A method and system for monitoring 5gc signaling

Abstract

The embodiment of the application discloses a kind of methods and systems for monitoring 5GC signaling, which method is applied to the monitoring system for monitoring 5GC signaling, and the monitoring system includes at least two network elements in monitoring device and 5GC.The method comprises the following steps: the first network element sends target signaling, and the message sequence coding of the process to which the target signaling belongs determined based on the pre-set standard process, the network service identification of the first network element, the IMSI of UE and the set access information are written in the route expansion head field of IPv6, and IP packet is obtained;Target signaling is 5GC signaling;The second network element receives IP packet, and parses IP packet, to obtain target signaling and target marking information;Monitoring device compares target marking information with the marking information corresponding to the pre-set standard process, to generate difference information;Difference information is used to indicate whether target signaling is abnormal.In the embodiment of the application, based on network layer IPv6, the accuracy of monitoring abnormal signaling is improved.

Description

Technical Field

[0001] This application relates to the field of 5GC technology, and in particular to a method and system for monitoring 5GC signaling. Background Technology

[0002] Service-oriented architecture is a significant difference between the 5G core network (5G Mobile Communication Technology Core, 5GC) and traditional core networks. Under this architecture, network services can communicate arbitrarily according to demand, greatly optimizing communication paths. However, this architecture also introduces security challenges from the internet domain to 5GC.

[0003] When faced with a large amount of unclear or erratic information, it is difficult to accurately determine the source of the information. Since most 5GC signaling is based on standard procedure definitions and has clear characteristics, utilizing these characteristics to identify information attribution is of great significance for 5GC security control. However, the accuracy of identifying whether 5GC signaling is abnormal in related technologies is relatively low, thus posing a significant security risk to 5GC control. Summary of the Invention

[0004] This application provides a method and system for monitoring 5GC signaling to improve the accuracy of 5GC signaling monitoring.

[0005] In a first aspect, one embodiment of this application provides a method for monitoring 5GC signaling, applied to a monitoring system for monitoring 5GC signaling, the monitoring system including monitoring equipment and at least two network elements in the 5GC; the method includes:

[0006] The first network element sends the target signaling and writes the message sequence encoding of the process to which the target signaling belongs, the network service identifier of the first network element, the UE's IMSI, and the configured access information into the IPv6 routing extension header field to obtain an IP data packet; wherein the target signaling is 5GC signaling.

[0007] The second network element receives IP data packets and parses them to obtain target signaling and target marking information;

[0008] The monitoring equipment compares the target marking information with the marking information corresponding to the pre-set standard procedure to generate difference information; the difference information is used to indicate whether the target signaling is abnormal.

[0009] In some exemplary embodiments, before the first network element sends the target signaling, the method further includes:

[0010] The first network element parses the NAS signaling received from the UE to obtain the UE's IMSI; or,

[0011] The first network element extracts the UE's IMSI from the tag information stored by the upstream network element.

[0012] In some exemplary embodiments, the target marking information includes some or all of the first message sequence code, the first network service identifier, the first IMSI, and the first set access information.

[0013] In some exemplary embodiments, the monitoring device compares the tagging information with the tagging information corresponding to a pre-set standard procedure to generate difference information, including:

[0014] Using IMSI as the granularity, the information in the tagging information other than the first IMSI is compared with the information corresponding to the pre-set standard process to generate difference information.

[0015] In some exemplary embodiments, the monitoring device compares the target tag information with the tag information corresponding to a pre-set standard procedure to generate difference information, including:

[0016] Establish a standard process message number index based on a pre-defined standard process;

[0017] The message header identifies the target tag information, and the tag information corresponding to the pre-set standard process is determined based on the message header and the standard process message number index.

[0018] Difference information is generated based on the target marking information and the marking information corresponding to the pre-defined standard process.

[0019] In some exemplary embodiments, after the second network element receives and parses the IP data packet to obtain the target signaling and target marking information, the method further includes:

[0020] The second network element transmits the target signaling to the application layer.

