Message interaction method, device, equipment and storage medium

Abstract

The present application discloses a message interaction method, apparatus, device and storage medium. The message interaction method is applied to a 5G signaling security gateway of the fifth generation mobile communication technology, and includes: intercepting a connection establishment request sent by a client terminal for establishing a connection with a server; establishing connections with the client terminal and the server respectively according to the connection establishment request; receiving a 5G core network protocol signaling request sent by the client terminal; sending a 5G core network protocol signaling request that meets preset security conditions to the server; and involving the field of network security to solve the problem that the business message interaction process used for security protection in the existing network cannot be applied to the 5G network.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a message interaction method, apparatus, device and storage medium. Background Art

[0002] The business message interaction process used for security protection in the existing 5G signaling security gateway is mainly designed for the 4th generation mobile communication technology (4G) network. The 4G signaling network is a Dia hierarchical signaling network, while the 5th generation mobile communication technology (5G) network has evolved into a service-oriented architecture network. It can be seen that there are significant differences between the 4G network and the 5G network.

[0003] Since there are significant differences between 4G networks and 5G networks, the business message interaction process in the existing network is mainly set up for 4G networks and cannot be applied to 5G networks. Summary of the invention

[0004] The embodiments of the present application provide a message interaction method, apparatus, device and storage medium, which solve the problem that the business message interaction process used for security protection in the existing network cannot be applied to the 5G network.

[0005] In order to achieve the above technical objectives, the embodiments of the present application adopt the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides a message interaction method, which is applied to a fifth generation mobile communication technology 5G signaling security gateway, including:

[0007] Intercepting a connection establishment request sent by a client terminal for establishing a connection with a server;

[0008] Establishing connections with the client terminal and the server respectively according to the connection establishment request;

[0009] Receive 5G core network protocol signaling request sent by the client terminal;

[0010] Send the 5G core network protocol signaling request that meets the preset security conditions to the server.

[0011] This application intercepts the connection establishment request sent by the client terminal to the server through the 5G signaling security gateway, and establishes connections with the client terminal and the server respectively according to the connection establishment request, and then receives and detects the 5G core network protocol signaling request sent by the client terminal, and finally sends the 5G core network protocol signaling request that meets the preset security conditions to the server. The 5G signaling security gateway acts as a "middleman" between the client terminal and the server, filtering and protecting the interactive data. The client terminal and the server are unaware of the 5G signaling security gateway, which realizes the security protection of 5G network service message interaction and improves the security of 5G service data interaction.

[0012] In one embodiment, before establishing connections with the client terminal and the server respectively according to the connection establishment request, the method further includes:

[0013] Parse the connection establishment request to obtain Internet Protocol (IP) packet header information and Transmission Control Protocol (TCP) port information;

[0014] When the Internet Protocol IP packet header information and the Transmission Control Protocol TCP port information meet the preset security protection conditions, it is determined that it is necessary to establish connections with the client terminal and the server respectively according to the connection establishment request.

[0015] In one embodiment, the connection establishment request includes an Internet Protocol (IP) address of the server;

[0016] Establishing connections with the client terminal and the server respectively according to the connection establishment request, including:

[0017] The simulated IP address sends a response data packet to the client terminal; the response data packet is used to establish a connection between the client terminal and the 5G signaling security gateway;

[0018] Establish a connection with the server based on the certificate of the 5G signaling security gateway.

[0019] In one embodiment, connecting includes:

[0020] Transmission Control Protocol TCP connection and Transport Layer Security TLS connection.

[0021] In one embodiment, before sending the 5G core network protocol signaling request that meets the preset security conditions to the server, the method further includes:

[0022] Generate a secret key;

[0023] Send the secret key to the client terminal; the secret key is used to encrypt and / or decrypt 5G core network protocol signaling requests.

