A safety protection method, device, equipment and medium

Abstract

This application discloses a security protection method, device, equipment, and medium, relating to the field of mobile communication security and applied to user plane functional network elements. The method includes: acquiring each data packet; verifying whether the first IPv6 prefix and corresponding first base station address in the first IPv6 address of the first data packet are consistent with the target base station address and target IPv6 prefix; if consistent, verifying whether the target base station address and first IPv6 address are consistent with the subsequent base station address and subsequent IPv6 address corresponding to subsequent data packets; if consistent, sending the subsequent data packets to the target network device; if inconsistent, discarding the subsequent data packets, thereby ensuring that all subsequent data packets sent to the target network device are sent by the user who sent the first data packet through the terminal that sent the first data packet, based on the target base station; since all data packets sent to the target network device in this application are sent by the user and terminal that sent the first data packet, there will be no large number of fake users, only one genuine user.

Description

Technical Field

[0001] This invention relates to the field of mobile communication security, and in particular to a security protection method, device, equipment and medium. Background Technology

[0002] Currently, in 5G (5th Generation Mobile Communication Technology), the IPv6 address of a terminal is assigned by the core network. Specifically, the session management network element first assigns an interface identifier to the terminal. The terminal then uses this interface identifier, combined with its own MAC (Media Access Control) address, to generate a new 64-bit interface identifier. Simultaneously, the terminal obtains a 64-bit prefix assigned by the core network. The prefix and the interface identifier combine to form the terminal's IPv6 address, which the terminal can use to access the internet data network of network devices through the core network. The user plane function network element in the core network is the interface between the core network data plane and the external internet. The user plane function network element performs packet inspection (i.e., verifies the 64-bit prefix) on the data packets initiated by the terminal after decapsulation. Based on the rules matched by the packet inspection, it performs routing forwarding, QoS (Quality of Service) services, billing, etc.

[0003] The existing processing procedures of operators for IPv6 users mainly verify the first 64 bits of the IPv6 prefix of the user's source address. Therefore, when the 64-bit prefix of a terminal is intercepted by a forger, the forger can arbitrarily forge the terminal's IPv6 address based on the IPv6 prefix, and then use the terminal's IPv6 address to access Internet data. This can steal data traffic and also cause additional charges to the original terminal user. Furthermore, if forgers use the 64-bit prefix to forge a large number of fake users to access Internet data, it will cause serious impacts such as consuming core network user plane bandwidth and creating a DDoS (Distributed Denial of Service) attack on Internet servers.

[0004] In conclusion, preventing forgers from creating a large number of fake users is an urgent problem that needs to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a security protection method, device, equipment, and medium that can prevent counterfeiters from creating a large number of fake users. The specific solution is as follows:

[0006] Firstly, this application discloses a security protection method applied to user plane function network elements, including:

[0007] Retrieve the data packets sent to the local machine for accessing the target network device;

[0008] Verify whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element; the IPv6 address includes the IPv6 prefix and the interface identifier; one user corresponds to one IPv6 prefix; one interface identifier corresponds to one terminal;

[0009] If they match, then verify whether the target base station address and the first IPv6 address are consistent with the subsequent base station address and subsequent IPv6 address corresponding to the subsequent data packets in each data packet. If they match, then send the subsequent data packets to the target network device. If they do not match, then discard the subsequent data packets to ensure that the subsequent data packets sent to the target network device are all sent by the user who sent the first data packet through the terminal that sent the first data packet based on the target base station.

[0010] If they are inconsistent, the next data packet in each data packet is taken as the first data packet, and the process jumps to the step of verifying whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet are consistent with the target base station address and the target IPv6 prefix issued by the session management network element, until the verification of each data packet is completed.

[0011] Optionally, before acquiring the data packets sent locally for accessing the target network device, the method further includes:

[0012] After the target user accesses the session management network element through the target terminal and initiates a session request based on the target base station, the target base station address and the target IPv6 prefix sent by the session management network element are obtained;

[0013] The target IPv6 prefix is ​​sent to the target terminal so that the target terminal can allocate the target IPv6 prefix to the target user. The target terminal combines the target interface identifier provided by the target terminal with the target IPv6 prefix to obtain the target IPv6 address. Then, the target terminal constructs an initial data packet based on the target IPv6 address and sends the initial data packet to the user plane function network element through the target base station. The target base station, after obtaining the initial data packet, adds the target base station address as the source address to the initial data packet to obtain the target data packet, and then sends the target data packet to the user plane function network element. The target interface identifier is an interface identifier generated by the target terminal based on the terminal media access control address and the initial interface identifier allocated to the target terminal by the session management network element.