[0021] In some exemplary embodiments, after the monitoring device compares the target tag information with the tag information corresponding to a pre-set standard procedure to generate difference information, the method further includes:

[0022] Based on the discrepancy information, identify the abnormal UE, abnormal signaling, and part or all of the abnormal process.

[0023] In some exemplary embodiments, after the monitoring device compares the target tag information with the tag information corresponding to a pre-set standard procedure to generate difference information, the method further includes:

[0024] The abnormal IMSI and abnormal network service identifier are determined based on the difference information;

[0025] The abnormal UE is determined based on the abnormal IMSI, and the abnormal network element is determined based on the abnormal network service identifier.

[0026] Secondly, one embodiment of this application provides a method for monitoring 5GC signaling, applied to a monitoring device, comprising:

[0027] The IP data packet generated during the process of the first network element sending the target signaling to the second network element is obtained; wherein the IP data packet is obtained by writing the message sequence encoding of the target signaling to which the process belongs, the network service identifier of the first network element, the UE's IMSI and the configured access information into the routing extension header field of IPv6 based on the pre-set standard procedure;

[0028] Parse IP packets to obtain target signaling and target marking information;

[0029] The target tag information is compared with the tag information corresponding to the pre-set standard process to generate difference information; the difference information is used to indicate whether the target signaling is abnormal.

[0030] Thirdly, one embodiment of this application provides a system for monitoring 5GC signaling, including a monitoring device and at least two network elements; the system is used to perform the method of the first aspect.

[0031] Fourthly, one embodiment of this application provides a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the steps of any of the above methods.

[0032] The embodiments of this application have the following beneficial effects: The first network element does not directly send the target signaling (5GC signaling) to the second network element. Instead, based on the IPv6 network layer, it writes the message sequence encoding of the target signaling's procedure (determined by a pre-set standard procedure), the network service identifier of the first network element, the UE's IMSI, and configured access information into the IPv6 routing extension header field to obtain an IP data packet. After receiving the IP data packet, the second network element parses it to obtain the target signaling and target marking information normally transmitted between network elements. The monitoring device compares the target marking information with the marking information corresponding to the pre-set standard procedure to generate difference information indicating whether the target signaling is abnormal. This makes monitoring whether 5GC signaling is abnormal more accurate and more helpful in guiding 5GC security control. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 A schematic diagram of the structure of a monitoring system for monitoring 5GC signaling is provided in one embodiment of this application;

[0035] Figure 2 A flowchart illustrating a method for monitoring 5GC signaling according to an embodiment of this application;

[0036] Figure 3 A schematic diagram of the structure of a monitoring system for monitoring 5GC signaling is provided in one embodiment of this application;

[0037] Figure 4 A schematic diagram of an IPv6 header provided in an embodiment of this application;

[0038] Figure 5 A schematic diagram of a TLV format provided for an embodiment of this application;

[0039] Figure 6 A schematic diagram of another TLV format provided in an embodiment of this application;

[0040] Figure 7 A schematic diagram of an MSG Seq-Info field provided in an embodiment of this application;

[0041] Figure 8 A schematic diagram illustrating the value retrieval of the MSG Seq-Info field according to an embodiment of this application;

[0042] Figure 9 A schematic diagram of a pre-process message type in the Pre-process Type field provided in an embodiment of this application;

[0043] Figure 10 This is a schematic diagram illustrating a triggering method for a field Trigger Mode, provided in an embodiment of this application.

[0044] Figure 11 A schematic diagram of an IMSI format provided for an embodiment of this application;

[0045] Figure 12 A schematic diagram illustrating necessary information for an access process provided in an embodiment of this application;

[0046] Figure 13 This is a schematic diagram illustrating the field values ​​of necessary information for the access process, provided in an embodiment of this application.