[0024] In a second aspect, an embodiment of the present application provides a message interaction device, which is applied to a fifth generation mobile communication technology 5G signaling security gateway, including:

[0025] An interception module, used to intercept a connection establishment request sent by a client terminal for establishing a connection with a server;

[0026] A connection module, used to establish connections with the client terminal and the server respectively according to a connection establishment request;

[0027] A receiving module, used to receive a 5G core network protocol signaling request sent by a client terminal;

[0028] The sending module is used to send a 5G core network protocol signaling request that meets preset security conditions to the server.

[0029] In one embodiment, the apparatus further comprises a parsing module and a determining module;

[0030] A parsing module, used for parsing the connection establishment request to obtain Internet Protocol IP packet header information and Transmission Control Protocol TCP port information before establishing connections with the client terminal and the server respectively according to the connection establishment request;

[0031] The determination module is used to determine the need to establish connections with the client terminal and the server respectively according to the connection establishment request when the Internet interconnection protocol IP packet header information and the transmission control protocol TCP port information meet the preset security protection conditions.

[0032] In one embodiment, the connection establishment request includes an Internet Protocol (IP) address of the server; the connection module is specifically configured to:

[0033] The simulated IP address sends a response data packet to the client terminal; the response data packet is used to establish a connection between the client terminal and the 5G signaling security gateway;

[0034] Establish a connection with the server based on the certificate of the 5G signaling security gateway.

[0035] In one embodiment, connecting includes:

[0036] Transmission Control Protocol TCP connection and Transport Layer Security TLS connection.

[0037] In one embodiment, the apparatus further comprises a generating module;

[0038] A generation module, used to generate a secret key before sending a 5G core network protocol signaling request that meets preset security conditions to a server;

[0039] The sending module is also used to send a secret key to the client terminal; the secret key is used to encrypt and / or decrypt 5G core network protocol signaling requests.

[0040] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory for storing processor executable instructions; wherein the processor is configured to execute instructions to implement the message interaction method provided in the first aspect above.

[0041] In a fourth aspect, the present application provides a computer-readable storage medium storing an implementation program for information transmission, which, when executed by a processor, implements the message interaction method provided in the first aspect.

[0042] In a fifth aspect, the present application provides a computer program product, which, when executed on a computer, enables the computer to execute the method provided in the first aspect above.

[0043] The beneficial effects described in the second, third, fourth and fifth aspects of the present application can refer to the beneficial effect analysis of the first aspect and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A schematic diagram of a message interaction system architecture provided in an embodiment of the present application;

[0045] Figure 2 A schematic diagram of another message interaction system architecture provided in an embodiment of the present application;

[0046] Figure 3 A flowchart of a message interaction method provided in an embodiment of the present application;

[0047] Figure 4 A schematic diagram of a process for determining whether to execute a 5G signaling security gateway to establish connections with a client terminal and a server respectively, provided in an embodiment of the present application;

[0048] Figure 5 A schematic diagram of a process for establishing a connection between a 5G signaling security gateway and a client terminal and a server respectively provided in an embodiment of the present application:

[0049] Figure 6 A schematic diagram of a key generation process provided in an embodiment of the present application;

[0050] Figure 7 A schematic diagram of a specific example of a message interaction method provided in an embodiment of the present application;

[0051] Figure 8 A schematic diagram of the structure of a message interaction device provided in an embodiment of the present application;

[0052] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present application and are not configured to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0054] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations; nor can they be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this embodiment, unless otherwise specified, the meaning of "multiple" is two or more. Moreover, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or equipment. In the absence of more restrictions, the elements defined by the sentence "include..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements.

[0055] Since there are significant differences between 4G networks and 5G networks, the business message interaction process in the existing network is mainly set up for 4G networks and cannot be applied to 5G networks.

[0056] In view of the above technical problems, the embodiment of the present application provides a message interaction system, and the message interaction method provided in the embodiment of the present application is applied to the message interaction system, such as Figure 1 As shown, the message interaction system includes:

[0057] 5G signaling security gateway 110 and 5G private network element 120.

