Traffic anomaly processing method and apparatus, user plane function entity, and storage medium

Abstract

The application provides a traffic anomaly processing method and device, a user plane function entity and a storage medium, and relates to the technical field of communication. The method comprises the following steps: sending a policy acquisition request to a PCF, wherein the policy acquisition request comprises the identifier of a terminal device and the identifier of a first network slice, so that the PCF queries and returns the first user routing selection policy of the terminal device according to the identifier of the terminal device and the identifier of the first network slice; receiving a data packet for the terminal device, and judging whether the characteristics of the data packet meet the first user routing selection policy, wherein the data packet is a data packet sent by the terminal device or a data packet sent to the terminal device; and if the characteristics of the data packet do not meet the first user routing selection policy, determining that the traffic of the data packet is abnormal traffic and discarding the data packet. The application can identify and process abnormal service data streams, thereby avoiding the abnormal occupation of network resources.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically, to a method, apparatus, user plane functional entity, and storage medium for handling traffic anomalies. Background Technology

[0002] 5G (fifth-generation, 5G) local networks, also known as private 5G networks, use 5G technology to create a dedicated network at the local user site. This network has unified connectivity, optimized services, and secure communication methods within a specific area, and provides the high transmission speed, low latency, and massive connectivity features supported by 5G technology.

[0003] 5G network slicing divides a physical 5G network into multiple virtual networks, manages 5G network data separately, and maintains the logical independence between each virtual network. It can provide customized network services for different terminal devices without adding network architecture.

[0004] In existing technologies, for terminal devices that cannot support user routing policies, the generated business data will be transmitted through specific network slices, resulting in the resources within the network slice being occupied by illegal data, causing business anomalies. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of the prior art by providing a method, apparatus, user plane functional entity, and storage medium for handling abnormal traffic flow, so as to identify and process abnormal service data flows and prevent network resources from being abnormally occupied.

[0006] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows:

[0007] In a first aspect, embodiments of this application provide a traffic anomaly handling method applied to a User Plane Function (UPF), the method comprising:

[0008] Send a policy retrieval request to the local policy control function (PCF). The policy retrieval request includes: the identifier of the terminal device and the identifier of the first network slice, so that the PCF queries and returns the first user routing policy of the terminal device based on the identifier of the terminal device and the identifier of the first network slice.

[0009] Receive data packets for the terminal device and determine whether the characteristics of the data packets conform to the first user routing selection policy, wherein the data packets are: data packets sent by the terminal device, or data packets sent to the terminal device;

[0010] If the characteristics of the data packet do not match the first user routing selection policy, the traffic sending the data packet is determined to be abnormal traffic and the data packet is discarded.

[0011] Optionally, sending a policy acquisition request to the local policy control function (PCF), so that the PCF queries and returns the first user routing policy of the terminal device based on the identifier of the terminal device and the identifier of the first network slice, includes:

[0012] The local network management server and the network open function (NEF) forward a first policy retrieval request to the session management function (SMF). The SMF retrieves the user's permanent identifier from the terminal device's network address and then forwards a second policy retrieval request to the PCF via the NEF. This allows the PCF to query the first user routing policy based on the user's permanent identifier and the identifier of the first network slice. The first policy retrieval request includes the terminal device's network address and the identifier of the first network slice, and the second policy retrieval request includes the terminal device's user's permanent identifier and the identifier of the first network slice.

[0013] Receive the first user routing policy forwarded by the PCF through the NEF and the local network management server.

[0014] Optionally, determining whether the characteristics of the data packet conform to the first user routing selection policy includes:

[0015] Determine whether the identification characteristics of the data packet match the identification characteristics in the first user routing selection strategy;

[0016] If they match, determine whether the traffic characteristics of the data packet match the traffic characteristics in the first user routing selection strategy;

[0017] If the identification characteristics of the data packet do not conform to the identification characteristics in the first user routing policy, or if the identification characteristics of the data packet conform to the identification characteristics in the first user routing policy and the traffic characteristics of the data packet do not conform to the traffic characteristics in the first user routing policy, then it is determined that the characteristics of the data packet do not conform to the first user routing policy.

[0018] Optionally, the method further includes:

[0019] If the identification feature of the data packet matches the identification feature in the first user routing policy, and the traffic feature of the data packet matches the traffic feature in the first user routing policy, then it is determined that the features of the data packet match the first user routing policy.

[0020] The data packet is forwarded based on its address information.

[0021] Optionally, after discarding the data packet, the method further includes:

[0022] The NEF sends a user subscription information modification request to the Universal Data Management UDM. The user subscription information modification request includes the user permanent identifier, so that the UDM modifies the first network slice corresponding to the user permanent identifier to the second network slice, and notifies the SMF to establish the PDU session between the terminal device and the UPF on the second network slice.

[0023] Receive the second user routing selection policy corresponding to the second network slice sent by the local network management server.

[0024] Optionally, if the second network slice is the default network slice, receiving the second user routing selection policy corresponding to the second network slice sent by the local network management server includes:

[0025] The system receives PDU session modification confirmation information sent by the local network management server based on the UDM, and generates a second user routing selection policy based on the default network slice. The second user routing selection policy only includes: traffic characteristics.

[0026] Optionally, if the second network slice is not the default network slice, receiving the second user routing selection policy corresponding to the second network slice sent by the local network management server includes:

[0027] The system receives PDU session modification confirmation information sent by the local network management server based on the UDM, and queries the second user routing policy through the PCF based on the user permanent identifier and the identifier of the second network slice. The second user routing policy includes: identifier features and traffic features.

[0028] Secondly, embodiments of this application also provide a traffic anomaly handling device applied to a User Plane Function (UPF), the device comprising:

[0029] The policy acquisition request sending module is used to send a policy acquisition request to the local policy control function (PCF). The policy acquisition request includes: the identifier of the terminal device and the identifier of the first network slice, so that the PCF queries and returns the first user routing selection policy of the terminal device based on the identifier of the terminal device and the identifier of the first network slice.

