Method and device for determining category information

Abstract

The present application provides a method and device for determining category information. The method includes: a core network element obtains information of a terminal; the core network element determines the category information of the terminal based on the information of the terminal. Based on this solution, the core network element assigns categories to the terminal, and the categories are assigned to the terminal based on the information of the terminal, so the classification method is more flexible. Compared with the classification method in the background technology in which the classification is performed according to the urgency of the service and the classification results are pre-written into the SIM card, the classification method of the present application is more flexible.

Description

[0001] This application is a divisional application. The application number of the original application is 201811302764.0, and the original application date is November 02, 2018. The entire content of the original application is incorporated into this application by reference. Technical Field

[0002] The present application relates to the field of mobile communication technology, and in particular to a method and device for determining category information. Background Art

[0003] In some business scenarios, some terminals are usually simple to implement and have poor security protection, making them easy to be attacked by attackers and become devices controlled by attackers. An example of an attack is that attackers can use virus software to quickly control a large number of terminals to form a botnet controlled by themselves. When the scale reaches a certain value, attackers can control these terminals to initiate a large number of connections to a server at the same time, causing the server to be overwhelmed and crash, resulting in a distributed denial of service (DDoS) attack.

[0004] At present, one method of controlling terminal attacks is that the base station controls the access of the terminal according to the granularity of the terminal's service urgency, that is, the access class (AC) is pre-written in the terminal's Subscriber Identity Module (SIM) card, and different ACs represent different service urgency. When the base station is overloaded due to an attack, it sends a broadcast data packet to restrict the access of the terminal. After receiving the broadcast data packet, the terminal determines whether it needs to restrict its access to the base station based on the AC in the SIM card, thereby controlling the access of the terminal.

[0005] The above method has the following defects: 1) the AC of the terminal is pre-written into the SIM card, so it is not flexible enough; 2) the AC can only reflect the service urgency of the terminal, so the classification method of the terminal is not flexible enough. Summary of the invention

[0006] The present application provides a method for determining category information, a method and an apparatus for controlling terminal access, so as to flexibly classify terminals and control access to terminals based on the classification.

[0007] In a first aspect, the present application provides a method for determining category information, the method comprising: for N terminals accessing a network, a core network element obtains information of the N terminals; for each of the N terminals, the core network element determines the category information of the terminal according to the information of the terminal. The information of the terminal includes part or all of the following information:

[0008] Function information of the terminal, which is used to indicate the capability information of the terminal;

[0009] User information of the terminal, where the user information is used to indicate the owner information of the terminal;

[0010] Device information of the terminal, which is used to indicate the manufacturing information of the terminal;

[0011] The location information of the terminal is used to indicate the location of the terminal.

[0012] Based on this solution, the core network element assigns categories to the terminal, and the categories are assigned to the terminal based on the terminal information, so the classification method is more flexible. Compared with the classification method in the background technology that classifies according to the urgency of the service and the classification results are pre-written into the SIM card, the classification method of this application is more flexible.

[0013] In one possible implementation, the functional information of the terminal includes network capabilities, mobile station network capabilities, mobile station category mask 2, mobile station category mask 3, supported encodings, added update categories, voice domain preferences, terminal usage settings, terminal device performance, and some or all parameters in the mobile station supported network features; the user information of the terminal includes some or all parameters in the group identifier, administrator identifier, and company identifier; and the device information of the terminal includes some or all parameters in the category allocation number of the terminal's device identification code and the software version number.

[0014] In one possible implementation, the core network network element determines the category information of the terminal based on the information of the terminal, including: the core network network element determines the first category in the category information of the terminal based on the location information of the terminal; the core network network element determines the second category in the category information of the terminal based on part or all of the function information, user information or device information of the terminal.

[0015] In a possible implementation manner, if the location information of the terminal is updated, the core network element updates the first category in the category information of the terminal according to the updated location information.

[0016] In one possible implementation, a core network element sends category information of a terminal to a communication device, where the communication device includes some or all of the following devices: a terminal, an access network device, a mobility management element, a session management element, a policy control element, and a user plane element.

[0017] In a possible implementation manner, a core network element receives indication information, where the indication information is used to indicate the determination of category information of the terminal.

[0018] In a possible implementation manner, the core network element is a mobility management network element or a policy control network element.

[0019] In a possible implementation manner, the core network element is a policy control network element;

[0020] For each terminal among the N terminals, the policy control network element stores a correspondence between the category information of the terminal and the identifier of the terminal.

[0021] In the second aspect, the present application provides a method for controlling terminal access, the method comprising: a policy control network element receives an identity list of abnormal terminals from a security detection network element, the identity list is used to indicate one or more abnormal terminals; the policy control network element determines abnormal category information according to a local policy, the identity list, and a correspondence between the category information of the terminal and the identifier of the terminal; the policy control network element sends the abnormal category information. Based on this scheme, the control of the terminal can be implemented based on the abnormal category information, thereby realizing the control of the terminal access according to the granularity of the category information, realizing the function of controlling the access of multiple terminals at one time, and reducing the control signaling.

[0022] In a possible implementation manner, the policy control network element determines the abnormal category information according to the local policy, the identity list, and the correspondence between the category information of the terminal and the identifier of the terminal, including:

[0023] The control policy network element determines the candidate abnormal category information corresponding to the identity list according to the correspondence between the category information of the terminal and the identifier of the terminal, wherein the terminals with the same category information in the identity list correspond to the same candidate abnormal category information;

[0024] For each candidate abnormal category information, if the ratio of the number of terminals belonging to the candidate abnormal category information in the identity list to the number of all terminals corresponding to the candidate abnormal category information is greater than a preset ratio threshold, the candidate abnormal category information is determined to be abnormal category information; or,

[0025] For each candidate abnormal category information, if the number of terminals in the identity list belonging to the candidate abnormal category information is greater than a preset number threshold, the candidate abnormal category information is determined to be abnormal category information.

[0026] In a possible implementation manner, the policy control network element sending the category information includes: the policy control network element sending abnormal category information to the access network device.

[0027] In another possible implementation, the policy control network element sends exception category information, including: the policy control network element sends the exception category information to the user plane network element; the policy control network element also sends flow matching information and a flow processing method to the user plane network element, the flow matching information is used to match the user plane traffic, and the flow processing method is used to control the user plane traffic matching the flow matching information sent by the terminal matching the exception category information.

[0028] In a third aspect, the present application provides a method for controlling terminal access, the method comprising: a security detection network element determines abnormal category information according to the flow data of the terminal; and the security detection network element sends the abnormal category information. Based on this scheme, the terminal can be controlled based on the abnormal category information, thereby realizing the control of the terminal access according to the granularity of the category information, realizing the function of controlling the access of multiple terminals at one time, and reducing the control signaling.

[0029] In a possible implementation, before the security detection network element determines the abnormal category information based on the traffic data of the terminal, it also includes: the security detection network element sends a data collection service request message to the network device, the data collection service request message includes a data collection unit and a data collection range, the data collection unit is used to indicate the format of the reported data, and the data collection range is used to indicate the collection according to the category information of the terminal; the security detection network element receives the data collection service response message sent by the network device, the data collection service response message includes the category information and the traffic data corresponding to the category information, and the traffic data of the terminal indicated by the category information meets the reporting conditions.

[0030] In a possible implementation, the data collection service request message further includes a reporting condition, where the reporting condition is used to indicate a condition for triggering reporting of traffic data.

[0031] In a possible implementation manner, the network device includes part or all of the following devices: a mobility management network element, a session management network element, a policy control network element, and a user plane network element.

[0032] In a possible implementation, the security detection network element determines abnormal category information according to the traffic data of the terminal, including: the security detection network element detects the traffic data corresponding to the category information according to a security detection algorithm to determine the abnormal category information.

[0033] In a fourth aspect, the present application provides a method for controlling terminal access, the method comprising: a user plane network element receives abnormal category information, flow matching information, and a flow processing method; if the user plane traffic matches the flow matching information, and the terminal sending the user plane traffic matches the abnormal category information, the user plane network element performs control of the user plane traffic according to the flow processing method. Based on this scheme, the control of the terminal can be implemented based on the abnormal category information, thereby realizing the control of the terminal access according to the category information granularity, realizing the function of controlling the access of multiple terminals at one time, and reducing the control signaling.

[0034] In one possible implementation, the user plane network element performs control on the user plane traffic according to the flow processing method, including: if the flow processing method includes a discard operation, the user plane network element discards the user plane traffic; or if the flow processing method includes a service quality modification operation, the user plane network element modifies the service quality of the user plane traffic.

[0035] In a fifth aspect, the present application provides a method for controlling terminal access, the method comprising: an access network device receives abnormal category information from a core network element; the access network device sends a broadcast data packet, the broadcast data packet includes abnormal category information, and the broadcast data packet is used to restrict the access of terminals matching the abnormal category information. Based on this scheme, the control of the terminal can be implemented based on the abnormal category information, thereby realizing the control of the terminal access according to the granularity of the category information, realizing the function of controlling the access of multiple terminals at one time, and reducing the control signaling.

[0036] In a possible implementation, before the access network device sends the broadcast data packet, the method further includes: the access network device receives a restriction indication, where the restriction indication is used to indicate that access is restricted to terminals matching the abnormal category information according to the restriction indication.

[0037] In a possible implementation, after the access network device receives the abnormal category information, the method further includes: the access network device starts a timer. The access network device sends a broadcast data packet, including: if the timer has not timed out, the access network device sends the broadcast data packet.

[0038] In a sixth aspect, the present application provides a method for controlling terminal access, the method comprising: the terminal receives a broadcast data packet from an access network device, the broadcast data packet includes abnormal category information; if the category information of the terminal matches the received abnormal category information, the terminal restricts the access of the terminal, wherein the category information of the terminal is received by the terminal from a core network element. Based on this scheme, the control of the terminal can be implemented based on the abnormal category information, thereby realizing the control of the terminal access according to the granularity of the category information, realizing the function of controlling the access of multiple terminals at one time, and reducing the control signaling.

[0039] In a possible implementation manner, the terminal further receives category information of the terminal from a core network element, where the category information of the terminal is generated according to information of the terminal, and the information of the terminal includes part or all of the following information:

[0040] Function information of the terminal, where the function information is used to indicate capability information of the terminal;

[0041] User information of the terminal, where the user information is used to indicate information of the owner of the terminal;

[0042] Device information of the terminal, where the device information is used to indicate manufacturing information of the terminal;

[0043] The location information of the terminal, where the location information is used to indicate the location of the terminal.

[0044] In a possible implementation manner, the terminal may also release the connection with the access network device.

[0045] In a seventh aspect, the present application provides a device, which may be an access network device, a terminal device, a security function network element, or a chip. The device has the function of implementing the embodiments of any one of the first aspect, the second aspect, the third aspect, or the fourth aspect. The function may be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0046] In an eighth aspect, a device is provided, comprising: a processor and a memory; the memory is used to store computer-executable instructions, and when the device is running, the processor executes the computer-executable instructions stored in the memory to enable the device to perform the method for determining category information as described in the first aspect or any one of the first aspects, or to enable the device to perform the method for controlling terminal access as described in the second aspect or any one of the second aspects, or to enable the device to perform the method for controlling terminal access as described in the third aspect or any one of the third aspects, or to enable the device to perform the method for controlling terminal access as described in the fourth aspect or any one of the fourth aspects, or to enable the device to perform the method for controlling terminal access as described in the fifth aspect or any one of the fifth aspects, or to enable the device to perform the method for controlling terminal access as described in the sixth aspect or any one of the sixth aspects.

[0047] In a ninth aspect, the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the methods described in the above aspects.

[0048] In a tenth aspect, the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the methods described in the above aspects.

[0049] In the eleventh aspect, the present application further provides a system, which includes the policy control network element in the second aspect or any embodiment of the second aspect, the security detection network element in the third aspect or any embodiment of the third aspect, and the user plane network element in the fourth aspect or any embodiment of the fourth aspect. Further, the system may also include the terminal in the sixth aspect or any embodiment of the sixth aspect.

[0050] In a twelfth aspect, the present application further provides a system, the system comprising the security detection network element in the third aspect or any embodiment of the third aspect and the access network device in the fifth aspect or any embodiment of the fifth aspect. Further, the system may also include the terminal in the sixth aspect or any embodiment of the sixth aspect.

[0051] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A possible network architecture diagram provided for this application;

[0053] Figure 2 A flow chart of a method for controlling UE access in the prior art;

[0054] Figure 3 This is a flow chart of another method for controlling UE access in the prior art;

[0055] Figure 4 A flow chart of a method for determining category information of a UE provided in this application;

[0056] Figure 5 A flow chart of a method for determining category information of another UE provided in the present application;

[0057] Figure 6 A flow chart of a method for determining category information of another UE provided in the present application;

[0058] Figure 7 A flow chart of a method for determining category information of another UE provided in the present application;

[0059] Figure 8 A flow chart of a method for sending UE category information provided in this application;

[0060] Fig. 9 A flow chart of a method for updating UE category information provided in this application;

[0061] Fig.10 A flow chart of a method for collecting traffic of network devices provided by the present application;

[0062] Fig.11 A flow chart of a method for controlling UE access provided in this application;

[0063] Fig.12 A flowchart of another method for controlling UE access provided by the present application;

[0064] Fig.13 A schematic diagram of a device provided for this application;

[0065] Fig.14 A schematic diagram of another device provided for this application. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. The specific operation method in the method embodiment can also be applied to the device embodiment or the system embodiment. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more.

