Method, system and terminal for selecting route of terminal outgoing service data
By using the method of using public key decryption token matching in URSP, the unreliability problem of application authentication in the prior art is solved, ensuring that the service is only open to specific applications, and improving network security and service reliability.
Patent Information
- Application Number
- CN202011434535.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-12-10
- Publication Date
- 2024-12-20
- Estimated Expiration
- 2040-12-10
AI Technical Summary
Existing URSP standards fail to accurately and reliably label and verify application identity, resulting in cybersecurity threats and service unreliability, and fail to ensure that services are only open to specific applications.
By obtaining the information of the request protocol data unit PDU session containing application information, and using the public key provided by the application service provider to decrypt and match the tokens in the application information, it is ensured that only routing policies are provided to applications that match the URSP rules, As a condition for verifying a legitimate application, the token supports the application to establish a modification session under different IP addresses/non-IP information without affecting the optimization strategy.
Accurate and reliable matching and verification of URSP services is achieved, ensuring that the service is only open to specific applications, improving network security and operator service reliability, and supporting applications to use the same optimization strategy under different conditions.
Smart Images
Figure CN114630316B_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of communications, and in particular to a method, system and terminal for selecting a route for outbound service data sent by a terminal. Background Art
[0002] In 5G networks, operators can use the URSP (UE Route Selection Policy) function to provide to-B (for application providers) and to-C (for specific users) data plane optimization services. For example, through URSP rules, dedicated slices are provided for OTT (specific application providers) and specific users to ensure the service quality of specific applications.
[0003] However, the premise for the URSP function to work properly is that, during the PDU (Protocol Data Unit) session establishment process, the session establishment / modification requests of applications that need to be optimized can be accurately and effectively distinguished from requests of other applications, and then corresponding strategies can be adopted for them. In other words, being able to accurately and effectively identify session establishment / modification requests of applications that need to be optimized is a necessary condition for operators to provide services such as dedicated slicing services to users / customers based on URSP.
[0004] Since application service providers frequently change the destination server information (including IP and non-IP) used when actually deploying applications, and may also change the target domain, DNN (Data Network Name) and other information, for operational efficiency, using application authentication is the most reasonable method.
[0005] In the existing URSP standards, the OSid+OS app id method is used to describe the identity of the application. However, since the operating system does not restrict the source of the specific application used, and in most daily use environments, the reliability of application development and application market cannot be guaranteed. Therefore, this method cannot uniquely and accurately mark specific applications in actual applications, and there is a possibility of being misused, endangering network security. And this situation may not be improved for a considerable period of time due to commercial reasons. In other words, based on the existing URSP standards and processes, it is impossible to accurately and reliably mark the identity of the application from the network level; operators cannot provide reliable services based on this. Summary of the invention
[0006] A technical problem to be solved by the present disclosure is to provide a method, system and terminal for selecting a route for outbound service data sent by a terminal, which can ensure that the services provided by URSP are only open to specific applications.
[0007] According to one aspect of the present disclosure, a method for routing service data sent out by a terminal is proposed, comprising: obtaining a user routing selection policy URSP rule, wherein the URSP rule includes a public key provided by an application service provider; upon receiving information of a request protocol data unit (PDU) session containing application information, matching the application information with the URSP rule, wherein the application information includes a token generated using a private key; if the application information matches the URSP rule, determining that an application matching the URSP rule is detected; and providing a routing policy matching the URSP rule to the application.
[0008] In some embodiments, matching the application information with the URSP rules includes: using a public key in the URSP rules to decrypt a token carried in the application information.
[0009] In some embodiments, after decrypting the token using the public key, it is determined whether the decrypted token content matches at least one of the parameters required to generate the token carried in the application information; and if they match, it is determined that the token carried in the application information matches the public key in the URSP rule.
[0010] In some embodiments, the token is generated based on at least one of an application identifier, IP triplet information, a non-IP descriptor, a data network name, a connection capability, and a domain name descriptor.
[0011] According to another aspect of the present disclosure, a terminal is also proposed, including: a rule acquisition unit, configured to acquire a user routing selection policy URSP rule, wherein the URSP rule includes a public key information receiving unit provided by an application service provider, configured to receive information of a request protocol data unit PDU session containing application information, wherein the application information includes a token generated using a private key; a rule matching unit, configured to match the application information with the URSP rule, and if the application information matches the URSP rule, determining that an application matching the URSP rule is detected; and a routing selection unit, configured to provide a routing policy matching the URSP rule to the application.
[0012] In some embodiments, the rule matching unit is configured to decrypt the token carried in the application information using the public key in the URSP rule.