[0014] Optionally, after obtaining the target base station address and the target IPv6 prefix sent by the session management network element, the method further includes:

[0015] The target base station is determined based on the target base station address, and a target tunnel is established between the target base station and the user plane function network element so that the target base station can send the target data packet to the user plane function network element through the target tunnel.

[0016] Optionally, sending the target IPv6 prefix to the target terminal includes:

[0017] The system obtains the router request sent by the target terminal and returns a router advertisement to the target terminal based on the router request; the router advertisement includes the target IPv6 prefix.

[0018] Optionally, obtaining the target base station address and the target IPv6 prefix sent by the session management network element includes:

[0019] Obtain the session establishment message sent by the session management network element, and obtain the target base station address of the target base station carried in the first field of the session establishment message and the target IPv6 prefix carried in the second field of the session establishment message.

[0020] Optionally, before acquiring the data packets sent locally for accessing the target network device, the method further includes:

[0021] Obtain the target field carrying the target base station address issued by the session management network element, and obtain the target base station address based on the target field; the target field is a reused original field between the session management network element and the user plane function network element.

[0022] Secondly, this application discloses a security protection device applied to a user plane functional network element, comprising:

[0023] The data packet acquisition module is used to acquire the data packets sent to the local machine for accessing the target network device;

[0024] The first verification module is used to verify whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element; the IPv6 address includes the IPv6 prefix and the interface identifier; one user corresponds to one IPv6 prefix; one interface identifier corresponds to one terminal;

[0025] The second verification module is used to verify, if they match, whether the target base station address and the first IPv6 address are consistent with the subsequent base station address and subsequent IPv6 address corresponding to the subsequent data packets in each data packet. If they match, the subsequent data packets are sent to the target network device. If they do not match, the subsequent data packets are discarded, so as to ensure that the subsequent data packets sent to the target network device are all sent by the user who sent the first data packet through the terminal that sent the first data packet based on the target base station.

[0026] The first data packet determination module is used to take the next data packet in each data packet as the first data packet, and jump to the step of verifying whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element, until the verification of each data packet is completed.

[0027] Optionally, the safety protection device further includes:

[0028] The information acquisition module is used to acquire the target base station address and the target IPv6 prefix sent by the session management network element after the target user accesses the session management network element through the target terminal based on the target base station and initiates a session request;

[0029] An information sending module is used to send the target IPv6 prefix to the target terminal, so that the target terminal can allocate the target IPv6 prefix to the target user, and combine the target interface identifier provided by the target terminal with the target IPv6 prefix to obtain the target IPv6 address. Then, the target terminal constructs an initial data packet based on the target IPv6 address and sends the initial data packet to the user plane function network element through the target base station. The target base station, after obtaining the initial data packet, adds the target base station address as the source address to the initial data packet to obtain the target data packet, and then sends the target data packet to the user plane function network element.

[0030] Thirdly, this application discloses an electronic device, including:

[0031] Memory, used to store computer programs;

[0032] A processor is used to execute the computer program to implement the aforementioned disclosed security protection method.

[0033] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned security protection method.

[0034] As can be seen, this application acquires each data packet sent to the local machine for accessing the target network device; verifies whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element; the IPv6 address includes the IPv6 prefix and the interface identifier; one user corresponds to one IPv6 prefix; one interface identifier corresponds to one terminal; if they are consistent, then it verifies whether the target base station address and the first IPv6 address are consistent with the subsequent base station addresses and subsequent IPv6 addresses corresponding to subsequent data packets in each data packet. If they match, the subsequent data packets are sent to the target network device. If they do not match, the subsequent data packets are discarded to ensure that all subsequent data packets sent to the target network device are sent by the user terminal that sent the first data packet based on the target base station. If they do not match, the next data packet in each data packet is used as the first data packet, and the process jumps to the step of verifying whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet match the target base station address and target IPv6 prefix issued by the session management network element, until the verification of each data packet is completed. Therefore, by using the first IPv6 address (including the first IPv6 prefix and the first interface identifier) ​​of the first data packet that has passed IPv6 prefix verification for the verification of subsequent data packets, the subsequent data packets sent to the target network device are all sent by the user terminal that sent the first data packet based on the target base station. In this case, only data packets sent by one user through one terminal based on the target base station will be obtained, and data packets sent by other users through other terminals based on the target base station will not be obtained. Therefore, there will not be a large number of fake users; only one user will exist. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0036] Figure 1 This is a flowchart of a security protection method disclosed in this application;

