A trust evaluation, data packet processing method, network element and storage medium

Abstract

The present invention discloses a trust evaluation, data packet processing method, network element and storage medium, including: a target SEPP in a target network receives a data packet sent by an NF in a source network; labels the data packet and sends the data packet to the NF for processing; receives a security policy and executes the security policy. The NF processes the data packet; and sends the data packet and the processing result to the network element. The network element receives the data packet and / or the processing result of the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result; the network element evaluates the trust level of the source network according to the data packet and / or the processing result of the data packet. By adopting the present invention, there is no need for a trust relationship between the source network and the target network, and the trust level of the source network can be dynamically evaluated by the network element.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a trust evaluation, data packet processing method, network element and storage medium. Background Art

[0002] SEPP (Security Edge Protection Proxies) is introduced in the 5G interoperability security architecture. As an entity located at the network boundary of PLMN (Public Land Mobile Network), it implements secure communication between NF Service Consumer (NF: Network Function) and Producer (Service Provider) in different PLMN networks. The functions of SEPP include:

[0003] 1) All messages from the PLMN NF are converted into N32 interface format and forwarded to other PLMNs;

[0004] 2) Receive N32 interface messages from other PLMNs, verify their security, and then forward them to the NF in the PLMN to which they belong;

[0005] 3) SEPP functions also include message filtering, policy implementation of N32 control plane messages, and topology hiding.

[0006] Zero Trust is a network security paradigm centered on resource protection, and its premise is that trust must be continuously evaluated. In the concept of zero trust, external or internal threats exist in the network from beginning to end, and the location in the network does not determine its trustworthiness. Therefore, security policies must be dynamic, and the trustworthiness of users / devices / network traffic must be dynamically evaluated.

[0007] The disadvantage of the prior art is that SEPP cannot dynamically evaluate the credit level of cSEPP (opposite operator), and thus cannot dynamically manage its trust authority. Summary of the invention

[0008] The present invention provides a trust evaluation, data packet processing method, network element and storage medium, which are used to solve the problem that SEPP cannot dynamically evaluate the credit level of cSEPP (opposite operator) and thus cannot dynamically manage the trust authority thereof.

[0009] The present invention provides the following technical solutions:

[0010] A data packet processing method, comprising:

[0011] The network element receives a data packet and / or a processing result of the data packet. The data packet is sent by the network function entity NF in the source network, and is forwarded to the NF belonging to the target network after the target SEPP verifies and labels the data packet. The information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result;

[0012] The network element evaluates the trust level of the source network according to the data packet and / or the processing result of the data packet.

[0013] In implementation, the network element is NWDAF.

[0014] In implementation, when the network element evaluates the trust level of the source network according to the data packet and / or the result of processing the data packet, it determines whether it is an abnormal data packet in one of the following ways or a combination thereof:

[0015] Determine based on the processing result of NF Producer;

[0016] When data packets flow in the network, they are acquired by specific security equipment and subjected to security analysis and judgment results;

[0017] NF Producer sends the data packet to NWDAF for security analysis and decision making;

[0018] The results are determined through audit channels.

[0019] In implementation, when the network element evaluates the trust level of the source network according to the data packet and / or the processing result of the data packet, a zero-trust dynamic evaluation is performed according to one or a combination of the following factors:

[0020] Whether it is an abnormal data packet;

[0021] The frequency of abnormal data packets;

[0022] According to the degree of harm caused by abnormal data packets;

[0023] The network function service type accessed by the abnormal data packet.

[0024] During implementation, when the network element is not NWDAF, the method further includes:

[0025] Send zero-trust dynamic assessment results to NWDAF to generate security policies.

[0026] During implementation, it further includes:

[0027] The network element manages the trust authority of the SEEP of the source network based on the evaluation results.

[0028] During implementation, it further includes:

[0029] Generate a security policy based on the trust level evaluation result and send the security policy to the target SEPP.

[0030] In practice, the security policy includes one or a combination of the following:

[0031] Permanently reject packets from the source network;

[0032] Reject packets from the source network for a period of time;

[0033] Deny data packets from the source network access to one or several network function services;

[0034] Allow packets from the source network;

[0035] Recovery allows packets from the source network.

[0036] A data packet processing method, comprising:

[0037] The target SEPP in the target network receives the data packet sent by the NF in the source network;

[0038] The target SEPP labels the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feed back the data packet and its processing result;

[0039] The target SEPP sends the data packet to the NF for processing.

[0040] During implementation, it further includes:

[0041] The target SEPP receives the security policy and executes the security policy.

[0042] In implementation, the security policy received by the target SEPP is sent by the NWDAF.

[0043] In implementation, before labeling the data packet, the method further includes:

[0044] The target SEPP verifies the data packet, and the verification is used to ensure whether the data packet comes from the source network;

[0045] After verification, the target SEPP labels the data packet.

[0046] A data packet processing method, comprising:

[0047] The NF receives the data packet with a label sent by the target SEPP. The information carried in the label can associate the data packet with the source network and instruct the network element that processes the data packet to feedback the data packet and its processing result.

[0048] NF processes the data packet;

[0049] The NF sends the data packet and / or the processing result of the data packet to the network element according to the data packet label instruction, so that the network element can evaluate the trust level.

[0050] In implementation, the data packet is sent by a network function entity NF in a source network, and is forwarded to a NF in a target network after the target SEPP verifies and labels the data packet.

[0051] In implementation, the network element is NWDAF.