[0067] The network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0068] like Figure 1 As shown, a possible network architecture diagram applicable to the present application is shown. The network architecture includes access network equipment and core network elements. Optionally, the network architecture also includes security function network elements. Among them, the access network equipment can communicate with the terminal via wired or wireless means. The terminal can communicate with the core network element via non-access stratum (NAS) messages, for example, via the N1 interface.

[0069] The core network elements may include some or all of the mobility management network elements, session management network elements, policy control network elements, user plane network elements, and data management network elements.

[0070] In the present application, the core network element may classify the terminal according to the information of the terminal, for example, the mobility management element may classify the terminal, or the policy control element may classify the terminal, or the mobility management element and the policy control element may classify the terminal.

[0071] In this application, a terminal is a device with wireless transceiver function, and the terminal can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; it can also be deployed on the water surface (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons and satellites, etc.). The terminal can be a mobile phone, a tablet computer (pad), a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, and can also include user equipment (UE), etc. The terminal may also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a handheld device with wireless communication function, a computing device or other processing device connected to a wireless modem, a vehicle-mounted device, a wearable device, a terminal device in the future fifth generation (5G) network, or a terminal device in the future evolved public land mobile communication network (PLMN), etc. The terminal may also be sometimes referred to as a terminal device, a user equipment (UE), an access terminal device, a vehicle-mounted terminal, an industrial control terminal, a UE unit, a UE station, a mobile station, a mobile station, a remote station, a remote terminal device, a mobile device, a UE terminal device, a terminal device, a wireless communication device, a UE agent or a UE device, etc. The terminal may also be fixed or mobile. The embodiments of the present application are not limited to this.

[0072] Access network equipment, also known as radio access network (RAN) equipment, is a device that provides wireless communication functions for terminals. Access network equipment includes, but is not limited to: next-generation base stations (gnodeB, gNB) in 5G, evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B (node ​​B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or homenode B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmission point (transmitting point, TP), mobile switching center, etc. The access network device may also be a wireless controller, a centralized unit (CU), and / or a distributed unit (DU) in a cloud radio access network (CRAN) scenario, or the network device may be a relay station, an access point, an on-board device, a wearable device, a network device in a future 5G network, or a network device in a future evolved PLMN network. The terminal may communicate with multiple access network devices of different technologies. For example, the terminal may communicate with an access network device supporting a long term evolution (LTE) network, or with an access network device supporting a 5G network, and may also support dual connections with an access network device of an LTE network and an access network device of a 5G network. The embodiments of the present application are not limited thereto.

[0073] The user plane network element is mainly responsible for processing user messages, such as forwarding, billing, legal monitoring, etc. In a 5G network, the user plane network element may be a user plane function (UPF) network element. In future communications such as the 6th generation (6G) network, the user plane network element may still be a UPF network element, or have other names, which are not limited in this application.

[0074] The session management network element is mainly used for session management in mobile networks, such as session creation, modification, and release. Specific functions include allocating Internet Protocol (IP) addresses to users and selecting user-side network elements that provide message forwarding functions. In 5G networks, the session management network element can be a session management function (SMF) network element. In future communications such as 6G networks, the session management network element can still be an SMF network element, or have other names, which are not limited in this application.

[0075] The mobility management network element is mainly used for the registration, mobility management, and tracking area update processes of terminals in the mobile network. The mobility management network element terminates the NAS message, completes registration management, connection management, and reachability management, allocates the tracking area list (TA list) and mobility management, and transparently routes the session management (SM) message to the session management network element. In the 5G network, the mobility management network element may be an access and mobility management function (AMF) network element. In future communications such as 6G networks, the mobility management network element may still be an AMF network element, or have other names, which is not limited in this application.

[0076] The data management network element is mainly responsible for managing the contract data and notifying the corresponding network element when the contract data is modified. In 5G, the data management network element can be a unified data management (UDM) network element. In future communications such as 6G, the data management network element can still be a UDM network element or have other names, which are not limited in this application.

[0077] The policy control network element includes user subscription information management function, policy control function, charging policy control function, quality of service (QoS) control, etc. In a 5G network, the policy control network element may be a policy control function (PCF) network element. In future communications such as 6G networks, the policy control network element may still be a PCF network element, or have other names, which are not limited in this application.

[0078] The security detection network element in this application has security functions, and can analyze the traffic data of the terminal to find malicious traffic, that is, to find terminals with abnormal behavior. In a specific implementation, in 5G, the security detection network element can be called a security detection function (Security Detection Function, SEDF) network element, or have other names. In a specific implementation, the security detection network element can be a separate network element, or integrated into a network data analysis function (NetWork Data Analysis Function, NWDAF) entity, or integrated into an operation, administration and maintenance (Operation, Administration and Maintenance, OAM) entity, or integrated into an application function (Application Function, AF) entity. Among them, the OAM entity can also be called a network management system, which is used to provide a set of network management functions, including fault monitoring, fault reporting, fault location, and fault repair. The NWDAF entity is used to provide big data analysis services. The entity can collect data from the 3rd generation partnership project (3GPP) network and perform big data analysis to provide better strategies. The AF entity is used to provide application services, which can be provided by a third party or an operator.

[0079] It is understandable that the above functions can be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform).

[0080] For the convenience of explanation, this application will be described later by taking the terminal as UE, the access network device as base station, the user plane network element as UPF network element, the session management network element as SMF network element, the mobility management network element as AMF network element, the policy control network element as PCF network element, the data management network element as UDM network element, and the security detection network element as SEDF network element as an example. Further, the UPF network element is referred to as UPF, the session management network element is referred to as SMF, the AMF network element is referred to as AMF, the PCF network element is referred to as PCF, the UDM network element is referred to as UDM, and the SEDF network element is referred to as SEDF. That is, the UPF described later in this application can be replaced with a user plane network element, the SMF can be replaced with a session management network element, the AMF can be replaced with a mobility management network element, the UDM can be replaced with a data management network element, the SEDF can be replaced with a security detection network element, the UE can be replaced with a terminal, and the base station can be replaced with an access network device. A unified description is given here, and no further details will be given later.

[0081] 5G is mainly aimed at three business scenarios: Enhanced Mobile Broadband (eMBB), Enhanced Machine Type Communication (eMTC) and Ultra-Reliable and Low-Latency Communication (URLLC). Among them, eMTC is mainly aimed at Internet of Things (IoT) devices, which are usually simple to implement, have poor security protection, and are easily attacked by attackers and become devices controlled by attackers.

[0082] An example of an attack is that attackers can use virus software to quickly control a large number of IoT devices to form a botnet controlled by themselves. When the scale reaches a certain value, the attacker can control these devices to initiate a large number of connections to a server at the same time, causing the server to be overwhelmed and crash, resulting in a DDoS attack.

[0083] Therefore, when a server is attacked by DDoS, it is necessary to control the terminal that initiates the attack to restrict the access of the terminal.

[0084] like Figure 2 As shown, a method for controlling UE access in the prior art is shown. The method includes the following steps:

[0085] Step 201: SEDF determines that there is a UE with abnormal behavior.

[0086] The UE with abnormal behavior here may be one or more UEs.

[0087] Step 202: SEDF sends a second identifier of the UE to the base station, where the second identifier is used to indicate a UE with abnormal behavior.

[0088] Step 203: Optionally, the base station releases the connection with the UE according to the second identifier.

[0089] Step 204: The first UE initiates a connection and carries a first identifier, where the first identifier is used to indicate the UE.

[0090] Step 205: The base station matches the first identifier with the second identifier.

[0091] If the first identifier and the second identifier match, the following steps 206 to 207 are continued to be executed.

[0092] Step 206: The base station restricts access of the first UE.

[0093] Since the first UE is a UE with abnormal behavior, the base station restricts access of the first UE.

[0094] Optionally, in step 206, the base station also sends a rejection reason to the first UE, for example, the rejection reason is a security reason.

[0095] Step 207: The first UE waits for a set period of time and then attempts to access again.

[0096] In this embodiment, access control is performed on UEs with abnormal behavior at the UE granularity. When a DDoS attack occurs, the number of UEs with abnormal behavior is large, for example, tens of thousands. Access of UEs at the UE granularity requires tens of thousands of signaling, resulting in a large signaling overhead.

[0097] like Figure 3 As shown, another method for controlling UE access provided by the prior art. This embodiment is applicable to overload control of a base station. When an overload occurs on a base station, the base station may trigger this process. The method includes the following steps:

[0098] Step 301: a base station is overloaded.

[0099] The reason why the base station is overloaded may be that there are too many UEs currently connected, or too many messages sent by the UEs, or the CPU of the base station is overloaded.

[0100] Step 302: The base station sends a broadcast data packet, which includes three parameters: ac-BarringFactor, ac-BarringTime, and ac-BarringForSpecialAC.

[0101] The ac-BarringFactor is a value between 0 and 1. Before each access attempt, the UE generates a random number between 0 and 1. If the generated random number is less than the ac-BarringFactor, the UE can access the network directly. Otherwise, the UE will not access the network and will wait for a period of time before trying again.

[0102] ac-BarringTime is used to indicate the access blocking time. When the UE decides not to access, it waits for the ac-BarringTime.

[0103] ac-BarringForSpecialAC is used to indicate one or more access classes (ACs). Access Class indicates the access class of the UE and is configured on the SIM card of the UE. There are 15 types of ACs, of which 0-9 are randomly assigned to normal UEs, 11 is used for public land mobile networks (PLMNs), 12 is for security services, 13 is for public equipment, 14 is for emergency services, and 15 is for PLMN employees. It can be seen that ACs 11-15 have a higher priority. Under normal circumstances, when AC Barring Check occurs, UEs 0-9 need to start AC Barring Check, and UEs 11-15 can connect normally. However, ac-BarringForSpecialAC can indicate ACs 11-15. When the parameter ac-BarringForSpecialAC exists, the UE of the indicated AC also needs to start AC Barring Check.

[0104] Step 303: After receiving the broadcast data packet, the UE determines a corresponding access mode according to the AC in the SIM card.

[0105] When the AC in the SIM card is 0-9, the UE directly performs AC Barring Check based on ac-BarringFactor and ac-BarringTime. When the AC in the SIM card is 11-15, the UE decides whether to perform AC Barring Check based on ac-BarringForSpecialAC.

[0106] Figure 3 The overload mechanism of the illustrated embodiment performs access control on the UE according to the granularity of the UE's service urgency (with AC indicating the service urgency). The defects of this method are: 1) the AC of the UE is pre-written into the SIM card, so it is not flexible enough; 2) the overload mechanism only acts on the UE attempting to connect, and cannot control the UE that has already been connected to the base station; 3) the overload mechanism is implemented spontaneously by the base station, but the detection mechanism is simple and cannot control some advanced attacks.

[0107] To solve Figure 2 and Figure 3 In order to solve the problem of controlling UE access in the embodiment of the present invention, the present application provides a method for determining UE category information and a method for controlling UE access. The following are respectively described.

[0108] like Figure 4 As shown, a method for determining category information of a UE provided by the present application can be used to classify the UE. The method includes the following steps:

[0109] Step 401: For N UEs accessing the network, a core network element obtains information of the N UEs, where N is a positive integer.

[0110] The core network element here may be, for example, AMF, PCF, or AMF and PCF.

[0111] The UE information here includes part or all of the following information:

[0112] (1) UE functional information, which is used to indicate the capability information of UE, and may indicate the functions supported by UE. For example, UE functional information may include some or all of the parameters such as UE Network Capability, MS Network Capability, Mobile Station Class Mask 2, Mobile Station Class Mask 3, Supported Codecs, Additional Update Type, Voice domain Preference and UE's usage setting, Device Properities, MS Network Feature Support, etc.

[0113] (2) User information of the UE. The user information is used to indicate the owner information of the UE. For example, the user information of the UE may include part or all of parameters such as a group ID, an administrator ID, and a company ID.

[0114] (3) UE equipment information. The equipment information is used to indicate the manufacturing information of the UE. For example, the UE equipment information may be the type allocation code (TAC) of the UE equipment identification code, the software version number (SV), etc.

[0115] (4) UE location information. The location information is used to indicate the location of the UE. For example, the UE location information may be the cell identifier, location area, etc., where the UE is currently located.

[0116] Step 402: For any UE among the N UEs, the core network element determines the category information of the UE according to the UE information.