[0030] The data packet determination module is used to receive data packets for the terminal device and determine whether the characteristics of the data packets conform to the first user routing selection strategy, wherein the data packet is: a data packet sent by the terminal device, or a data packet sent to the terminal device;

[0031] The packet dropping module is used to determine that the traffic sending the packet is abnormal traffic and drop the packet if the characteristics of the packet do not conform to the first user routing selection policy.

[0032] Optionally, the strategy acquisition request sending module includes:

[0033] A request sending unit is configured to forward a first policy acquisition request to a session management function (SMF) via a local network management server and a network open function (NEF). The SMF retrieves the user's permanent identifier from the terminal device's network address and then forwards a second policy acquisition request to the PCF via the NEF. This allows the PCF to query the first user routing policy based on the user's permanent identifier and the identifier of the first network slice. The first policy acquisition request includes the terminal device's network address and the identifier of the first network slice, and the second policy acquisition request includes the terminal device's user's permanent identifier and the identifier of the first network slice.

[0034] The policy receiving unit is used to receive the first user routing policy forwarded by the PCF through the NEF and the local network management server.

[0035] Optionally, the data packet determination module includes:

[0036] The identification feature determination unit is used to determine whether the identification feature of the data packet conforms to the identification feature in the first user routing selection strategy;

[0037] A traffic characteristic determination unit is used to determine whether the traffic characteristics of the data packet conform to the traffic characteristics in the first user routing selection strategy if the data packet is consistent with the traffic characteristics.

[0038] The determination result unit is used to determine that the characteristics of the data packet do not conform to the first user routing policy if the identification characteristics of the data packet do not conform to the identification characteristics in the first user routing policy, or if the identification characteristics of the data packet conform to the identification characteristics in the first user routing policy and the traffic characteristics of the data packet do not conform to the traffic characteristics in the first user routing policy.

[0039] Optionally, the determination result unit is further configured to determine that the characteristics of the data packet conform to the first user routing policy if the identification characteristics of the data packet conform to the identification characteristics in the first user routing policy and the traffic characteristics of the data packet conform to the traffic characteristics in the first user routing policy.

[0040] A data packet forwarding unit is used to forward the data packet according to the address information of the data packet.

[0041] Optionally, the device further includes:

[0042] The modification request sending module is also used to send a user subscription information modification request to the Universal Data Management UDM through the NEF. The user subscription information modification request includes the user permanent identifier, so that the UDM modifies the first network slice corresponding to the user permanent identifier to the second network slice, and notifies the SMF to establish the PDU session between the terminal device and the UPF on the second network slice.

[0043] The policy receiving module is used to receive the second user routing policy corresponding to the second network slice sent by the local network management server.

[0044] Optionally, if the second network slice is the default network slice, the policy receiving module is specifically used to receive the PDU session modification confirmation information sent by the local network management server based on the UDM, and generate a second user routing selection policy according to the default network slice. The second user routing selection policy only includes: traffic characteristics.

[0045] Optionally, if the second network slice is not the default network slice, the policy receiving module is specifically used to receive the PDU session modification confirmation information sent by the local network management server based on the UDM, and query the second user routing policy through the PCF according to the user permanent identifier and the identifier of the second network slice. The second user routing policy includes: identifier features and traffic features.

[0046] Thirdly, embodiments of this application also provide a user plane functional entity, including:

[0047] Transceiver, processor, and storage media;

[0048] The transceiver is used to receive and send data;

[0049] The storage medium stores program instructions executable by the processor;

[0050] The processor is used to invoke the program instructions stored in the storage medium to execute the steps of the traffic anomaly handling method as described in any of the first aspects.

[0051] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the traffic anomaly handling method as described in any of the first aspects.

[0052] The beneficial effects of this application are:

[0053] This application provides a method, apparatus, user plane function entity, and storage medium for handling abnormal traffic. By sending a policy acquisition request to the PCF (Programmable Flow Function), the PCF determines a first user routing policy based on the identifier of the terminal device and the identifier of a first network slice. The UPF (User Plane Function) then judges the characteristics of upstream and downstream data packets of the terminal device according to the first user routing policy. If the characteristics of a data packet do not conform to the first user routing policy, the traffic sending the data packet is determined to be abnormal traffic and the data packet is discarded. This embodiment targets terminal devices that lack the ability to process user routing policies. By utilizing user plane functions, it enables the detection of abnormal traffic using user routing policies, preventing abnormal traffic data packets from occupying network resources of the network slice and ensuring the reasonable use of network slice resources. Furthermore, it can achieve automated abnormal traffic detection and management without manual intervention. Attached Figure Description

[0054] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 A schematic diagram of the network architecture provided in the embodiments of this application;

[0056] Figure 2 This is a schematic diagram illustrating the correspondence between a PDU session and a network slice.

[0057] Figure 3 A flowchart illustrating a traffic anomaly handling method provided in an embodiment of this application;

[0058] Figure 4 A flowchart illustrating another traffic anomaly handling method provided in an embodiment of this application;

[0059] Figure 5 An interactive schematic diagram of a traffic anomaly handling method provided in an embodiment of this application;

[0060] Figure 6 A flowchart illustrating another traffic anomaly handling method provided in this application embodiment;

[0061] Figure 7 A flowchart illustrating another traffic anomaly handling method provided in an embodiment of this application;

[0062] Figure 8 An interactive schematic diagram of another traffic anomaly handling method provided in an embodiment of this application;

[0063] Figure 9 This is a schematic diagram of the structure of a flow anomaly processing device provided in an embodiment of this application;

[0064] Figure 10 This is a schematic diagram of the structure of a user-plane functional entity provided in an embodiment of this application. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0066] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0067] Furthermore, the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Additionally, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0068] It should be noted that, where there is no conflict, the features in the embodiments of this application can be combined with each other.