[0052] A network element, characterized by comprising:

[0053] The processor reads the program in the memory and performs the following processes:

[0054] Receive a data packet and / or a processing result of the data packet, wherein the data packet is sent by the network function entity NF in the source network, and is forwarded to the NF belonging to the target network after the target SEPP verifies and labels the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result;

[0055] Performing a trust level evaluation on the source network according to the data packet and / or a result of processing the data packet;

[0056] A transceiver is used to receive and send data under the control of the processor.

[0057] In implementation, the network element is NWDAF.

[0058] In implementation, when the trust level of the source network is evaluated based on the data packet and / or the processing result of the data packet, whether it is an abnormal data packet is determined in one of the following ways or a combination thereof:

[0059] Determine based on the processing result of NF Producer;

[0060] When data packets flow in the network, they are acquired by specific security equipment and subjected to security analysis and judgment results;

[0061] NF Producer sends the data packet to NWDAF for security analysis and decision making;

[0062] The results are determined through audit channels.

[0063] In implementation, when the trust level of the source network is evaluated based on the data packet and / or the result of processing the data packet, a zero-trust dynamic evaluation is performed based on one or a combination of the following factors:

[0064] Whether it is an abnormal data packet;

[0065] The frequency of abnormal data packets;

[0066] According to the degree of harm caused by abnormal data packets;

[0067] The network function service type accessed by the abnormal data packet.

[0068] During implementation, when the network element is not NWDAF, the method further includes:

[0069] Send zero-trust dynamic assessment results to NWDAF to generate security policies.

[0070] During implementation, it further includes:

[0071] The network element manages the trust authority of the SEEP of the source network based on the evaluation results.

[0072] During implementation, it further includes:

[0073] Generate a security policy based on the trust level evaluation result and send the security policy to the target SEPP.

[0074] In practice, the security policy includes one or a combination of the following:

[0075] Permanently reject packets from the source network;

[0076] Reject packets from the source network for a period of time;

[0077] Deny data packets from the source network access to one or several network function services;

[0078] Allow packets from the source network;

[0079] Recovery allows packets from the source network.

[0080] A network element, comprising:

[0081] A network element receiving module is used to receive a data packet and / or a processing result of the data packet. The data packet is sent by a network function entity NF in a source network and forwarded to a NF belonging to a target network after the target SEPP verifies and labels the data packet. The information carried in the label can associate the data packet with the source network and instruct the network element that processes the data packet to feedback the data packet and its processing result.

[0082] The network element evaluation module is used to evaluate the trust level of the source network according to the data packet and / or the processing result of the data packet.

[0083] In implementation, the network element is NWDAF.

[0084] In implementation, the network element evaluation module is further used to determine whether it is an abnormal data packet in one of the following ways or a combination thereof when evaluating the trust level of the source network according to the data packet and / or the processing result of the data packet:

[0085] Determine based on the processing result of NF Producer;

[0086] When data packets flow in the network, they are acquired by specific security equipment and subjected to security analysis and judgment results;

[0087] NF Producer sends the data packet to NWDAF for security analysis and decision making;

[0088] The results are determined through audit channels.

[0089] In implementation, the network element evaluation module is further used to perform a zero-trust dynamic evaluation based on one or a combination of the following factors when evaluating the trust level of the source network based on the data packet and / or the processing result of the data packet:

[0090] Whether it is an abnormal data packet;

[0091] The frequency of abnormal data packets;

[0092] According to the degree of harm caused by abnormal data packets;

[0093] The network function service type accessed by the abnormal data packet.

[0094] In implementation, the network element evaluation module is further used to, when the network element is not a NWDAF, further include:

[0095] Send zero-trust dynamic assessment results to NWDAF to generate security policies.

[0096] During implementation, the network element evaluation module is further used to perform trust authority management on the SEEP of the source network according to the evaluation results.

[0097] During implementation, it further includes:

[0098] The network element policy module is used to generate a security policy based on the trust level evaluation result and send the security policy to the target SEPP.

[0099] In implementation, the network element policy module is further used to generate a security policy including one or a combination of the following:

[0100] Permanently reject packets from the source network;

[0101] Reject packets from the source network for a period of time;

[0102] Deny data packets from the source network access to one or several network function services;

[0103] Allow packets from the source network;

[0104] Recovery allows packets from the source network.

[0105] A SEPP comprising:

[0106] The processor reads the program in the memory and performs the following processes:

[0107] Receive data packets sent by NF in the source network;

[0108] Labeling the data packet, wherein the information carried in the label can associate the data packet with the source network, and instruct the network element processing the data packet to feed back the data packet and the processing result thereof;

[0109] Send the data packet to the NF for processing;

[0110] A transceiver is used to receive and send data under the control of the processor.

[0111] In implementation, the received security policy is sent by NWDAF.

[0112] In implementation, before labeling the data packet, the method further includes:

[0113] Verifying the data packet, wherein the verification is used to ensure whether the data packet comes from a source network;

[0114] After verification, the data packet is labeled.

[0115] A SEPP comprising:

[0116] The target SEPP receiving module is used to receive the data packets sent by the NF in the source network;

[0117] A target SEPP label module is used to label the data packet, label the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result;

[0118] The target SEPP sending module is used to send the data packet to the processing.

[0119] During implementation, the target SEPP policy module is further used to receive the security policy sent by the NWDAF.

[0120] During implementation, it further includes:

[0121] The target SEPP verification module is used to verify the data packet before labeling the data packet, and the verification is used to ensure whether the data packet comes from the source network; after the verification is passed, the data packet is labeled.