[0117] It is necessary to explain that the core network element can determine which information of the UE and how to determine the category information to which the UE belongs according to the pre-set policy. The pre-set policy can also be adjusted by the operator as needed. For example, in the scenario of preventing potential attacks, when using the above UE information to classify the UE, the corresponding UE information can be selected to classify the UE according to different attack methods. Usually, the attacker attacks the UE in the following ways:

[0118] Attack method 1: Exploit application software / communication protocol / operating system / firmware vulnerabilities to attack.

[0119] According to the different locations of the vulnerabilities, the vulnerability types can be divided into application software, communication protocol and operating system vulnerabilities. For example, vulnerabilities caused by application software design defects are called application software vulnerabilities, such as the buffer overflow vulnerability in WeChat; vulnerabilities caused by communication protocol design defects are called communication protocol vulnerabilities, such as the Heartbleed vulnerability in the Transport Layer Security (TLS) protocol; vulnerabilities caused by operating system design defects are called operating system vulnerabilities, such as the buffer overflow vulnerability in Android; vulnerabilities caused by driver design defects are called firmware vulnerabilities. For this type of vulnerability, attackers can usually carefully construct attack data packets and send them to UEs with this type of vulnerability. Due to the vulnerability defects, attackers can gain control of the UE through the vulnerability.

[0120] Application software vulnerability attacks are usually related to the user information of the UE. For example, IoT devices have a single function and usually need to be pre-installed with a specific application software. This application software can be reflected by the user information of the UE. For example, the shared bicycles owned by Company A need to be pre-installed with the APP developed by Company A, and the shared bicycles owned by Company B need to be pre-installed with the APP developed by Company B. Once a vulnerability occurs in the APP of Company A, all shared bicycles owned by Company A may be at risk of security risks. The group ID or company ID of the UE can distinguish different companies. In this case, the classification information of the UE can be determined based on the user information of the UE.

[0121] Communication protocol vulnerability attacks are usually related to the functional information and / or device information of the UE. For example, the communication chip of the IoT device is determined when it leaves the factory, so the communication protocol can be reflected by the functional information and device information of the UE. For example, the chip of the electric meter produced by Company A implements communication protocol A, while the chip of the electric meter produced by Company B does not implement communication protocol A. If there is a vulnerability in communication protocol A, the electric meter produced by Company A that implements communication protocol A may have security risks. The Type Allocation Code (TAC) of the UE's International Mobile Equipment Identity (IMEI) / permanent equipment identifier (PEI) can reflect the manufacturer and device model of the UE, and the UE's capability information can reflect whether the UE implements the communication protocol with vulnerabilities. In this case, the classification information of the UE can be determined based on the functional information and / or device information of the UE.

[0122] Operating system vulnerability attacks are usually related to the UE's device information. For example, IoT devices are pre-installed with an operating system when they leave the factory, so the operating system can be reflected by the UE's device information. For example, medical devices produced by Company A are pre-installed with version A of the Android system, and those produced by Company B are pre-installed with version B of the Apple system. If version A of the Android system has vulnerabilities, then the medical devices produced by Company A with version A of the Android system pre-installed may pose security risks. The Type Allocation Code (TAC) of the UE's International Mobile Equipment Identity (IMEI) / permanent equipment identifier (PEI) can reflect the UE's manufacturer and device model, and the software version number (SV) can reflect the UE's operating system version number. In this case, the UE's classification information can be determined based on the UE's device information.

[0123] Firmware vulnerability attacks are usually related to the UE's device information. For example, IoT devices are pre-installed with drivers when they leave the factory, so the drivers can be reflected by the UE's device information. For example, medical devices produced by Company A are pre-installed with driver A, and medical devices produced by Company B are pre-installed with driver B. If driver A has a vulnerability, the medical device produced by Company A with driver A pre-installed may pose a security risk. The Type Allocation Code (TAC) of the UE's International Mobile Equipment Identity (IMEI) / permanent equipment identifier (PEI) can reflect the UE's manufacturer and device model. In this case, the UE's classification information can be determined based on the UE's device information.

[0124] Attack method 2: Exploiting management vulnerabilities: Factory devices usually have default usernames and passwords, for example, username admin, password admin. Administrators sometimes forget to change these default usernames and passwords, which can be easily exploited by attackers, posing management risks. Management vulnerability attacks are usually related to the UE's device information. The UE's manufacturer and device model can be reflected by the Type Allocation Code (TAC) of the UE's International Mobile Equipment Identity (IMEI) / permanent equipment identifier (PEI). In this case, the UE's classification information can be determined based on the UE's device information.

[0125] Attack method 3: Attack using physical methods: This type of attack requires the attacker to attack close to the terminal, such as side channel attacks, hardware attacks, etc. For example, the attacker can move to an area and attack all data collectors in the area to achieve the purpose of tampering with the collected data. Physical attack methods are usually related to the UE's location information, and the UE's location can be reflected through the UE's location identifier, such as CGI, TAI, etc. In this case, the UE's classification information can be determined based on the UE's location information.

[0126] Therefore, the embodiment of the present application selects the above-mentioned UE information to determine the category information of the UE, which can be associated with the attacker's attack method, thereby reflecting a class of terminals with the same potential attack, so that the beneficial effect of controlling the terminals by category can be implemented.

[0127] In one implementation, the core network element directly determines the category information of a UE based on the information of the UE, for example, based on part or all of the function information, user information, device information, and location information of the UE.

[0128] The following examples are provided for explanation. Take the example of determining the category information of the UE based on the user information of the UE and the device information of the UE. Specifically, take the example of the user information of the UE including the group identifier (group ID), and the device information of the UE including the TAC and SV. For example, when the user information of the UE indicates group ID 1, and the device information indicates TAC1 and SV1, the UE is assigned category 1, recorded as C1. When the user information of the UE indicates group ID 2, and the device information indicates TAC1 and SV2, the UE is assigned category 2, recorded as C2. When the user information of the UE indicates group ID1, and the device information indicates TAC3 and SV3, the UE is assigned category 3, recorded as C3. And so on.

[0129] For example, based on the above classification method, the UE is classified, and the classification information finally obtained may be, for example:

[0130] UE1: C1 (i.e., UE1 belongs to category 1);

[0131] UE2: C2 (i.e., UE2 belongs to category 2);

[0132] UE3: C2 (i.e., UE3 belongs to category 2);

[0133] UE4: C3 (UE4 belongs to category 3);

[0134] …

[0135] In the above classification method, the category information of the UE is determined based on all the information of the UE. If all the information of the two UEs belongs to the same category, the category information determined by the core network element for the two UEs is the same. However, if the information of any of the two UEs does not belong to the same category, the category information determined by the core network element for the two UEs is different.

[0136] In another implementation, the core network element determines the first category in the category information of the UE based on the dynamic information of the UE, and determines the second category in the category information of the UE based on the static information of the UE. The dynamic information of the UE represents the information of the UE that may change within the first preset time (generally a shorter time), such as the location information of the UE. The static information of the UE represents the information of the UE that does not change within the second preset time (generally a longer time), such as part or all of the functional information, user information or device information of the UE. The first category may also be referred to as dynamic category information, and the second category may also be referred to as static category information. The duration of the first preset time is less than or equal to the duration of the second preset time.

[0137] The following example illustrates this.

[0138] For the core network element to determine the first category in the category information of the UE according to the location information of the UE, since both the Tracking Area Identity (TAI) and the Cell Global Identification (CGI) can indicate the current location of the UE, the UE can be classified into the first category according to the TAI or CGI. For example, taking TAI as an example, when the UE is in TAI1, the first category 1 is assigned to the UE, which is recorded as C11. When the UE is in TAI2, the first category 2 is assigned to the UE, which is recorded as C12. When the UE is in TAI3 and TAI4, the first category 3 is assigned to the UE, which is recorded as C13. And so on. It should be noted that when the UE moves to a new TAI, such as when the UE moves from TAI1 to TAI2, the first category of the UE needs to be updated from C11 to C12. Of course, when the UE moves to a new TAI, it may not be necessary to update the first category. For example, when the UE moves from TAI3 to TAI4, the first category of the UE remains C13. For another example, taking CGI as an example, when the UE is in CGI1 and CGI4, the first category 1 is allocated to the UE, which is recorded as C11. When the UE is in CGI2, the first category 2 is allocated to the UE, which is recorded as C12. When the UE is in CGI3, the first category 3 is allocated to the UE, which is recorded as C13. And so on. It should be noted that when the UE moves to a new CGI, such as the UE moves from CGI1 to CGI2, the first category of the UE needs to be updated from C11 to C12. Of course, when the UE moves to a new CGI, it may not be necessary to update the first category. For example, if the UE moves from CGI1 to CGI4, the first category of the UE remains C11. In actual applications, one of TAI or CGI is selected to allocate the second category to the UE. Of course, TAI and CGI can also be combined to allocate the second category to the UE.

[0139] The core network element determines the second category in the category information of the UE according to part or all of the functional information, user information or device information of the UE. The following takes the determination of the second category in the category information of the UE according to the functional information, user information and device information of the UE as an example. For example, when the user information of the UE indicates that the company it belongs to is ofo, the device information indicates that the manufacturer is GIANT, and the functional information indicates that the device supports the NB-IOT CP protocol, the second category 1 is assigned to the UE1, which is recorded as C21. When the user information of the UE indicates that the company it belongs to is Mobike, the device information indicates that the manufacturer is PHOENIX, and the functional information indicates that the device function supports the NB-IOT CP protocol, the second category 2 is assigned to the UE2, which is recorded as C22. And so on.

[0140] For example, based on the above classification method, the UE is classified, and the classification information finally obtained may be, for example:

[0141] UE1: C11, C22, (i.e., UE1 belongs to the first category 1 and the second category 2);

[0142] UE2: C11, C21, (i.e., UE2 belongs to the first category 1 and the second category 1);

[0143] UE3: C12, C23, (i.e., UE3 belongs to the first category 2 and the second category 3);

[0144] UE4: C12, C24, (i.e., UE4 belongs to the first category 2 and the second category 4);

[0145] UE5: C13, C21, (i.e., UE5 belongs to the first category 3 and the second category 1);

[0146] …

[0147] In the above classification method, generally, the first category to which the UE belongs can be changed, that is, if the location information of the UE is updated, the core network element updates the first category in the category information of the UE according to the updated location information. Of course, in actual applications, whether the first category and the second category to which the UE belongs can be changed depends on actual needs, and this application does not limit it.

[0148] In another implementation, the core network element determines different categories according to information of different UEs, for example, the core network element determines a first category in the category information of the UE according to the location information of the UE, determines a second category in the category information of the UE according to the function information of the UE, determines a third category in the category information of the UE according to the user information of the UE, and determines a fourth category in the category information of the UE according to the device information of the UE. Of course, the core network element may also determine only some of the above four categories.

[0149] The following example illustrates this.

[0150] For the core network element to determine the first category in the category information of the UE according to the location information of the UE, since both the Tracking Area Identity (TAI) and the Cell Global Identification (CGI) can indicate the current location of the UE, the UE can be classified into the first category according to the TAI or CGI. For example, taking TAI as an example, when the UE is in TAI1, the first category 1 is assigned to the UE, which is recorded as C11. When the UE is in TAI2, the first category 2 is assigned to the UE, which is recorded as C12. When the UE is in TAI3 and TAI4, the first category 3 is assigned to the UE, which is recorded as C13. And so on. It should be noted that when the UE moves to a new TAI, such as when the UE moves from TAI1 to TAI2, the first category of the UE needs to be updated from C11 to C12. Of course, when the UE moves to a new TAI, it may not be necessary to update the first category. For example, when the UE moves from TAI3 to TAI4, the first category of the UE remains C13. For another example, taking CGI as an example, when the UE is in CGI1 and CGI4, the first category 1 is allocated to the UE, which is recorded as C11. When the UE is in CGI2, the first category 2 is allocated to the UE, which is recorded as C12. When the UE is in CGI3, the first category 3 is allocated to the UE, which is recorded as C13. And so on. It should be noted that when the UE moves to a new CGI, such as the UE moves from CGI1 to CGI2, the first category of the UE needs to be updated from C11 to C12. Of course, when the UE moves to a new CGI, it may not be necessary to update the first category. For example, if the UE moves from CGI1 to CGI4, the first category of the UE remains C11. In actual applications, one of TAI or CGI is selected to allocate the second category to the UE. Of course, TAI and CGI can also be combined to allocate the second category to the UE.

[0151] The core network element determines the second category in the category information of the UE according to the functional information of the UE. For example, when the functional information of the UE indicates that the device function supports the NB-IOT CP protocol, the second category 1 is assigned to the UE, which is recorded as C21. For another example, when the functional information of the UE indicates that the device function supports the NB-IOT UP protocol, the second category 2 is assigned to the UE, which is recorded as C22, and so on.

[0152] The core network element determines the third category in the category information of the UE according to the user information of the UE. For example, when the user information of the UE indicates that the company it belongs to is ofo, the third category 1 is assigned to the UE, recorded as C31. For another example, when the company to which the user information of the UE belongs is Mobike, the third category 2 is assigned to the UE, recorded as C32. And so on.

