A method, system, medium and device for testing PFCP protocol data

Abstract

The application belongs to the technical field of communication security, and provides a PFCP protocol data test method, system, medium and equipment. The method comprises the following steps: obtaining actual network parameters, simulating session messages between UPF and SMF network elements in PFCP protocol communication; forging UPF or SMF network elements and sending a preset command to a peer network element; the actual network parameters are injected into the preset command; testing whether the tested network element can identify the legitimacy of the source of the forged message; and performing a matching reinforcement processing measure on the corresponding network element according to the test result.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of communication security, and particularly relates to a PFCP protocol data test method, system, medium and equipment. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute prior art.

[0003] 5G network adopts SBA service architecture, and the interaction between the NFS of the control plane NF is based on the calling mode of the service interface. Although the service interface has advantages in information interaction and readability, there are more redundant contents in transmission, and there is a large performance consumption for device coding and interpretation. Therefore, 5G network still maintains the use of non-service interface on part of the interface, especially for the N4 interface between SMF and UPF, which needs to transfer a large amount of business and policy information, and the logic is relatively complex, and the use of non-service interface of PFCP (Packet Forwarding Control Protocol) protocol can effectively improve the transmission efficiency.

[0004] Based on Figure 1 The packet forwarding model of UPF Session, UPF receives user plane message (user plane traffic flow) from SMF through N4 interface, and finally realizes data distribution according to rules. PFCP Session is mainly used for transmitting Node Management, Session Management and UP Message Report between CP and UP. The rules for interaction between CP and UP include: identification (PDRs, Packet Detection Rules, data packet discovery rules), forwarding (FARs, Forwarding Action Rules, forwarding operation rules), buffering (BARs, Buffering Action Rules, buffering operation rules), marking (QERs, QoS Enforcement Rules, Qos implementation rules), reporting (URRs, Usage Reporting Rules, usage reporting rules), multi-access (MAR, Multi-Access Rule, multi-access rule) data packet.

[0005] The inventors find that the prior art does not consider the security risks that may exist between the UPF and the SMF in the UPF and SMF communication process in the PFCP protocol, so that after an attacker establishes a connection with the UPF by using a fake SMF, the attacker may guide the forwarding position of a user plane data packet by using a session modification process to perform data stealing, or may cause some users to be denied service by using a session deletion process. Therefore, the security of the PFCP protocol is reduced. SUMMARY

[0006] To solve the technical problems in the background art, the present application provides a PFCP protocol data test method, system, medium and device, which can detect the robustness of a communication network element under test in processing PFCP protocol data, and whether overload control protection is effective.

[0007] To achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0008] The first aspect of the present application provides a PFCP protocol data test method.

[0009] In one or more embodiments, a PFCP protocol data test method is provided, which is executed in a test controller and includes:

[0010] Obtaining actual network parameters, simulating session messages between UPF and SMF network elements in PFCP protocol communication;

[0011] Faking a UPF or SMF network element and sending a preset command to the opposite network element; wherein the preset command has actual network parameters injected therein;

[0012] Testing whether the network element under test can identify the legitimacy of the source of the fake message;

[0013] According to the test result, corresponding reinforcement processing measures are taken for the corresponding network element.

[0014] As an implementation mode, the preset command includes a PFCP session deletion command, a coupling update-coupling release command, a session forwarding command and a coupling release attack command.

[0015] As an implementation mode, when the preset command is a PFCP session deletion command, it is checked whether the UPF will normally reply to the corresponding message, and the Cause field content in the reply message is parsed to determine whether the user PFCP session is deleted.

[0016] As an implementation mode, if the UPF has normally processed the PFCP session deletion message, the reply message Cause field content is Request accepted and the corresponding PFCP session has been deleted, which indicates that the fake SMF network element attack is successful, and the UPF needs to be subjected to targeted reinforcement processing.

[0017] As an implementation form, when the preset command is the coupling update-coupling release command, if the SMF normally responds to the fake UPF coupling update-coupling release request message, actively issues the session deletion request and the coupling deletion request message to the UPF after receiving the request, and the UPF successfully responds to the coupling update-coupling release command, it indicates that the SMF network element does not check the source of the coupling update-coupling release request message, and the UPF needs to be processed for targeted reinforcement.

[0018] As an implementation form, when the preset command is the session forwarding command, if the UPF accepts the message and modifies the forwarding rule of the corresponding PFCP session to forward the user downlink data to an illegal IP, the attack is successful, and the UPF needs to be taken for targeted reinforcement measures to avoid illegal modification of the forwarding strategy; if the UPF discards the message without processing, it indicates that the UPF can identify the illegal SMF network element message.