[0122] A NF comprising:

[0123] The processor reads the program in the memory and performs the following processes:

[0124] Receive a data packet with a label sent by a target SEPP, wherein the information carried in the label can associate the data packet with a source network, and instruct a network element that processes the data packet to feed back the data packet and its processing result;

[0125] Processing data packets;

[0126] Sending the data packet and / or the processing result of the data packet to the network element according to the data packet label indication, so that the network element can evaluate the trust level;

[0127] A transceiver is used to receive and send data under the control of the processor.

[0128] In implementation, the data packet is sent by a network function entity NF in a source network, and is forwarded to a NF in a target network after the target SEPP verifies and labels the data packet.

[0129] In implementation, the network element is NWDAF.

[0130] A NF comprising:

[0131] NF receiving module, used to receive a data packet with a label sent by the target SEPP, the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result;

[0132] NF processing module, used to process data packets;

[0133] The NF sending module is used to send the data packet and / or the processing result of the data packet to the network element according to the data packet label indication, so that the network element can evaluate the trust level.

[0134] In implementation, the NF receiving module is further used to receive a data packet sent by a network function entity NF in a source network, and forwarded to a NF belonging to a target network after the target SEPP verifies and labels the data packet.

[0135] During implementation, the NF sending module is further used to send the processing result to the NWDAF of the network element.

[0136] A computer-readable storage medium stores a computer program for executing the above-mentioned data packet processing method.

[0137] The beneficial effects of the present invention are as follows:

[0138] In the technical solution provided by the embodiment of the present invention, the NF of the target network sends the data packet and / or the processing result of the data packet to the network element, which performs a trust level assessment. Since the trust level assessment process is independent of the source network, there is no need for a trust relationship between the source network and the target network. At the same time, the target network can also dynamically assess the trust level of the source network through the network element, thereby executing dynamic policies on the messages of the source network according to the actual situation of the source network. BRIEF DESCRIPTION OF THE DRAWINGS

[0139] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0140] Figure 1 A schematic diagram of a data packet processing method implementation flow in an embodiment of the present invention;

[0141] Figure 2 A schematic diagram of a data packet processing method implementation flow in an embodiment of the present invention;

[0142] Figure 3 A schematic diagram of a data packet processing method implementation flow in an embodiment of the present invention;

[0143] Figure 4 A schematic diagram of a dynamic evaluation and processing flow for inter-operator communication messages based on zero trust in an embodiment of the present invention is provided;

[0144] Figure 5 This is a schematic diagram of a network element structure in an embodiment of the present invention;

[0145] Figure 6 This is a schematic diagram of the SEPP structure in an embodiment of the present invention;

[0146] Figure 7 It is a schematic diagram of the NF producer structure in an embodiment of the present invention. DETAILED DESCRIPTION

[0147] The inventors noticed during the invention process that:

[0148] The existing technology only considers the transmission security protection between two different operators, and assumes that the information within the operator is credible and cannot be changed. This assumption is valid when the two different operators are in normal working state. However, when the operator is in an abnormal state, such as being attacked by an attacker, or rented to a third party due to operational difficulties, the above assumption will no longer hold. Attackers or third parties can construct untrustworthy information as needed and send it to the other end through legitimate network equipment and legitimate network boundaries.

[0149] At this point, when the operator network on the other end tries to verify the data, the data can be verified. However, the information in it is invalid. This happens because the source of the information has changed from a trusted network to an untrusted network.

[0150] Based on this, the technical solution provided by the embodiment of the present invention introduces a zero-trust dynamic evaluation mechanism, so that the network boundary SEPP adds special tags to the messages received and forwarded to the internal NF, and establishes a feedback response mechanism. After each NF receives and processes the message, it needs to feed back the processing result to a specific network element (which can be NWDAF (Network Data Analytics Function) or a new network element). The network element is responsible for tracking the relevant messages and processing results. After data analysis, it can dynamically evaluate the credit level of cSEPP (opposite operator), dynamically manage its trust authority, and send the evaluation results or execution strategy to SEPP, which discards, rejects or delays the message from the specific opposite cSEPP based on the strategy.

[0151] The specific implementation of the present invention will be described below in conjunction with the accompanying drawings.

[0152] In the description process, the implementation of SEPP, NF and network element side of the source network and the target network will be described respectively, and then an example of their coordinated implementation will be given to better understand the implementation of the solution given in the embodiment of the present invention. Such a description does not mean that they must be implemented in coordination or must be implemented separately. In fact, when they are implemented separately, they also solve the problems on their own side, and when they are used in combination, better technical effects will be obtained.

[0153] Figure 1 The schematic diagram of the target SEPP side data packet processing method implementation flow chart, as shown in the figure, may include:

[0154] Step 101, a target SEPP in a target network receives a data packet sent by a NF in a source network;

[0155] Step 102: The target SEPP labels the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feed back the data packet and its processing result;

[0156] Step 103: The target SEPP sends the data packet to the NF for processing.

[0157] During implementation, it further includes:

[0158] The network element manages the trust authority of the SEEP of the source network based on the evaluation results.

[0159] During implementation, it further includes:

[0160] Generate a security policy based on the trust level evaluation result and send the security policy to the target SEPP.

[0161] Specifically, the target SEPP in the target network receives the data packet sent by the NF in the source network; when the data packet arrives at the boundary of the target network, the target SEPP verifies the data packet, and the verification is used to ensure whether the data packet comes from the source network; after the verification, the target SEPP labels the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the processing result; the target SEPP sends the data packet to the NF for processing; the target SEPP receives the security policy and executes the security policy.