[0013] According to another aspect of the present disclosure, a terminal is further provided, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute the above-mentioned method for selecting routing of outbound service data of the terminal based on instructions stored in the memory.
[0014] According to another aspect of the present disclosure, a routing selection system for terminal outbound business data is also proposed, including: the above-mentioned terminal; and an application, configured to send information requesting a protocol data unit (PDU) session containing application information to the terminal, wherein the application information includes a token generated using a private key.
[0015] In some embodiments, the token is generated based on at least one of an application identifier, IP triplet information, a non-IP descriptor, a data network name, a connection capability, and a domain name descriptor.
[0016] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium is also provided, on which computer program instructions are stored, and when the instructions are executed by a processor, the above-mentioned method for selecting routing of terminal outbound service data is implemented.
[0017] In the disclosed embodiment, the terminal uses the token in the received application information as one of the conditions for matching with the URSP, and ensures the verification of the legitimacy of the application while ensuring policy matching, so that the services provided by the URSP are open only to specific applications. In addition, by using the token as one of the conditions for verifying the legitimate application, it is possible to support the application to use different destination IP addresses / destination non-IP information to establish and modify the PDU session at different times without affecting the operator's use of the same path optimization strategy for the application.
[0018] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0019] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.
[0020] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:
[0021] Figure 1 The present invention is a flowchart of some embodiments of the method for selecting a route for outbound service data sent by a terminal.
[0022] Figure 2 The flowchart is a schematic diagram of other embodiments of the method for selecting a route for outbound service data sent by a terminal according to the present disclosure.
[0023] Figure 3 It is a schematic diagram of the structure of some embodiments of the terminal disclosed in the present invention.
[0024] Figure 4 Schematic diagrams of structures of other embodiments of the terminal disclosed herein.
[0025] Figure 5It is a schematic diagram of the structure of some embodiments of the routing selection system for outbound service data of a terminal disclosed in the present invention. DETAILED DESCRIPTION
[0026] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of components and steps, numerical expressions and numerical values set forth in these embodiments do not limit the scope of the present disclosure unless otherwise specifically stated.
[0027] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.
[0028] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.
[0029] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.
[0030] In all examples shown and discussed herein, any specific values should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.
[0031] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.
[0032] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.
[0033] Figure 1 The flowchart of some embodiments of the method for selecting a route for outbound service data sent by a terminal of the present disclosure is shown in FIG.
[0034] In step 110, a URSP rule is obtained, wherein the URSP rule includes a public key provided by the application service provider.
[0035] In some embodiments, an application service provider who is willing to use the operator's special services such as independent slicing provides the operator with a public key for establishing URSP rules, which will serve as a public key verification condition.
[0036] In some embodiments, the public key is located in the traffic descriptor of the URSP rule.
[0037] In step 120, when information requesting a PDU session including application information is received, the application information is matched with the URSP rule, wherein the application information includes a token generated using a private key.
[0038] In some embodiments, a Token is generated based on at least one of an application identifier, IP triplet information, a non-IP descriptor, a data network name, a connection capability, and a domain name descriptor.
[0039] In some embodiments, the terminal bottom layer receives information requesting a PDU session from an upper layer, the information including application information, and the application information carries a token. The terminal bottom layer matches the application information with the description information in the URSP rule, thereby generating a correct PDU session request.
[0040] In step 130, if the application information matches the URSP rule, it is determined that an application matching the URSP rule is detected.
[0041] In some embodiments, when performing URSP matching, the above public key verification condition and its matching process are used as one of the matching verification conditions, and other verification conditions are processed according to the existing URSP matching process.
[0042] In some embodiments, when the terminal evaluates whether the application information matches the URSP rule, if the URSP rule contains a service descriptor that matches the application information, the application information is matched with the URSP rule in the order of priority of the service descriptor. If the application information matches the URSP rule, it is considered that an application matching the URSP rule is detected, and a routing policy corresponding to the rule can be executed.
[0043] In step 140, a routing policy matching the URSP rule is provided to the application, so that the operator provides services to the application.
[0044] For example, the application data is routed to an established PDU session, or the application data load is migrated to a non-3GPP access outside the PDU session, or a new PDU session for the application is triggered.
[0045] In the above embodiment, the terminal uses the token in the received application information as one of the conditions for matching with the URSP, and ensures the verification of the legitimacy of the application while ensuring policy matching, so that the services provided by the URSP are open only to specific applications. In addition, the present application uses the token as one of the conditions for verifying legitimate applications, and can support applications to use different destination IP addresses / destination non-IP information to establish and modify PDU sessions at different times without affecting the operator's use of the same path optimization strategy for the application.
