A method and apparatus for detecting abnormal terminal access

Abstract

This invention provides a method and apparatus for detecting abnormal terminal access. The abnormal terminal detection node is pre-configured with a Trusted Execution Environment (TEE). The method includes: the TEE receiving first encrypted data sent by a Deep Packet Inspection (DPI) system node, wherein the first encrypted data includes access information of a target terminal; the TEE receiving second encrypted data sent by an enterprise node, wherein the second encrypted data includes access experience data of the target terminal; and the TEE comparing the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal. This method, apparatus, and system can solve the problem of high false alarm rates caused by the inability to provide a secure detection environment in existing abnormal terminal access detection technologies, thus failing to compare user data with accurate experience data.

Description

Technical Field

[0001] This invention relates to a method and apparatus for detecting abnormal terminal access. Background Technology

[0002] Operators typically detect abnormal terminal access in edge computing centers by deploying a DPI (Deep Packet Inspection) system to collect core network signaling. First, a model of normal network behavior needs to be established. When a deviation is found between the real-time behavior model of the detected data and the normal behavior model, it is considered that the detected data is abnormal.

[0003] Simply deploying a DPI system on the operator's network side to detect abnormal terminal access has an accuracy rate that depends on the terminal access threshold settings. However, accurate terminal access threshold data is often held by enterprise users. Since existing abnormal terminal access detection technologies cannot provide a secure detection environment, enterprise users will not disclose the threshold data due to data security concerns, and operators will also not send user data to enterprises for data security reasons. This results in a high false alarm rate because there is no accurate empirical data to compare with user data during the detection process. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to address the above-mentioned shortcomings of the prior art by providing an abnormal terminal access detection method and apparatus. This method and apparatus ensure the security of publicly available terminal access experience data of enterprises and user data of operators through a trusted execution environment, thereby solving the problem that existing abnormal terminal access detection technologies cannot provide a secure detection environment, thus making it impossible to compare user data with accurate experience data, resulting in a high false alarm rate.

[0005] In a first aspect, the present invention provides an abnormal terminal access detection method, applied to an abnormal terminal detection node, comprising:

[0006] The TEE receives first encrypted data sent by the Deep Packet Inspection (DPI) system node, wherein the first encrypted data includes access information of the target terminal;

[0007] The TEE receives second encrypted data sent by the enterprise node, wherein the second encrypted data includes target terminal access experience data;

[0008] The TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal.

[0009] Preferably, before the TEE receives the first encrypted data sent by the Deep Packet Inspection (DPI) system node, it further includes:

[0010] The TEE generates a first key pair and a second key pair, wherein the first key pair includes a first public key and a first private key, and the second key pair includes a second public key and a second private key;

[0011] The TEE sends the first public key to the Deep Packet Inspection (DPI) system node, so that the DPI system node encrypts the access information of the target terminal and generates the first encrypted data based on the first public key.

[0012] The TEE sends the second public key to the enterprise node, so that the enterprise node encrypts the experience data and generates second encrypted data based on the second public key;

[0013] Before the TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal, it also includes:

[0014] The TEE decrypts the first encrypted information using the first private key to obtain the access information of the target terminal;

[0015] The TEE decrypts the encrypted information using the second private key to obtain the target terminal access experience data.

[0016] Preferably, the access information of the target terminal includes the target terminal's card number, the target access behavior, and the time when the target access behavior occurred;

[0017] The target terminal access experience data includes the target terminal's card number, target access behavior, experience time period of the target access behavior, and the threshold of the target access behavior within the corresponding experience time period.

[0018] Preferably, the TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal, including:

[0019] The TEE determines whether the number of times the target terminal performs the target access behavior within the empirical time period of the target access behavior exceeds the target access behavior threshold. If so, the access information of the target terminal is abnormal; otherwise, the access information of the target terminal is normal.

[0020] Preferably, in response to an abnormality in the access information of the target terminal, the TEE generates alarm information;

[0021] After the TEE generates alarm information, it also includes:

[0022] The TEE uses the first private key to encrypt the alarm information to obtain the third encrypted information;

[0023] The TEE uses the second private key to encrypt the alarm information to obtain the fourth encrypted information;

[0024] The TEE sends the third encrypted information to the Deep Packet Inspection (DPI) system node, so that the DPI system node can decrypt the third encrypted information according to the first public key and obtain the alarm information.

[0025] The TEE sends the fourth encrypted information to the enterprise node, so that the enterprise node can decrypt the fourth encrypted information according to the second public key and obtain the alarm information.

[0026] Preferably, it further includes:

[0027] The TEE deletes the access information and access experience data of the target terminal.

[0028] Secondly, the present invention also provides an abnormal terminal access detection method, applied to a Deep Packet Inspection (DPI) system node, comprising:

[0029] The first encrypted data is sent to the Trusted Execution Environment (TEE) in the abnormal terminal detection node, so that after receiving the first encrypted data and the second encrypted data sent by the enterprise node, the TEE compares the access information of the target terminal in the first encrypted data with the access experience data of the target terminal in the second encrypted data to determine whether the access information of the target terminal is abnormal.