[0162] During implementation, the label that the target SEPP adds to the data packet can also include information that requires feedback on the processing results. The target SEPP does not need to send notification information specifically to the NF Producer. When the data packet flows in the home network, each network element that has processed the data packet can feedback the processing information.

[0163] In implementation, the security policy received by the target SEPP is sent by the NWDAF.

[0164] Figure 2 A flowchart for implementing a packet processing method is shown in the figure, which may include:

[0165] Step 201: NF receives a data packet with a label sent by a target SEPP. The information carried in the label can associate the data packet with the source network and instruct the network element that processes the data packet to feed back the data packet and its processing result.

[0166] Step 202: NF processes the data packet;

[0167] Step 203: The NF sends the data packet and / or the processing result of the data packet to the network element according to the data packet label instruction, so that the network element can evaluate the trust level.

[0168] In implementation, the data packet is sent by a network function entity NF in a source network, and is forwarded to a NF in a target network after the target SEPP verifies and labels the data packet.

[0169] Specifically, taking NF producer as an example, after NF producer receives the feedback of processing result from the network element instructing the target SEPP to process the data packet, it receives the data packet sent by the target SEPP; NF producer processes the data packet; and NF producer sends the processing result to the network element.

[0170] In implementation, the network element is NWDAF.

[0171] Figure 3 A flowchart for implementing a packet processing method is shown in the figure, which may include:

[0172] Step 301: A network element receives a data packet and / or a processing result of the data packet. The data packet is sent by a network function entity NF in a source network, and is forwarded to a NF belonging to a target network after the target SEPP verifies and labels the data packet. The information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feed back the data packet and its processing result.

[0173] Step 302: The network element evaluates the trust level of the source network according to the data packet and / or the processing result of the data packet.

[0174] During implementation, it further includes:

[0175] The network element manages the trust authority of the SEEP of the source network based on the evaluation results.

[0176] During implementation, it further includes:

[0177] Generate a security policy based on the trust level evaluation result and send the security policy to the target SEPP.

[0178] Specifically, the network element receives the processing result of the data packet sent by the NF producer, where the data packet is sent from the NF in the source network to the NF producer of the target network; the network element generates a security policy based on the processing result and the relevant information on the data packet processing by the target network to which the NFproducer belongs; the network element sends the security policy to the SEPP of the target network to which the NF producer belongs.

[0179] The generation of security policies can be based not only on the processing results of the NF, but also on related information, such as processing feedback information from other network elements (such as agents, gateways, other security processing units, etc.) in the home network.

[0180] Specifically, for example, a network element may receive data packets and processing results sent by a network function service provider NF producer and related network elements (agents, gateways or other security network elements, etc.); the network element evaluates the trust level of the source network based on the data packets and processing results and other related information; and sends the evaluation results to the network data analysis function NWDAF (if the network element is not NWDAF).

[0181] In implementation, the network element is NWDAF.

[0182] In implementation, when the network element evaluates the trust level of the source network according to the data packet and / or the result of processing the data packet, it determines whether it is an abnormal data packet in one of the following ways or a combination thereof:

[0183] Determine based on the processing result of NF Producer;

[0184] When data packets flow in the network, they are acquired by specific security equipment and subjected to security analysis and judgment results;

[0185] NF Producer sends the data packet to NWDAF for security analysis and decision making;

[0186] The results are determined through audit channels.

[0187] Specifically, determining whether a data packet is an abnormal data packet includes but is not limited to:

[0188] Determine based on the processing result of NF Producer;

[0189] When data packets flow in the network, they are acquired by specific security devices and subjected to security analysis and judgment;

[0190] NF Producer sends the data packet to NWDAF for security analysis and determination;

[0191] Determined through audit and other channels.

[0192] In implementation, when the network element evaluates the trust level of the source network according to the data packet and / or the processing result of the data packet, a zero-trust dynamic evaluation is performed according to one or a combination of the following factors:

[0193] Whether it is an abnormal data packet;

[0194] The frequency of abnormal data packets;

[0195] According to the degree of harm caused by abnormal data packets;

[0196] The network function service type accessed by the abnormal data packet.

[0197] Specifically, when a data packet is judged, a zero-trust dynamic assessment will be performed, including but not limited to:

[0198] The trust level of the source network is evaluated and updated based on whether it is an abnormal data packet. For example, a normal data packet can be scored +1 point, while an abnormal data packet can be scored -1 point.

[0199] Or score according to the frequency of abnormal data packets, for example, if it occurs more than once a minute, it is scored as 0, and if it occurs less than once a year, it is scored as 100;

[0200] Or, the abnormal data packets may be evaluated based on their degree of harm, for example, extremely serious data packets are marked as untrustworthy, while those with little impact are marked as trustworthy, etc.

[0201] Alternatively, the abnormal data packets may be scored based on the type of network function service accessed by the abnormal data packets. For example, if there are a large number of abnormal data packets accessing AMF (Access and Mobility Management Function), the credibility of the source network's access to AMF may be reduced.

[0202] During implementation, when the network element is not NWDAF, the method further includes:

[0203] Send zero-trust dynamic assessment results to NWDAF to generate security policies.

[0204] Specifically, in 5GC (5G Core Network), NWDAF can collect data from each network element and use AI (Artificial Intelligence) technology to perform data analysis and dynamic policy arrangement. Therefore, after the dynamic evaluation is completed, NWDAF can formulate the security policy to be sent to pSEPP. If the network element that performs the security evaluation is not NWDAF, the evaluation result can be sent to NWDAF for policy arrangement.

