entity query message can be used to request the vNRF to query the authenticity of the entity information of the vNF.

[0056] In step S312, a confirmation result message returned by the vNF according to the request confirmation message and a query result message returned by the vNRF according to the entity query message are received.

[0057] The confirmation result message may be generated by the vNF according to the sending record query result and the token information of the request message after the vNF performs a sending record query on the request message according to the request message and the timestamp information of the request message. For example, the confirmation result message may include but is not limited to the message true value (true is 1, false is 0) and token information. The token information in the confirmation result message is used by the vSEPP to match the local request message to be sent.

[0058] The query result message may be generated by the vNRF according to the authenticity verification result of the entity information and the token information of the request message after the vNRF verifies the authenticity of the entity information of the vNF according to the information of the vNF and the timestamp information of the request message. For example, the query result message may include but is not limited to the true value of the vNF information (true is 1, false is 0) and the token information. The token information in the query result message is used by the vSEPP to match the local request message to be sent.

[0059] In step S314, if the request message is successfully verified according to the confirmation result message and the query result message, the request message is sent to the hSEPP of the home network.

[0060] Among them, in the confirmation result message of the token message including the request message and the query result message, when the true value of the confirmation message is 1 and the true value of the vNF information is 1, it is confirmed that the request message verification is successful.

[0061] According to the message sending method of the security edge protection agent provided by the embodiment of the present disclosure, when vSEPP receives the request message, it sends a vNF query message to vNRF, and vNRF returns a query result message to vSEPP to confirm the authenticity of the vNF entity. When vSEPP receives the request message, it sends a request confirmation message to vNF, and vNF returns a confirmation result message to vSEPP to confirm the authenticity of the request message. The request message can be verified based on the entity of the NF and the authenticity of the request message, and the request message is sent to the hSEPP of the home network when the verification is successful, avoiding the attack threat of forged NF and false messages, thereby ensuring the security of the 5G core network.

[0062] Furthermore, if the request message is successfully verified based on the confirmation result message and the query result message, the vNF information, the message type of the request message, the token information of the request message and the timestamp information of the request message may also be stored in the time limit cache table.

[0063] The time limit cache table can be in the form of Figure 4 As shown, Figure 4 Each row of data in represents a request message. For example, the information of a vNF can be Figure 4 NF information 1, ..., NF information n. The message type of the request message is, for example, Figure 4 Message type 1, ..., message type n in the request message. For example, Figure 4 The timestamp information of the request message is as follows: Figure 4 Specifically, a timer for the request message can be generated according to the timestamp information of the request message and the preset duration, and the timer is used to count from the time represented by the timestamp information, and the timing length is the preset duration. Therefore, the request message in the cache table can be deleted after the timer ends, and the request message stored in the time limit cache table is the request message successfully sent by the vNF to the hSEPP of the home network within the preset duration before the current moment.

[0064] Figure 5 The present invention is a flowchart of a message sending method of a security edge protection agent according to yet another exemplary embodiment. Figure 3 The step S304 of the embodiment may further include steps S502 to S508 .

[0065] like Figure 5 As shown, in step S502, a match is performed in the time limit cache table according to the message type in the request message and the information of the vNF to obtain a successfully matched historical message, a timestamp information of the historical message, and a token information of the historical message.

[0066] For example, if the vNF is a vPCF, it needs to request a policy from the hPCF. Then the vPCF will send a policy request message to the vSEPP. The information of the NF is searched in the time limit cache table as the cache table of the vPCF, and the historical message whose message type is the policy request message is found in the cache table of the vPCF, and it is determined as a historical message that has been successfully matched, and the timestamp information of the historical message and the token information of the historical message are obtained from the time limit cache table.

[0067] Furthermore, vSEPP may first perform verification according to the source address, destination address, and identifier of the request message to obtain an initial verification result, and when the initial verification result is passed, search the cache table of the NF in the time limit cache table for the vPCF information.

[0068] In step S504, token verification is performed according to the token information of the historical message and the sent message of the vSEPP.