[0069] 5G (fifth-generation, 5G) local networks, also known as private 5G networks, use 5G technology to create a dedicated network at the local user site. This network has unified connectivity, optimized services, and secure communication methods within a specific area, and provides the high transmission speed, low latency, and massive connectivity features supported by 5G technology.

[0070] A 5G local network is built on 5G equipment, including 5G terminal devices, 5G wireless base stations, and 5G core network equipment. It belongs exclusively to the network owner, i.e., the local user, and can be independently managed and easily deployed. The 5G local network can be configured locally, and the network owner has complete control over the network, including security and network resource usage. The network owner can allocate higher priority to critical equipment for using network resources.

[0071] 5G local networks can be deployed in virtually any campus, corporate building, or public space, especially in specific areas where public 5G network deployment is slow, enabling rapid deployment. In Industrial Internet of Things (IIoT) scenarios, sensors are installed in factories to monitor environmental conditions, supporting quality control and customized manufacturing. Through 5G local networks, sensor data can be collected and analyzed, providing refined control over all aspects of factory operations. The analysis results can be transmitted to intelligent robots via the 5G local network, supporting product manufacturing or the transportation of goods within the factory. With the help of 5G local networks, workers can wear lightweight augmented reality devices to operate equipment in a virtual environment.

[0072] 5G network slicing divides a physical 5G network into multiple virtual networks, enabling differentiated management of 5G network data while maintaining the logical independence of each virtual network. This allows for customized network services to be provided to different terminal devices without adding new network architecture. For example, in industrial internet scenarios such as real-time high-definition video transmission, massive IoT terminal access, and low-latency precision control, 5G network slicing can virtually divide the 5G network into several virtual networks, each with characteristics such as enhanced mobile bandwidth, massive IoT connectivity, and ultra-reliable low-latency communication. These virtual networks can carry services in different scenarios, thereby meeting the differentiated needs of various situations.

[0073] Please refer to Figure 1 This is a schematic diagram of the network architecture provided in the embodiments of this application, such as... Figure 1 As shown, the network architecture may specifically include the following network elements:

[0074] 1. Terminal Equipment (UE): Also known as user equipment, terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, wireless communication equipment, user agent, or user device.

[0075] 2. Access Network (AN): Provides network access functionality to authorized users in a specific area and can use transmission tunnels of different qualities based on user level and service requirements. An access network that implements access network functions based on wireless communication technology can be called a Radio Access Network (RAN). The RAN manages radio resources, provides access services to terminals, and facilitates the forwarding of control signals and user data between terminals and the core network.

[0076] 3. Local network management server: In this embodiment, a 5G local network management server is used. Its role in the network architecture will be explained in detail when the solution of this application is introduced later.

[0077] 4. Network Exposure Function (NEF) entity: Used to securely expose services and capabilities provided by 3GPP network functions to the outside world.

[0078] 5. Session Management Function (SMF) entity: Primarily used for session management, UE Internet Protocol (IP) address allocation and management, selection of manageable user plane functions, policy control, or endpoints for charging function interfaces, and downlink data notification, etc. In this embodiment, it can be used to implement the functions of the session management network element.

[0079] 6. Policy Control Function (PCF) entity: A unified policy framework used to guide network behavior, providing policy rule information to control plane functional network elements (such as AMF, SMF, etc.).

[0080] 7. User Plane Function (UPF) Entity: This is the data plane gateway. It can be used for packet routing and forwarding, or for quality of service (QoS) processing of user plane data. User data can access the data network (DN) through this network element. In this embodiment, it can be used to implement the functions of a user plane gateway.

[0081] 8. Unified Data Management (UDM) stores users' static contract information and dynamic registration information, such as the AMF the user is currently connected to, the user's authentication status, or registration status.

[0082] 9. A data network (DN) is a network that provides services to users. Generally, the client is located at the UE (User Equipment), and the server is located in the data network. A data network can be a private network, such as a local area network (LAN), an external network not controlled by the operator, such as the Internet, or a dedicated network jointly deployed by the operator, such as for configuring IMS (IP Multimedia Core Network Subsystem) services.

[0083] For example, please refer to Figure 2 This is a schematic diagram illustrating the correspondence between a PDU session and a network slice, such as... Figure 2 As shown, each UE establishes a PDU session with the UPF in the 5G core network. Each PDU session corresponds to a network slice. When the UE communicates with the data network DN through the PDU session, it uses the network resources in the corresponding network slice.

[0084] like Figure 1 As shown, when establishing a PDU session between different UEs or different applications (APPs) within a single UE and the UPF in the 5G core network, a network slice is allocated to each PDU session. During network slice allocation, different types of network slices can be assigned to different PDU sessions according to network resource usage policies, namely dedicated network slices or default network slices. Dedicated network slices can only be used to transmit specific data.

[0085] For terminal devices that support User Routing Selection Policy (URSP), such as R16 devices, the PCF in the 5G core network issues URSP policies to this type of terminal. The URSP policies are used to judge the transmitted service data to ensure that legitimate data is transmitted through a dedicated network slice.

[0086] However, for terminal devices that cannot support URSP policies, such as some R15 devices, the generated service data will be transmitted through a dedicated network slice, causing the resources within that network slice to be occupied by illegal data, resulting in service anomalies.

[0087] Based on this, embodiments of this application propose to provide a traffic anomaly handling method, apparatus, user plane function entity, and storage medium. For terminal devices that cannot support URSP policies, the UPF obtains the URSP policy to determine the characteristics of data packets sent by the terminal device or data packets sent to the terminal device, and discards data packets that do not meet the network slice characteristic requirements of the terminal device, thereby preventing the network resources of the terminal device's network slice from being occupied by illegal service data.