[0205] In practice, the security policy includes one or a combination of the following:

[0206] Permanently reject packets from the source network;

[0207] Reject packets from the source network for a period of time;

[0208] Deny data packets from the source network access to one or several network function services;

[0209] Allow packets from the source network;

[0210] Recovery allows packets from the source network.

[0211] Specifically, the policy may include: permanently rejecting data packets from the source network (cSEPP), rejecting data packets from the source network for a period of time, rejecting data packets from the source network (cSEPP) accessing one or several network function services, allowing data packets from the source network, and restoring allowing data packets from the source network.

[0212] The following is an example to illustrate the NF, in which NF Producer is used as an example to illustrate the NF.

[0213] Figure 4 A schematic diagram of a process for providing dynamic evaluation and processing of inter-operator intercommunication messages based on zero trust is provided. As shown in the figure, when providing dynamic evaluation and processing of inter-operator intercommunication messages based on zero trust, the following may be included:

[0214] 1. Any network element NF in the source network sends a data packet m, which is sent to the target pSEPP in the target network via the cSEPP.

[0215] 2. When the data packet reaches the boundary of the target network, pSEPP verifies the data packet to ensure that the data packet comes from the source network.

[0216] 3. When the verification is passed, pSEPP adds a special label label to the data packet m. The information contained in the label can associate the data packet with the source network and prompt each network element to perform feedback response processing on the data packet. Then the data packet is sent to the corresponding processing NF producer according to the process.

[0217] 4. When NF Producer finishes processing the data packet, the processing results and corresponding analysis results will be sent to the specific network element for data packet determination and zero-trust dynamic evaluation, specifically:

[0218] 1) The specific network element may be NWDAF or a dedicated security network element.

[0219] 2) Determine whether the data packet is an abnormal data packet, including but not limited to:

[0220] A. Determine based on the processing result of NF Producer;

[0221] B. When data packets flow in the network, they are acquired by specific security equipment and subjected to security analysis and judgment;

[0222] C. NF Producer sends the data packet to NWDAF for security analysis and determination;

[0223] D. Determine through audit or other channels.

[0224] 3) After the data packet is judged, a zero-trust dynamic assessment will be performed, including but not limited to:

[0225] Depending on whether it is an abnormal data packet, the trust level of the source network is evaluated and updated, for example, a normal data packet can get +1 point, and an abnormal data packet can get -1 point; or scoring is performed based on the frequency of abnormal data packets, for example, more than once a minute is recorded as 0 points, and less than once a year is recorded as 100 points; or evaluation is performed based on the degree of harm caused by abnormal data packets, for example, very serious ones are recorded as untrustworthy, and those with almost no impact are recorded as trustworthy, etc.; or scoring is performed based on the type of network function service accessed by abnormal data packets, for example, if there are more abnormal data packets accessing AMF, the credibility of the source network's access to AMF is reduced, etc.

[0226] 5. In 5GC, NWDAF can collect data from each network element and use AI technology to perform data analysis and dynamic policy orchestration. Therefore, it is recommended that NWDAF formulate a security policy to be sent to pSEPP after the dynamic assessment is completed. If the network element determined in step 4 is not NWDAF, the assessment result needs to be sent to NWDAF for policy orchestration. The policy may include: permanently rejecting data packets from the source network (cSEPP), rejecting data packets from the source network for a period of time, rejecting data packets from the source network (cSEPP) to access one or several network function services, allowing data packets from the source network, and restoring the permission of data packets from the source network.

[0227] 6. NWDAF sends the strategy to pSEPP.

[0228] 7. pSEPP performs filtering and control of packets from the source network (vSEPP) according to the policy.

[0229] Based on the same inventive concept, an embodiment of the present invention also provides a target SEPP, a network element, a NF, and a computer-readable storage medium. Since the principles of solving the problems by these devices are similar to the data packet processing methods on the target SEPP, network element, and NF side, the implementation of these devices can refer to the implementation of the method, and the repeated parts will not be repeated.

[0230] When implementing the technical solution provided by the embodiment of the present invention, it can be implemented as follows.

[0231] Figure 5 The following is a schematic diagram of the network element structure. As shown in the figure, the network element includes:

[0232] The processor 500 is used to read the program in the memory 520 and execute the following process:

[0233] Receive a data packet and / or a processing result of the data packet, wherein the data packet is sent by the network function entity NF in the source network, and is forwarded to the NF belonging to the target network after the target SEPP verifies and labels the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result;

[0234] Performing a trust level evaluation on the source network according to the data packet and / or a result of processing the data packet;

[0235] The transceiver 510 is configured to receive and send data under the control of the processor 500 .

[0236] In implementation, the network element is NWDAF.

[0237] In implementation, when the trust level of the source network is evaluated based on the data packet and / or the processing result of the data packet, whether it is an abnormal data packet is determined in one of the following ways or a combination thereof:

[0238] Determine based on the processing result of NF Producer;

[0239] When data packets flow in the network, they are acquired by specific security equipment and subjected to security analysis and judgment results;

[0240] NF Producer sends the data packet to NWDAF for security analysis and decision making;

[0241] The results are determined through audit channels.

[0242] In implementation, when the trust level of the source network is evaluated based on the data packet and / or the result of processing the data packet, a zero-trust dynamic evaluation is performed based on one or a combination of the following factors:

[0243] Whether it is an abnormal data packet;

[0244] The frequency of abnormal data packets;

[0245] According to the degree of harm caused by abnormal data packets;

[0246] The network function service type accessed by the abnormal data packet.