[0019] As an implementation form, when the preset command is the coupling release attack command, if the UPF has coupled the release attack message and deleted all PFCP sessions in the coupling, it indicates that the coupling release attack is successful, and the UPF needs to be processed for targeted reinforcement.

[0020] As an implementation form, the test method of the PFCP protocol data further includes:

[0021] The simulation PFCP protocol communication network element sends the set traffic PFCP protocol data packet to the UPF and the SMF network element, and detects whether the corresponding network element appears abnormity based on the traffic detection baseline.

[0022] The second aspect of the application provides a test system of PFCP protocol data.

[0023] In one or more embodiments, a test system of PFCP protocol data includes:

[0024] A session message simulation module is used to obtain actual network parameters, simulate the session message between the UPF and the SMF network element in the PFCP protocol communication;

[0025] A fake network element command sending module is used to fake the UPF or the SMF network element and send a preset command to the opposite network element; wherein the actual network parameters are injected in the preset command;

[0026] A network element test module is used to test whether the tested network element can identify the legitimacy of the source of the fake message;

[0027] A reinforcement processing module is used to take matching reinforcement processing measures for the corresponding network element according to the test result.

[0028] A third aspect of the present application provides a computer readable storage medium.

[0029] A computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the method for testing PFCP protocol data as described above.

[0030] A fourth aspect of the present application provides a computer device.

[0031] A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the method for testing PFCP protocol data as described above when executing the program.

[0032] Compared with the prior art, the present application has the following advantages:

[0033] (1) The present application sends a large flow of PFCP protocol data to the tested network element device through the test tool, and achieves the effect of generating an attack on the tested network element by setting the test script parameters to increase the packet sending rate, so as to detect the robustness of the tested communication network element in processing PFCP protocol data, and whether the overload control protection is effective.

[0034] (2) The present application sends PFCP protocol operation type messages to the tested device through the test tool, achieves the effect of penetration testing by forging UPF or SMF network elements, detects whether the tested network element can identify the legitimacy of the source of the forged message, and detects whether the UPF network element and the SMF network element perform authentication and business logic protection during the PFCP protocol communication process.

[0035] (3) Compared with the prior art, this method actively simulates an attack scene and finds weak points of the tested device, and is more targeted. At the same time, due to the deep integration of 5G technology and vertical industries, 5G private network construction is rapidly developing, and in the face of possible system upgrades, new business online, and other situations, this testing method can provide a network security testing and verification method that is fast and effective, low in cost, low in technical threshold, and good in scalability for vertical industries.

[0036] The advantages of the additional aspects of the present application will be partially given in the following description, partially become obvious from the following description, or be understood through the practice of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0037] The accompanying drawings, which form a part of the present application, are included to provide a further understanding of the application, and are incorporated herein for purposes of explanation, but are not intended to limit the present application.

[0038] Figure 1Packet forwarding model of UPF Session;

[0039] Figure 2 N4 interface session deletion general test of the embodiment of the application;

[0040] Figure 3 N4 interface coupling update general test of the embodiment of the application;

[0041] Figure 4 N4 interface coupling update large flow test of the embodiment of the application;

[0042] Figure 5 N4 interface session forwarding test of the embodiment of the application;

[0043] Figure 6 N4 interface coupling release attack of the embodiment of the application;

[0044] Figure 7 Coupling update request message large flow data of the embodiment of the application;

[0045] Figure 8 N4 interface data flow coupling update request message (carrying coupling deletion request) of the embodiment of the application;

[0046] Figure 9 N4 interface data flow coupling update response message of the embodiment of the application;

[0047] Figure 10 N4 interface data flow coupling update-coupling release processing process of the embodiment of the application;

[0048] Figure 11 Interruption by service terminal Ping service server of the embodiment of the application;

[0049] Figure 12 A test method flow chart of PFCP protocol data of the embodiment of the application. DETAILED DESCRIPTION

[0050] The application will be further described below in conjunction with the accompanying drawings and embodiments.

[0051] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as generally understood by those skilled in the art to which the application belongs.

[0052] It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments in accordance with the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, steps, operations, elements, components, and / or groups thereof, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or groups thereof.

[0053] Terminology:

[0054] PDR: Packet Detection Rule, packet detection rule, used to indicate how the UPF detects and classifies data packets.

[0055] FAR: Forwarding Action Rule, forwarding action rule, used to indicate how the UPF forwards data packets detected by the PDR.

[0056] BAR: Buffering Action Rule, buffering action rule, used to indicate how the UPF buffers data packets identified by the PDR.