[0047] Figure 14 This is a schematic diagram illustrating another method for monitoring 5GC signaling provided in an embodiment of this application;

[0048] Figure 15A schematic diagram of a device for monitoring 5GC signaling provided in an embodiment of this application;

[0049] Figure 16 This is a schematic diagram of the structure of a device for monitoring 5GC signaling provided in an embodiment of this application. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0051] For ease of understanding, the terms used in the embodiments of this application are explained below:

[0052] The number of any elements in the accompanying drawings is for illustrative purposes only and not as a limitation, and any naming is for distinction only and has no limiting meaning.

[0053] In practice, 5G core network signaling (5GC signaling) has been fully IP-based, and SRv6 (segment routing IPv6) is one of the means to implement 5G network slicing. For 5GC networks deploying SRv6, the radio access process, authentication process, and core network signaling flow are mapped through the optional TLV (Type, Length, Value) definition of the SRH (segment routing header). This marks the 5GC signaling flow and can be used to identify the meaning and relationship of signaling messages, enabling the judgment of signaling anomalies. For example, when 5GC service fails, becomes infected, or signaling is lost, tampered with, ghosted, flooded, illegally requested, or leaked, signaling analysis can be performed on the message relay based on the HTTP (Hypertext Transfer Protocol) header markings to detect anomalies.

[0054] Therefore, refer to Figure 1This application provides a method for monitoring 5GC signaling. This method is applied to a monitoring system for monitoring 5GC signaling, which includes monitoring equipment and at least two network elements within the 5GC. These network elements can be, for example, base stations, routers, or switches within the 5GC. In this method, during the transmission of target signaling (5GC signaling) from the first network element to the second network element, the protocol stack or relay encodes the message sequence of the target signaling based on a pre-defined standard procedure, the network service identifier of the first network element, the IMSI (International Mobile Subscriber Identity) of the UE (user equipment), and configured access information, and writes these into the routing extension header field of IPv6 to obtain an IP packet. A collection module collects the IP packets, and a detection and analysis module parses the IP packets to obtain the target signaling and target marking information. The target marking information is compared with the marking information corresponding to a pre-defined standard procedure to generate difference information indicating whether the target signaling is abnormal. This not only enables the transmission of 5GC signaling between network elements but also achieves the monitoring of whether the 5GC signaling is abnormal through the generated IP packets. Compared with related technologies, this method improves the accuracy of monitoring.

[0055] Of course, the methods provided in the embodiments of this application are not limited to... Figure 1 The application scenarios shown can also be used in other possible scenarios, and this application does not impose any limitations. Figure 1 The functions that each device in the application scenario shown can achieve will be described in subsequent method embodiments, and will not be elaborated on here.

[0056] To further illustrate the technical solutions provided in the embodiments of this application, a detailed description is provided below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of this application provide method operation steps as shown in the following embodiments or drawings, the method may include more or fewer operation steps based on conventional or non-inventive methods. In steps where there is no logically necessary causal relationship, the execution order of these steps is not limited to the execution order provided in the embodiments of this application.

[0057] The following is combined with Figure 1 The application scenarios shown illustrate the technical solutions provided in the embodiments of this application.

[0058] refer to Figure 2 This application provides a method for monitoring 5GC signaling. The method is applied to a system for monitoring 5GC signaling and includes at least the following steps:

[0059] S201, the first network element sends the target signaling and writes the message sequence code of the process to which the target signaling belongs, the network service identifier of the first network element, the IMSI of the UE and the set access information into the IPv6 routing extension header field to obtain an IP data packet; wherein the target signaling is 5GC signaling.

[0060] S202. The second network element receives IP data packets and parses them to obtain target signaling and target marking information.

[0061] S203. The monitoring equipment compares the target marking information with the marking information corresponding to the pre-set standard procedure to generate difference information; wherein, the difference information is used to indicate whether the target signaling is abnormal.