[0247] During implementation, when the network element is not NWDAF, the method further includes:

[0248] Send zero-trust dynamic assessment results to NWDAF to generate security policies.

[0249] During implementation, it further includes:

[0250] The network element manages the trust authority of the SEEP of the source network based on the evaluation results.

[0251] During implementation, it further includes:

[0252] Generate a security policy based on the trust level evaluation result and send the security policy to the target SEPP.

[0253] In practice, the security policy includes one or a combination of the following:

[0254] Permanently reject packets from the source network;

[0255] Reject packets from the source network for a period of time;

[0256] Deny data packets from the source network access to one or several network function services;

[0257] Allow packets from the source network;

[0258] Recovery allows packets from the source network.

[0259] Among them, Figure 5 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 500 and memory represented by memory 520. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 510 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 500 is responsible for managing the bus architecture and general processing, and the memory 520 may store data used by the processor 500 when performing operations.

[0260] An embodiment of the present invention further provides a network element, including:

[0261] A network element receiving module is used to receive a data packet and / or a processing result of the data packet. The data packet is sent by a network function entity NF in a source network and forwarded to a NF belonging to a target network after the target SEPP verifies and labels the data packet. The information carried in the label can associate the data packet with the source network and instruct the network element that processes the data packet to feedback the data packet and its processing result.

[0262] The network element evaluation module is used to evaluate the trust level of the source network according to the data packet and / or the processing result of the data packet.

[0263] In implementation, the network element is NWDAF.

[0264] In implementation, the network element evaluation module is further used to determine whether it is an abnormal data packet in one of the following ways or a combination thereof when evaluating the trust level of the source network according to the data packet and / or the processing result of the data packet:

[0265] Determine based on the processing result of NF Producer;

[0266] When data packets flow in the network, they are acquired by specific security equipment and subjected to security analysis and judgment results;

[0267] NF Producer sends the data packet to NWDAF for security analysis and decision making;

[0268] The results are determined through audit channels.

[0269] In implementation, the network element evaluation module is further used to perform a zero-trust dynamic evaluation based on one or a combination of the following factors when evaluating the trust level of the source network based on the data packet and / or the processing result of the data packet:

[0270] Whether it is an abnormal data packet;

[0271] The frequency of abnormal data packets;

[0272] According to the degree of harm caused by abnormal data packets;

[0273] The network function service type accessed by the abnormal data packet.

[0274] In implementation, the network element evaluation module is further used to, when the network element is not a NWDAF, further include:

[0275] Send zero-trust dynamic assessment results to NWDAF to generate security policies.

[0276] During implementation, the network element evaluation module is further used to perform trust authority management on the SEEP of the source network according to the evaluation results.

[0277] During implementation, it further includes:

[0278] The network element policy module is used to generate a security policy based on the trust level evaluation result and send the security policy to the target SEPP.

[0279] In implementation, the network element policy module is further used to generate a security policy including one or a combination of the following:

[0280] Permanently reject packets from the source network;

[0281] Reject packets from the source network for a period of time;

[0282] Deny data packets from the source network access to one or several network function services;

[0283] Allow packets from the source network;

[0284] Recovery allows packets from the source network.

[0285] For the convenience of description, the various parts of the above-mentioned device are divided into various modules or units according to their functions and described separately. Of course, when implementing the present invention, the functions of each module or unit can be implemented in the same or multiple software or hardware.

[0286] Figure 6 The following is a schematic diagram of the SEPP structure. As shown in the figure, SEPP includes:

[0287] The processor 600 is used to read the program in the memory 620 and execute the following process:

[0288] Receive data packets sent by NF in the source network;

[0289] Labeling the data packet, wherein the information carried in the label can associate the data packet with the source network, and instruct the network element processing the data packet to feed back the data packet and the processing result thereof;

[0290] Send the data packet to the NF for processing;

[0291] The transceiver 610 is configured to receive and send data under the control of the processor 600 .

[0292] In implementation, the received security policy is sent by NWDAF.

[0293] In implementation, before labeling the data packet, the method further includes:

[0294] Verifying the data packet, wherein the verification is used to ensure whether the data packet comes from a source network;

[0295] After verification, the data packet is labeled.

[0296] Among them, Figure 6In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 600 and memory represented by memory 620. The bus architecture may also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 610 may be a plurality of components, i.e., including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 600 is responsible for managing the bus architecture and general processing, and the memory 620 may store data used by the processor 600 when performing operations.

[0297] An embodiment of the present invention further provides a SEPP, including:

[0298] The target SEPP receiving module is used to receive the data packets sent by the NF in the source network;

[0299] A target SEPP label module is used to label the data packet, label the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result;

[0300] The target SEPP sending module is used to send the data packet to the processing.

[0301] During implementation, the target SEPP policy module is further used to receive the security policy sent by the NWDAF.

[0302] During implementation, it further includes:

[0303] The target SEPP verification module is used to verify the data packet before labeling the data packet, and the verification is used to ensure whether the data packet comes from the source network; after the verification is passed, the data packet is labeled.

[0304] For the convenience of description, the various parts of the above-mentioned device are divided into various modules or units according to their functions and described separately. Of course, when implementing the present invention, the functions of each module or unit can be implemented in the same or multiple software or hardware.