[0057] QER: QoS Enforcement Rule, QoS (Quality of Service) enforcement rule, used to indicate how the UPF performs QoS policy on data packets identified by the PDR.

[0058] URR: Usage Reporting Rule, usage reporting rule, used to indicate how the UPF reports usage statistics of services identified by the PDR.

[0059] The security risks that may exist in the communication process between the UPF and the SMF include: the UPF directly communicates with the operator data network, and the port thereof may be exposed to the public network, based on the 5GC control plane and user plane separation architecture, the UPF needs to be sunk to the network edge, and the exposure risk is increased. The establishment process of N4 is issued to the UPF by the SMF, and if there is no perfect network element authentication mechanism configured in the UPF, an attacker can initiate an attack to the UPF by faking the SMF. In order to solve the problems mentioned in the background art, the present application provides a PFCP protocol data test method, system, medium and equipment.

[0060] Embodiment one

[0061] As shown in Figure 12 The present embodiment provides a PFCP protocol data test method, which is executed in a test controller and specifically includes the following steps:

[0062] Step 1: Obtain actual network parameters, simulate session messages between UPF and SMF network elements in PFCP protocol communication;

[0063] Step 2: Fake UPF or SMF network element and send preset command to the opposite network element; wherein the actual network parameters are injected in the preset command;

[0064] Step 3: Test whether the tested network element can identify the legitimacy of the source of the fake message;

[0065] Step 4: According to the test result, the corresponding network element is matched for reinforcement processing measures.

[0066] In some other embodiments, the test method of the PFCP protocol data further comprises:

[0067] Simulate PFCP protocol communication network elements, send set traffic PFCP protocol data packets to UPF and SMF network elements, and detect whether the corresponding network element appears abnormal based on the traffic detection baseline.

[0068] The preset command includes PFCP session deletion command, coupling update-coupling release command, session forwarding command and coupling release attack command.

[0069] Wherein:

[0070] As shown in Figure 2 , the PFCP session deletion command:

[0071] Obtain the PFCP message of the user N4 interface in the actual 5G network, parse the message to extract the seid (the message related to the session in the PFCP message packet must contain the seid field, seid is the session endpoint identifier, full name: Session Endpoint Identifier, used to identify the PFCP session on the IP address of the PFCP entity) sent by the UPF to the SMF; connect the UPF network element to the test platform, input the network parameters and the extracted seid in the session deletion test parameter interface, and simulate the SMF network element N4 interface to send the PFCP session deletion request message (PFCP Session Deletion Request) to the UPF.

[0072] Check whether the UPF will normally reply to this message, parse the Cause field content in the reply message, and whether the user PFCP session is deleted. If the UPF normally processes this message, the reply message Cause field content is Request accepted and the corresponding PFCP session is deleted, which indicates that the fake SMF network element attack is successful, and the UPF needs to be processed for reinforcement.

[0073] As shown in Figure 3 and Figure 11As shown, the coupling update-coupling release command:

[0074] The test platform accesses the network environment, the test platform creates an N4 interface coupling update general test task, fills in the network parameters and node information in the test interface, then simulates a UPF network element device, sends a PFCP AssociationUpdate Request request message (carrying an Association Release Request) to the SMF, and obtains N4 port traffic in an attack process, such as Figure 4 As shown.

[0075] If the SMF normally responds to the fake UPF coupling update-coupling release request message, actively issues a session deletion request and a coupling deletion request message to the UPF after receiving the request, and the UPF successfully responds to the message, it indicates that the SMF network element N4 interface does not check the source of the coupling update-coupling release request message, and the UPF needs to be reinforced.

[0076] The test platform accesses the network environment, the test platform creates an N4 interface coupling update large flow test task, simulates an SMF to initiate a large flow PFCP protocol attack to a UPF network element, monitors whether the UPF network element appears abnormal, and monitors whether the service terminal pings the service server after the attack flow is initiated. If the service terminal pings the service server is interrupted, such as Figure 11 As shown, it can be inferred that the UPF overload control does not achieve the effect, and targeted protection measures should be taken.

[0077] As shown in Figure 5 Session forwarding command:

[0078] In the actual network environment, the PFCP message of the user N4 interface is acquired, and the fseid (data structure, full name Full Qualified SEID, that is, full session endpoint identifier, including SEID and IP address) and downlink FAR ID (unique identifier of a FAR structure, FAR full name Forwarding Action Rule, that is, forwarding operation rule, used to indicate how the UPF forwards the data packet detected by the PDR, PDR full name Packet Detection Rule, used to indicate how the UPF detects and classifies the data packet, PDR is issued in the session establishment and session modification process, and each FAR must be associated with a PDR) sent by the UPF to the SMF are extracted. The test tool simulates the SMF network element to send a PFCP Session Modification Request message to the UPF, wherein the seid is the extracted seid, the update FAR IE (IE information in the FAR structure that needs to be modified) is carried, and the ID is the ID of the acquired FAR IE. The Apply Action IE in the update FAR or the IP address of the outerheader creation is modified, it is checked whether the UPF normally accepts the message, and whether the UPF discards or forwards the downlink data packet to the specified IP.