[0046] Figure 2 The flowchart is a schematic diagram of other embodiments of the method for selecting a route for outbound service data sent by a terminal according to the present disclosure.
[0047] In step 210, the operator and the application service provider reach an agreement on the correspondence between the public key and the private key.
[0048] In step 220, when establishing a connection, the application uses a private key to encrypt the application identifier, IP triplet information, non-IP descriptor, data network name, connection capability, and domain name descriptor to generate a Token.
[0049] In some embodiments, the encrypted information should be consistent with a certain agreed-upon plaintext information data in the request.
[0050] In some embodiments, the application encrypts one or more IP 3-tuples defined in 3GPP TS 23.503 [2], namely, the target IP address, the target port number and the protocol used by the IP to generate a Token.
[0051] In some embodiments, the application encrypts one or more non-IP descriptors, ie, destination information of non-IP traffic, to generate a Token.
[0052] In some embodiments, the application encrypts one or more application identifiers to generate a Token.
[0053] In some embodiments, the application encrypts one or more data network names to generate a Token.
[0054] In some embodiments, the application encrypts one or more connection capabilities to generate a Token.
[0055] In some embodiments, the application encrypts one or more domain name descriptors to generate a Token.
[0056] In step 230, the terminal bottom layer obtains the URSP rule, wherein the URSP rule includes the public key provided by the application service provider.
[0057] In step 240, the terminal upper layer sends the generated Token to the terminal lower layer as a part of the application information for making a PDU session request.
[0058] In step 250, the terminal bottom layer executes the existing URSP matching process and uses the public key to decrypt the Token.
[0059] In some embodiments, if the terminal bottom layer determines that the upper layer information does not contain a Token, it means that the request does not meet the public key verification condition.
[0060] In some embodiments, if the terminal bottom layer can use the public key to decrypt the content in the Token, it means that the Token matches the public key in the URSP rule.
[0061] In step 260, the terminal bottom layer determines whether the decrypted Token content matches at least one of the parameters required for generating the token carried in the application information.
[0062] In some embodiments, if the terminal bottom layer can use the public key to decrypt the content in the Token, but the Token content is empty, it means that the request does not meet the public key verification condition.
[0063] In this step, after decrypting the Token using the public key, if the decrypted content is consistent with the plaintext data information in the corresponding request, it means that the Token verification is successful.
[0064] In step 270, if the decrypted Token content matches at least one of the parameters required for generating the token carried in the application information, and other parameters in the upper layer information match the EPRS rules, it is considered that an application matching the URSP rules has been detected.
[0065] At step 280, a routing policy matching the URSP rule is selected for the application.
[0066] In this embodiment, it is possible to support applications to use different destination IP addresses / destination non-IP information to establish and modify PDU sessions at different times without affecting the operator's use of the same path optimization strategy for the application. In addition, in the URSP rule matching process, the introduction of Token can provide matching rule conditions and user legitimacy verification at the same time, improve the accuracy and security of matching, and ensure that the services provided by URSP are only open to specific applications and will not be used by other applications.
[0067] Figure 3 The terminal of the present disclosure includes a rule acquisition unit 310 , an information receiving unit 320 , a rule matching unit 330 and a route selection unit 340 .
[0068] The rule acquisition unit 310 is configured to acquire a URSP rule, wherein the URSP rule includes a public key provided by an application service provider.
[0069] In some embodiments, an application service provider who is willing to use the operator's special services such as independent slicing provides the operator with a public key for establishing URSP rules, which will serve as a public key verification condition.
[0070] The information receiving unit 320 is configured to receive information requesting a PDU session including application information, wherein the application information includes a token generated using a private key.
[0071] In some embodiments, the token is generated based on at least one of an application identifier, IP triplet information, a non-IP descriptor, a data network name, a connection capability, and a domain name descriptor. The IP triplet information includes a target IP address, a target port number, and a protocol used by the IP.
[0072] The rule matching unit 330 is configured to match the application information with the URSP rule, and if the application information matches the URSP rule, determine to detect an application that matches the URSP rule.
[0073] In some embodiments, the token carried in the application information is decrypted using the public key in the URSP rule.
[0074] In some embodiments, after decrypting the token using the public key, it is determined whether the decrypted token content matches at least one of the parameters required for generating the token carried in the application information; and if they match, it is determined that the token carried in the application information matches the public key in the URSP rule. Using the above public key verification condition and its matching process as one of the matching verification conditions can enable URSP matching to complete matching and user verification at one time, thereby improving efficiency.