[0062] The embodiments of this application have the following beneficial effects: The first network element does not directly send the target signaling (5GC signaling) to the second network element. Instead, based on the IPv6 network layer, it writes the message sequence encoding of the target signaling's procedure (determined by a pre-set standard procedure), the network service identifier of the first network element, the UE's IMSI, and configured access information into the IPv6 routing extension header field to obtain an IP data packet. After receiving the IP data packet, the second network element parses it to obtain the target signaling and target marking information normally transmitted between network elements. The monitoring device compares the target marking information with the marking information corresponding to the pre-set standard procedure to generate difference information indicating whether the target signaling is abnormal. This makes monitoring whether 5GC signaling is abnormal more accurate and more helpful in guiding 5GC security control.

[0063] The method for monitoring 5GC signaling is explained using two network elements as an example.

[0064] Regarding S201, the UE initiates NAS (network attached storage) signaling to 5GC. In this example, initiating the signal to 5GC is the first network element to 5GC. Alternatively, 5GC can initiate a NAS message to the UE to trigger the UE to initiate NAS signaling to 5GC.

[0065] When the first network element sends out target signaling (5GC signaling) via its first network service, it does not directly send the target signaling to the second network element. Instead, it packages the target signaling. This non-direct transmission can be intercepted by the marking module in the first network element. The packaging process involves determining the flow to which the target signaling belongs based on a pre-defined standard procedure. Since each flow corresponds to a message sequence code, a message sequence code can be determined. Furthermore, this message sequence code, the network service identifier of the first network element, the UE's IMSI, and configured access information are written into the IPv6 routing extension field (IPv6SRH Optional TLV) to obtain an IP data packet.

[0066] In different situations, IMSI can be obtained in the following two ways:

[0067] In the first scenario, the first network element has no upstream network element. In this case, the first network element parses the NAS signaling received from the UE to obtain the UE's IMSI.

[0068] In the second scenario, the first network element extracts the UE's IMSI from the tag information stored by the upstream network element.

[0069] In this case, the upstream network element can extract information from the marking information in its next upstream network element. The marking information of the next upstream network element is obtained by parsing the IP packets of the corresponding process.

[0070] This involves S202, the second network element receiving IP data packets, parsing the IP data packets, and obtaining target signaling and target marking information.

[0071] The parsed target signaling is the signaling normally transmitted between the first network element and the second network element, while the parsed target tagging information can be used to monitor whether the target signaling is abnormal. For example, the target tagging information includes some or all of a message sequence code, a first network service identifier, a first IMSI, and first configured access information. When the target signaling is normal, these pieces of information are written into the IPv6 routing extension header field. When the target signaling is abnormal, at least one of these pieces of information changes.

[0072] In S203, the monitoring equipment compares the target marking information with the marking information corresponding to the pre-set standard procedure to generate difference information; the difference information is used to indicate whether the target signaling is abnormal.

[0073] For example, information in the tagging information other than the first IMSI can be compared with the information corresponding to a pre-defined standard process at the IMSI granularity to generate difference information. In this way, data comparison can be achieved for each IMSI, so that the data can be displayed to the user more intuitively.

[0074] The comparison process is as follows:

[0075] A. Establish a standard process message number index based on the pre-set standard process.

[0076] Because a standard process is pre-defined, a standard process message number index can be created based on the pre-defined standard process.

[0077] B. Identify the message header of the target tag information, and determine the tag information corresponding to the pre-set standard process based on the message header and the standard process message number index.

[0078] The target tag information consists of a message header and other messages. The message header that identifies the target tag information can be used to determine the tag information corresponding to the pre-set standard process based on the message header and the standard process message number index.

[0079] C. Generate difference information based on the target marking information and the marking information corresponding to the pre-set standard process.

[0080] For example, by comparing the target label information with the label information corresponding to a pre-defined standard process, the differences between the two can be determined, and difference information can be obtained.

[0081] In practical applications, the second network element transmits the target signaling to the application layer so that the target signaling can be processed in various ways at the application layer.