[0069] Continuing with the above example, if the NF information is vPCF, and the historical message whose message type is policy request message is historical message A, the token information of the historical message A can be searched in the sent messages of vSEPP. If the search is successful, the result of the token verification is considered to be passed, otherwise it is considered to be failed.

[0070] In step S506, the historical message is time-validated according to the timestamp information of the historical message.

[0071] Continuing with the above example, the time difference between the timestamp information of the historical message A and the current time can be calculated. If the time difference is less than the preset duration, the result of the invalidation verification is considered to be passed.

[0072] In step S508, if the results of the token verification and the time validity verification are both passed, it is determined that the query result of the request message is a successful query.

[0073] Figure 6 1 is a flowchart of a message sending method of a security edge protection agent according to another exemplary embodiment. The message sending method of the security edge protection agent provided in the embodiment of the present disclosure may include steps S602 to S614. The interactive flowchart of the message sending method of the security edge protection agent in this embodiment may be as follows: Figure 7 As shown. Figure 7 The interaction flow shown may include vNF, vNRF, vSEPP of the visited network and hSEPP of the home network.

[0074] like Figure 6 As shown, in step S602, the vNF of the visited network sends a request message to the vSEPP of the visited network.

[0075] In step S604, the vSEPP performs verification according to the source address, destination address, and identifier in the request message to obtain an initial verification result. If the initial verification result is passed, step S606 is executed, otherwise the vSEPP discards the request message.

[0076] In step S606, the vSEPP queries the local time limit cache table to check whether there is such a request message of the vNF. If so, the request message is forwarded to the hSEPP of the home network. If not, S608 is executed.

[0077] In step S608, the vSEPP sends an entity query message of the vNF to the vNRF, and sends a request confirmation message of the request message to the vNF.

[0078] The request confirmation message includes but is not limited to request message information, timestamp information and token information.

[0079] In step S610, the vNRF queries the authenticity of the vNF entity information and sends a query result message of the vNF to the vSEPP. The vNF queries whether the request message has been sent and sends a confirmation result message to the vSEPP. The entity query message includes but is not limited to the vNF information, timestamp, token

[0080] In step S612, the vSEPP receives the vNF query result message and the confirmation result message, and when the request message is successfully verified according to the confirmation result message and the query result message, the request message is determined to be a legitimate message and forwarded to the hSEPP of the home network. If the request message fails to be verified according to the confirmation result message and the query result message, the vSEPP discards the request message.

[0081] In step S614, the vSEPP of the visited network stores the information of the vNF, the message type of the request message, the token information of the request message and the timestamp information of the request message into a time limit cache table, and exempts the same category of messages of the vNF from review within a preset time period.

[0082] According to the message sending method of the security edge protection agent provided by the embodiment of the present disclosure, the vSEPP of the visited network verifies the authenticity of the request message and the vNF sending message. When the vSEPP receives the request message, it sends a vNF query message to the vNRF to confirm the authenticity of the vNF entity. When the vSEPP receives the request message, it sends a request confirmation message to the vNF to confirm the authenticity of the request message. A time limit cache table is established in the vSEPP to save the vNF message information. The same category of messages of the vNF are exempted from review within the set time, which can avoid the attack threat of forged NF and false messages, thereby ensuring the security of the 5G core network.

[0083] It should be clearly understood that the present disclosure describes how to form and use specific examples, but the principles of the present disclosure are not limited to any details of these examples. On the contrary, based on the teachings of the contents disclosed in the present disclosure, these principles can be applied to many other embodiments.

[0084] Those skilled in the art will appreciate that all or part of the steps for implementing the above embodiments are implemented as a computer program executed by a central processing unit (CPU). When the computer program is executed by the central processing unit (CPU), the above functions defined by the above method provided by the present disclosure are executed. The program may be stored in a computer-readable storage medium, which may be a read-only memory, a disk, or an optical disk, etc.

[0085] In addition, it should be noted that the above figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0086] The following are embodiments of the device disclosed herein, which can be used to execute the method embodiments disclosed herein. For details not disclosed in the device embodiments disclosed herein, please refer to the method embodiments disclosed herein.