[0037] Figure 2 This is a flowchart of a specific security protection method disclosed in this application;

[0038] Figure 3 This is a schematic diagram of a security protection process disclosed in this application;

[0039] Figure 4This is a schematic diagram of the structure of a safety protection device disclosed in this application;

[0040] Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0041] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0042] When a terminal's 64-bit prefix is ​​intercepted by a forger, the forger can arbitrarily forge the terminal's IPv6 address and then use that IPv6 address to access internet data. This can steal data traffic and cause additional charges to the original terminal user. Furthermore, if the forger uses the 64-bit prefix to forge a large number of fake users to access internet data, it will cause serious impacts such as consuming core network user plane bandwidth and creating a DDoS (Distributed Denial of Service) attack on internet servers.

[0043] Therefore, this application proposes a security protection scheme to prevent counterfeiters from creating a large number of fake users.

[0044] This application discloses a security protection method applied to a user plane function network element. See also... Figure 1 As shown, the method includes:

[0045] Step S11: Obtain the data packets sent to the local machine for accessing the target network device.

[0046] In this embodiment, each data packet may include a target data packet, a fake data packet sent by a fake user based on the target IPv6 prefix after intercepting it, and other data packets unrelated to the target IPv6 prefix. It should be noted that the fake user will intercept the target IPv6 prefix and combine it with a fake interface identifier of the fake user's terminal to construct a fake IPv6 address, and then send fake data packets based on the fake IPv6 address; the fake interface identifier is the real interface identifier of the fake user's terminal.

[0047] In this embodiment, before obtaining each data packet sent to the local machine for accessing the target network device, the method further includes: obtaining a target field carrying the target base station address issued by the session management network element, and obtaining the target base station address based on the target field; the target field is a reused original field between the session management network element and the user plane function network element.

[0048] It should be noted that the reused original field is the Source IP Address field. The reasons for using this field are as follows: First, the internal structure of this field satisfies the use of dual-stack addresses for tunnel IPv4 and IPv6; Second, this field originally only involves the use of downlink multicast, a function unique to user plane network elements, and reuse does not affect the use of basic functions of user plane network elements. The use of the two functions of this field can be distinguished by the feature function switch in the user plane network element; Third, the choice to reuse the existing 3GPP (3rd Generation Partnership Project) field instead of constructing a private field to store the target base station address is because constructing a private field may cause abnormal interfacing between session function network elements and user plane function network elements from different vendors.

[0049] It should be noted that since the existing matching process of operators does not verify the base station address of data packets, forgers can also intrude into the backhaul network from the base station to the user plane network element by forging the base station address. If forgers use the base station address to forge a large number of uplink data packets to access Internet data, it will also cause a data storm that overwhelms the core network user plane bandwidth, resulting in serious consequences such as normal users being unable to access the Internet. Therefore, the above-mentioned user plane network element obtains the target base station address and adds the step of verifying the target base station address to further ensure that users can access the Internet normally.

[0050] Step S12: Verify whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element; the IPv6 address includes the IPv6 prefix and the interface identifier; one user corresponds to one IPv6 prefix; one interface identifier corresponds to one terminal.

[0051] In this embodiment, the user plane function network element and the session management network element both belong to the core network element.

[0052] In this embodiment, verifying whether the address of the first base station is consistent with the address of the target base station is to ensure that the data packet is a data packet forwarded by the target base station corresponding to the target base station address.

[0053] In this embodiment, verifying whether the first IPv6 prefix is ​​consistent with the target IPv6 prefix is ​​to determine whether the data packet is sent based on the target IPv6 prefix. It should be noted that although one user corresponds to one IPv6 prefix, a fake user may intercept the target user's target IPv6 prefix. In this case, the fake data packet sent by the fake user will also have the target IPv6 prefix.

[0054] In summary, verifying whether the first IPv6 prefix matches the target IPv6 prefix cannot determine whether the user sending the data packet is the target user or a fake user. However, it can exclude other data packets that are unrelated to the target IPv6 prefix, further ensuring that the user sending the data packet is using the target IPv6 prefix.