[0058] Among them, the 5G signaling security gateway 110 is bridged between the 5G core network and the 5G private network through the operator's Internet Protocol (IP) bearer network and the intelligent domain network. The 5G private network network element 120 may include: User Port Function (UPF) network element, Authentication Management Function (AMF) network element, Service Management Function (SMF) network element, etc.

[0059] Figure 2 A schematic diagram of the message interaction system architecture is shown in FIG. Figure 2 As shown in the figure, the 5G signaling security gateway is bridged between the AMF network element of the 5G private network and the SMF network element and the Unified Data Management (UDM) network element of the 5G core network. The destination address accessed by the 5G private network network element is the 5G core network network element address. The 5G private network network element is deployed in the client terminal, and the 5G core network network element is deployed in the server. The 5G signaling security gateway acts as a "middleman" between the client terminal and the server, filtering and protecting the interactive data. The client terminal and the server are unaware of the 5G signaling security gateway.

[0060] Based on the above message interaction system, the embodiment of the present application also provides a message interaction method. Figure 3 FIG. 1 is a flow chart of a message interaction method provided by an embodiment of the present application. Figure 3 As shown, the method may include the following steps:

[0061] S310, the client terminal sends a connection establishment request to the server for establishing a connection with the server.

[0062] The connection establishment request may include a synchronous (SYN) message, which is a handshake signal used by protocols such as the Transmission Control Protocol (TCP) / IP to establish a connection. When a normal TCP network connection is established between a client terminal and a server, the client terminal first sends a SYN message, and the server uses a SYN+acknowledgement message (ACK) to respond to indicate that the message has been received, and finally the client terminal responds with an ACK message. In this way, a reliable TCP connection can be established between the client terminal and the server, and data can be transmitted between the client terminal and the server.

[0063] S320, the 5G signaling security gateway intercepts the connection establishment request sent by the client terminal.

[0064] Among them, after the client terminal sends a connection establishment request to the server, the 5G signaling security gateway can intercept the connection establishment request for security testing.

[0065] S330, the 5G signaling security gateway establishes connections with the client terminal and the server respectively according to the connection establishment request.

[0066] Among them, the connection establishment request includes the information required to establish a connection with the client terminal and the server. The 5G signaling security gateway can establish connections with the client terminal and the server respectively according to the connection establishment request.

[0067] S340, the 5G signaling security gateway receives the 5G core network protocol signaling request sent by the client terminal.

[0068] Among them, after the 5G signaling security gateway establishes connections with the client terminal and the server respectively, it can serve as a data transfer station between the client terminal and the server, and accept the 5G core network protocol signaling request originally sent by the client terminal to the server.

[0069] S350, the 5G signaling security gateway sends the 5G core network protocol signaling request that meets the preset security conditions to the server.

[0070] Among them, after the 5G signaling security gateway establishes connections with the client terminal and the server respectively, it can serve as a data transfer station between the client terminal and the server, accept the 5G core network protocol signaling request originally sent by the client terminal to the server, and detect the 5G core network protocol signaling through preset security conditions. Only the 5G core network protocol signaling requests that meet the preset security conditions will be released, and the 5G core network protocol signaling requests that meet the preset security conditions will be sent to the server.

[0071] Furthermore, the 5G signaling security gateway may be pre-installed with a rule engine for determining whether preset security conditions are met. The rule engine can determine whether the 5G core network protocol signaling request meets the preset security conditions. The rule engine may have many screening and filtering rules, for example: verifying whether the domain name / host name format in the 5G core network protocol signaling request is correct, verifying whether the source IP address and destination IP address of the 5G core network protocol signaling request meet the preset address range, etc.