[0075] The routing selection unit 340 is configured to provide a routing policy that matches the URSP rule to the application, so that the operator provides services to the application.
[0076] In this embodiment, the terminal uses the token in the received application information as one of the conditions for matching with the URSP, and ensures the verification of the legitimacy of the application while ensuring policy matching, so as to ensure that the services provided by the URSP are only open to specific applications.
[0077] Figure 4 4 is a schematic diagram of the structure of another embodiment of the terminal disclosed in the present invention. The terminal includes 400, a memory 410 and a processor 420. The memory 410 may be a disk, a flash memory or any other non-volatile storage medium. The memory 410 is used to store Figure 1-2 The processor 420 is coupled to the memory 410 and can be implemented as one or more integrated circuits, such as a microprocessor or a microcontroller. The processor 420 is used to execute the instructions stored in the memory.
[0078] In some embodiments, the processor 420 is coupled to the memory 410 via a BUS 430. The terminal 400 can also be connected to an external storage system 450 via a storage interface 440 to call external data, and can also be connected to a network or another computer system (not shown) via a network interface 460. No further detailed description will be given here.
[0079] In this embodiment, by storing data instructions in a memory and processing the instructions through a processor, it is possible to ensure that the services provided by the URSP are only open to specific applications, and even if the application uses a different destination IP address / destination non-IP information to establish a modified PDU session, it will not affect the operator's use of the same path optimization strategy for the application.
[0080] Figure 5 The schematic diagram of the structure of some embodiments of the routing selection system for outbound service data of the terminal disclosed in the present invention comprises a terminal 510 and an application 520, wherein the terminal 510 has been described in detail in the above embodiments and will not be further described here.
[0081] The application 520 is configured to send information requesting a PDU session including application information to the terminal 510, wherein the application information includes a token generated using a private key. The token is generated based on at least one of an application identifier, IP triplet information, non-IP descriptor, data network name, connection capability, and domain name descriptor. Even if the application uses a different destination IP address / destination non-IP information to establish and modify a PDU session, it will not affect the operator's use of the same path optimization strategy for the application.
[0082] In some other embodiments, a computer readable storage medium stores computer program instructions, which when executed by a processor implement Figure 1-2 The steps of the method in the corresponding embodiment. Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, devices, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0083] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0084] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0085] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.
[0086] So far, the present disclosure has been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.
[0087] Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. It should be understood by those skilled in the art that the above embodiments may be modified without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.
Claims
1. A method for selecting a route for outgoing service data from a terminal, comprising: Obtaining a user routing selection policy URSP rule, wherein the URSP rule includes a public key provided by an application service provider; When receiving information of a request protocol data unit (PDU) session including application information, matching the application information with the URSP rule, wherein the application information includes a token generated using a private key, wherein the token is generated according to IP triplet information, and matching the application information with the URSP rule includes: using a public key in the URSP rule to decrypt the token carried in the application information, and determining whether the decrypted token content matches at least one of the parameters required for generating the token carried in the application information, and if so, determining that the token carried in the application information matches the public key in the URSP rule; If the application information matches the URSP rule, determining that an application matching the URSP rule is detected; and A routing policy matching the URSP rule is provided to the application.
2. The routing selection method according to claim 1, wherein: The token is also generated based on at least one of an application identifier, a non-IP descriptor, a data network name, a connection capability, and a domain name descriptor.
3. A terminal, comprising: A rule acquisition unit, configured to acquire a user routing selection policy URSP rule, wherein the URSP rule includes a public key provided by an application service provider; An information receiving unit is configured to receive information of a request protocol data unit (PDU) session including application information, wherein the application information includes a token generated using a private key, wherein the token is generated according to IP triplet information; a rule matching unit configured to match the application information with the URSP rule, and if the application information matches the URSP rule, determine that an application matching the URSP rule is detected, wherein matching the application information with the URSP rule comprises: using a public key in the URSP rule to decrypt a token carried in the application information, and determining whether the decrypted token content matches at least one of the parameters required for generating the token carried in the application information, and if so, determining that the token carried in the application information matches the public key in the URSP rule; and The routing selection unit is configured to provide the application with a routing policy that matches the URSP rule.
4. A terminal, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method for selecting routing of terminal outbound service data according to claim 1 or 2 based on instructions stored in the memory.
5. A routing selection system for outbound service data from a terminal, comprising: The terminal according to claim 3 or 4; as well as The application is configured to send information requesting a protocol data unit (PDU) session containing application information to the terminal, wherein the application information includes a token generated using a private key.
6. A non-transitory computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the method for selecting routing of terminal outbound service data as claimed in claim 1 or 2.