[0055] Step S13: If they match, verify whether the target base station address and the first IPv6 address are consistent with the subsequent base station address and subsequent IPv6 address corresponding to the subsequent data packets in each data packet. If they match, send the subsequent data packets to the target network device. If they do not match, discard the subsequent data packets to ensure that the subsequent data packets sent to the target network device are all sent by the user who sent the first data packet through the terminal that sent the first data packet based on the target base station.

[0056] In this embodiment, if the first IPv6 prefix matches the target IPv6 prefix, it is determined that the prefix used by the user sending the data packet is the target IPv6 prefix, that is, the target user or any virtual user. At this time, it is verified whether the target base station address and the first IPv6 address are consistent with the subsequent base station address and subsequent IPv6 address corresponding to the subsequent data packets in each data packet. That is, it is verified whether the target base station address is consistent with the subsequent base station address, whether the first IPv6 prefix in the first IPv6 address is consistent with the subsequent IPv6 prefix in the subsequent IPv6 address, and whether the first interface identifier in the first IPv6 address is consistent with the subsequent interface identifier in the subsequent IPv6 address. If all are consistent, then the subsequent data packets sent to the target network device are all sent by the user who sent the first data packet through the terminal that sent the first data packet based on the target base station. That is, the user and terminal that sent the first data packet and the target network device that received the subsequent data packets are the same.

[0057] Step S14: If there is a discrepancy, the next data packet in each data packet is taken as the first data packet, and the process jumps to the step of verifying whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element, until the verification of each data packet is completed.

[0058] In this embodiment, if there is a discrepancy, the current first data packet is discarded and the next data packet in each data packet is taken as the first data packet.

[0059] In summary, only one fixed user can send data packets to the target network device through a fixed terminal.

[0060] As can be seen, this application uses the first IPv6 address (including the first IPv6 prefix and the first interface identifier) ​​of the first data packet that passes IPv6 prefix verification for verification of subsequent data packets. This ensures that all subsequent data packets sent to the target network device are sent by the user who sent the first data packet through the terminal that sent the first data packet, based on the target base station. In this case, only data packets sent by one user through one terminal based on the target base station will be obtained. Therefore, there will not be a large number of fake users; only one user will exist. Furthermore, when the first IPv6 address is a forged address created by a fake user after intercepting the target IPv6 prefix, only data packets sent by that fake user will be obtained subsequently. When the first IPv6 address is the target IPv6 address of the target user, only data packets sent by that target user will be obtained subsequently.

[0061] This application discloses a specific security protection method applied to user plane functional network elements. Compared to the previous embodiment, this embodiment further explains and optimizes the technical solution. See also... Figure 2 As shown, it specifically includes:

[0062] Step S21: After the target user accesses the session management network element through the target terminal based on the target base station and initiates a session request, obtain the target base station address and the target IPv6 prefix of the target base station sent by the session management network element.

[0063] In this embodiment, before the verification process, the target terminal needs to access the session management network element through the target base station and initiate a session request, the target terminal needs to create a target IPv6 address, and a data packet transmission channel needs to be established between the target base station and the user plane function network element.

[0064] In this embodiment, the data packet transmission channel between the target base station and the user plane function network element is established as follows: after obtaining the target base station address and the target IPv6 prefix sent by the session management network element, the method further includes: determining the target base station based on the target base station address, and establishing a target tunnel between the target base station and the user plane function network element, so that the target base station can send the target data packet to the user plane function network element through the target tunnel.

[0065] It should be noted that the target tunnel is a general packet radio service tunnel.

[0066] In this embodiment, before obtaining each data packet sent to the local machine for accessing the target network device, the method further includes: obtaining a target field carrying the target base station address issued by the session management network element, and obtaining the target base station address based on the target field; the target field is a reused original field between the session management network element and the user plane function network element.

[0067] It should be noted that since the existing matching process of operators only verifies the user plane network element address corresponding to the target tunnel, forgers can also intrude into the backhaul network from the base station to the user plane network element by forging the base station address corresponding to the target tunnel. If forgers use the base station address to forge a large number of uplink data packets to access Internet data, it will also cause a data storm that overwhelms the core network user plane bandwidth, resulting in serious consequences such as normal users being unable to access the Internet. Therefore, the above-mentioned user plane network element obtaining the target base station address and adding the step of verifying the target base station address can further ensure that users can access the Internet normally.