[0072] In the embodiment of the present application, the 5G signaling security gateway intercepts the connection establishment request sent by the client terminal to the server, and establishes connections with the client terminal and the server respectively according to the connection establishment request, and then receives and detects the 5G core network protocol signaling request sent by the client terminal, and finally sends the 5G core network protocol signaling request that meets the preset security conditions to the server. The 5G signaling security gateway acts as a "middleman" between the client terminal and the server, filtering and protecting the interactive data. The client terminal and the server are not aware of the 5G signaling security gateway, which realizes the security protection of 5G network service message interaction and improves the security of 5G service data interaction.

[0073] In one embodiment, if Figure 4 As shown, before S330: establishing connections with the client terminal and the server respectively according to the connection establishment request, the method may further include:

[0074] S360, parsing the connection establishment request to obtain Internet Protocol IP packet header information and Transmission Control Protocol TCP port information.

[0075] S370, when the Internet Protocol IP packet header information and the Transmission Control Protocol TCP port information meet the preset security protection conditions, determine that it is necessary to establish connections with the client terminal and the server respectively according to the connection establishment request.

[0076] Among them, not all business message interactions require security detection, only some types of business message interactions require security detection. Security protection conditions can be pre-deployed on the 5G signaling security gateway, and it can be determined whether the connection establishment request meets the preset security protection conditions. Only when the preset security protection conditions are met, it is determined that it is necessary to establish connections with the client terminal and the server respectively according to the connection establishment request. For example, the preset security protection condition can be: security protection is required only for the IP header information and the transmission control protocol TCP port information that exist in the preset list pre-stored by the 5G signaling security gateway. Specifically, the Internet interconnection protocol IP header information obtained by parsing the connection establishment request can be compared with the transmission control protocol TCP port information and the preset security protection conditions to determine whether it is necessary to establish connections with the client terminal and the server respectively according to the connection establishment request.

[0077] In an embodiment of the present application, the Internet Protocol IP header information obtained based on the analysis of the connection establishment request is compared with the Transmission Control Protocol TCP port information and the preset security protection conditions to determine whether it is necessary to establish connections with the client terminal and the server respectively according to the connection establishment request. Then, only when the Internet Protocol IP header information and the Transmission Control Protocol TCP port information meet the preset security protection conditions, the 5G signaling security gateway is executed to establish connections with the client terminal and the server respectively, thereby saving system computing power.

[0078] In one embodiment, the connection establishment request may include the Internet Protocol (IP) address of the server; Figure 5 As shown, S330: establishing connections with the client terminal and the server respectively according to the connection establishment request may include:

[0079] S3301, simulate the IP address and send a response data packet to the client terminal.

[0080] S3302, establish a connection with the server based on the certificate of the 5G signaling security gateway.

[0081] Among them, the response data packet may include a SYN message and an ACK message. When a normal TCP network connection is established between the client terminal and the server, the client terminal first sends a SYN message, and the server uses a SYN+ACK response to indicate that the message has been received. Finally, the client terminal responds with an ACK message. Based on the response data packet, the client terminal can establish a connection with the 5G signaling security gateway, and the 5G signaling security gateway simulates an IP address to send a response data packet to the client terminal. The IP address belongs to the server, so that the client terminal perceives that a connection has been established with the server, but cannot perceive the 5G signaling security gateway.

[0082] Furthermore, if the server does not record the corresponding information of the client terminal, the 5G signaling security gateway can use its own certificate to establish a connection with the server, and the server cannot perceive the 5G signaling security gateway.

[0083] In an embodiment of the present application, the 5G signaling security gateway sends a response data packet to the client terminal by simulating an IP address, and establishes a connection with the server based on the certificate of the 5G signaling security gateway, so that the client terminal and the server are unaware of the 5G signaling security gateway, thereby achieving security protection for 5G network service message interaction and improving the security of 5G service data interaction.

[0084] In one embodiment, the connection may include:

[0085] Transmission Control Protocol TCP connection and Transport Layer Security TLS connection.