[0030] Preferably, before sending the first encrypted data to the Trusted Execution Environment (TEE) in the abnormal terminal detection node, the method further includes:

[0031] Collect core network signaling from the N4 interface of the core network;

[0032] The access information of the target terminal is statistically analyzed based on the core network signaling.

[0033] Receive the first public key sent by the TEE;

[0034] The access information of the target terminal is encrypted using the first public key, and the first encrypted data is generated.

[0035] Preferably, it further includes:

[0036] Receive the third encrypted information sent by the TEE, wherein the third encrypted information includes alarm information;

[0037] The first public key is used to decrypt the third encrypted information to obtain the alarm information.

[0038] Thirdly, the present invention also provides an abnormal terminal access detection device, which is set in a Trusted Execution Environment (TEE) pre-configured in the abnormal terminal detection node, comprising:

[0039] The first encrypted receiving module is used to receive first encrypted data sent by the Deep Packet Inspection (DPI) system node, wherein the first encrypted data includes access information of the target terminal;

[0040] The second encrypted receiving module is connected to the first encrypted receiving module and is used to receive the second encrypted data sent by the enterprise node, wherein the second encrypted data includes target terminal access experience data;

[0041] The comparison module, connected to the second encrypted receiving module, is used to compare the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal.

[0042] Fourthly, the present invention also provides an abnormal terminal access detection device, disposed at a node of a deep packet inspection (DPI) system, comprising:

[0043] An encrypted transmission module is used to send first encrypted data to the Trusted Execution Environment (TEE) in the abnormal terminal detection node, so that after receiving the first encrypted data and the second encrypted data sent by the enterprise node, the TEE compares the access information of the target terminal in the first encrypted data with the access experience data of the target terminal in the second encrypted data to determine whether the access information of the target terminal is abnormal.

[0044] Fifthly, the present invention also provides an abnormal terminal access detection device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the abnormal terminal access detection method as described in the first aspect above, or to implement the abnormal terminal access detection method as described in the second aspect above.

[0045] The abnormal terminal access detection method and apparatus provided by this invention pre-configures a Trusted Execution Environment (TEE) at the abnormal terminal detection node. First, the TEE receives first encrypted data sent by a Deep Packet Inspection (DPI) system node, which includes access information of the target terminal. Then, the TEE receives second encrypted data sent by an enterprise node, which includes access experience data of the target terminal. Finally, the TEE compares the access information of the target terminal with the access experience data to determine whether the access information of the target terminal is abnormal. Because this invention ensures the security of publicly available terminal access experience data through a trusted execution environment during the abnormal terminal access detection process, it solves the problem of high false alarm rates in existing abnormal terminal access detection technologies that cannot provide a secure detection environment and therefore cannot compare user data with accurate experience data. Attached Figure Description

[0046] Figure 1 This is a scenario diagram illustrating an abnormal terminal access detection method according to an embodiment of the present invention;

[0047] Figure 2 This is a flowchart of an abnormal terminal access detection method according to Embodiment 1 of the present invention;

[0048] Figure 3 This is a flowchart of an abnormal terminal access detection method according to Embodiment 2 of the present invention;

[0049] Figure 4 This is a schematic diagram of the structure of an abnormal terminal access detection device according to Embodiment 3 of the present invention;

[0050] Figure 5 This is a schematic diagram of the structure of an abnormal terminal access detection device according to Embodiment 4 of the present invention;

[0051] Figure 6 This is a schematic diagram of an abnormal terminal access detection device according to Embodiment 5 of the present invention. Detailed Implementation

[0052] To enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0053] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0054] It is understood that, without conflict, the various embodiments and features in the embodiments of the present invention can be combined with each other.

[0055] It is understood that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, while the parts unrelated to the present invention are not shown in the drawings.

[0056] It is understood that each unit or module involved in the embodiments of the present invention may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0057] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this invention may occur in a different order than that marked in the accompanying drawings.

[0058] It is understood that the flowcharts and block diagrams of this invention illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this invention. Each block in the flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagram and flowchart can be implemented using a hardware-based system to achieve the specified function, or using a combination of hardware and computer instructions.

[0059] It is understood that the units and modules involved in the embodiments of the present invention can be implemented by software or by hardware. For example, the units and modules can be located in a processor.

[0060] It should be noted that the scenario diagrams described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0061] like Figure 1 The diagram shown is a scenario diagram of an abnormal terminal access detection method provided in an embodiment of this application, wherein each part is described as follows:

[0062] (1) Abnormal terminal access detection node: It is used to provide a Trusted Execution Environment (TEE). After receiving the access information of the target terminal sent by the DPI system and the access experience data of the target terminal sent by the enterprise node, it can compare the access information of the target terminal with the access experience data of the target terminal in the TEE to determine whether the access information of the target terminal is abnormal.