[0088] Based on the above Figure 1 Based on the network architecture shown, embodiments of this application provide a method for handling traffic anomalies in a UPF within the aforementioned network architecture.

[0089] Please refer to Figure 3 This is a flowchart illustrating a traffic anomaly handling method provided in an embodiment of this application, as shown below. Figure 3 As shown, the method may include:

[0090] S10: Send a policy retrieval request to the PCF. The policy retrieval request includes the identifier of the terminal device and the identifier of the first network slice, so that the PCF can query and return the first user routing policy of the terminal device based on the identifier of the terminal device and the identifier of the first network slice.

[0091] In this embodiment, the PCF, as a policy control function entity in the 5G core network, is used to provide policies to other network elements. The PCF stores URSP policies pre-configured by the network administrator for multiple terminal devices according to service requirements. Since each terminal device may establish multiple PDU sessions with the UPF, the PCF may contain multiple URSP policies corresponding to network slices for each terminal device. In the PCF, the index field of the URSP policy is the identifier of the terminal device, and the policy configuration data of at least one URSP policy belonging to the terminal device's identifier includes the identifier of the network slice.

[0092] In some embodiments, when a UE initiates a PDU session establishment procedure with a UPF to establish a PDU session with the UPF, the 5G core network allocates a first network slice for the PDU session. This first network slice is a dedicated network slice used to transmit specific service data. After the UPF determines that a PDU session has been successfully established with the UE, it initiates a policy retrieval request to the PCF. This request carries the UE's identifier and the identifier of the first network slice. Upon receiving the policy retrieval request, the PCF, based on the UE's identifier, filters at least one URSP policy belonging to the UE from multiple URSP policies. Then, based on the identifier of the first network slice, it selects the first URSP policy from the at least one URSP policy and sends the first URSP policy to the UPF.

[0093] S20: Receive data packets for the terminal device and determine whether the characteristics of the data packets conform to the first user routing selection policy.

[0094] In this context, a data packet refers to either a data packet sent by a terminal device or a data packet sent to a terminal device. Data packets typically include information such as the source address and destination address.

[0095] In this embodiment, the data packets received by the UPF for the UE can be either data packets sent by the UE to the data network DN, or data packets sent by the data network DN to the UE. Data transmission between the UE and the data network DN consumes network resources of the first network slice. To prevent the network resources of the first network slice from being illegally occupied, the UPF needs to determine the legality of the data packets according to the first URSP policy upon receiving them. The first URSP policy includes data characteristics that allow data transmission using the first network slice. The UPF determines whether the data packets are legitimate by judging whether their characteristics conform to the data characteristics specified in the first URSP policy.

[0096] In some embodiments, the UPF includes a traffic anomaly detection module. After receiving the first URSP policy, the UPF sends the first URSP policy to the traffic anomaly detection module, which then determines the legality of the UE's uplink and downlink data packets based on the first URSP policy.

[0097] S30: If the characteristics of the data packet do not match the routing policy of the first user, determine that the traffic sending the data packet is abnormal traffic and discard the data packet.

[0098] In this embodiment, if it is determined that the characteristics of a data packet do not conform to the data characteristics specified by the first URSP policy, the data packet is determined to be an illegal data packet, the traffic that sends the data packet is abnormal traffic, and it cannot occupy the network resources of the first network slice for data transmission, so the data packet needs to be discarded.

[0099] In some possible implementations, if the characteristics of a data packet match the data characteristics specified by the first URSP policy, and the data packet is determined to be a legitimate data packet, and the traffic sending the data packet is normal traffic that can occupy the network resources of the first network slice for data transmission, then the UPF will send the data packet sent by the UE to the data network DN, or send the data packet sent by the data network DN to the UE.

[0100] The traffic anomaly handling method provided in the above embodiments sends a policy acquisition request to the PCF, enabling the PCF to determine a first user routing policy based on the identifier of the terminal device and the identifier of the first network slice. The UPF then judges the characteristics of upstream and downstream data packets of the terminal device according to the first user routing policy. If the characteristics of the data packets do not conform to the first user routing policy, the traffic sending the data packets is determined to be abnormal traffic, and the data packets are discarded. This embodiment is designed for terminal devices that do not have the ability to process user routing policies. It uses user plane functions to detect abnormal traffic using user routing policies, avoiding abnormal traffic data packets from occupying network slice network resources and ensuring the reasonable use of network slice network resources. Furthermore, it can achieve automated abnormal traffic detection and management without manual intervention.

[0101] Please refer to Figure 4 This is a flowchart illustrating another traffic anomaly handling method provided in an embodiment of this application, as shown below. Figure 4 As shown, the process of sending a policy acquisition request to the PCF in S10, so that the PCF queries and returns the first user routing policy of the terminal device based on the identifier of the terminal device and the identifier of the first network slice, may include:

[0102] S11: The first policy acquisition request is forwarded from the local network management server and NEF to the SMF. The SMF queries the user permanent identifier of the terminal device based on the network address of the terminal device, and then forwards the second policy acquisition request from the NEF to the PCF so that the PCF can query the first user routing selection policy based on the user permanent identifier and the identifier of the first network slice.

[0103] The first policy acquisition request includes: the network address of the terminal device and the identifier of the first network slice; the second policy acquisition request includes: the user permanent identifier of the terminal device and the identifier of the first network slice.

[0104] like Figure 1 As shown, after confirming the successful establishment of the PDU session, the UPF sends a first policy retrieval request to the local network management server, instructing the UPF to retrieve the URSP policy for the UE. The first policy retrieval request includes the UE's network address (Internet Protocol Address, IP address) and the identifier of the first network slice. Upon receiving the first policy retrieval request, the local network management server extracts the UE's IP address and the identifier of the first network slice from the request and sends a first policy retrieval request to the local NEF, requesting the UE's URSP policy.