[0086] Among them, TCP connection is a connection-oriented, reliable, byte stream-based transport layer communication protocol, and TCP is designed to adapt to the layered protocol hierarchy that supports multi-network applications. TCP is used to provide reliable communication services between pairs of processes in a host computer connected to different but interconnected computer communication networks. TCP assumes that it can obtain simple, possibly unreliable datagram services from lower-level protocols. In principle, TCP should be able to operate on various communication systems from hard-wired connections to packet switching or circuit switching networks. The message interaction method provided in the embodiment of the present application can be implemented between a client terminal, a 5G signaling security gateway, and a server.

[0087] Furthermore, the Transport Layer Security (TLS) protocol is used to provide confidentiality and data integrity between two communication applications, thereby ensuring the confidentiality and data integrity of the information exchanged by the message exchange method provided in the embodiment of the present application.

[0088] In the embodiment of the present application, a transmission control protocol TCP connection and a transport layer security TLS connection are established between the client terminal and the 5G signaling security gateway, and between the server and the 5G signaling security gateway. TCP can operate on various communication systems from hard-wired connections to packet switching or circuit switching networks, so that the message interaction method provided in the embodiment of the present application can be implemented between the client terminal, the 5G signaling security gateway, and the server. The secure transport layer protocol (TLS) is used to provide confidentiality and data integrity between two communication applications. The confidentiality and data integrity of the information interacted by the message interaction method provided in the embodiment of the present application are ensured.

[0089] In one embodiment, if Figure 6 As shown, before S350: sending the 5G core network protocol signaling request that meets the preset security conditions to the server, the method may also include:

[0090] S380, generate a secret key.

[0091] S390, sending the secret key to the client terminal.

[0092] The secret key is used to encrypt and / or decrypt 5G core network protocol signaling requests.

[0093] In an embodiment of the present application, in order to further improve the confidentiality of message interaction, before sending a 5G core network protocol signaling request that meets the preset security conditions to the server, a secret key is generated and sent to the client terminal. The client terminal can apply the secret key to encrypt the 5G core network protocol signaling request before sending it. After the 5G signaling security gateway receives the encrypted 5G core network protocol signaling request, it applies the secret key to decrypt the encrypted 5G core network protocol signaling, thereby further improving the confidentiality of message interaction.

[0094] In one embodiment, the 5G signaling security gateway also has a flow control function, specifically:

[0095] When the 5G signaling security gateway receives a large number of service access requests from a certain office, in order to avoid the potential downtime risk of the server connected to the 5G signaling security gateway due to ultra-high concurrent service processing, it can control the incoming traffic, such as allowing 70% of the incoming traffic. The remaining service client terminals that have not been allowed can initiate requests again.

[0096] In the embodiment of the present application, the 5G signaling security gateway can avoid the potential downtime risk of the server connected to the 5G signaling security gateway due to ultra-high concurrent business processing by controlling the incoming traffic, thereby improving network stability.

[0097] In one embodiment, the 5G signaling security gateway also has a blacklist and whitelist function, specifically:

[0098] The 5G signaling security gateway pre-stores an IP address library of trusted access devices and untrusted access devices. Access is allowed for devices in the trusted IP address library, and access can be denied for devices not in the trusted IP address library.

[0099] In the embodiment of the present application, the 5G signaling security gateway manages and controls access devices through a pre-stored IP address library, thereby improving network security.

[0100] In one embodiment, the 5G signaling security gateway also has a signaling route optimization function. For example, if the client terminal requests a low-latency service and there are two servers that can provide the relevant service, the 5G signaling security gateway can select the server with a closer path to provide the service.

[0101] In the embodiment of the present application, the 5G signaling security gateway intelligently optimizes the signaling, improves the signaling routing efficiency, and optimizes the user experience.

[0102] In order to help understand the message interaction method provided in the embodiment of the present application, the embodiment of the present application also provides a specific example of the message interaction method, such as Figure 7 As shown, a specific example of the message interaction method may include:

[0103] Step 1: The client terminal initiates a TCP connection establishment request. The client terminal sends a SYN message to request a TCP connection establishment with the server.