[0068] In this embodiment, obtaining the target base station address and the target IPv6 prefix of the target base station sent by the session management network element includes: obtaining a session establishment message sent by the session management network element, and obtaining the target base station address of the target base station carried in the first field of the session establishment message and the target IPv6 prefix carried in the second field of the session establishment message. It should be noted that the first field is one of the multiplexed fields in the session establishment message.

[0069] Step S22: The target IPv6 prefix is ​​sent to the target terminal so that the target terminal can allocate the target IPv6 prefix to the target user. The target terminal combines the target interface identifier provided by the target terminal with the target IPv6 prefix to obtain the target IPv6 address. Then, the target terminal constructs an initial data packet based on the target IPv6 address and sends the initial data packet to the user plane function network element through the target base station. The target base station, after obtaining the initial data packet, adds the target base station address as the source address to the initial data packet to obtain the target data packet and sends the target data packet to the user plane function network element.

[0070] In this embodiment, sending the target IPv6 prefix to the target terminal includes: obtaining a router request sent by the target terminal, and returning a router advertisement to the target terminal based on the router request; the router advertisement includes the target IPv6 prefix.

[0071] In this embodiment, the user plane function network element will also bind the target IPv6 prefix to the target base station address for subsequent verification and to reduce the security risks of the target tunnel from the base station to the user plane function network element being forged and proxied. In other words, it prevents the target base station from being replaced by other base stations.

[0072] In this embodiment, the target interface identifier is an interface identifier generated by the target terminal based on the terminal media access control address and the initial interface identifier allocated to the target terminal by the session management network element.

[0073] As can be seen, after the target user accesses the session management network element through the target terminal and initiates a session request based on the target base station, this application obtains the target base station address and the target IPv6 prefix sent by the session management network element; sends the target IPv6 prefix to the target terminal so that the target terminal can allocate the target IPv6 prefix to the target user; and combines the target interface identifier provided by the target terminal with the target IPv6 prefix to obtain the target IPv6 address. Then, the target terminal constructs an initial data packet based on the target IPv6 address and sends the initial data packet to the user plane function network element through the target base station. The target base station, after obtaining the initial data packet, adds the target base station address as the source address to the initial data packet to obtain the target data packet, and sends the target data packet to the user plane function network element. Therefore, before the verification process, this application requires the target terminal to access the session management network element through the target base station and initiate a session request, the target terminal to create a target IPv6 address, and a data packet transmission channel to be established between the target base station and the user plane function network element for subsequent data packet transmission and verification.

[0074] See Figure 3 The diagram shown is a schematic of the safety protection process.

[0075] Step 1: The target terminal accesses the core network through the target base station and initiates a session establishment process. The session management network element sends a PFCP Session Establishment Request message to the user plane function network element. The Create PDR => IP Multicast Addressing Info => Source IP Address field carries the target base station address (gNB_ip). Specifically, it reuses the first field Source IPAddress under the IP Multicast Addressing Info field to carry the target base station address, and uses the Create PDR => PDI => UE IP address field (the second field) to carry the target IPv6 prefix UE_ipA of the terminal dynamically assigned by the session management network element. The user plane function network element creates and records session-related information based on the session establishment message sent by the session management network element.

[0076] Step 2: Establish a GTP (GPRS Tunneling Protocol) tunnel on the N3 side between the target base station (the base station corresponding to the target base station address gNB_ip) and the user plane function network element.

[0077] The target tunnel is used for data transmission.

[0078] Step 3: The target terminal obtains the target IPv6 prefix UE_ipA dynamically allocated by the session management network element through RS (Router Solicitation) / RA (Router Advertisement) messages, and then generates the target interface identifier UE_ipB by combining it with its own MAC address. UE_ipA + UE_ipB are combined to generate the target IPv6 address UE_ip used by the terminal to access Internet data.

[0079] Step 4: When the target terminal accesses internet data on the target network device side using the target IPv6 address UE_ip, if the first packet in the data stream passes through the user plane function element, the user plane function element will verify whether the source address gtp_gNBip (first base station address) in the outer GTP header of the data packet is the same as the target base station address gNB_ip issued by the session management element, and verify whether the prefix of the IPv6 source address UE_ip (first IPv6 prefix) in the inner IPv6 header of the data packet is the same as the target IPv6 prefix UE_ipA dynamically allocated by the session management element. If the verification passes, the user plane function element forwards the data packet to the target network device and records the complete target IPv6 address UE_ip of the target terminal, updating the Create PDR => PDI => UEIP address field, replacing the original value UE_ipA in this field with UE_ip; if the verification fails, the user plane function element discards the data packet.