[0105] After receiving the request from the local network management server, the local NEF extracts the UE's IP address from the request and sends an identifier retrieval request to the local SMF, requesting to obtain the UE's User Permanent Identifier (SUPI). The identifier retrieval request includes the UE's IP address.

[0106] The local SMF stores the mapping between the terminal device's IP address and SUPI. After receiving the identifier acquisition request sent by the local NEF, the local SMF extracts the IP address in the identifier acquisition request, uses the IP address as an index to query the UE's SUPI, and returns the queried UE's SUPI to the local NEF.

[0107] Subsequently, after receiving the UE's SUPI returned by the local SMF, the local NEF sends a second policy retrieval request to the local PCF. This request carries the UE's SUPI and the identifier of the first network slice. In the PCF, the index field of the URSP policy is the terminal device's SUPI, and the policy configuration data of at least one URSP policy belonging to the terminal device's SUPI contains the network slice identifier. Upon receiving the second policy retrieval request, the PCF, based on the UE's SUPI, filters at least one URSP policy belonging to the UE from multiple URSP policies, and then, based on the identifier of the first network slice, retrieves the first URSP policy from the at least one URSP policy.

[0108] S12: Receive the first user routing policy forwarded by PCF through NEF and the local network management server.

[0109] In this embodiment, the PCF returns the first URSP policy found to the local NEF, which then forwards the first URSP policy to the local network management server, which in turn forwards it to the UPF.

[0110] For example, please refer to Figure 5 This is an interactive schematic diagram of a traffic anomaly handling method provided in an embodiment of this application, such as... Figure 5 As shown, the process may include:

[0111] S101: UPF sends a first policy acquisition request to the local network management server.

[0112] S102: The local network management server sends a first policy acquisition request to NEF.

[0113] S103: NEF sends an identifier acquisition request to SMF.

[0114] S104: SMF queries the UE's SUPI based on the UE's IP address.

[0115] S105: SMF returns the SUPI of the UE obtained from the query to NEF.

[0116] S106: NEF sends a second policy acquisition request to PCF.

[0117] S107: PCF queries the first URSP policy based on the UE's SUPI and the identifier of the first network slice.

[0118] S108: PCF sends the first URSP policy it has queried to NEF.

[0119] S109: NEF forwards the first URSP policy to the local network management server.

[0120] S110: The local network management server forwards the first URSP policy to the UPF.

[0121] S111: UPF performs traffic anomaly detection based on the first URSP policy.

[0122] The traffic anomaly handling method provided in the above embodiments is designed for terminal devices that do not have the ability to process user routing policies. By communicating with each other in the core network, the user routing policy of the UE is obtained, and the abnormal traffic is detected using the user routing policy. This avoids abnormal traffic data packets occupying network resources of the network slice and ensures the reasonable use of network resources of the network slice. Moreover, it can realize automated abnormal traffic detection and management without manual intervention.

[0123] Please refer to Figure 6 This is a flowchart illustrating another traffic anomaly handling method provided in an embodiment of this application, as shown below. Figure 6 As shown, the process of determining whether the characteristics of the data packet conform to the first user routing selection policy in S20 above may include:

[0124] S21: Determine whether the identification characteristics of the data packet match the identification characteristics in the first user routing selection policy.

[0125] S22: If it matches, determine whether the traffic characteristics of the data packet match the traffic characteristics in the first user routing selection strategy.

[0126] S23: If the identification characteristics of the data packet do not conform to the identification characteristics in the first user routing policy, or if the identification characteristics of the data packet conform to the identification characteristics in the first user routing policy and the traffic characteristics of the data packet do not conform to the traffic characteristics in the first user routing policy, it is determined that the characteristics of the data packet do not conform to the first user routing policy.

[0127] In this embodiment, the first URSP policy specifies the identification features and traffic features that data packets transmitted through the first network slice must possess. After receiving upstream and downstream data packets from the UE, the UPF first parses the identification features of the data packets to determine whether the identification features of the data packets meet the identification features specified in the first URSP policy.

[0128] If the identification characteristics of a data packet do not meet the identification characteristics specified in the first URSP policy, then the characteristics of the data packet are directly determined to be inconsistent with the first user routing policy, and the data packet is an illegal data packet. There is no need to judge the traffic characteristics of the data packet.

[0129] If the identification characteristics of the data packet meet the identification characteristics specified in the first URSP policy, then it is determined whether the traffic characteristics of the data packet meet the traffic characteristics specified in the first URSP policy. If the traffic characteristics of the data packet do not meet the traffic characteristics specified in the first URSP policy, then it is determined that the characteristics of the data packet do not meet the first user routing selection policy, and the traffic required to send the data packet is determined to be illegal traffic. The data packet is then directly discarded and no longer occupies the network resources of the first network slice for data transmission.

[0130] For example, the traffic characteristics of a data packet include: the peak rate and average rate required during data packet transmission. The identification characteristics of a data packet include: a Layer 2 frame header, a Layer 3 IP header, and a Layer 4 frame header. The Layer 2 frame header includes: the destination MAC (Media Access Control) address, the source MAC address, and the Virtual LAN ID (VLAN ID). The Layer 3 frame header includes: the destination IP address and the source IP address. The Layer 4 frame header includes: the destination port number, the source port number, and the protocol type. All of the above identification characteristics in the data packet must match the first URSP policy.

[0131] In some embodiments, such as Figure 6 As shown, the method may further include:

[0132] S24: If the identification characteristics of the data packet match the identification characteristics in the first user routing policy, and the traffic characteristics of the data packet match the traffic characteristics in the first user routing policy, then the characteristics of the data packet match the first user routing policy.

[0133] S25: Forward the data packet based on the address information of the data packet.