[0082] In addition, abnormal UEs, abnormal signaling, and some or all of abnormal processes can be identified based on the difference information. For example, abnormal IMSI and abnormal network service identifiers can be identified based on the difference information; abnormal UEs can be identified based on the abnormal IMSI; and abnormal network elements can be identified based on the abnormal network service identifier.

[0083] To make the technical solution of this application easier to understand, the following is combined with... Figure 3 A specific embodiment will be used for illustration.

[0084] S1, UE generates NAS signaling.

[0085] S2, the UE initiates NAS signaling to the first network element of 5GC, or the first network element of 5GC initiates a start message to obtain the NAS message of the UE.

[0086] In this way, the first network element can obtain the UE's IMSI.

[0087] S3. The first network element sends the target signaling (5GC signaling), which is encapsulated via HTTP and intercepted by the marking module in the kernel space. The purpose of the interception is to prevent it from being directly sent to the second network element.

[0088] S4-S5, the marking module of the first network element (the first marking module) calls the network service interface to obtain the corresponding IMSI based on the message body, process ID, etc.

[0089] S6. The marking module of the first network element (the first marking module) queries the standard process definition to obtain the corresponding process message sequence code, and fills the message marking code, the network service identifier (networks function Identitydocument, NF IDs) of the first network element, the IMSI, and the access information (necessary information for the access process) into the IPv6 SRH OptionalTLV.

[0090] See Figure 4 The image shows the IPv6 header with Next Header=43, the routing extension header; and the extension header Routing Type=4, which identifies the SRH.

[0091] See Figure 5 The value of the Optional TLV is shown as 7-123 / 128-251Unassigned.

[0092] See Figure 6 Define a new Optional TLV to identify the signaling flow protocol type of this application.

[0093] Type = 7, Length = TLV length, (16+32+128+128+64+32) / 8. Value: Fill the IPv6 SRH Optional TLV with the message tag encoding, network service identifier, IMSI, and necessary access procedure information.

[0094] See Figure 7 This shows the MSG Seq-Info field (32 bits); (participating in...) Figure 8 This shows the possible values ​​for the field.

[0095] See Figure 9 This indicates the type of pre-process message in the Pre-process Type field.

[0096] See Figure 10 This shows how the Trigger Mode field is triggered.

[0097] The NF peer (NF IDs, 128*2 bits) example uses the UUIDv4 format, consisting of a 32-bit hexadecimal digit set. The format is divided into five segments by hyphens, represented as 32 characters in the form of 8-4-4-4-12. For example, srcinst = 54804518-4191-46b3-955c-ac631f953ed8; dstinst = 54804518-4191-4453-569c-ac631f74765c. According to the UUIDv4 generation algorithm, some bits in srcinst and dstinst are repeated.

[0098] See Figure 11 The format of IMSI is shown below. IMSI (15 or 16 decimal bits, identified by 56 bits): MCC 6 bits; MNC6it; MSIN 20 bits.

[0099] See Figure 12 This displays necessary information for the access process (such as UERAProc-Info, 16 bits), with a length of 16 bits. See [link to field values] for more details. Figure 13 .

[0100] S7-S8 and 5GC signaling transmission.

[0101] S9, the protocol stack of the second network element processes messages and, based on the meaning of the optional fields, hands them over to the parsing module and the proxy interface of the network service.

[0102] S10-S11, the second network element's parsing module (second parsing module) calls the IP layer interface to obtain the necessary fields.

[0103] S12. The parsing module (second parsing module) of the second network element retains the IMSI, the sequence code of this message, and the necessary information of the access process, and passes them to the marking module (second marking module) of the second network element.

[0104] S13, the parsing module of the second network element (the second parsing module) delivers the regular signaling message (5GC signaling) to the application layer.

[0105] S14. The network service of the second network element performs signaling logic processing, sends out the next signaling message, which is then encapsulated via HTTP and intercepted by the marking module in the kernel space.

[0106] S15-17, The marking module of the second network element (the second marking module) repeats S4-S6.