[0305] Figure 7 This is a schematic diagram of the NF producer structure. As shown in the figure, the NF producer includes:

[0306] The processor 700 is used to read the program in the memory 720 and execute the following process:

[0307] Receive a data packet with a label sent by a target SEPP, wherein the information carried in the label can associate the data packet with a source network, and instruct a network element that processes the data packet to feed back the data packet and its processing result;

[0308] Processing data packets;

[0309] Sending the data packet and / or the processing result of the data packet to the network element according to the data packet label indication, so that the network element can evaluate the trust level;

[0310] The transceiver 710 is configured to receive and send data under the control of the processor 700 .

[0311] In implementation, the data packet is sent by a network function entity NF in a source network, and is forwarded to a NF in a target network after the target SEPP verifies and labels the data packet.

[0312] In implementation, the network element is NWDAF.

[0313] Among them, Figure 7 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 700 and memory represented by memory 720. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 710 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium. The processor 700 is responsible for managing the bus architecture and general processing, and the memory 720 may store data used by the processor 700 when performing operations.

[0314] An embodiment of the present invention further provides a NF, including:

[0315] NF receiving module, used to receive a data packet with a label sent by the target SEPP, the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result;

[0316] NF processing module, used to process data packets;

[0317] The NF sending module is used to send the data packet and / or the processing result of the data packet to the network element according to the data packet label indication, so that the network element can evaluate the trust level.

[0318] In implementation, the NF receiving module is further used to receive a data packet sent by a network function entity NF in a source network, and forwarded to a NF belonging to a target network after the target SEPP verifies and labels the data packet.

[0319] During implementation, the NF sending module is further used to send the processing result to the NWDAF of the network element.

[0320] For the convenience of description, the various parts of the above-mentioned device are divided into various modules or units according to their functions and described separately. Of course, when implementing the present invention, the functions of each module or unit can be implemented in the same or multiple software or hardware.

[0321] A computer-readable storage medium is also provided in an embodiment of the present invention, wherein the computer-readable storage medium stores a computer program for executing the above-mentioned data packet processing method.

[0322] For specific implementation, reference may be made to the implementation of the data packet processing method on one of the target SEPP, network element, NF side, or a combination thereof.

[0323] In summary, the technical solution provided by the embodiment of the present invention provides a solution for marking data packets, a solution for dynamically evaluating data packets, and a solution for updating and executing policies after evaluation.

[0324] Specifically, the network elements are set up to continuously evaluate the messages received by SEPP and dynamically evaluate the security of vSEPP.

[0325] The message received by SEPP and forwarded to the internal NF is marked with a label indicating that feedback is required, and a response feedback mechanism is established, that is, each NF needs to feedback the received message and its processing result. The network element that tracks the message and processes the feedback information can be NWDAF or a new network element. According to the received feedback information, the credit level of vSEPP can be dynamically evaluated through data analysis, and its trust authority can be dynamically managed.

[0326] This solution can enable the target network to dynamically evaluate the trustworthiness of the source network and implement dynamic policies on the messages of the source network according to the actual situation of the source network.

[0327] No trust relationship is required between the source and destination networks.

[0328] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0329] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0330] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0331] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0332] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A trust assessment method, characterized in that: include: The network element receives a data packet sent by the NF of the target network and a processing result of the data packet. The data packet is sent by the network function entity NF in the source network, and is forwarded to the NF belonging to the target network after the target security edge protection agent SEPP of the target network verifies and labels the data packet. The information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result; The network element performs a trust evaluation on the source network according to the data packet and the processing result of the data packet to obtain a trust evaluation result, and the trust evaluation result is used to generate a security policy for the target SEPP; The network element sends the security policy to the target SEPP; Further including: The network element performs trust authority management on the SEEP of the source network according to the trust level evaluation result; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

2. The method according to claim 1, characterized in that The network element is the network data analysis function NWDAF.

3. The method according to claim 1, characterized in that When the network element evaluates the trust level of the source network according to the data packet and the processing result of the data packet, it determines whether it is an abnormal data packet in one of the following ways or a combination thereof: Determine based on the processing result of the network function entity service provider NF Producer; When data packets flow in the network, they are acquired by specific security equipment and subjected to security analysis and judgment results; NF Producer sends the data packet to NWDAF for security analysis and decision making; The results are determined through audit channels.

4. The method according to claim 3, characterized in that When the network element evaluates the trust level of the source network according to the data packet and the processing result of the data packet, the zero-trust dynamic evaluation is performed according to one or a combination of the following factors: Whether it is an abnormal data packet; The frequency of abnormal data packets; According to the degree of harm caused by abnormal data packets; The network function service type accessed by the abnormal data packet.

5. The method according to claim 4, characterized in that When the network element is not NWDAF, it further includes: Send zero-trust dynamic assessment results to NWDAF to generate security policies.

6. A data packet processing method, characterized in that: include: The target SEPP in the target network receives the data packet sent by the NF in the source network; The target SEPP labels the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feed back the data packet and its processing result; The target SEPP sends the data packet to the NF of the target network for processing; Further including: The target SEPP receives the security policy sent by the network element and executes the security policy, wherein the security policy is generated by the network element based on the trust evaluation result, the trust evaluation result is obtained by the network element performing a trust evaluation on the source network according to the data packet and the result of processing the data packet, and the trust evaluation result is also used by the network element to perform trust authority management on the SEEP of the source network; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

7. The method according to claim 6, characterized in that The security policy received by the target SEPP is sent by the NWDAF.