[0134] In this embodiment, if the identification characteristics of a data packet satisfy the identification characteristics specified in the first URSP policy, and the traffic characteristics of the data packet also satisfy the traffic characteristics specified in the first URSP policy, then the data packet is determined to conform to the first URSP policy, and the data packet is a legitimate data packet. The UPF forwards the data packet through the first network slice according to the destination IP address recorded in the data packet. For example, if the data packet is an uplink data packet sent by the UE to the data network DN, the UPF determines that the data packet received from the UE is a legitimate data packet and forwards the data packet to the data network DN; if the data packet is a downlink data packet sent by the data network DN to the UE, the UPF determines that the data packet received from the data network DN is a legitimate data packet and forwards the data packet to the UE.

[0135] The traffic anomaly handling method provided in the above embodiments uses a user routing selection strategy to judge both the identification characteristics and traffic characteristics of data packets, thereby improving the accuracy of detecting abnormal traffic, preventing the illegal occupation of network resources of network slices, and ensuring the reasonable use of network resources of network slices.

[0136] Please refer to Figure 7 This is a flowchart illustrating another traffic anomaly handling method provided in an embodiment of this application, as shown below. Figure 7 As shown, the method may further include:

[0137] S40: Send a user subscription information modification request to UDM via NEF. The user subscription information modification request includes: user permanent identifier, so that UDM modifies the first network slice corresponding to the user permanent identifier to the second network slice, and notifies SMF to establish the PDU session between the terminal device and UPF on the second network slice.

[0138] In this embodiment, if the UPF determines that the data packet for the UE is an illegal data packet according to the first URSP policy, and determines that the first network slice allocated for the PDU session between the UE and the UPF does not meet the data transmission requirements of the UE, a new network slice needs to be allocated for the PDU session between the UE and the UPF.

[0139] Specifically, after the UPF determines that the data packet is an illegal data packet, it sends a traffic anomaly detection alarm message to the local network management server. The traffic anomaly detection alarm message includes the UE's IP address. The local network management server reads the UE's IP address from the traffic anomaly detection alarm message and sends a network slice update request to the NEF. The network slice update request includes the UE's IP address. The NEF then executes the above S103-S105 process again to obtain the UE's SUPI from the SMF.

[0140] Subsequently, the NEF sends a user subscription information modification request to the UDM, requesting the UDM to modify the network slice occupied by the PDU session. The user subscription information modification request includes the UE's SUPI. The UDM queries the UE's user subscription information based on the UE's SUPI and modifies the identifier of the first network slice corresponding to the UE's PDU session in the user subscription information to the identifier of the second network slice.

[0141] In some embodiments, after determining that a data packet is an illegal data packet, the UPF can determine a second network slice that can provide legitimate network resources to the UE from multiple network slices, and carry the identifier of the second network slice in the network slice update request and the user subscription information modification request, so that the UDM can modify the identifier of the first network slice corresponding to the UE's PDU session to the identifier of the second network slice.

[0142] In other embodiments, if the UPF does not have the function of re-selecting a second network slice that can provide legitimate network resources for the UE, the UDM directly modifies the identifier of the first network slice corresponding to the UE's PDU session to the identifier of the default network slice, that is, the second network slice is the default network slice.

[0143] After the UDM modifies the UE's user subscription information, it sends the modified user subscription information to the SMF to notify the SMF to modify the PDU session, so that the PDU session is established on the second network slice and uses the network resources of the second network slice for data transmission.

[0144] S50: Receive the second user routing selection policy corresponding to the second network slice sent by the local network management server.

[0145] In this embodiment, after the UDM determines that the SMF has completed the PDU session modification, it sends a PDU session modification confirmation message to the NEF. The NEF then sends the PDU session modification confirmation message to the local network management server. Based on the PDU session modification confirmation message, the local network management server determines the second network slice established by the PDU session and sends the second URSP policy corresponding to the second network slice to the UPF. When the UPF receives new upstream and downstream data packets from the UE, it determines whether the upstream and downstream data packets are valid according to the second URSP policy.

[0146] In some embodiments, the second user routing policy corresponding to the second network slice sent by the local network management server in S50 above may include:

[0147] Receive PDU session modification confirmation information sent by the local network management server based on UDM, and generate a second user routing policy based on the default network slice. The second user routing policy only includes: traffic characteristics.

[0148] Specifically, if the UDM modifies the identifier of the first network slice corresponding to the UE's PDU session to the identifier of the default network slice, so that the PDU session is established on the default network slice, the local network management server directly sends the second URSP policy corresponding to the default network slice to the UPF based on the identifier of the default network slice in the PDU session modification confirmation information. The second URSP policy corresponding to the default network slice specifies that it will not judge the identifier characteristics of the UE's uplink and downlink data packets. That is, the second URSP policy corresponding to the default network slice only includes traffic characteristics, and the UPF judges only the traffic characteristics of uplink and downlink data packets based on the second URSP policy.

[0149] In other embodiments, the second user routing policy corresponding to the second network slice sent by the local network management server in S50 above may include:

[0150] Receive PDU session modification confirmation information sent by the local network management server based on UDM, and query the second user routing policy through PCF based on the user's permanent identifier and the identifier of the second network slice. The second user routing policy includes: identifier characteristics and traffic characteristics.

[0151] Specifically, if the UDM modifies the identifier of the first network slice corresponding to the UE's PDU session to the identifier of a second network slice other than the default network slice, so that the PDU session is established on the second network slice, then the local network management server executes the above S11-S12 process according to the identifier of the second network slice in the PDU session modification confirmation information, obtains the second URSP policy corresponding to the identifier of the second network slice, and sends the second URSP policy to the UPF. The identifier characteristics and traffic characteristics specified in the second URSP policy are different from those specified in the first URSP policy.

[0152] Please refer to Figure 8 This is an interactive schematic diagram of another traffic anomaly handling method provided in an embodiment of this application, such as... Figure 8 As shown, the process may include:

[0153] S201: UPF sends a traffic anomaly detection alarm to the local network management server.