[0080] Step 5: When subsequent data packets from the target terminal's internet access flow pass through the user plane function network element, the user plane function network element verifies whether the source address gtp_gNBip (subsequent base station address) in the outer GTP header of the data packet is the same as the target base station address gNB_ip issued by the session management network element, and verifies whether the inner IPv6 source address UE_ip (subsequent IPv6 address) of the data packet is the same as the terminal's target IPv6 address UE_ip recorded in the Create PDR => PDI => UE IP address field. If the verification passes, the user plane function network element forwards the data packet to the target network terminal; if the verification fails, the user plane function network element discards the data packet.

[0081] In summary, this solution adds verification of the interface identifier to achieve security protection. By matching and verifying the entire 128-bit IPv6 address, this application effectively reduces the risk of user information leakage and DDoS attacks on the Internet caused by forged IPv6 interface identifiers. Furthermore, by binding the user address (target IPv6 address) to the access base station address, it prevents the target base station from being replaced. Compared to existing user plane function network element packet matching processes, the method provided in this application increases security without affecting the performance of user plane function network elements or adding PFCP private fields.

[0082] Accordingly, this application also discloses a security protection device applied to a user plane function network element, see [link to relevant documentation]. Figure 4 As shown, the device includes:

[0083] The data packet acquisition module 11 is used to acquire each data packet sent to the local machine for accessing the target network device;

[0084] The first verification module 12 is used to verify whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element; the IPv6 address includes the IPv6 prefix and the interface identifier; one user corresponds to one IPv6 prefix; one interface identifier corresponds to one terminal;

[0085] The second verification module 13 is used to verify, if they match, whether the target base station address and the first IPv6 address are consistent with the subsequent base station address and subsequent IPv6 address corresponding to the subsequent data packets in each data packet. If they match, the subsequent data packets are sent to the target network device. If they do not match, the subsequent data packets are discarded to ensure that the subsequent data packets sent to the target network device are all sent by the user who sent the first data packet through the terminal that sent the first data packet based on the target base station.

[0086] The first data packet determination module 14 is used to take the next data packet in each data packet as the first data packet, and jump to the step of verifying whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element.

[0087] For more detailed information on the working process of each of the above modules, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0088] As can be seen, this application uses the first IPv6 address (including the first IPv6 prefix and the first interface identifier) ​​of the first data packet that has passed IPv6 prefix verification for the verification of subsequent data packets. This ensures that the subsequent data packets sent to the target network device are all sent by the user and terminal that sent the first data packet based on the target base station. At this time, only data packets sent by one user and one terminal based on the target base station will be obtained. Therefore, there will not be a large number of fake users, and only one user will exist.

[0089] Furthermore, embodiments of this application also provide an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0090] Figure 5This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a display screen 23, an input / output interface 24, a communication interface 25, a power supply 26, and a communication bus 27. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the security protection method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0091] In this embodiment, the power supply 26 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 25 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 24 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0092] Furthermore, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon can include computer programs 221, and the storage method can be temporary storage or permanent storage. The computer programs 221 may include, in addition to computer programs capable of performing the security protection methods executed by the electronic device 20 as disclosed in any of the foregoing embodiments, computer programs capable of performing other specific tasks.

[0093] Furthermore, embodiments of this application also disclose a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed security protection method.

[0094] For the specific steps of this method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0095] The various embodiments in this application are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. For the same or similar parts between the various embodiments, refer to each other. As for the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and relevant parts can be referred to in the method section.

[0096] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0097] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0098] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0099] The above provides a detailed description of the security protection method, device, equipment, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A security protection method, characterized in that, Applied to user plane function network elements, including: Retrieve the data packets sent to the local machine for accessing the target network device; Verify whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element; the IPv6 address includes the IPv6 prefix and the interface identifier; one user corresponds to one IPv6 prefix; one interface identifier corresponds to one terminal; If they match, then verify whether the target base station address and the first IPv6 address are consistent with the subsequent base station address and subsequent IPv6 address corresponding to the subsequent data packets in each data packet. If they match, then send the subsequent data packets to the target network device. If they do not match, then discard the subsequent data packets to ensure that the subsequent data packets sent to the target network device are all sent by the user who sent the first data packet through the terminal that sent the first data packet based on the target base station. If they are inconsistent, the next data packet in each data packet is taken as the first data packet, and the process jumps to the step of verifying whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet are consistent with the target base station address and the target IPv6 prefix issued by the session management network element, until the verification of each data packet is completed.