[0079] If the UPF accepts the message and modifies the forwarding rule of the corresponding PFCP session, the user data is controlled not to be forwarded, and the user downlink data is forwarded to an illegal IP, the attack is successful, and the UPF needs to take targeted reinforcement measures to avoid illegal modification of the forwarding strategy. If the UPF discards the message without processing, it indicates that the UPF can identify the illegal SMF network element message.

[0080] As shown in Figure 6 , the coupling release attack command is as follows:

[0081] The test platform simulates the SMF, establishes a coupling with the UPF, and acquires the Node ID of another SMF network element. The test platform simulates the SMF network element to send a PFCP Association Release Request coupling release request message to the UPF, the NodeID in the message is the Node ID of the acquired another SMF, and it is checked whether the UPF accepts the message and deletes all PFCP sessions in the coupling.

[0082] If the UPF processes the message and deletes all PFCP sessions in the coupling, it indicates that the coupling release attack is successful, and the UPF needs to take targeted reinforcement processing.

[0083] PFCP protocol robustness test:

[0084] UPF authentication test:

[0085] The test platform connects the UPF network element, fills in the network parameters in the coupling creation interface, simulates the SMF network element to send a coupling request PFCP Association Setup Request to the UPF, and checks whether the UPF responds normally. If the UPF normally replies PFCP Association Setup Response and the coupling is successfully established, it indicates that the authentication attack is successful, the UPF does not authenticate the SMF, and the coupling can be established as long as the network is normal. At this time, the UPF needs to be reinforced, and the SMF sending the coupling request needs to be authenticated. Among them, Figure 8 The N4 interface data flow coupling update request message (carrying the coupling deletion request) is given; Figure 9 The N4 interface data flow coupling update response message is given.

[0086] SMF authentication:

[0087] The test platform simulates the UPF and initiates a PFCP coupling request to the SMF; check whether the SMF accepts the coupling establishment request initiated by the simulated UPF. If the SMF does not reply, it indicates that the SMF has certain authentication capability for the UPF access.

[0088] PFCP Association Setup Request command robustness test:

[0089] Connect the test platform to the UPF network element, send a PFCP protocol Association Setup Request malformed packet to the UPF, and inject error strategies in the parameters in the command to test the robustness of the UPF to the PFCP protocol processing. If the UPF does not appear abnormal during the test, it indicates that the robustness of the UPF network element to the PFCP protocol processing is basically guaranteed.

[0090] N4 interface signaling storm attack on SMF:

[0091] As shown in Figure 7 , send a large flow of PFCP messages to the SMF through the N4 interface, check whether the SMF network element appears abnormal, and whether the CPU and memory usage of the SMF network element before and during the signaling storm attack test have obvious changes. Connect the test tool to the core network, communicate normally with the SMF network element, select the N4 interface node to report the large flow test case, configure the relevant parameters, and execute the case.

[0092] Embodiment two

[0093] The embodiment provides a PFCP protocol data test system, which comprises:

[0094] The session message simulation module is configured to acquire actual network parameters and simulate session messages between a UPF and an SMF network element in PFCP protocol communication.

[0095] The fake network element command sending module is configured to fake a UPF or an SMF network element and send a preset command to a peer network element, wherein the preset command is injected with actual network parameters.

[0096] The network element testing module is configured to test whether a tested network element can identify the legitimacy of a source of a fake message.

[0097] The reinforcement processing module is configured to perform a matching reinforcement processing measure on a corresponding network element according to a test result.

[0098] It should be noted that each module in the embodiment corresponds to each step in Embodiment One, and the specific implementation process is the same, which will not be repeated here.

[0099] Embodiment Three

[0100] The embodiment provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to realize the steps in the test method of PFCP protocol data.

[0101] Embodiment Four

[0102] The embodiment provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor realizes the steps in the test method of PFCP protocol data when executing the program.

[0103] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system) and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the functions specified in the flowcharts and / or block diagrams. Figure 1 The device for realizing the functions specified in one flow or multiple flows and / or blocks. Figure 1 The device for realizing the functions specified in one flow or multiple flows and / or blocks.