[0153] The core network element determines the fourth category in the category information of the UE according to the device information of the UE. For example, when the device information of the UE indicates that the manufacturer is a model A device produced by GIANT, the fourth category 1 is assigned to the UE, which is recorded as C41. For another example, when the device information of the UE indicates that the manufacturer is a model B device produced by PHOENIX, the fourth category 2 is assigned to the UE, which is recorded as C42. And so on.

[0154] For example, based on the above classification method, the UE is classified, and the classification information finally obtained may be, for example:

[0155] UE1: C11, C22, C31, C42 (i.e., UE1 belongs to the first category 1, the second category 2, the third category 1, and the fourth category 2);

[0156] UE2: C11, C21, C32, C42 (i.e., UE2 belongs to the first category 1, the second category 1, the third category 2, and the fourth category 2);

[0157] UE3: C12, C23, C31, C42 (i.e., UE3 belongs to the first category 2, the second category 3, the third category 1, and the fourth category 2);

[0158] UE4: C12, C22, C32, C41 (i.e., UE4 belongs to the first category 2, the second category 2, the third category 2, and the fourth category 1);

[0159] UE5: C13, C21, C31, C41 (i.e., UE5 belongs to the first category 3, the second category 1, the third category 1, and the fourth category 1);

[0160] …

[0161] In the above classification method, generally, the first category to which the UE belongs can be changed, that is, if the location information of the UE is updated, the core network element updates the first category in the category information of the UE according to the updated location information. The second category, third category, and fourth category to which the UE belongs do not change. Of course, in actual applications, whether the first category, second category, third category, and fourth category to which the UE belongs can be changed depends on actual needs, and this application does not limit it. Figure 4In the embodiment shown, the core network element can assign categories to UEs, and the categories are assigned to terminals based on part or all of the UE's function information, user information, device information, and location information, so the classification method is relatively flexible. In the embodiment of the present application, the above UE information is selected to determine the UE category information, which can be associated with the attacker's attack method, thereby reflecting a class of terminals with the same potential attack, so that the beneficial effect of controlling terminals by category can be implemented. Compared with Figure 3 The classification method in the prior art shown is to classify services according to their urgency and pre-write the classification results into the SIM card. The classification method of the present application is more flexible.

[0162] Further, after the above step 402, the core network element may also send the category information of the UE to the communication device. For example, when the category information of the UE is determined by the AMF, the AMF may send the category information of the UE to the following communication devices: UE, base station, SMF, PCF or UPF. For another example, when the category information of the UE is determined by the PCF, the PCF may send the category information of the UE to the following communication devices: UE, base station, AMF, SMF or UPF. For another example, when the category information of the UE is determined by the AMF and the PCF together, such as the AMF determines the first category of the UE, and the PCF determines the second category of the UE; or the AMF determines the first category of the UE, and the PCF determines the second category, the third category and the fourth category of the UE, then based on this implementation method, after determining the first category of the UE, the AMF sends the first category of the UE to the PCF, and then the PCF may send the category information of the UE to the following communication devices: UE, base station, AMF, SMF or UPF.

[0163] Furthermore, before the above step 401, the following steps may also be included: the core network element receives indication information, and the indication information is used to indicate the determination of the category information of the UE. That is, the core network element determines the category information of the UE only after receiving the indication information. The indication information may be sent by the network management system, or may be sent by the UE, which is not limited in this application.

[0164] As examples, several specific implementation methods for determining the category information of UE are given below in conjunction with the accompanying drawings.

[0165] like Figure 5 As shown, a method for determining the category information of a UE provided in the present application is provided. The method is to determine the category information of the UE by an AMF. The method comprises the following steps:

[0166] Step 501: UE sends a registration request message to a base station.

[0167] Optionally, the message includes UE capability information (UE Capability), and UE Capability may include UE network capability (UE Network Capability), mobile station network capability (MS Network Capability), mobile station class mask 2 (Mobile Station Classmask2), mobile station class mask 3 (Mobile StationClassmask3), supported coding (Supported Codecs), additional update category (Additional UpdateType), voice domain preference and UE's usage setting (Voice domain Preference and UE's usagesetting), device performance (Device Properities), mobile station supported network features (MS Network FeatureSupport) and other parameters. Part or all of the parameters.

[0168] The UE capability information may also be referred to as UE function information.

[0169] Step 502: The base station sends an initialization UE message (Initial UE message) to the AMF. The Initial UE message includes the UE location information and a registration request message, etc.

[0170] The above Initial UE message is an N2 message. AMF can obtain the UE's location information, such as CGI, TAI, etc. from the N2 message, where CGI reflects the cell location of the UE and TAI reflects the tracking area location of the UE. AMF can also obtain the UE's capability information from the registration request message.

[0171] Step 503: AMF obtains the UE device information from the UE through the NAS security mode completed (SMP) message process, such as TAC and SV in IMEI / PEI.

[0172] For example, AMF can obtain a permanent equipment identifier (PEI) from the UE through the NAS SMP process. The PEI can reflect equipment-related information such as the manufacturer of the equipment.

[0173] Step 504: AMF obtains the user information of the UE from the UDM through the Nudm_SDM_Get procedure.

[0174] Among them, the user information of the UE can specifically be SIM card related information. For example, the SIM card related information obtained from the UDM through the Nudm_SDM_Get process includes a group ID, an administrator ID, a company ID and other information, wherein the group ID can reflect the group category of the UE, the administrator ID can reflect the user information of the UE, and the company ID can reflect the information of the company to which the UE belongs.

[0175] Step 505: AMF determines the category information of the UE based on the information of the UE.

[0176] The specific implementation method of AMF determining the category information of UE can refer to the above Figure 4 The relevant description in the illustrated embodiment will not be repeated here.

[0177] Optionally, the AMF stores the UE category information in the UE context.

[0178] Step 506: AMF sends UE category information to UDM, PCF, UE, and some or all communication devices in the base station.

[0179] Optionally, AMF can send UE category information to PCF by calling the service interface opened by PCF. The service provided by PCF can include Npcf_AMPolicyControl.

[0180] Optionally, AMF can send UE category information to UDM by calling the service interface opened by UDM. The services provided by UDM may include Subscriber Data Management, UE Context Management services, etc.

[0181] Optionally, the AMF may send the UE category information to the UE via a NAS message, for example, the NAS message is a Registration Accept message.

[0182] Optionally, the AMF may send the category information of the UE to the base station via an N2 message, for example, the N2 message is a message for establishing an initial context.

[0183] Step 507: The communication device that obtains the category information of the UE stores the category information of the UE.

[0184] For example, the PCF stores the obtained category information of the UE in the context information of the UE.

[0185] For example, the UDM stores the obtained category information of the UE in the context information of the UE.

[0186] For example, the base station stores the obtained category information of the UE in the context information of the UE.

[0187] For example, the UE stores the obtained UE category information locally.

[0188] As an implementation method, indication information may also be carried in the above steps 501 and 502, and the indication information is used to indicate the category information of the UE, so that when the AMF receives the indication information, it can execute the above step 505 according to the indication information.

[0189] As another implementation method, AMF can also receive the above-mentioned indication information from other network elements, such as AF network elements, so that when AMF receives the indication information, it executes the above-mentioned step 505 according to the indication information.

[0190] based on Figure 5 In the embodiment shown, after determining the category information of the UE, the AMF may send the category information of the UE to some or all devices in the PCF, UDM, base station, and UE:

[0191] In scenario 1, AMF sends the category information of the UE to PCF and UDM, and AMF stores the category information of the UE, so that AMF can store the category information of the UE in the context of the UE, PCF can store the category information of the UE in the context of the UE, and UDM can store the category information of the UE in the context of the UE.

[0192] In scenario 2, AMF only sends the UE category information to UDM or PCF. UDM or PCF can store the UE category information in the context of the UE, and AMF does not store the UE category information.

[0193] In scenario three, AMF sends the UE category information to UDM and PCF, and AMF does not store the UE category information. In this case, UDM may store the UE category information in the context of the UE, and PCF may store the UE category information in the context of the UE.

[0194] In scenario four, the AMF sends the UE category information to the base station, UE and PCF, and the AMF also stores the UE category information, so that the AMF can store the UE category information in the context of the UE, the PCF can store the UE category information in the context of the UE, the base station can store the UE category information in the context of the UE, and the UE can store the UE category information.

[0195] Of course, there are many other situations, which will not be listed here. Figure 5In the embodiment shown, after the AMF determines the category information of the UE, some or all devices in the core network element, UE, and base station can obtain the category information of the UE. For the device that has obtained the category information of the UE, the category information of the UE can be stored locally and can be obtained from the local when it is needed later. For other devices that have not obtained the category information of the UE, they can be obtained from the device that stores the category information when it is needed later.

[0196] It should be noted that, when storing the category information of the UE, the communication device may store the corresponding relationship or mapping relationship between the identifier of the UE and the category information of the UE.

[0197] like Figure 6 As shown, another method for determining the category information of a UE provided by the present application is provided. The method is to determine the category information of the UE by a PCF. The method comprises the following steps:

[0198] Step 601-Step 604, same Figure 5 For steps 501 to 504 shown, please refer to the above description and will not be repeated here.

[0199] Step 605: AMF sends UE information to PCF.

[0200] For example, AMF sends the above UE information to UE by calling the service-oriented interface of PCF, where the UE information may include UE function information, UE location information, UE user information, UE device information, etc. Among them, the service provided by PCF may be Npcf_AMPolicyControl.

[0201] Step 606: The PCF determines the category information of the UE according to the information of the UE.

[0202] Optionally, the PCF also stores the UE category information in the UE context.

[0203] The specific implementation method of PCF determining the category information of UE is Figure 5 The method for determining the category information of the UE in step 505 of the illustrated embodiment is the same, and reference may be made to the above description.

[0204] Step 607: PCF sends UE category information to AMF.

[0205] Step 608: AMF sends UE category information to UDM, UE, and some or all communication devices in the base station.

[0206] Optionally, AMF can send UE category information to UDM by calling the service interface opened by UDM. The services provided by UDM may include Subscriber Data Management, UE Context Management services, etc.

[0207] Optionally, the AMF may send the UE category information to the UE via a NAS message, for example, the NAS message is a registration accept message.

[0208] Optionally, the AMF may send the category information of the UE to the base station via an N2 message, for example, the N2 message is a message for establishing an initial context.

[0209] Step 609: The communication device that obtains the category information of the UE stores the category information of the UE.

[0210] For example, the UDM stores the obtained category information of the UE in the context information of the UE.

[0211] For example, the base station stores the obtained category information of the UE in the context information of the UE.

[0212] For example, the UE stores the obtained UE category information locally.

[0213] As an implementation method, the above steps 601, 602, and 605 may also carry indication information, where the indication information is used to indicate the category information of the UE, so that when the PCF receives the indication information, it executes the above step 606 according to the indication information.

[0214] As another implementation manner, the PCF may also receive the above indication information from other network elements, such as the AF network element, so that when the PCF receives the indication information, it executes the above step 606 according to the indication information.

[0215] based on Figure 6 In the illustrated embodiment, after determining the category information of the UE, the PCF may send the category information of the UE to some or all devices in the AMF, UDM, base station, and UE:

[0216] In scenario 1, the PCF sends the UE category information to both the AMF and the UDM, and the PCF also stores the UE category information, so that the PCF can store the UE category information in the context of the UE, the UDM can store the UE category information in the context of the UE, and the AMF can store the UE category information in the context of the UE.

[0217] In scenario 2, the PCF only sends the category information of the UE to the UDM, and the PCF does not store the category information of the UE. Then the UDM may store the category information of the UE in the context of the UE.

[0218] Scenario three: PCF sends the category information of the UE to UDM, and PCF stores the category information of the UE. Then, UDM may store the category information of the UE in the context of the UE, and PCF may store the category information of the UE in the context of the UE.

[0219] In scenario four, the PCF sends the UE category information to the base station, UE and AMF. The base station can store the UE category information in the context of the UE, the UE can store the UE category information, the AMF can store the UE category information in the context of the UE, and the PCF stores the UE category information in the context of the UE.

[0220] Of course, there are many other situations, which will not be listed here. Figure 6 In the embodiment shown, after the PCF determines the category information of the UE, some or all devices in the core network element, UE, and base station can obtain the category information of the UE. For the device that has obtained the category information of the UE, the category information of the UE can be stored locally and can be obtained from the local when it is needed later. For other devices that have not obtained the category information of the UE, they can be obtained from the device that stores the category information when it is needed later.

[0221] It should be noted that, when storing the category information of the UE, the communication device may store the corresponding relationship or mapping relationship between the identifier of the UE and the category information of the UE.

[0222] like Figure 7 As shown, another method for determining the category information of a UE provided by the present application is provided. The method is that the AMF and the PCF jointly determine the category information of the UE. The method comprises the following steps:

[0223] Step 701-Step 704, same Figure 5 For steps 501 to 504 shown, please refer to the above description and will not be repeated here.

[0224] Step 705: AMF determines the dynamic category information of the UE according to the dynamic information of the UE.