[0104] The destination IP address of the TCP connection establishment request initiated by the client terminal is the server address.

[0105] Step 2: The 5G signaling security gateway checks the destination address and simulates the server to complete the connection establishment with the client terminal.

[0106] Among them, the 5G signaling security gateway captures the SYN message, extracts the IP packet header information and TCP port information, and screens whether the connection needs 5G signaling security gateway protection. If protection is required, the 5G signaling security gateway simulates the server IP address to send a SYN ACK message to establish a connection with the client terminal. The client terminal sends an ACK message to the 5G signaling security gateway. If the 5G signaling security gateway successfully receives it, the TCP connection is established.

[0107] Step 3: The client terminal initiates a TLS connection establishment request.

[0108] Step 4: The signaling gateway establishes a TCP connection with the server. The 5G signaling security gateway simulates the client terminal to establish a TCP connection with the server, associates the established connection with the connection in step 2, and generates a message key.

[0109] Step 5: The signaling gateway establishes a TLS connection with the server. The 5G signaling security gateway simulates the client terminal to establish a TLS connection with the server. At this time, the 5G signaling security gateway uses its own certificate as the client terminal certificate to establish the connection.

[0110] Step 6: The client terminal sends an HTTP 2.0 5GC signaling request to the 5G signaling security gateway. The signaling gateway decrypts the request using the message key generated when the connection is established.

[0111] Step 7: The 5G signaling security gateway enables the rule engine to filter requests. The 5G signaling security gateway uses the rule engine to filter each field of the HTTP request to filter out legitimate requests that meet the preset security conditions.

[0112] Step 8: The 5G signaling security gateway sends the legitimate request to the server.

[0113] Specifically, the TLS connection established in steps 4 and 5 can be used to send the message to the server, that is, the 5G signaling security gateway forwards the request message to the server.

[0114] In the embodiment of the present application, the 5G signaling security gateway intercepts the connection establishment request sent by the client terminal to the server, and establishes connections with the client terminal and the server respectively according to the connection establishment request, and then receives and detects the 5G core network protocol signaling request sent by the client terminal, and finally sends the 5G core network protocol signaling request that meets the preset security conditions to the server. The 5G signaling security gateway acts as a "middleman" between the client terminal and the server, filtering and protecting the interactive data. The client terminal and the server are not aware of the 5G signaling security gateway, which realizes the security protection of 5G network service message interaction and improves the security of 5G service data interaction.

[0115] Figure 1-Figure 7 Describes the message interaction method, the following is combined Figure 8-Figure 9 Describe the device provided by the embodiment of the present application. In order to implement the above functions, the message interaction device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0116] The embodiment of the present application can exemplarily divide the functional modules of the message interaction device according to the above method. The message interaction device can divide each functional module corresponding to each function, or integrate two or more functions into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0117] Figure 8 A schematic diagram showing the structure of a message interaction device provided by an embodiment of the present application is shown. Figure 8 Each module in the device shown has the function of realizing Figure 3 The functions of each step in the process can achieve the corresponding technical effects. Figure 8 As shown, the device may include:

[0118] An interception module 810, used to intercept a connection establishment request sent by a client terminal for establishing a connection with a server;

[0119] A connection module 820, used to establish connections with the client terminal and the server respectively according to a connection establishment request;

[0120] The receiving module 830 is used to receive a 5G core network protocol signaling request sent by a client terminal;

[0121] The sending module 840 is used to send a 5G core network protocol signaling request that meets preset security conditions to the server.

[0122] In the embodiment of the present application, the 5G signaling security gateway intercepts the connection establishment request sent by the client terminal to the server, and establishes connections with the client terminal and the server respectively according to the connection establishment request, and then receives and detects the 5G core network protocol signaling request sent by the client terminal, and finally sends the 5G core network protocol signaling request that meets the preset security conditions to the server. The 5G signaling security gateway acts as a "middleman" between the client terminal and the server, filtering and protecting the interactive data. The client terminal and the server are not aware of the 5G signaling security gateway, which realizes the security protection of 5G network service message interaction and improves the security of 5G service data interaction.