2. The security protection method according to claim 1, characterized in that, Before acquiring the data packets sent to the local machine for accessing the target network device, the process further includes: After the target user accesses the session management network element through the target terminal and initiates a session request based on the target base station, the target base station address and the target IPv6 prefix sent by the session management network element are obtained; The target IPv6 prefix is ​​sent to the target terminal so that the target terminal can allocate the target IPv6 prefix to the target user. The target terminal combines the target interface identifier provided by the target terminal with the target IPv6 prefix to obtain the target IPv6 address. Then, the target terminal constructs an initial data packet based on the target IPv6 address and sends the initial data packet to the user plane function network element through the target base station. The target base station, after obtaining the initial data packet, adds the target base station address as the source address to the initial data packet to obtain the target data packet, and then sends the target data packet to the user plane function network element. The target interface identifier is an interface identifier generated by the target terminal based on the terminal media access control address and the initial interface identifier allocated to the target terminal by the session management network element.

3. The security protection method according to claim 2, characterized in that, After obtaining the target base station address and the target IPv6 prefix sent by the session management network element, the method further includes: The target base station is determined based on the target base station address, and a target tunnel is established between the target base station and the user plane function network element so that the target base station can send the target data packet to the user plane function network element through the target tunnel.

4. The security protection method according to claim 2, characterized in that, Sending the target IPv6 prefix to the target terminal includes: The system obtains the router request sent by the target terminal and returns a router advertisement to the target terminal based on the router request; the router advertisement includes the target IPv6 prefix.

5. The safety protection method according to claim 2, characterized in that, The step of obtaining the target base station address and the target IPv6 prefix sent by the session management network element includes: Obtain the session establishment message sent by the session management network element, and obtain the target base station address of the target base station carried in the first field of the session establishment message and the target IPv6 prefix carried in the second field of the session establishment message.

6. The security protection method according to claim 2, characterized in that, Before acquiring the data packets sent to the local machine for accessing the target network device, the process further includes: Obtain the target field carrying the target base station address issued by the session management network element, and obtain the target base station address based on the target field; the target field is a reused original field between the session management network element and the user plane function network element.

7. A safety protection device, characterized in that, Applied to user plane function network elements, including: The data packet acquisition module is used to acquire the data packets sent to the local machine for accessing the target network device; The first verification module is used to verify whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element; the IPv6 address includes the IPv6 prefix and the interface identifier; one user corresponds to one IPv6 prefix; one interface identifier corresponds to one terminal; The second verification module is used to verify, if they match, whether the target base station address and the first IPv6 address are consistent with the subsequent base station address and subsequent IPv6 address corresponding to the subsequent data packets in each data packet. If they match, the subsequent data packets are sent to the target network device. If they do not match, the subsequent data packets are discarded, so as to ensure that the subsequent data packets sent to the target network device are all sent by the user who sent the first data packet through the terminal that sent the first data packet based on the target base station. The first data packet determination module is used to take the next data packet in each data packet as the first data packet, and jump to the step of verifying whether the first IPv6 prefix and the corresponding first base station address in the first IPv6 address of the first data packet in each data packet are consistent with the target base station address and target IPv6 prefix issued by the session management network element, until the verification of each data packet is completed.

8. The safety protection device according to claim 7, characterized in that, Also includes: The information acquisition module is used to acquire the target base station address and the target IPv6 prefix sent by the session management network element after the target user accesses the session management network element through the target terminal based on the target base station and initiates a session request; An information sending module is used to send the target IPv6 prefix to the target terminal, so that the target terminal can allocate the target IPv6 prefix to the target user, and combine the target interface identifier provided by the target terminal with the target IPv6 prefix to obtain the target IPv6 address. Then, the target terminal constructs an initial data packet based on the target IPv6 address and sends the initial data packet to the user plane function network element through the target base station. The target base station, after obtaining the initial data packet, adds the target base station address as the source address to the initial data packet to obtain the target data packet, and then sends the target data packet to the user plane function network element.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the security protection method as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, Used to store computer programs; wherein, when the computer programs are executed by a processor, they implement the security protection method as described in any one of claims 1 to 6.

Images