[0087] Figure 8 1 is a block diagram of a message sending device of a security edge protection agent according to an exemplary embodiment. Figure 8 The message sending device 80 of the security edge protection agent provided by the embodiment of the present disclosure may include: a message receiving module 802 , a message query module 804 and a message sending module 806 .

[0088] In the message sending device 80 of the security edge protection agent, the message receiving module 802 may be used to receive a request message sent by a vNF of a visited network, where the request message is a roaming message for roaming to a home network.

[0089] The message query module 804 may be used to query the local time limit cache table according to the message type in the request message and the information of the vNF to obtain the query result;

[0090] The message sending module 806 can be used to send the request message to the hSEPP of the home network if the query result is successful; wherein the time limit cache table stores the request messages successfully sent by the vNF to the hSEPP of the home network within a preset time before the current moment.

[0091] According to the message sending device of the security edge protection agent provided by the embodiment of the present disclosure, the request messages successfully sent to the hSEPP of the home network by different vNFs within a preset time before the current moment are stored locally in advance, and when a request message for roaming to the home network sent by the vNF of the visited network is received, the local time limit cache table is queried according to the message type in the request message and the information of the vNF, and the request message can be verified based on the entity of the NF and the authenticity of the request message, and the request message is sent to the hSEPP of the home network when the query result is a success, thereby avoiding the attack threat of forged NF and false messages, thereby ensuring the security of the 5G core network.

[0092] In an exemplary embodiment, the message sending device of the security edge protection agent may also include: a token generation module, which can be used to generate token information of the request message if the query result is a search failure; a request confirmation message sending module, which can be used to generate a request confirmation message according to the request message, the timestamp information of the request message and the token information of the request message, and send it to the vNF; an entity query message sending module, which can be used to generate an entity query message of the vNF according to the information of the vNF, the timestamp information of the request message and the token information of the request message, and send it to the vNRF; a feedback message receiving module, which can be used to receive a confirmation result message returned by the vNF according to the request confirmation message, and a query result message returned by the vNRF according to the entity query message; a request message verification module, which can be used to send the request message to the hSEPP of the home network if the request message is successfully verified according to the confirmation result message and the query result message.

[0093] In an exemplary embodiment, the message sending device of the security edge protection agent may also include: a message caching module, which can be used to store the information of the vNF, the message type of the request message, the token information of the request message and the timestamp information of the request message in the time limit cache table if the request message is successfully verified according to the confirmation result message and the query result message.

[0094] In an exemplary embodiment, the message query module 804 may include: an initial verification unit, which can be used to perform verification according to the source address, destination address, and identifier in the request message to obtain an initial verification result; a message query unit, which can be used to query in a local time limit cache table according to the message type in the request message and the information of the vNF to obtain a query result if the initial verification result is passed.

[0095] In an exemplary embodiment, the query result message is generated by the vNRF according to the entity information authenticity verification result and the token information of the request message after the vNRF verifies the authenticity of the entity information of the vNF according to the information of the vNF and the timestamp information of the request message.

[0096] In an exemplary embodiment, the confirmation result message is generated by the vNF according to the sending record query result and the token information of the request message after the vNF performs a sending record query on the request message according to the request message and the timestamp information of the request message.

[0097] In an exemplary embodiment, the message query module 804 may include: a cache table matching unit, which can be used to match the time limit cache table according to the message type in the request message and the information of the vNF, and obtain the successfully matched historical message, the timestamp information of the historical message and the token information of the historical message; a token verification unit, which can be used to perform token verification according to the token information of the historical message and the sent message of the vSEPP; an expiration verification unit, which can be used to perform time validity verification on the historical message according to the timestamp information of the historical message; and a query result confirmation unit, which can be used to determine that the query result of the request message is a successful query if the results of both the token verification and the time validity verification are passed.

[0098] Refer to the following Fig. 9 An electronic device 900 according to this embodiment of the present invention will be described. Fig. 9 The electronic device 900 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0099] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0100] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 910 can perform the following steps: Figure 2 or Figure 3 or Figure 5 or Figure 6 or Figure 7 Steps shown.