[0225] Here, the dynamic information of the UE may be, for example, the location information of the UE, and the dynamic category information refers to the first category of the UE, that is, the AMF determines the first category of the UE based on the location information of the UE.

[0226] Step 706: AMF sends the static information and dynamic category information of the UE to the PCF.

[0227] The static information here refers to part or all of the UE's user information, UE's function information, and UE's device information.

[0228] For example, AMF sends static information and dynamic category information of UE to UE by calling the service-oriented interface of PCF. The service provided by PCF may be Npcf_AMPolicyControl.

[0229] Step 707: The PCF determines the static category information of the UE according to the static information of the UE.

[0230] The static category information here has different meanings in different classification methods. For example, if the second category is determined based on the user information of the UE, the functional information of the UE, and part or all of the information in the device information of the UE, then the static category information here refers to the second category of the UE. For another example, if the second category in the category information of the UE is determined based on the functional information of the UE, the third category in the category information of the UE is determined based on the user information of the UE, and the fourth category in the category information of the UE is determined based on the device information of the UE, then the static category information here refers to the second category, the third category, and the fourth category of the UE.

[0231] On the one hand, the PCF can determine the static category information of the UE, and on the other hand, it can obtain the dynamic category information of the UE from the AMF, so that the PCF can obtain the category information of the UE (including the static category information of the UE and the dynamic category information of the UE). Optionally, the PCF also stores the category information of the UE in the context of the UE.

[0232] Step 708: PCF sends UE category information to AMF.

[0233] Step 709: AMF sends UE category information to UDM, UE, and some or all communication devices in the base station.

[0234] Optionally, AMF can send UE category information to UDM by calling the service interface opened by UDM. The services provided by UDM may include Subscriber Data Management, UE Context Management services, etc.

[0235] Optionally, the AMF may send the UE category information to the UE via a NAS message, for example, the NAS message is a registration accept message.

[0236] Optionally, the AMF may send the category information of the UE to the base station via an N2 message, for example, the N2 message is a message for establishing an initial context.

[0237] Step 710: The communication device that obtains the category information of the UE stores the category information of the UE.

[0238] For example, the UDM stores the obtained category information of the UE in the context information of the UE.

[0239] For example, the base station stores the obtained category information of the UE in the context information of the UE.

[0240] For example, the UE stores the obtained UE category information locally.

[0241] As an alternative implementation method, the above steps 706-710 can also be replaced by: the AMF determines the dynamic category information of the UE and then sends the dynamic category information of the UE to other communication devices, and the PCF determines the static category information of the UE and then sends the static category information of the UE to other communication devices.

[0242] As an alternative implementation method, the above steps 706-710 can also be replaced by: after the AMF determines the dynamic category information of the UE, the dynamic category information of the UE is sent to the PCF; after the PCF determines the static category information of the UE, the category information of the UE is determined based on the static category information and the dynamic category information, and then the PCF sends the category information of the UE to other communication devices.

[0243] As an implementation method, the above steps 701, 702, and 706 may also carry indication information, and the indication information is used to indicate the category information of the UE, so that when the AMF receives the indication information, it executes the above step 705 according to the indication information, and when the PCF receives the indication information, it executes the above step 707 according to the indication information.

[0244] As another implementation, the AMF and PCF may also receive the above indication information from other network elements, such as the AF network element, so that when the AMF and PCF receive the indication information, they perform the above steps 705 and 707 according to the indication information. Figure 7 In the embodiment shown, after the AMF determines the dynamic category information in the category information of the UE and the PCF determines the static category information in the category information of the UE, the category information of the UE can be sent to other devices. Figure 7 In the implementation manner of the embodiment shown, after the PCF sends the category information of the UE to the AMF, the AMF may send the category information of the UE to the UE, the base station, and some or all of the communication devices in the UDM, and the PCF may store or not store the category information of the UE, as described below:

[0245] In scenario 1, AMF sends the category information of the UE to UDM, and AMF stores the category information of the UE, so that AMF can store the category information of the UE in the context of the UE, and UDM can store the category information of the UE in the context of the UE. In addition, PCF also stores the category information of the UE in the context of the UE.

[0246] In scenario 2, AMF only sends the category information of the UE to UDM, and UDM can store the category information of the UE in the context of the UE, and AMF does not store the category information of the UE. Furthermore, PCF does not store the category information of the UE.

[0247] Scenario 3: AMF sends the category information of the UE to UDM, and AMF does not store the category information of the UE. Then UDM can store the category information of the UE in the context of the UE. And PCF also stores the category information of the UE in the context of the UE.

[0248] In scenario 4, the AMF sends the category information of the UE to the base station and the UE, and the AMF also stores the category information of the UE, so that the AMF can store the category information of the UE in the context of the UE, the base station can store the category information of the UE in the context of the UE, and the UE can store the category information of the UE. In addition, the PCF also stores the category information of the UE.

[0249] Of course, there are many other situations, which will not be listed here. Figure 7 In the embodiment shown, after the AMF and the PCF jointly determine the category information of the UE, some or all devices in the core network element, UE, and base station can obtain the category information of the UE. For the device that has obtained the category information of the UE, the category information of the UE can be stored locally and can be obtained from the local when it is needed later. For other devices that have not obtained the category information of the UE, they can be obtained from the device that stores the category information when it is needed later.

[0250] It should be noted that, when storing the category information of the UE, the communication device may store the corresponding relationship or mapping relationship between the identifier of the UE and the category information of the UE.

[0251] The following describes the specific implementation method of SMF and UPF obtaining UE category information. Figure 8 As shown, a method for sending UE category information provided by the present application. The method comprises the following steps:

[0252] Step 801: The UE initiates a protocol data unit (PDU) session establishment process, and the UE sends a PDU session establishment request to the AMF.

[0253] When UE initiates communication, it needs to initiate Figure 5-7 The registration process in the NAS communication is established, and the subsequent Figure 8 The PDU session establishment process shown in Figure 1 is to request the network side to establish communication resources for it. Therefore, this process occurs at Figure 5-7 After the process, the core network elements (such as Figure 5 In AMF, Figure 6 PCF or Figure 7 The AMF&PCF in the UE has already determined the UE category information.

[0254] Step 802: SMF obtains UE category information.

[0255] SMF can obtain UE category information in any of the following ways.

[0256] Method 1: SMF obtains UE category information from AMF.

[0257] AMF can send UE category information to SMF by calling the service interface opened by SMF. Among them, the services provided by SMF to AMF may include Create SM Context service, SMContextStatusNotify service, etc.

[0258] Among them, AMF can be Figure 5-Figure 7 The method of any embodiment of the present invention obtains the category information of the UE. For example, Figure 5-7 In scenario 1 described in any one of the embodiments, the AMF may obtain the category information of the UE.

[0259] Method 2: SMF obtains UE category information from UDM.

[0260] SMF can query UDM to obtain UE category information by calling the service interface opened by UDM. The services provided by UDM to SMF may include Subscriber Data Management service, UE Context Management service, etc.

[0261] Among them, UDM can be Figure 5-Figure 7 The method of any embodiment of the present invention obtains the category information of the UE. For example, Figure 5-7 In scenario 1, scenario 2 or scenario 3 described in any one of the embodiments, the UDM can obtain the category information of the UE.

[0262] Method three: SMF obtains UE category information from PCF.

[0263] SMF can query PCF to obtain UE category information by calling the service interface opened by PCF. The service provided by PCF to SMF may include Npcf_SMPolicyControl service.

[0264] Among them, PCF can be Figure 5-Figure 7 The method of any embodiment of the present invention obtains the category information of the UE. For example, the PCF may Figure 5 The UE category information is obtained in case 1, case 2, case 3, or case 4 of the embodiment. Alternatively, the PCF may Figure 6 The UE category information is obtained in case 1, case 3 or case 4 of the embodiment. Alternatively, the PCF may Figure 7 In scenario 1, scenario 3 or scenario 4 of the embodiment, the category information of the UE is obtained.

[0265] Step 803: SMF stores the category information of the UE into the corresponding UE context.

[0266] This step is optional.

[0267] Step 804: SMF sends UE category information to UPF.

[0268] During the PDU session establishment process, the SMF may allocate a UPF for the PDU session requested by the UE according to the prior art, and send the UE category information to the allocated UPF. For example, the SMF may send the UE category information to the UPF via an N4 Session Establishment message or an N4 Session Modification Request message.

[0269] Optionally, the SMF may also send the UE identifier to the UPF, and the identifier may be the source IP of the UE.

[0270] Step 805: UPF stores the category information of the UE into the corresponding UE context.

[0271] Optionally, the UPF may also bind the category information of the UE with the UE identifier.

[0272] For example, the UPF may map the UE identifier with the UE category information to form a mapping table or a corresponding relationship, such as group1: IP1, IP2, group2: IP3, group3: IP4, IP5.

[0273] based on Figure 8In the illustrated embodiment, during the PDU session establishment process of the UE, the SMF obtains the category information of the UE and sends the category information of the UE to the UPF that serves the PDU session of the UE.

[0274] Through the above Figure 5-Figure 7 Any of the embodiments shown in the embodiment, and through the above Figure 8 In the embodiment shown, each network element in the network, such as part or all of the network elements in the UE, base station, AMF, SMF, PCF, UPF, and UDM, can obtain and store the category information of the UE, so that the category information of the UE can be used later, such as performing access control on the UE according to the category information of the UE, which will be described in detail later.

[0275] Furthermore, since the position of the UE is movable, in one implementation, the core network element can redetermine the first category in the UE's category information based on the UE's updated location information, or redetermine the dynamic category information in the UE's category information based on the UE's updated dynamic information.

[0276] Specifically, based on Figure 5-Figure 7 In any of the embodiments of the method for determining the category information of the UE, if the location information of the UE changes, it is necessary to re-determine the first category in the category information of the UE. Figure 5 Taking the method for determining the category information of the UE as an example, when the location of the UE is updated, the first category in the category information of the UE may be re-determined according to the following method.

[0277] It should be noted that based on Figure 6 or Figure 7 The method for determining the category information of the UE shown in the embodiment of the present invention, when the location of the UE is updated, the method for re-determining the first category in the category information of the UE is similar to the method for determining the category information of the UE shown in the embodiment of the present invention. Fig. 9 The method shown is similar and can be used as a reference for implementation, so I will not go into details here.

[0278] like Fig. 9 As shown, a method for updating UE category information provided by the present application is provided. The method comprises the following steps:

[0279] Step 901: UE sends a registration request message to a base station.

[0280] Optionally, when the UE's location is updated, the UE is triggered to send a registration request message to the AMF, where the registration request message is used to update the location area and includes a new TAI.

[0281] The registration request message may be carried in a NAS message.

[0282] Step 902: The base station sends a registration request message to the AMF.

[0283] Step 903: AMF updates the first category in the category information of the UE.

[0284] In a specific implementation, the AMF first re-determines the first category in the category information of the UE according to the new location information of the UE. If the re-determined first category is the same as the original first category of the UE, it is not necessary to perform step 903 and subsequent steps related to updating the first category of the UE. If the re-determined first category is different from the original first category of the UE, it is necessary to perform step 903 and subsequent steps related to updating the first category of the UE.

[0285] Step 904: AMF sends the updated first category of UE to each communication device.

[0286] For example, AMF can send the updated first category of UE to UDM by calling the service interface opened by UDM, such as Nudm_SDM_Get service.

[0287] For example, the AMF may send the updated first category of the UE to the PCF through a Policy Association Establishment procedure.

[0288] For example, the AMF may send the updated first category of the UE to the base station and the UE via a Registration Accept message.

[0289] As an alternative, step 904 may also be replaced by: AMF sends the updated category information to each communication device, that is, the updated first category and the original static category information need to be sent to each communication device.

[0290] Step 905: Each network element updates the first category in the category information of the UE according to the updated first category.

[0291] Step 906: PCF triggers updating of category information on SMF, and SMF triggers updating of category information on UPF.

[0292] PCF can send the category information of UE to SMF by calling the service interface opened by SMF. Among them, the service provided by SMF can include Nsmf_EventExposure service. Thus, SMF can update the first category in the category information of UE according to the updated first category. And SMF can trigger the update of category information on UPF.

[0293] pass Fig. 9In the illustrated embodiment, when the location information of the UE is updated, each communication device may update the category information of the UE.

[0294] Through the above Figure 5-Figure 9 In the embodiment shown, each communication device can obtain the category information of the UE. The following describes a method for the network side to control the attack behavior based on the category information of the UE when an attack occurs to the UE. That is, the network side can implement access control of the UE according to the category information of the UE and at the granularity of the category of the UE.

[0295] like Fig.10 As shown, a method for collecting traffic of a network device provided by the present application is provided. The method comprises:

[0296] Step 1001: SEDF sends a data collection service request message to a network device.

[0297] In a specific implementation, the data collection service request message sent by SEDF may be a subscription to a data collection event.