[0123] In one embodiment, the apparatus further comprises a parsing module and a determining module;

[0124] A parsing module, used for parsing the connection establishment request to obtain Internet Protocol IP packet header information and Transmission Control Protocol TCP port information before establishing connections with the client terminal and the server respectively according to the connection establishment request;

[0125] The determination module is used to determine the need to establish connections with the client terminal and the server respectively according to the connection establishment request when the Internet interconnection protocol IP packet header information and the transmission control protocol TCP port information meet the preset security protection conditions.

[0126] In one embodiment, the connection establishment request includes an Internet Protocol (IP) address of the server; the connection module 820 is specifically configured to:

[0127] The simulated IP address sends a response data packet to the client terminal; the response data packet is used to establish a connection between the client terminal and the 5G signaling security gateway;

[0128] Establish a connection with the server based on the certificate of the 5G signaling security gateway.

[0129] In one embodiment, connecting includes:

[0130] Transmission Control Protocol TCP connection and Transport Layer Security TLS connection.

[0131] In one embodiment, the apparatus further comprises a generating module;

[0132] A generation module, used to generate a secret key before sending a 5G core network protocol signaling request that meets preset security conditions to a server;

[0133] The sending module 840 is also used to send a secret key to the client terminal; the secret key is used to encrypt and / or decrypt 5G core network protocol signaling requests.

[0134] In the embodiment of the present application, the 5G signaling security gateway intercepts the connection establishment request sent by the client terminal to the server, and establishes connections with the client terminal and the server respectively according to the connection establishment request, and then receives and detects the 5G core network protocol signaling request sent by the client terminal, and finally sends the 5G core network protocol signaling request that meets the preset security conditions to the server. The 5G signaling security gateway acts as a "middleman" between the client terminal and the server, filtering and protecting the interactive data. The client terminal and the server are not aware of the 5G signaling security gateway, which realizes the security protection of 5G network service message interaction and improves the security of 5G service data interaction.

[0135] Fig. 9 FIG. 1 is a schematic diagram showing the structure of an electronic device provided by an embodiment of the present application. Fig. 9 As shown, the device may include a processor 901 and a memory 902 storing computer program instructions.

[0136] Specifically, the processor 901 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0137] The memory 902 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 902 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In one example, the memory 902 may include a removable or non-removable (or fixed) medium, or the memory 902 is a non-volatile solid-state memory. The memory 902 may be inside or outside the integrated gateway disaster recovery device.

[0138] In one example, the memory 902 may be a read-only memory (ROM). In one example, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or a flash memory, or a combination of two or more of these.

[0139] The processor 901 reads and executes the computer program instructions stored in the memory 902 to implement Figure 3 The method in the embodiment shown in the figure is achieved Figure 3The corresponding technical effects achieved by executing the method in the example shown are not repeated here for the sake of brevity.

[0140] In one example, the electronic device may further include a communication interface 903 and a bus 910. Fig. 9 As shown, the processor 901, the memory 902, and the communication interface 903 are connected via a bus 910 and communicate with each other.

[0141] The communication interface 903 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0142] Bus 910 includes hardware, software or both, and the components of online data flow billing equipment are coupled to each other. For example, but not limitation, the bus may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), Hyper Transport (HT) interconnection, Industry Standard Architecture (ISA) bus, InfiniBand interconnection, Low Pin Count (LPC) bus, Memory bus, Micro Channel Architecture (MCA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Attachment (SATA) bus, Video Electronics Standards Association Local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 910 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the present application considers any suitable bus or interconnection.

[0143] The electronic device can execute the message interaction method in the embodiment of the present application, thereby realizing Figure 3 The corresponding technical effects of the described message interaction method.

[0144] In addition, in combination with the message interaction method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the message interaction methods in the above embodiment is implemented.