[0154] S202: The local network management server sends a network slice update request to NEF.

[0155] S203: NEF sends an identifier acquisition request to SMF.

[0156] S204: SMF queries the UE's SUPI based on the UE's IP address.

[0157] S205: SMF returns the SUPI of the UE found in the query to NEF.

[0158] S206: NEF sends a request to UDM to modify user subscription information.

[0159] S207: UDM notifies SMF to modify the PDU session so that the PDU session is established on the second network slice.

[0160] S208: After confirming that the SMF has completed the PDU session modification, the UDM sends a PDU session modification confirmation message to the NEF.

[0161] S209: NEF sends a PDU session modification confirmation message to the local network management server.

[0162] S210: The local network management server sends the second URSP policy corresponding to the second network slice to the UPF.

[0163] S211: UP determines whether upstream and downstream data packets are valid based on the second URSP policy.

[0164] The traffic anomaly handling method provided in the above embodiments, after determining that the data packet is invalid, modifies the identifier of the network slice to which the terminal device belongs through UDM, re-establishes the PDU session on the new network slice, and sends the URSP policy corresponding to the new network slice to UPF, so that UPF uses the new URSP policy to judge the legality of data packets transmitted through the new network slice, thereby realizing automated abnormal traffic detection and management without manual intervention to adjust the network slice and URSP policy, and can avoid abnormal traffic data packets occupying the network resources of the network slice, ensuring the reasonable use of the network resources of the network slice.

[0165] Based on the above embodiments, this application also provides a traffic anomaly handling device applied to the User Plane Function (UPF). Please refer to... Figure 9 This is a schematic diagram of the structure of a traffic anomaly processing device provided in an embodiment of this application, as shown below. Figure 9 As shown, the device includes:

[0166] The policy acquisition request sending module 10 is used to send a policy acquisition request to the local policy control function (PCF). The policy acquisition request includes the identifier of the terminal device and the identifier of the first network slice, so that the PCF can query and return the first user routing policy of the terminal device based on the identifier of the terminal device and the identifier of the first network slice.

[0167] The data packet judgment module 20 is used to receive data packets for the terminal device and judge whether the characteristics of the data packets conform to the first user routing selection strategy, wherein the data packet is: a data packet sent by the terminal device, or a data packet sent to the terminal device;

[0168] The packet dropping module 30 is used to determine that the traffic sending the packet is abnormal traffic and to drop the packet if the characteristics of the packet do not conform to the first user routing selection policy.

[0169] Optionally, the policy acquisition request sending module 10 includes:

[0170] The request sending unit is used to forward a first policy acquisition request to the session management function (SMF) through the local network management server and the network open function (NEF). The SMF queries the user permanent identifier of the terminal device based on the network address of the terminal device, and then forwards a second policy acquisition request to the PCF through the NEF, so that the PCF can query the first user routing policy based on the user permanent identifier and the identifier of the first network slice. The first policy acquisition request includes the network address of the terminal device and the identifier of the first network slice, and the second policy acquisition request includes the user permanent identifier of the terminal device and the identifier of the first network slice.

[0171] The policy receiving unit is used to receive the first user routing policy forwarded by the PCF through the NEF and the local network management server.

[0172] Optionally, the data packet judgment module 20 includes:

[0173] The identification feature determination unit is used to determine whether the identification feature of the data packet conforms to the identification feature in the first user routing selection strategy;

[0174] The traffic characteristic judgment unit is used to determine whether the traffic characteristics of the data packet match the traffic characteristics in the first user routing selection strategy if the data packet matches.

[0175] The judgment result determination unit is used to determine that the characteristics of the data packet do not conform to the first user routing policy if the identification characteristics of the data packet do not conform to the identification characteristics in the first user routing policy, or if the identification characteristics of the data packet conform to the identification characteristics in the first user routing policy and the traffic characteristics of the data packet do not conform to the traffic characteristics in the first user routing policy.

[0176] Optionally, the determination result unit is further configured to determine that the characteristics of the data packet conform to the first user routing selection strategy if the identification characteristics of the data packet conform to the identification characteristics in the first user routing selection strategy and the traffic characteristics of the data packet conform to the traffic characteristics in the first user routing selection strategy.

[0177] The packet forwarding unit is used to forward data packets based on their address information.

[0178] Optionally, the device also includes:

[0179] The modification request sending module is also used to send a user subscription information modification request to the Universal Data Management UDM via NEF. The user subscription information modification request includes: a user permanent identifier, so that the UDM modifies the first network slice corresponding to the user permanent identifier to the second network slice, and notifies the SMF to establish the PDU session between the terminal device and the UPF on the second network slice.

[0180] The policy receiving module is used to receive the second user routing policy corresponding to the second network slice sent by the local network management server.

[0181] Optionally, if the second network slice is the default network slice, the policy receiving module is specifically used to receive the PDU session modification confirmation information sent by the local network management server based on UDM, and generate a second user routing selection policy based on the default network slice. The second user routing selection policy only includes: traffic characteristics.

[0182] Optionally, if the second network slice is not the default network slice, the policy receiving module is specifically used to receive the PDU session modification confirmation information sent by the local network management server based on UDM, and query the second user routing policy through PCF based on the user permanent identifier and the identifier of the second network slice. The second user routing policy includes: identifier features and traffic features.

[0183] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.

[0184] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).

[0185] Please refer to Figure 10This is a schematic diagram of the structure of a user plane functional entity provided in an embodiment of this application, such as... Figure 10 As shown, the user plane function entity 100 includes a transceiver 101, a processor 102, and a storage medium 103. The transceiver 101 is used to receive and send data. The storage medium stores program instructions executable by the processor 102. The processor 102 executes the program instructions to perform the steps of the traffic anomaly handling method described above in any embodiment of the UPF. The specific implementation and technical effects are similar and will not be repeated here.