[0107] S18, the protocol stack of the second network element repeats S7.

[0108] S19. The monitoring system's acquisition module collects data from the host kernel protocol stack or network relay, extracts the source IP and destination IP, SRH Optional TLV, obtains the sequence code of this signaling message, IMSI, necessary access process information, and performs data processing.

[0109] S20. The detection and analysis module of the monitoring system draws a message sequence based on the processed data, using IMSI as the granularity, and compares it with the standard process definition to analyze the reasons for the deviation.

[0110] The inspection and analysis module uses the processed data to plot message sequences at the IMSI level, compares them with the standard process definition, and analyzes the reasons for deviations.

[0111] Specifically, this can be achieved in the following way:

[0112] Establish a standard process message number index and message mapping.

[0113] The standard process mainly includes a main process and sub-processes. The main process includes the initial registration process, periodic registration process, deregistration process, authentication process, session establishment process, session modification process, session release process, slice selection process, and policy download process. Sub-processes include other main processes nested within each main process, or optional processes for different cases. Message sequence numbers are arranged sequentially according to the time order of each main process and sub-process. By analyzing the collected signaling message HTTP headers, the correlation between signaling messages is interpreted, and the standard process is compared using message number indexes.

[0114] The identification of anomalies mainly includes signaling anomalies, user anomalies, and process anomalies. Signaling anomalies include erroneous signaling, ghost signaling, missing signaling, and signaling flooding; user anomalies include registration anomalies, session anomalies, policy anomalies, handover anomalies, and access anomalies; process anomalies include process blocking, signaling loops, concatenation errors, and illegal requests.

[0115] S21. For anomalies in specific terminals or network services, further analyze the behavioral characteristics. If they match the network security feature database, take action, such as blocking the terminal or migrating the network service through 5G network management.

[0116] Compared to related technologies that primarily analyze message content by decapsulating HTTP messages, the embodiments described above, based on the network layer SRv6 SRH, can obtain the necessary information for signaling monitoring without decapsulating HTTP messages, thus improving collection efficiency. Furthermore, all network elements (network devices) can be used as collection points, making the collection method more flexible. Moreover, based on the access procedure, message encoding, and NF peer, the signaling flow of the 3GPP standard is described, and an anomaly analysis method for comparing the signaling flow with the standard process is designed. Compared to existing log-based problem tracing and troubleshooting solutions, this solution can quickly locate signaling flow anomalies and identify access fraud using certain methods.

[0117] See Figure 14 This application also provides a method for monitoring 5GC signaling, applied to a monitoring device, including:

[0118] S1401. Obtain the IP data packet generated during the process of the first network element sending the target signaling to the second network element; wherein the IP data packet is obtained by writing the message sequence encoding of the target signaling to which the process belongs, the network service identifier of the first network element, the IMSI of the UE, and the configured access information into the routing extension header field of IPv6 based on the pre-set standard procedure.

[0119] S1402. Parse the IP data packet to obtain the target signaling and target marking information;

[0120] S1403. Compare the target marking information with the marking information corresponding to the pre-set standard process to generate difference information; wherein, the difference information is used to indicate whether the target signaling is abnormal.

[0121] The implementation methods for each step are described in the aforementioned embodiments and will not be repeated here.

[0122] This application also provides a system for monitoring 5GC signaling, including a monitoring device and at least two network elements; the system is used to perform a method for monitoring 5GC signaling.

[0123] like Figure 15 As shown, based on the same inventive concept as the above-described method for monitoring 5GC signaling, this application embodiment also provides an apparatus for monitoring 5GC signaling, including a sending unit 1501, a receiving unit 1502, and a processing unit 1503.

[0124] The sending unit 1501 is used to send target signaling and write the message sequence encoding of the process to which the target signaling belongs, the network service identifier of the first network element, the IMSI of the UE, and the configured access information into the routing extension header field of IPv6 to obtain an IP data packet; wherein the target signaling is 5GC signaling.