8. The method according to claim 6, characterized in that Before labeling the data packet, the following steps are further performed: The target SEPP verifies the data packet, and the verification is used to ensure whether the data packet comes from the source network; After verification, the target SEPP labels the data packet.

9. A data packet processing method, characterized in that: include: The NF receives a data packet with a label sent by a target SEPP of a target network. The information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result. The NF belongs to the target network. The data packet is sent by a network function entity NF in the source network and forwarded to the NF belonging to the target network after the target SEPP verifies and labels the data packet. NF processes the data packet; The NF sends the data packet and the processing result of the data packet to the network element according to the data packet label indication, so that the network element can perform a trust evaluation on the source network to obtain a trust evaluation result, and the trust evaluation result is used to generate the security policy of the target SEPP. The trust evaluation result is also used by the network element to perform trust authority management on the SEEP of the source network; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

10. The method according to claim 9, characterized in that The network element is NWDAF.

11. A network element, characterized in that: include: The processor reads the program in the memory and performs the following processes: Receive a data packet sent by the NF of the target network and the processing result of the data packet. The data packet is sent by the network function entity NF in the source network, and is forwarded to the NF belonging to the target network after the target SEPP of the target network verifies and labels the data packet. The information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result; Performing a trust evaluation on the source network according to the data packet and the result of processing the data packet to obtain a trust evaluation result, wherein the trust evaluation result is used to generate a security policy for the target SEPP; Sending the security policy to the target SEPP; Perform trust authority management on the SEEP of the source network according to the trust level evaluation result; a transceiver for receiving and transmitting data under the control of the processor; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

12. A network element, characterized in that: include: A network element receiving module is used to receive a data packet and / or a processing result of the data packet. The data packet is sent by a network function entity NF in a source network and forwarded to a NF belonging to a target network after the target SEPP verifies and labels the data packet. The information carried in the label can associate the data packet with the source network and instruct the network element that processes the data packet to feedback the data packet and its processing result. A network element evaluation module, used to evaluate the trust level of the source network according to the data packet and the processing result of the data packet, and obtain a trust level evaluation result, wherein the trust level evaluation result is used to generate a security policy of the target SEPP; A network element policy module, used for sending the security policy to the target SEPP; The network element evaluation module is further used to perform trust authority management on the SEEP of the source network according to the trust level evaluation result; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

13. A SEPP, characterized in that: include: The processor reads the program in the memory and performs the following processes: Receive data packets sent by NF in the source network; Labeling the data packet, wherein the information carried in the label can associate the data packet with the source network, and instruct the network element processing the data packet to feed back the data packet and the processing result thereof; Send the data packet to the NF of the target network for processing; receiving a security policy sent by a network element and executing the security policy, wherein the security policy is generated by the network element based on a trust evaluation result, wherein the trust evaluation result is obtained by the network element performing a trust evaluation on a source network according to the data packet and a result of processing the data packet, and the trust evaluation result is also used by the network element to perform trust authority management on a SEEP of the source network; a transceiver for receiving and transmitting data under the control of the processor; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

14. A SEPP, characterized in that include: The target SEPP receiving module is used to receive the data packets sent by the NF in the source network; A target SEPP label module is used to label the data packet, label the data packet, and the information carried in the label can associate the data packet with the source network, and instruct the network element that processes the data packet to feedback the data packet and its processing result; The target SEPP sending module is used to send the data packet to the NF of the target network for processing; The target SEPP receiving module is further used to receive a security policy sent by a network element and execute the security policy, wherein the security policy is generated by the network element based on a trust evaluation result, wherein the trust evaluation result is obtained by the network element performing a trust evaluation on the source network according to the data packet and a result of processing the data packet, and the trust evaluation result is also used by the network element to perform trust authority management on the SEEP of the source network; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

15. A NF, characterized in that: include: The processor reads the program in the memory and performs the following processes: Receive a data packet with a label sent by a target SEPP of a target network, wherein the information carried in the label can associate the data packet with a source network, and instruct the network element processing the data packet to feedback the data packet and its processing result, wherein the NF belongs to the target network, and the data packet is sent by a network function entity NF in the source network, and is forwarded to the NF belonging to the target network after the target SEPP verifies and labels the data packet; Processing data packets; Sending the data packet and the processing result of the data packet to the network element according to the data packet label indication, so that the network element can perform a trust evaluation on the source network to obtain a trust evaluation result, the trust evaluation result is used to generate the security policy of the target SEPP, and the trust evaluation result is also used by the network element to perform trust authority management on the SEEP of the source network; a transceiver for receiving and transmitting data under the control of the processor; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

16. A NF, characterized in that: include: The NF receiving module is used to receive a data packet with a label sent by a target SEPP of a target network, wherein the information carried in the label can associate the data packet with a source network, and instruct the network element processing the data packet to feedback the data packet and its processing result, wherein the NF belongs to the target network, and the data packet is sent by a network function entity NF in the source network, and is forwarded to the NF belonging to the target network after the target SEPP verifies and labels the data packet; NF processing module, used to process data packets; The NF sending module is used to send the data packet and the processing result of the data packet to the network element according to the data packet label indication, so that the network element can perform a trust evaluation on the source network to obtain a trust evaluation result, and the trust evaluation result is used to generate the security policy of the target SEPP. The trust evaluation result is also used by the network element to perform trust authority management on the SEEP of the source network; The security policy includes one or a combination of the following: Permanently reject packets from the source network; Reject packets from the source network for a period of time; Deny data packets from the source network access to one or several network function services; Allow packets from the source network; Recovery allows packets from the source network.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 10.

Images