[0104] The above only describes the preferred embodiments of the present application and is not used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for testing PFCP protocol data, wherein the method is executed within a test controller, characterized in that, include: Obtain actual network parameters and simulate session messages between UPF and SMF network elements in PFCP protocol communication; Forge UPF or SMF network elements and send preset commands to the peer network element; The preset command contains actual network parameters; Test whether the network element under test can identify the legitimacy of the source of the forged message; Based on the test results, appropriate reinforcement measures are implemented for the corresponding network elements; Connect the test platform to the UPF network element, send a PFCP protocol Association Setup Request malformed packet to the UPF, inject error policies into the parameters in the command, and test the robustness of the UPF in handling the PFCP protocol. Send large volumes of PFCP messages to the SMF via the N4 port to check whether the SMF network element is abnormal and whether there are significant changes in the CPU and memory usage of the SMF network element before and during the signaling storm attack test. When the default command is the association update-association release command, if the SMF responds normally to the forged UPF association update-association release request message, and actively sends session deletion request and association deletion request messages to the UPF after receiving the request, and the UPF successfully responds to the association update-association release command, it means that the SMF network element has not verified the source of the association update-association release request message, and the SMF network element needs to be specifically hardened. The testing methods for PFCP protocol data also include: Simulate PFCP protocol communication network elements, send PFCP protocol data packets with a set flow rate to UPF and SMF network elements, and detect whether the corresponding network elements are abnormal based on the flow detection baseline.

2. The method for testing PFCP protocol data as described in claim 1, characterized in that, The preset commands also include PFCP session deletion command, session forwarding command, and association release attack command.

3. The method for testing PFCP protocol data as described in claim 2, characterized in that, When the default command is the PFCP session deletion command, check whether UPF will reply with the corresponding message normally, and parse the Cause field content in the reply message to determine whether the user's PFCP session has been deleted.

4. The method for testing PFCP protocol data as described in claim 3, characterized in that, If the UPF has processed the PFCP session deletion message normally, and the Cause field of the reply message contains "Request accepted" and the corresponding PFCP session has been deleted, it indicates that the forged SMF network element attack was successful, and the UPF needs to be hardened accordingly.

5. The method for testing PFCP protocol data as described in claim 2, characterized in that, When the default command is a session forwarding command, if the UPF accepts this message and modifies the forwarding rules of the corresponding PFCP session to forward the user's downlink data to an illegal IP, the attack is successful. Targeted hardening measures need to be taken against the UPF to prevent illegal modification of the forwarding policy. If the UPF discards this message without processing it, it means that the UPF can identify illegal SMF network element messages; or When the default command is the association release attack command, if the UPF has already associated the release attack message and deleted all PFCP sessions within the association, it means that the association release attack was successful and the UPF needs to be specifically hardened.

6. A testing system for PFCP protocol data, characterized in that, include: The session message simulation module is used to obtain actual network parameters and simulate session messages between UPF and SMF network elements in PFCP protocol communication; A forged network element command sending module is used to forge a UPF or SMF network element and send a preset command to the peer network element; wherein the preset command is injected with actual network parameters. The network element testing module is used to test whether the network element under test can identify the legitimacy of the source of forged messages; The hardening module is used to perform matching hardening measures on the corresponding network elements based on the test results; Connect the test platform to the UPF network element, send a PFCP protocol Association Setup Request malformed packet to the UPF, inject error policies into the parameters in the command, and test the robustness of the UPF in handling the PFCP protocol. Send large volumes of PFCP messages to the SMF via the N4 port to check whether the SMF network element is abnormal and whether there are significant changes in the CPU and memory usage of the SMF network element before and during the signaling storm attack test. When the default command is the association update-association release command, if the SMF responds normally to the forged UPF association update-association release request message, and actively sends session deletion request and association deletion request messages to the UPF after receiving the request, and the UPF successfully responds to the association update-association release command, it means that the SMF network element has not verified the source of the association update-association release request message, and the SMF network element needs to be specifically hardened. The testing methods for PFCP protocol data also include: Simulate PFCP protocol communication network elements, send PFCP protocol data packets with a set flow rate to UPF and SMF network elements, and detect whether the corresponding network elements are abnormal based on the flow detection baseline.

7. The PFCP protocol data testing system as described in claim 6, characterized in that, The preset commands also include PFCP session deletion command, session forwarding command, and association release attack command.

8. The PFCP protocol data testing system as described in claim 6, characterized in that, When the default command is the PFCP session deletion command, check whether UPF will reply with the corresponding message normally, and parse the Cause field content in the reply message to determine whether the user's PFCP session has been deleted.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the PFCP protocol data testing method as described in any one of claims 1-5.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the PFCP protocol data testing method as described in any one of claims 1-5.

Images