[0125] The receiving unit 1502 is used to receive the IP data packet and parse the IP data packet to obtain the target signaling and target marking information;

[0126] The processing unit 1503 is used to compare the target marking information with the marking information corresponding to the pre-set standard process to generate difference information; wherein, the difference information is used to indicate whether the target signaling is abnormal.

[0127] In some exemplary embodiments, before the sending unit 1501 sends the target signaling, the processing unit 1503 is further configured to:

[0128] Parse the received NAS signaling from the UE to obtain the UE's IMSI; or,

[0129] The UE's IMSI is extracted from the tag information stored in the upstream network element.

[0130] In some exemplary embodiments, the target marking information includes some or all of the first message sequence code, the first network service identifier, the first IMSI, and the first set access information.

[0131] In some exemplary embodiments, the processing unit 1503 is specifically used for:

[0132] Using IMSI as the granularity, the information in the tagging information other than the first IMSI is compared with the information corresponding to the pre-set standard process to generate difference information.

[0133] In some exemplary embodiments, the processing unit 1503 is specifically used for:

[0134] Establish a standard process message number index based on a pre-defined standard process;

[0135] The message header that identifies the target tag information is used to determine the tag information corresponding to the pre-set standard process based on the message header and the standard process message number index.

[0136] Difference information is generated based on the target marking information and the marking information corresponding to the pre-set standard process.

[0137] In some exemplary embodiments, after the receiving unit 1502 receives the IP data packet and parses the IP data packet to obtain the target signaling and target tag information, the sending unit 1501 is further configured to transmit the target signaling to the application layer.

[0138] In some exemplary embodiments, after the processing unit 1503 compares the target marking information with the marking information corresponding to the pre-set standard process and generates difference information, the processing unit 1503 is further configured to:

[0139] Based on the discrepancy information, identify the abnormal UE, abnormal signaling, and part or all of the abnormal process.

[0140] In some exemplary embodiments, after the processing unit 1503 compares the target marking information with the marking information corresponding to the pre-set standard process and generates difference information, the processing unit 1503 is further configured to:

[0141] Based on the discrepancy information, the abnormal IMSI and abnormal network service identifier are determined;

[0142] The abnormal UE is determined based on the abnormal IMSI, and the abnormal network element is determined based on the abnormal network service identifier.

[0143] The device for monitoring 5GC signaling provided in this application embodiment adopts the same inventive concept as the above-described method for monitoring 5GC signaling and can achieve the same beneficial effects, so it will not be described again here.

[0144] Based on the same inventive concept as the method for monitoring 5GC signaling described above, this application also provides a monitoring device, which can specifically be a desktop computer, portable computer, smartphone, tablet computer, personal digital assistant (PDA), server, etc. Figure 16 As shown, the monitoring device may include a processor 1601 and a memory 1602.

[0145] Processor 1601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0146] Memory 1602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. Memory 1602 in the embodiments of this application may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0147] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned computer storage medium can be any available medium or data storage device that a computer can access, including but not limited to: mobile storage devices, random access memory (RAM), magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)) and other media capable of storing program code.

[0148] Alternatively, if the integrated units described above in this application are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods of the various embodiments of this application. The aforementioned storage medium includes: mobile storage devices, random access memory (RAM), magnetic memory (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical memory (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor memory (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs), etc.) and other media capable of storing program code.

[0149] The above embodiments are only used to provide a detailed description of the technical solutions of this application. However, the description of the above embodiments is only for the purpose of helping to understand the methods of the embodiments of this application and should not be construed as a limitation on the embodiments of this application. Any changes or substitutions that can be easily conceived by those skilled in the art should be covered within the protection scope of the embodiments of this application.