[0145] In an exemplary embodiment, the embodiment of the present application further provides a computer program product, which, when executed on a computer, enables the computer to implement the message interaction method in the above embodiment.

[0146] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0147] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0148] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0149] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0150] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks or optical disks.

[0151] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A message interaction method, characterized in that: The method is applied to a 5G signaling security gateway of the fifth generation mobile communication technology, wherein the 5G signaling security gateway has a built-in rule engine, and the rule engine is used to determine whether a 5G core network protocol signaling request meets a preset security condition. The method includes: Intercepting a connection establishment request sent by a client terminal for establishing a connection with a server; Parsing the connection establishment request to obtain Internet Protocol (IP) packet header information and Transmission Control Protocol (TCP) port information; When the Internet Protocol (IP) packet header information and the Transmission Control Protocol (TCP) port information meet the preset security protection conditions, determining that it is necessary to establish connections with the client terminal and the server respectively according to the connection establishment request; Establishing connections with the client terminal and the server respectively according to the connection establishment request; Receiving the 5G core network protocol signaling request sent by the client terminal; The 5G core network protocol signaling request that meets the preset security conditions is sent to the server.

2. The message interaction method according to claim 1, characterized in that: The connection establishment request includes an Internet Protocol (IP) address of the server; The establishing of connections with the client terminal and the server respectively according to the connection establishment request comprises: Simulate the IP address to send a response data packet to the client terminal; the response data packet is used for the client terminal to establish a connection with the 5G signaling security gateway; Establish a connection with the server according to the certificate of the 5G signaling security gateway.

3. The message interaction method according to claim 2, characterized in that: The connection includes: Transmission Control Protocol TCP connection and Transport Layer Security TLS connection.

4. The message interaction method according to any one of claims 1 to 3, characterized in that: Before sending the 5G core network protocol signaling request that meets the preset security conditions to the server, the method further includes: Generate a secret key; Send the secret key to the client terminal; the secret key is used to encrypt and / or decrypt the 5G core network protocol signaling request.

5. A message interaction device, characterized in that: The device is applied to a 5G signaling security gateway of the fifth generation mobile communication technology. The 5G signaling security gateway has a built-in rule engine. The rule engine is used to determine whether a 5G core network protocol signaling request meets a preset security condition. The device includes: An interception module, used to intercept a connection establishment request sent by a client terminal for establishing a connection with a server; A parsing module, used for parsing the connection establishment request to obtain Internet Protocol IP packet header information and Transmission Control Protocol TCP port information; A determination module, configured to determine that it is necessary to establish a connection with the client terminal and the server respectively according to the connection establishment request when the Internet Protocol IP packet header information and the Transmission Control Protocol TCP port information meet a preset security protection condition; A connection module, used to establish connections with the client terminal and the server respectively according to the connection establishment request; A receiving module, used to receive the 5G core network protocol signaling request sent by the client terminal; A sending module is used to send the 5G core network protocol signaling request that meets the preset security conditions to the server.

6. The message interaction device according to claim 5, characterized in that: The connection establishment request includes an Internet Protocol (IP) address of the server; the connection module is specifically used to: Simulate the IP address to send a response data packet to the client terminal; the response data packet is used for the client terminal to establish a connection with the 5G signaling security gateway; Establish a connection with the server according to the certificate of the 5G signaling security gateway.

7. The message interaction device according to claim 6, characterized in that: The connection includes: Transmission Control Protocol TCP connection and Transport Layer Security TLS connection.

8. The message interaction device according to any one of claims 5 to 7, characterized in that: The device also includes a generating module; The generating module is used to generate a secret key before sending the 5G core network protocol signaling request that meets the preset security conditions to the server; The sending module is also used to send the secret key to the client terminal; the secret key is used to encrypt and / or decrypt the 5G core network protocol signaling request.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the message interaction method according to any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the message interaction method according to any one of claims 1 to 4 is implemented.

Images