[0298] The network devices here can be AMF, SMF, PCF, UPF, AF, etc. For example, for network elements such as AMF, UDM, PCF, etc. that have service interfaces with SEDF, SEDF can call the data collection subscription service, that is, SEDF sends data collection service request messages to AMF, UDM, and PCF respectively, and the messages are used to request AMF, UDM, and PCF to report relevant data information. For another example, for network elements such as UPF and AF that do not have service interfaces with SEDF, the communication between them and SEDF can be transferred through network elements such as SMF and NEF that have service interfaces.

[0299] The data collection service request message may include a data collection unit and a collection scope. The data collection unit is used to indicate the format of the reported data, and the collection scope is used to indicate the granularity at which data is collected. Here, the collection scope is to collect according to category information. The data collection service request message may also include a reporting condition (or trigger condition), which is used to indicate the condition that triggers the reporting of traffic data. For example, the reporting condition may be a threshold parameter or a time interval parameter, wherein the threshold parameter is used to indicate data indicators that meet the reporting condition. At this time, if certain data indicators exceed the specified threshold, the network device will need to report the data information indicated by the data collection unit. The time interval is used to indicate the interval time of periodic data reporting. At this time, the network device will report the data information indicated by the data collection unit at a certain interval.

[0300] Step 1002: The network device collects traffic data and sends a data collection service response message to the SEDF.

[0301] The data collection service response message includes category information and traffic data corresponding to the category information, and the traffic data of the UE indicated by the category information meets the reporting condition.

[0302] For example, if the network device is UPF, the data collection unit indicates to collect the number of flows per unit time, average packet size, packet size variance, average packet interval and other information of the user plane traffic of the target IP, the collection scope indicates to collect according to all categories of information, and the reporting condition is the time interval, whose value is T. Then UPF will periodically count the user plane information of all categories of information. For example, if UPF has a total of 100 categories of information (note that it can be in the form of type, or in the form of {type1, type2}, or in the form of {type1, type2, type3, type 4}), then UPF counts these 100 categories of information every T time period, obtains the number of flows per unit time, average packet size, packet size variance, average packet interval and other information of different target IPs corresponding to the 100 categories, and sends a data collection service response message to SEDF, and the data collection service response message includes the category information and the traffic data corresponding to the category information.

[0303] It should be noted that the above network devices can be Figure 5-Figure 7 The method of any of the embodiments shown can obtain the category information of the UE, and then report the traffic data according to the category information. For example, for a network device that receives a data collection service request message from a SEDF, if the network device has obtained the category information of the UE, it can directly report the traffic data according to the category information. Of course, for a network device that receives a data collection service request message from a SEDF, if the network device does not have the category information of the UE, the network device can obtain the category information of the UE from other network devices that have the category information of the UE.

[0304] For another example, if the network element is AMF, the data collection unit indicates to collect the number of flows per unit time, average packet interval and other information of the control plane traffic, the collection scope indicates to collect according to all categories of information, and the reporting condition is threshold triggering, such as triggering an event when the number of flows per unit time exceeds threshold A. Then AMF will periodically count the control plane information of all categories of information. For example, if AMF has a total of 100 categories of information, AMF will perform real-time statistics on these 100 categories of information. When the number of flows per unit time of a certain category of information exceeds threshold A, AMF sends a data collection service response message to SEDF, and the data collection service response message includes the category information and the traffic data corresponding to the category information.

[0305] The specific implementation method of network equipment reporting category information and traffic data corresponding to the category information can be, for example: for network equipment such as AMF and UDM that have a service interface with SEDF, the category information and the corresponding traffic data can be directly reported to SEDF by calling the prompt function of the data collection service. For network elements such as UPF and AF that do not have a service interface with SEDF, the communication between them and SEDF can be transferred through network elements such as SMF and NEF that have a service interface, that is, reporting category information and traffic data corresponding to the category information.

[0306] It should be noted that the above network devices can be Figure 5-Figure 7 The method of any embodiment shown in the figure obtains the category information of the UE, and then the traffic data can be reported according to the category information. For example, for a network device that receives a data collection service request message from the SEDF, if the device has obtained the category information of the UE, such as Figure 5-Figure 7 If the situation 1 or situation 3 is met, the traffic data can be reported directly according to the category information. Of course, for the network device that receives the data collection service request message from the SEDF, if the network device does not have the category information of the UE, such as Figure 5-Figure 7 In case 2, the network device may obtain the category information of the UE from other network devices that have the category information of the UE.

[0307] Step 1003. SEDF determines abnormal category information based on the UE's traffic data.

[0308] For example, SEDF detects the traffic data corresponding to the category information according to the security detection algorithm to determine the abnormal category information.

[0309] As an example, when a DDoS attack against an external AF occurs, a large amount of traffic will access the same target address at the same time. These traffics have similar characteristics and are likely to belong to the same category, because attackers usually attack devices of the same category. This will cause abnormalities in the number of access flows per unit time, average packet size, packet size variance, average packet interval, and other data with the destination address as the target. For example, the number of access flows per unit time will surge compared to the normal time period, which is caused by the characteristics of the DDoS attack; the average packet size per unit time will decrease compared to the normal time period, which is caused by a large number of identical user-plane attack packets; the packet size variance per unit time will become closer and closer to 0, which is caused by a large number of identical user-plane attack packets; the average packet interval per unit time will decrease compared to the normal time period, which is caused by a large number of high-speed user-plane attack packets. Therefore, these parameters can be used as input features for detecting DDoS attacks. After these parameters are input into SEDF, the security detection algorithm (such as a machine learning algorithm) can be used to determine whether the combination of the data information is abnormal, and therefore, it can be determined whether the category information corresponding to the data information is abnormal. That is, it is identified which terminals indicated by the category information cause the attack.

[0310] As another example, when a DDoS attack against an internal AMF or UDM occurs, a large amount of traffic will access the same AMF or UDM at the same time. Since it is a signaling message, there is no need to count the packet size and packet variance, because the length of the NAS message is similar, so it is only necessary to count the number of flows per unit time, the average packet interval and other information. For example, the number of flows accessing the AMF or UDM per unit time will surge compared to the normal time period, which is caused by the characteristics of the DDoS attack; the average packet interval per unit time will decrease compared to the normal time period, which is caused by a large number of high-speed control plane attack packets. Therefore, these parameters can be used as input features for detecting DDoS attacks. When the number of flows accessing the AMF or UDM per unit time exceeds a certain threshold, the AMF or UDM reports the above parameters to the SEDF. After these parameters are input into the SEDF, the security detection algorithm (such as a machine learning algorithm) can be used to determine whether the combination of the data information is abnormal. Therefore, it can be determined whether the category information corresponding to the data information is abnormal. That is, it is possible to identify the terminals indicated by which category information caused the attack.

[0311] pass Fig.10 In the illustrated embodiment, SEDF implements a process of analyzing security threats at the granularity of category information based on category information and data information. The analysis speed is faster than analysis at the UE level, and there is less signaling interaction.

[0312] It should be noted that after determining the abnormal category information, the SEDF may send the abnormal category information so that the network element receiving the abnormal category information may control the access of the UE according to the abnormal category information. Different implementations of controlling the access of the UE are given below.

[0313] like Fig.11 As shown, a method for controlling UE access provided by the present application is implemented by a control plane to control a UE with abnormal behavior. The method includes the following steps:

[0314] Step 1101, SEDF detects an abnormal UE (i.e., a UE with abnormal behavior) and outputs the abnormal UE identifier. The abnormal UE identifier can be abnormal category information or an abnormal UE identity list, such as a Subscription Permanent Identifier (SUPI) list. SEDF can notify AMF or PCF of the abnormal UE identifier.

[0315] In one implementation, SEDF sends exception category information to AMF. For example, SEDF can Fig.10 In the manner of the embodiment shown, one or more abnormal category information is detected. In one implementation, SEDF can send all the detected abnormal category information to AMF, and AMF implements access control on the terminal matching the abnormal category information according to the abnormal category information. In another implementation, SEDF can also send only part of the abnormal category information among all the acquired category information to AMF. For example, if 100 abnormal category information is acquired, the first 30% of the abnormal category information with the largest number of UEs included in the 100 abnormal category information can be sent to AMF according to a preset ratio such as 30%, or the first 50 abnormal category information with the largest number of UEs included in the 100 abnormal category information can be sent to AMF according to a preset fixed number such as 50, and AMF implements access control on the terminal matching the abnormal category information according to the abnormal category information.

[0316] In another implementation, the SEDF sends an identity list of abnormal UEs, such as a SUPI list, to the PCF, the PCF maps one or more abnormal category information according to the SUPI list, and then the PCF sends the abnormal category information to the AMF.

[0317] In another implementation, SEDF sends an identity list of abnormal UEs, such as a SUPI list, to AMF, and AMF maps one or more abnormal category information according to the SUPI list. It should be noted that SEDF can obtain the identity list of abnormal UEs based on UE granularity (per UE) according to the method of the prior art.

[0318] Step 1102: AMF or PCF maps the identity list to category information.

[0319] This step is optional. When the SEDF sends the UE identity list to the PCF in the above step 1101, step 1102 is executed.

[0320] Optionally, the AMF or PCF maps the identity list to category information, which may specifically be to determine the category information to which each terminal in the identity list belongs; and determine the abnormal category information according to the category information to which each terminal in the identity list belongs.

[0321] The determination of the exception type information may include the following implementations:

[0322] In one implementation, when the AMF or PCF maps one or more categories to the SUPI list, the AMF or PCF may determine the abnormal category information according to the local policy, and the local policy may include an absolute policy and a relative policy. The absolute policy may determine whether to output the corresponding category information as the abnormal category information according to a preset absolute threshold. For example, 100 SUPIs are obtained, of which 60 SUPIs belong to category A, 30 SUPIs belong to category B, and 10 SUPIs belong to category C. The administrator sets the absolute threshold to 30. Since the number of SUPIs of category A and category B is greater than or equal to 30, category A and category B are finally determined to be abnormal category information. Since category C is less than the absolute threshold, it is determined not to output category C as abnormal category information. In this example, category A, category B, and category C are candidate abnormal category information, and category A and category B are output abnormal category information. The relative strategy can determine whether to output the corresponding category information as abnormal category information according to the relative proportion of the output information. For example, 100 SUPIs are obtained, of which 60 SUPIs belong to category A, 30 SUPIs belong to category B, and 10 SUPIs belong to category C. The administrator sets the relative proportion to 30%. Since the number of SUPIs in category A and category B accounts for more than or equal to 30% of the total number, category A and category B are finally determined to be abnormal category information. Since category C accounts for less than 30% of the total number, it is determined not to output category C as abnormal category information. In this example, category A, category B, and category C are candidate abnormal category information, and category A and category B are output abnormal category information.

[0323] In another implementation, the AMF or PCF may determine the candidate exception category information corresponding to the identity list based on the identity list and the correspondence between the category information of the terminal and the identifier of the terminal, wherein the terminals with the same category information in the identity list correspond to the same candidate exception category information; for each candidate exception category information, if the ratio of the number of terminals in the identity list belonging to the candidate exception category information to the number of all terminals corresponding to the candidate exception category information is greater than a preset ratio threshold, the candidate exception category information is determined to be exception category information. For example, the identity list includes 100 SUPIs, which are mapped to three candidate abnormal category information, namely category A, category B and category C, where the number of abnormal UEs corresponding to category A is 30, the number of abnormal UEs corresponding to category B is 30, the number of abnormal UEs corresponding to category C is 40, and the preset ratio threshold is 40%. In addition, the AMF or PCF determines that the number of all UEs belonging to category A is 100, the number of all UEs belonging to category B is 50, and the number of all UEs belonging to category C is 80. Then, the ratio of abnormal UEs in category A is 30 / 100=30%, the ratio of abnormal UEs in category B is 30 / 50=60%, and the ratio of abnormal UEs in category C is 40 / 80=50%. Since 60% and 50% are both greater than the ratio threshold 40%, it can be determined that category B and category C are both abnormal category information.

[0324] Step 1103: AMF sends category information to the base station, notifying the base station to restrict the access of the terminal according to the category information.

[0325] AMF can decide to restrict terminal access by category information based on local policy. AMF can also restrict terminal access by category information based on notifications from other network elements (such as PCF, SEDF, etc.).

[0326] The category information is used to indicate a UE with abnormal behavior.

[0327] Optionally, the AMF may also send a restriction indication to the base station, where the restriction indication is used to notify the base station to restrict the access of the terminal according to category information.

[0328] Optionally, the AMF also sends a timer to the base station, where the timer is used to indicate the restriction expiration time.

[0329] Step 1104: The base station constructs a broadcast data packet according to the category information. The broadcast data packet includes the following parameters:

[0330] a. Limiting factors.

[0331] The restriction factor may also be referred to as a restriction indication, which is used to restrict access of UEs matching the category information. In a specific implementation, the restriction factor may be similar to Figure 3 ac-BarringFactor in the embodiment shown.

[0332] b. Time limit (optional).

[0333] In a specific implementation, the limit time can be similar to Figure 3 ac-BarringTime in the embodiment shown.

[0334] c. Category information.