Claims

1. A method for monitoring 5GC signaling, characterized in that, A monitoring system for monitoring 5GC signaling, the monitoring system comprising monitoring equipment and at least two network elements in the 5GC; the method comprising: The first network element sends a target signaling message and writes the message sequence code of the process to which the target signaling message belongs, the network service identifier of the first network element, the IMSI of the UE, and the configured access information into the routing extension header field of IPv6 to obtain an IP data packet; wherein the target signaling message is 5GC signaling; wherein the message sequence code is determined in the following way: the process to which the target signaling message belongs is determined based on a pre-set standard procedure; the message sequence code of the process to which the target signaling message belongs is determined according to the correspondence between the procedure and the message sequence code; The second network element receives the IP data packet and parses the IP data packet to obtain the target signaling and target tag information; wherein, the target signaling is the signaling normally transmitted between the first network element and the second network element, and the target tag information is information used to monitor whether the target signaling is abnormal; The monitoring device compares the target marking information with the marking information corresponding to the pre-set standard procedure to generate difference information; wherein, the difference information is used to indicate whether the target signaling is abnormal.

2. The method according to claim 1, characterized in that, Before the first network element sends the target signaling, the method further includes: The first network element parses the NAS signaling received from the UE to obtain the UE's IMSI; or, The first network element extracts the UE's IMSI from the tag information stored in the upstream network element.

3. The method according to claim 1, characterized in that, The target marking information includes some or all of the first message sequence code, the first network service identifier, the first IMSI, and the first set access information.

4. The method according to claim 3, characterized in that, The monitoring device compares the tagging information with the tagging information corresponding to a pre-set standard procedure to generate difference information, including: Using IMSI as the granularity, the information in the tagging information other than the first IMSI is compared with the information corresponding to the pre-set standard process to generate difference information.

5. The method according to claim 1, characterized in that, The monitoring device compares the target marker information with the marker information corresponding to the pre-set standard procedure to generate difference information, including: Establish a standard process message number index based on a pre-defined standard process; The message header that identifies the target tag information is used to determine the tag information corresponding to the pre-set standard process based on the message header and the standard process message number index. Difference information is generated based on the target marking information and the marking information corresponding to the pre-set standard process.

6. The method according to claim 1, characterized in that, After the second network element receives the IP data packet and parses the IP data packet to obtain the target signaling and target marking information, the method further includes: The second network element transmits the target signaling to the application layer.

7. The method according to claim 1, characterized in that, After the monitoring device compares the target marker information with the marker information corresponding to the pre-set standard procedure and generates difference information, the method further includes: Based on the discrepancy information, identify the abnormal UE, abnormal signaling, and part or all of the abnormal process.

8. The method according to claim 7, characterized in that, After the monitoring device compares the target marker information with the marker information corresponding to the pre-set standard procedure and generates difference information, the method further includes: Based on the discrepancy information, the abnormal IMSI and abnormal network service identifier are determined; The abnormal UE is determined based on the abnormal IMSI, and the abnormal network element is determined based on the abnormal network service identifier.

9. A method for monitoring 5GC signaling, characterized in that, Applied to monitoring equipment, including: The process involves acquiring IP data packets generated during the transmission of target signaling from a first network element to a second network element. These IP data packets are obtained by writing the message sequence code of the process to which the target signaling belongs, determined based on a pre-defined standard procedure, the network service identifier of the first network element, the IMSI of the UE, and configured access information into the routing extension header field of IPv6. The message sequence code is determined as follows: the process to which the target signaling belongs is determined based on a pre-defined standard procedure; the message sequence code of the process to which the target signaling belongs is determined according to the correspondence between the process and the message sequence code. The IP data packet is parsed to obtain the target signaling and target tag information; wherein, the target signaling is the signaling normally transmitted between the first network element and the second network element, and the target tag information is information used to monitor whether the target signaling is abnormal; The target tag information is compared with the tag information corresponding to the pre-set standard process to generate difference information; wherein, the difference information is used to indicate whether the target signaling is abnormal.

10. A system for monitoring 5GC signaling, characterized in that, The system includes monitoring equipment and at least two network elements; the system is used to perform the method according to any one of claims 1 to 8.

Images