[0101] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0102] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0103] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0104] The electronic device 900 may also communicate with one or more external devices 1000 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0105] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0106] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0107] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0108] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0109] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0110] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0111] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0112] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. A message sending method for a security edge protection agent, characterized in that: vSEPP applied to the visited network includes: receiving a request message sent by a vNF of a visited network, where the request message is a roaming message for roaming to a home network; Querying a local time limit cache table according to the message type in the request message and the information of the vNF to obtain a query result; If the query result is successful, sending the request message to the hSEPP of the home network; If the query result is a search failure, generating token information of the request message; Generate a request confirmation message according to the request message, the timestamp information of the request message and the token information of the request message, and send the message to the vNF; Generate an entity query message of the vNF according to the information of the vNF, the timestamp information of the request message and the token information of the request message, and send the message to the vNRF; Receiving a confirmation result message returned by the vNF according to the request confirmation message, and a query result message returned by the vNRF according to the entity query message; If the request message is successfully verified according to the confirmation result message and the query result message, the request message is sent to the hSEPP of the home network; Among them, the time limit cache table stores the request message successfully sent by the vNF to the hSEPP of the home network within a preset time before the current moment.

2. The method according to claim 1, characterized in that If the request message is successfully verified according to the confirmation result message and the query result message, the method further includes: The information of the vNF, the message type of the request message, the token information of the request message and the timestamp information of the request message are stored in the time limit cache table.

3. The method according to claim 1, characterized in that The query result obtained by querying in a local time limit cache table according to the message type in the request message and the information of the vNF includes: Perform verification according to the source address, destination address, and identifier in the request message to obtain an initial verification result; If the initial verification result is passed, the local time limit cache table is queried according to the message type in the request message and the information of the vNF to obtain the query result.

4. The method according to claim 1, characterized in that The query result message is generated by the vNRF according to the authenticity verification result of the entity information and the token information of the request message after the vNRF verifies the authenticity of the entity information of the vNF according to the information of the vNF and the timestamp information of the request message.

5. The method according to claim 1, characterized in that The confirmation result message is generated by the vNF according to the sending record query result and the token information of the request message after the vNF queries the sending record of the request message according to the request message and the timestamp information of the request message.

6. The method according to claim 2, characterized in that The query result obtained by querying in a local time limit cache table according to the message type in the request message and the information of the vNF includes: According to the message type in the request message and the information of the vNF, a match is performed in the time limit cache table to obtain a successfully matched historical message, a timestamp information of the historical message, and a token information of the historical message; Performing token verification according to the token information of the historical message and the sent message of the vSEPP; Performing time validity verification on the historical message according to the timestamp information of the historical message; If the results of the token verification and the time validity verification are both passed, it is determined that the query result of the request message is a successful query.

7. A message sending device for a security edge protection agent, characterized in that: A vSEPP applied to a visited network, the device comprising: A message receiving module, configured to receive a request message sent by a vNF of a visited network, wherein the request message is a roaming message for roaming to a home network; A message query module, used to query a local time limit cache table according to the message type in the request message and the information of the vNF to obtain a query result; A message sending module, configured to send the request message to the hSEPP of the home network if the query result is successful; A token generation module, which can be used to generate token information of the request message if the query result is a search failure; A request confirmation message sending module, which can be used to generate a request confirmation message according to the request message, the timestamp information of the request message and the token information of the request message, and send the request confirmation message to the vNF; An entity query message sending module, which can be used to generate an entity query message of the vNF according to the information of the vNF, the timestamp information of the request message and the token information of the request message, and send it to the vNRF; A feedback message receiving module, configured to receive a confirmation result message returned by the vNF according to the request confirmation message, and a query result message returned by the vNRF according to the entity query message; a request message verification module, configured to send the request message to the hSEPP of the home network if the request message is successfully verified according to the confirmation result message and the query result message; Among them, the time limit cache table stores the request message successfully sent by the vNF to the hSEPP of the home network within a preset time before the current moment.

8. An electronic device, characterized in that: include: at least one processor; A storage device for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images