[0335] The category information is obtained by the base station from the AMF. The category information may include one or more categories of information. For example, if the abnormal category information determined in step 1102 includes multiple categories, the broadcast data packet sent by the base station to the UE may include the multiple abnormal category information.

[0336] Step 1105: the base station sends the broadcast data packet.

[0337] Optionally, the base station may also store a timer, which may be generated by the base station itself according to a policy, or provided by the SEDF or AMF.

[0338] After receiving the category information, the base station starts a timer. If the timer has not timed out, the base station broadcasts and sends a broadcast data packet until the timer times out, and then the base station stops sending the broadcast data packet.

[0339] Step 1106: All UEs under the base station receive the broadcast data packet. If the category information of the UE matches the category information in the broadcast data packet, the UE restricts access of the UE.

[0340] For example, if the category information stored in a certain UE is (C11, C22), and the category information included in the broadcast data sent by the base station is category (C11, C22; C12, C21), since the category information included in the broadcast data packet includes the category information stored by the UE, the category information of the UE matches the category information in the broadcast data packet, and the UE restricts the access of the UE.

[0341] For another example, if the category information stored by a UE is (C12, C22), and the category information included in the broadcast data sent by the base station is category (C11, C22; C12, C21), since the category information included in the broadcast data packet does not include the category information stored by the UE, the category information of the UE does not match the category information in the broadcast data packet, and the UE does not restrict the access of the UE.

[0342] Among them, the specific implementation method of UE restricting UE access can be Figure 3The method for restricting UE access in the illustrated embodiment is the same. That is, ac-BarringFactor is a value between 0 and 1. Before each access attempt, the UE will generate a random number between 0 and 1. If the generated random number is less than ac-BarringFactor, it can directly access. Otherwise, it will not access and wait for a period of time before trying again. ac-BarringTime is used to indicate the time for blocking access. When the UE decides not to access, it waits for the ac-BarringTime.

[0343] Step 1107: Release the connection between the UE and the base station.

[0344] This step is optional.

[0345] In one implementation, when determining to restrict the access of the UE, the UE may actively release the connection with the base station.

[0346] In another implementation, the base station may determine, based on the category information of the UE, that the UE is a UE that requires restricted access, and the base station may release the connection with the UE with the corresponding category information. For example, the base station may send a release message to the corresponding UE, and the release message may include a reason value, and the reason value may indicate that the UE is released due to security reasons. When the UE receives the release message with the reason value, it may wait for a period of time before trying to initiate a connection. At this time, the base station needs to save the category information of the UE in the context information of the UE in advance. The category information may be obtained by the base station in the radio resource control (RRC) message carried by the UE when connecting to the base station, or may be provided to the base station by the network side through the S1 connection or the N2 connection when the base station interacts with the network side (as mentioned above). Figure 5-Figure 7 In the embodiment shown in the figure), it can also be provided by other base stations when X2 or Xn interaction is performed between base stations.

[0347] It should be noted that PCF or AMF can be Figure 5-Figure 7 The method of any embodiment shown in the figure obtains the category information of the UE, so that the PCF or AMF can map the received identity list (i.e., the identifiers of one or more UEs) to the category information of the UE. For example, if the PCF or AMF has obtained the category information of the UE, such as Figure 5-Figure 7 Scenario 1 or Scenario 3, that is, the PCF or AMF stores multiple UE contexts, and the UE category information and the UE identity are stored in the context of a UE, so that after receiving the identity list, the PCF or AMF can obtain the category information corresponding to the identity list. Of course, if the PCF or AMF does not have the UE category information, for example Figure 5-Figure 7In the second scenario, the PCF or AMF may send an identity list to other network devices having the category information of the UE, and then receive the category information of the UE from other network devices having the category information of the UE.

[0348] It should be noted that the UE or base station can Figure 5-Figure 7 The method of any embodiment shown in the figure obtains the category information of the UE, so that the UE or the base station can restrict the access of the terminal according to the received category information. For example, the UE or the base station can Figure 5-Figure 7 Case 4: Obtain UE category information.

[0349] pass Fig.11 In the embodiment shown, SEDF notifies the process of controlling UE access according to the category information granularity. Compared with the existing solution of controlling according to the UE granularity, it can realize the function of controlling the access of multiple UEs at one time, reducing the control signaling. Furthermore, a timer can be added to provide a false alarm self-recovery method to prevent the UE from being blocked from accessing the network for a long time. At the same time, the base station can release the connection with the UE, thereby achieving the function of controlling the UE in the connected state.

[0350] like Fig.12 As shown, another method for controlling UE access provided by the present application is to control UE with abnormal behavior through the user plane. The method includes the following steps:

[0351] Step 1201, SEDF detects an abnormal UE (i.e., a UE with abnormal behavior) and outputs the abnormal UE identifier. The UE identifier may be abnormal category information, or an abnormal UE identity list, such as a SUPI list, etc. SEDF may notify AMF or PCF of the abnormal UE identifier.

[0352] In one implementation, SEDF sends exception category information to PCF. For specific implementation, please refer to Fig.11 Relevant description of step 1101 in the embodiment shown.

[0353] In another implementation, SEDF sends an abnormal UE identity list, such as a SUPI list, to PCF, and PCF maps one or more abnormal category information according to the SUPI list. It should be noted that SEDF can obtain the abnormal UE identity list based on the UE granularity (per UE) according to the method of the prior art. For specific implementation, please refer to Fig.11 Relevant description of step 1101 in the embodiment shown.

[0354] Optionally, SEDF also sends a victim ID to PCF to identify the attacked target, such as an IP address and port number.

[0355] Step 1202: PCF maps the identity list to category information.

[0356] This step is optional. When the SEDF sends the UE identity list to the PCF in the above step 1201, step 1202 is executed.

[0357] For details on how PCF maps identity lists to category information, see Fig.11 The relevant description in step 1102 of the embodiment.

[0358] Step 1203: The PCF generates flow matching information and a flow processing method for controlling the UE with abnormal behavior.

[0359] PCF can generate flow matching information and flow processing methods according to category information based on local policy decisions. PCF can also generate flow matching information and flow processing methods based on notifications from other network elements (such as SEDF). Flow matching information is used to match user plane traffic and can include flow quintuples, such as source IP, source port, destination IP, destination port, and protocol type. The flow processing method is used to control the user plane traffic matching flow matching information sent by the UE that matches the category information. The category information is obtained from the SEDF or mapped by the PCF.

[0360] Optionally, flow matching information can be generated based on the victim ID. For example, when the victim ID is an IP address and a port number, the flow matching information is generated in which the source IP is a wildcard, the source port is a wildcard, the target IP is the victim's IP address, the target port is the victim's port number, and the protocol type is a wildcard.

[0361] In one implementation, the PCF may generate a control policy, which includes the above-mentioned flow matching information and flow processing method. The control policy may be a special Policy and Charging Control (PCC) rule. For example, the PCF generates a PCC rule including a lower Quality of Service (QoS) and a flow matching template, which is used to instruct the UPF to implement corresponding QoS control when matching the flow matching template if the current flow belongs to the UE sent by the category information. Alternatively, the PCF generates a PCC rule including a gate and a flow matching template, which is used to instruct the UPF to discard the relevant traffic when matching the flow matching template if the current flow belongs to the UE sent by the category information. Among them, the flow matching template can be used to identify the traffic that accesses the victim ID. In this way, the overall traffic corresponding to the entire category information can be controlled in the UPF. Optionally, the control policy may also include the above-mentioned category information.

[0362] Step 1204: PCF sends category information, flow matching information, and flow processing method to SMF.

[0363] In one implementation, the PCF sends category information and a control policy to the SMF, where the control policy includes flow matching information and a flow processing method.

[0364] In yet another implementation, the PCF sends a control policy to the SMF, where the control policy includes category information, flow matching information, and a flow processing method.

[0365] Optionally, the PCF also sends a timer to the SMF.

[0366] Step 1205, SMF sends category information, flow matching information and flow processing method to UPF.

[0367] In one implementation, the SMF sends category information and a control policy to the UPF, where the control policy includes flow matching information and a flow processing method.

[0368] In yet another implementation, the SMF sends a control policy to the UPF, where the control policy includes category information, flow matching information, and a flow processing method.

[0369] Optionally, the SMF also sends a timer to the UPF.

[0370] Step 1206: UPF controls user plane traffic according to category information, flow matching information, and flow processing method.

[0371] UPF monitors user plane traffic. When the traffic matches the flow matching information and the traffic belongs to the UE corresponding to the category information, UPF executes the control instruction according to the flow processing method. If the flow processing method includes a discard operation, UPF discards the user plane traffic. If the flow processing method includes a quality of service modification operation, UPF modifies the quality of service of the user plane traffic.

[0372] For example, UPF stores a mapping table locally, which stores the correspondence between source IP and category information. One source IP is used to identify one UE. When the target IP of the user plane traffic matches the target IP of the flow matching information, UPF checks the source IP. UPF obtains the category information of the source IP according to the mapping table. If the category information corresponding to the source IP matches the received category information, UPF executes the corresponding flow processing method, such as discarding the user plane traffic.

[0373] Optionally, a timer may be stored in the UPF. The timer may be generated by the UPF itself according to a policy, or provided by the SEDF or PCF. The timer is used to indicate the time for executing user plane flow control.

[0374] It should be noted that PCF can be Figure 5-Figure 7 The method of any embodiment shown in the figure obtains the category information of the UE, so that the PCF can map the received identity list (i.e., the identifiers of one or more UEs) to the category information of the UE. For example, if the PCF has obtained the category information of the UE, such as Figure 5-Figure 7 Scenario 1 or Scenario 3, that is, the PCF stores multiple UE contexts, and the UE category information and the UE identifier are stored in the context of a UE, so that after receiving the identity list, the PCF can obtain the category information corresponding to the identity list. Of course, if the PCF does not have the UE category information, for example Figure 5-Figure 7 In the second scenario, the PCF may send an identity list to other network devices having the category information of the UE, and then receive the category information of the UE from the other network devices having the category information of the UE.

[0375] It should be noted that SMF or UPF can be Figure 8 The method shown obtains the category information of the UE, so that the SMF or UPF can restrict the access of the terminal according to the received category information.

[0376] pass Fig.12 In the embodiment shown, SEDF notifies PCF to implement the process of limiting UE access according to category information granularity. Compared with the existing solution of controlling by UE granularity, it can control the traffic of multiple UEs at one time, reduce control signaling, and also reduce the number of policies on UPF, and can also accurately control the category of exceptions. Furthermore, a timer can be added to provide a false alarm self-recovery method to prevent UE from being blocked from accessing the network for a long time.

[0377] The above mainly introduces the solution provided by the present application from the perspective of the interaction between various network elements. It can be understood that in order to realize the above functions, the above-mentioned network elements include hardware structures and / or software modules corresponding to the execution of various functions. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed in this document, the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0378] In the case of an integrated unit, Fig.13A possible exemplary block diagram of the device involved in the embodiment of the present invention is shown. The device 1300 can exist in the form of software, can exist in the form of hardware, or can exist in the form of software and hardware, which is not limited in the embodiment of the present application. The device 1300 may include: a processing unit 1302 and a communication unit 1303. As an implementation method, the communication unit 1303 may include a receiving unit and / or a sending unit. The processing unit 1302 is used to control and manage the device 1300. The communication unit 1303 is used to support the communication between the device 1300 and other network entities. The device 1300 may also include a storage unit 1301 for storing program code and data of the device 1300.

[0379] Among them, the processing unit 1302 can be a processor or a controller, for example, it can be a general-purpose central processing unit (CPU), a general-purpose processor, a digital signal processing (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the embodiments of the present invention. The processor can also be a combination that implements a computing function, for example, including a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The communication unit 1303 can be a communication interface, a transceiver or a transceiver circuit, etc., wherein the communication interface is a general term, and in a specific implementation, the communication interface can include multiple interfaces. The storage unit 1301 can be a memory.

[0380] In the first application, the device 1300 may be an access network device in any of the above embodiments, or may be a chip in the access network device. For example, when the device 1300 is an access network device, the processing unit 1302 may be, for example, a processor, the communication unit may be, for example, a transceiver, and the transceiver includes a radio frequency circuit. Optionally, the storage unit may be, for example, a memory. For example, when the device 1300 is a chip in the access network device, the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit. The processing unit 1302 may execute computer-executable instructions stored in the storage unit. Optionally, the storage unit may be a storage unit in the chip, such as a register, a cache, etc. The storage unit may also be a storage unit located outside the chip in the access network device, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

[0381] Specifically, when the communication unit 1303 includes a sending unit and a receiving unit: the receiving unit is used to receive exception category information from a core network element; the sending unit is used to send a broadcast data packet, the broadcast data packet includes the exception category information, and the broadcast data packet is used to limit the access of terminals matching the exception category information.

[0382] In a possible implementation, the receiving unit is further used to receive a restriction indication from the core network element before the sending unit sends the broadcast data packet, wherein the restriction indication is used to indicate that access is restricted to terminals matching the abnormal category information according to the restriction indication.