[0186] Optionally, embodiments of this application also provide a computer-readable storage medium storing a computer program. When the computer program is run by a processor, the processor executes the steps of the traffic anomaly handling method in any of the above embodiments. The specific implementation and technical effects are similar and will not be described again here.

[0187] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0188] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0189] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0190] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0191] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A traffic anomaly handling method, characterized by, The method is applied to a user plane function (UPF), and the method comprises the following steps: sending a policy obtaining request to a local policy control function (PCF), wherein the policy obtaining request comprises an identifier of a terminal device and an identifier of a first network slice, so that the PCF queries and returns a first user routing selection policy of the terminal device according to the identifier of the terminal device and the identifier of the first network slice; receiving a data packet for the terminal device, and determining whether a feature of the data packet conforms to the first user routing selection policy, wherein the data packet is a data packet sent by the terminal device or a data packet sent to the terminal device; if the feature of the data packet does not conform to the first user routing selection policy, determining that traffic of the data packet is abnormal traffic and discarding the data packet; the step of determining whether the feature of the data packet conforms to the first user routing selection policy comprises the following steps: determining whether an identifier feature of the data packet conforms to an identifier feature in the first user routing selection policy; if yes, determining whether a traffic feature of the data packet conforms to a traffic feature in the first user routing selection policy; if the identifier feature of the data packet does not conform to the identifier feature in the first user routing selection policy, or the identifier feature of the data packet conforms to the identifier feature in the first user routing selection policy and the traffic feature of the data packet does not conform to the traffic feature in the first user routing selection policy, determining that the feature of the data packet does not conform to the first user routing selection policy.

2. The method of claim 1, wherein, the step of sending the policy obtaining request to the local PCF so that the PCF queries and returns the first user routing selection policy of the terminal device according to the identifier of the terminal device and the identifier of the first network slice comprises the following steps: forwarding a first policy obtaining request to a session management function (SMF) through a local network management server and a network exposure function (NEF), wherein the SMF queries a user permanent identifier of the terminal device according to a network address of the terminal device, forwards a second policy obtaining request to the PCF through the NEF, so that the PCF queries the first user routing selection policy according to the user permanent identifier and the identifier of the first network slice, wherein the first policy obtaining request comprises the network address of the terminal device and the identifier of the first network slice, and the second policy obtaining request comprises the user permanent identifier of the terminal device and the identifier of the first network slice; receiving the first user routing selection policy forwarded by the PCF through the NEF and the local network management server.

3. The method of claim 1, wherein, The method further comprises the following steps: if the identifier feature of the data packet conforms to the identifier feature in the first user routing selection policy and the traffic feature of the data packet conforms to the traffic feature in the first user routing selection policy, determining that the feature of the data packet conforms to the first user routing selection policy; forwarding the data packet according to address information of the data packet.

4. The method of claim 2, wherein, After the step of discarding the data packet, the method further comprises the following steps: sending, by the NEF, a user subscription information modification request to a universal data management (UDM), the user subscription information modification request including the user permanent identifier, so that the UDM modifies a first network slice corresponding to the user permanent identifier to a second network slice and notifies the SMF to establish a PDU session between the terminal device and the UPF on the second network slice; receiving a second user routing policy corresponding to the second network slice sent by the local network management server.

5. The method of claim 4, wherein, If the second network slice is a default network slice, the receiving the second user routing policy corresponding to the second network slice sent by the local network management server includes: receiving, by the local network management server, a PDU session modification confirmation information sent by the UDM, and generating a second user routing policy according to the default network slice, the second user routing policy including only traffic characteristics.

6. The method of claim 4, wherein, If the second network slice is not a default network slice, the receiving the second user routing policy corresponding to the second network slice sent by the local network management server includes: receiving, by the local network management server, a PDU session modification confirmation information sent by the UDM, and querying the second user routing policy according to the user permanent identifier and the identifier of the second network slice through the PCF, the second user routing policy including identifier characteristics and traffic characteristics.

7. A traffic anomaly processing apparatus characterized by comprising: An apparatus applied to a user plane function (UPF), the apparatus comprising: a policy obtaining request sending module configured to send a policy obtaining request to a local policy control function (PCF), the policy obtaining request including an identifier of a terminal device and an identifier of a first network slice, so that the PCF queries and returns a first user routing policy of the terminal device according to the identifier of the terminal device and the identifier of the first network slice; a data packet judging module configured to receive a data packet for the terminal device and judge whether a characteristic of the data packet conforms to the first user routing policy, wherein the data packet is a data packet sent by the terminal device or a data packet sent to the terminal device; a data packet discarding module configured to, if the characteristic of the data packet does not conform to the first user routing policy, determine that traffic of the data packet is abnormal traffic and discard the data packet; the data packet judging module includes: an identifier characteristic judging unit configured to judge whether an identifier characteristic of the data packet conforms to an identifier characteristic in the first user routing policy; a traffic characteristic judging unit configured to, if the judgment result is yes, judge whether a traffic characteristic of the data packet conforms to a traffic characteristic in the first user routing policy. A judgment result determining unit is configured to determine that the feature of the data packet does not conform to the first user routing strategy if the identification feature of the data packet does not conform to the identification feature in the first user routing strategy, or the identification feature of the data packet conforms to the identification feature in the first user routing strategy and the traffic feature of the data packet does not conform to the traffic feature in the first user routing strategy.

8. A user plane function entity, comprising: The application further provides a device for implementing the traffic anomaly processing method. The device comprises a transceiver, a processor and a storage medium. The transceiver is configured to receive and send data. The storage medium stores program instructions executable by the processor. The processor is configured to invoke the program instructions stored in the storage medium to execute the steps of the traffic anomaly processing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and the computer program is executed by the processor to execute the steps of the traffic anomaly processing method according to any one of claims 1 to 6.

Images