[0383] In a possible implementation, the processing unit is further configured to start a timer after the receiving unit receives the abnormal category information. The sending unit is specifically configured to send a broadcast data packet if the timer has not timed out.

[0384] In the second application, the device 1300 may be a terminal in any of the above embodiments, and may also be a chip in a terminal. For example, when the device 1300 may be a terminal, the processing unit 1302 may be, for example, a processor, the communication unit may be, for example, a transceiver, and the transceiver includes a radio frequency circuit, and optionally, the storage unit may be, for example, a memory. For example, when the device 1300 may be a chip in a terminal, the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit, etc. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit in the terminal located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0385] Specifically, when the communication unit 1303 includes a sending unit and a receiving unit, the receiving unit is used to receive broadcast information from an access network device, the broadcast information includes abnormal category information, and the broadcast data packet is used to restrict access of terminals matching the abnormal category information. The processing unit is used to restrict access of the terminal if the category information of the terminal matches the received abnormal category information, and the category information of the terminal is received by the terminal from a core network element.

[0386] In a possible implementation manner, the receiving unit is further configured to receive category information of the terminal from the core network element, where the category information of the terminal is generated according to information of the terminal, and the information of the terminal includes part or all of the following information:

[0387] Function information of the terminal, where the function information is used to indicate capability information of the terminal;

[0388] User information of the terminal, where the user information is used to indicate information of the owner of the terminal;

[0389] Device information of the terminal, where the device information is used to indicate manufacturing information of the terminal;

[0390] The location information of the terminal, where the location information is used to indicate the location of the terminal.

[0391] In a possible implementation manner, the processing unit is further configured to release the connection with the access network device.

[0392] In the third application, the device 1300 may be a core network element in any of the above embodiments, or may be a chip in a core network element, where the core network element may be a mobility management element or a policy control element. For example, when the device 1300 may be a core network element, the processing unit 1302 may be a processor, the communication unit may be a transceiver, and the transceiver may include a radio frequency circuit. Optionally, the storage unit may be a memory. For example, when the device 1300 may be a chip in a core network element, the processing unit 1302 may be a processor, and the communication unit may be an input / output interface, a pin or a circuit. Optionally, the storage unit may be a storage unit in the chip, such as a register, a cache, etc. The storage unit may also be a storage unit in the core network element located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0393] Specifically, when the communication unit 1303 includes a sending unit and a receiving unit: the processing unit is used to obtain information of N terminals accessing the network, where N is a positive integer; wherein the information of one terminal includes part or all of the following information:

[0394] Function information of the terminal, which is used to indicate the capability information of the terminal;

[0395] User information of the terminal, where the user information is used to indicate the owner information of the terminal;

[0396] Device information of the terminal, which is used to indicate the manufacturing information of the terminal;

[0397] The location information of the terminal is used to indicate the location of the terminal.

[0398] The processing unit is further configured to determine, for each terminal among the N terminals, terminal category information according to the terminal information.

[0399] In one possible implementation, the functional information of the terminal includes network capabilities, mobile station network capabilities, mobile station category mask 2, mobile station category mask 3, supported encodings, added update categories, voice domain preferences, terminal usage settings, terminal device performance, and some or all parameters in the mobile station supported network features; the user information of the terminal includes some or all parameters in the group identifier, administrator identifier, and company identifier; and the device information of the terminal includes some or all parameters in the category allocation number of the terminal's device identification code and the software version number.

[0400] In one possible implementation, the processing unit is used to determine the category information of the terminal based on the information of the terminal, specifically including: determining a first category in the category information of the terminal based on the location information of the terminal; and determining a second category in the category information of the terminal based on part or all of the function information, user information or device information of the terminal.

[0401] In a possible implementation manner, the processing unit is further configured to update the first category in the category information of the terminal according to the updated location information if the location information of the terminal is updated.

[0402] In a possible implementation, the sending unit is used to send the category information of the terminal to the communication device, and the communication device includes some or all of the following devices: terminal, access network device, mobility management network element, session management network element, policy control network element, user plane network element.

[0403] In a possible implementation manner, the receiving unit is configured to receive indication information, where the indication information is used to indicate the category information of the determined terminal.

[0404] In a possible implementation, the core network element is a policy control network element, and the policy control network element includes a storage unit, and the storage unit is used to store, for each terminal in the N terminals, a correspondence between the category information of the terminal and the identifier of the terminal.

[0405] In the fourth application, the device 1300 may be a policy control network element in any of the above embodiments, and may also be a chip in a policy control network element. For example, when the device 1300 may be a policy control network element, the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, a transceiver, and the transceiver includes a radio frequency circuit. Optionally, the storage unit may be, for example, a memory. For example, when the device 1300 may be a chip in a policy control network element, the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc. The storage unit may also be a storage unit in the policy control network element that is located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0406] Specifically, when the communication unit 1303 includes a sending unit and a receiving unit: the receiving unit is used to receive an identity list of abnormal terminals from a security detection network element, and the identity list is used to indicate one or more abnormal terminals; the processing unit is used to determine the abnormal category information according to the local policy and the identity list and the correspondence between the category information of the terminal and the identifier of the terminal; the sending unit is used to send the abnormal category information.

[0407] In a possible implementation manner, the processing unit is specifically configured to:

[0408] Determine candidate abnormal category information corresponding to the identity list according to the correspondence between the category information of the terminal and the identifier of the terminal, wherein the terminals with the same category information in the identity list correspond to the same candidate abnormal category information;

[0409] For each candidate abnormal category information, if the ratio of the number of terminals belonging to the candidate abnormal category information in the identity list to the number of all terminals corresponding to the candidate abnormal category information is greater than a preset ratio threshold, the candidate abnormal category information is determined to be abnormal category information; or,

[0410] For each candidate abnormal category information, if the number of terminals belonging to the candidate abnormal category information in the identity list is greater than a preset number threshold, the candidate abnormal category information is determined to be abnormal category information.

[0411] In a possible implementation manner, the sending unit is specifically configured to send abnormal category information to the access network device.

[0412] In one possible implementation, the sending unit is specifically used to send exception category information to the user plane network element; the sending unit is also used to send flow matching information and flow processing methods to the user plane network element, the flow matching information is used to match the user plane traffic, and the flow processing method is used to control the user plane traffic matching the flow matching information sent by the terminal matching the exception category information.

[0413] In the fifth application, the device 1300 may be a security detection network element in any of the above embodiments, and may also be a chip in a security detection network element. For example, when the device 1300 may be a security detection network element, the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, a transceiver, and the transceiver includes a radio frequency circuit. Optionally, the storage unit may be, for example, a memory. For example, when the device 1300 may be a chip in a security detection network element, the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc. The storage unit may also be a storage unit in the security detection network element that is located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0414] Specifically, when the communication unit 1303 includes a sending unit and a receiving unit: the processing unit is used to determine whether there is abnormal category information according to the traffic data of the terminal; and the sending unit is used to send the abnormal category information.

[0415] In a possible implementation, the sending unit is further used to send a data collection service request message to the network device before the processing unit determines the category information of the terminal with abnormal behavior based on the terminal's traffic data, the data collection service request message includes a data collection unit and a data collection range, the data collection unit is used to indicate the format of the reported data, and the data collection range is used to indicate collection according to the terminal's category information. The receiving unit is used to receive a data collection service response message sent by the network device, the data collection service response message includes the category information and the traffic data corresponding to the category information, and the traffic data of the terminal indicated by the category information meets the reporting condition.

[0416] In a possible implementation, the data collection service request message further includes a reporting condition, where the reporting condition is used to indicate a condition for triggering reporting of traffic data.

[0417] In a possible implementation manner, the network device includes part or all of the following devices: a mobility management network element, a session management network element, a policy control network element, and a user plane network element.

[0418] In a possible implementation, the processing unit is used to determine the abnormal category information according to the traffic data of the terminal, specifically including: detecting the traffic data corresponding to the category information according to the security detection algorithm to determine the abnormal category information.

[0419] In the sixth application, the device 1300 may be a user plane network element in any of the above embodiments, and may also be a chip in a user plane network element. For example, when the device 1300 may be a user plane network element, the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, a transceiver, and the transceiver includes a radio frequency circuit. Optionally, the storage unit may be, for example, a memory. For example, when the device 1300 may be a chip in a user plane network element, the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit. Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc. The storage unit may also be a storage unit in the user plane network element that is located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0420] Specifically, when the communication unit 1303 includes a sending unit and a receiving unit: the receiving unit is used to receive exception category information, flow matching information and a flow processing method; the processing unit is used to perform control on the user plane traffic according to the flow processing method if the user plane traffic matches the flow matching information and the terminal sending the user plane traffic matches the exception category information.

[0421] In a possible implementation manner, the processing unit is specifically configured to discard the user plane traffic if the flow processing method includes a discard operation; or to modify the quality of service of the user plane traffic if the flow processing method includes a quality of service modification operation.

[0422] Fig.13 When the device shown is a terminal, or an access network device, or a core network element, or a policy control network element, or a security detection network element, or a user plane network element, the specific beneficial effects of the method for determining the category information and the method for controlling terminal access used to execute can be referred to the relevant description in the aforementioned method embodiment, and will not be repeated here.

[0423] See also Fig.14As shown, it is a schematic diagram of a device provided by the present application, and the device can be the above-mentioned terminal, access network equipment, mobility management network element, policy control network element, user plane network element, or security detection network element. The device 1400 includes: a processor 1402, a communication interface 1403, and a memory 1401. Optionally, the device 1400 may also include a bus 1404. Among them, the communication interface 1403, the processor 1402 and the memory 1401 can be interconnected through a communication line 1404; the communication line 1404 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The communication line 1404 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.14 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0424] Processor 1402 may be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.

[0425] The communication interface 1403 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), wired access networks, etc.

[0426] The memory 1401 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a communication line 1404. The memory may also be integrated with the processor.

[0427] The memory 1401 is used to store computer-executable instructions for executing the solution of the present application, and the execution is controlled by the processor 1402. The processor 1402 is used to execute the computer-executable instructions stored in the memory 1401, thereby realizing the method for determining the category information and the method for controlling terminal access provided in the above-mentioned embodiment of the present application.

[0428] Optionally, the computer-executable instructions in the embodiments of the present application may also be referred to as application code, which is not specifically limited in the embodiments of the present application.

[0429] Those of ordinary skill in the art will appreciate that the various digital numbers such as the first and second involved in the present application are only for the convenience of description, and are not used to limit the scope of the embodiments of the present application, and also represent the order of precedence. "And / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one" refers to one or more. At least two refers to two or more. "At least one", "any one" or similar expressions refer to any combination of these items, including any combination of single items (individuals) or plural items (individuals). For example, at least one item (individual, kind) of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0430] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server, data center, etc. that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0431] The various illustrative logic units and circuits described in the embodiments of the present application can be implemented or operated by a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or the design of any combination of the above functions. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any traditional processor, controller, microcontroller or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration to implement.

[0432] The steps of the method or algorithm described in the embodiments of the present application can be directly embedded in the software unit executed by the hardware, the processor, or a combination of the two. The software unit can be stored in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM or other storage media of any form in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be arranged in an ASIC, and the ASIC can be arranged in a terminal. Optionally, the processor and the storage medium can also be arranged in different components in the terminal.

[0433] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0434] Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for determining category information, characterized in that: include: The security detection function network element sends a data collection service request message to the network device, wherein the data collection service request message includes a collection scope and a reporting condition; wherein the collection scope is used to indicate data collection according to terminal category information, and the reporting condition is used to indicate a condition for triggering reporting of traffic data; The security detection function network element receives a data collection service response message from the network device, the data collection service response message including first category information and traffic data corresponding to the first category information; wherein the traffic data of the terminal indicated by the first category information meets the reporting condition; The security detection function network element determines abnormality category information based on the traffic data; The security detection function network element sends the abnormality category information to the access and mobility management function network element or the policy control network element.

2. The method according to claim 1, wherein The abnormal category information is used to indicate a terminal with abnormal behavior.

3. The method according to claim 1, wherein The network device is the access and mobility management function network element, the session management function network element, the policy control network element or the user plane network element.

4. The method according to any one of claims 1 to 3, characterized in that: The abnormal category information is used by the access and mobility management function network element or the policy control network element to implement access control on terminals matching the abnormal category information.

5. The method according to any one of claims 1 to 3, characterized in that: The first category information is determined by device information of the terminal indicated by the first category information.

6. The method according to claim 4, wherein The first category information is determined by device information of the terminal indicated by the first category information.

7. The method according to claim 5, wherein The device information of the terminal indicated by the first category information includes a category allocation code TAC of the terminal indicated by the first category information.

8. The method according to claim 6, wherein The device information of the terminal indicated by the first category information includes a category allocation code TAC of the terminal indicated by the first category information.

9. A security detection function network element, characterized in that: The method comprises: a processor configured to read and execute instructions from a memory to implement the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that The method comprises instructions which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 8.

11. A computer program product, characterized in that The method comprises instructions which, when executed on a computer, perform the method according to any one of claims 1 to 8.

Images