[0063] (2) Core network: There are multiple core network elements, including SMF (Session Management Function) and UPF (User Plane Function), which can transmit core network signaling through the core network N4 interface connected to SMF and UPF.

[0064] (3) Enterprise node: Used to send target terminal access experience data to abnormal terminal access detection node, and can be located at enterprise edge gateway.

[0065] (4) Deep Packet Inspection (DPI) system node: It can collect signaling on the N4 interface of the core network and collect the access information of the target terminal. The access information includes the online and offline information of the target terminal.

[0066] based on Figure 1 The following describes relevant embodiments of the abnormal terminal access detection method involved in this application, based on the scenario diagram shown.

[0067] Example 1:

[0068] This embodiment provides a method for detecting abnormal terminal access, such as... Figure 2 As shown, this method is applied to an abnormal terminal detection node, which is pre-configured with a Trusted Execution Environment (TEE). The method includes:

[0069] Step S101: The TEE receives first encrypted data sent by the Deep Packet Inspection (DPI) system node, wherein the first encrypted data includes access information of the target terminal.

[0070] In this embodiment, for the 5G MEC (Mobile Edge Computing) scenario, abnormal online / offline behavior of terminal access is detected, and the access information of the target terminal is divided into online information and offline information.

[0071] TEE refers to a secure area built on a computing platform using hardware and software methods, which ensures the confidentiality and integrity of code and data loaded within the secure area. Its goal is to ensure that a task executes as expected, guaranteeing the confidentiality and integrity of the initial state as well as the confidentiality and integrity of the runtime state.

[0072] In step S102, the TEE receives second encrypted data sent by the enterprise node, wherein the second encrypted data includes target terminal access experience data.

[0073] In this embodiment, the determination of abnormal terminal access relies on threshold data provided by the enterprise user. This threshold data is empirical data derived from the summary of historical online and offline data of the terminal. Through the security environment provided by TEE, it can be ensured that the operator's signaling data and the enterprise's threshold data are not obtained by the other party.

[0074] Optionally, before the TEE receives the first encrypted data sent by the Deep Packet Inspection (DPI) system node, it further includes:

[0075] The TEE generates a first key pair and a second key pair, wherein the first key pair includes a first public key and a first private key, and the second key pair includes a second public key and a second private key;

[0076] The TEE sends the first public key to the Deep Packet Inspection (DPI) system node, so that the DPI system node encrypts the access information of the target terminal and generates the first encrypted data based on the first public key.

[0077] The TEE sends the second public key to the enterprise node, so that the enterprise node encrypts the experience data and generates second encrypted data based on the second public key;

[0078] Before the TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal, it also includes:

[0079] The TEE decrypts the first encrypted information using the first private key to obtain the access information of the target terminal;

[0080] The TEE decrypts the encrypted information using the second private key to obtain the target terminal access experience data.

[0081] Optionally, the access information of the target terminal includes the target terminal's card number, the target access behavior, and the time when the target access behavior occurred;

[0082] The target terminal access experience data includes the target terminal's card number, target access behavior, experience time period of the target access behavior, and the threshold of the target access behavior within the corresponding experience time period.

[0083] In this embodiment, the target terminal's SIM card number can be IMSI (International Mobile Subscriber Identity). The target access behavior is divided into online and offline. The target terminal's access information can be shown in the table below:

[0084] time IMSI Target access behavior t1 Target terminal card number Going online or offline t2

[0085] Where t1 and t2 represent the time points when the corresponding target access behavior occurs.

[0086] The experience data for target terminal access can be shown in the table below:

[0087]

[0088] Here, T1 and T2 represent the two time endpoints of the corresponding experience time period.

[0089] In step S103, the TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal.

[0090] In this embodiment, by determining whether the number of times the target terminal goes online or offline within a preset time exceeds the threshold data provided by the enterprise, it can be determined whether the access behavior of the target terminal within the preset time is abnormal.

[0091] Optionally, the TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal, including:

[0092] The TEE determines whether the number of times the target terminal performs the target access behavior within the empirical time period of the target access behavior exceeds the target access behavior threshold. If so, the access information of the target terminal is abnormal; otherwise, the access information of the target terminal is normal.

[0093] Optionally, in response to an abnormality in the access information of the target terminal, the TEE generates alarm information;

[0094] After the TEE generates alarm information, it also includes:

[0095] The TEE uses the first private key to encrypt the alarm information to obtain the third encrypted information;

[0096] The TEE uses the second private key to encrypt the alarm information to obtain the fourth encrypted information;

[0097] The TEE sends the third encrypted information to the Deep Packet Inspection (DPI) system node, so that the DPI system node can decrypt the third encrypted information according to the first public key and obtain the alarm information.

[0098] The TEE sends the fourth encrypted information to the enterprise node, so that the enterprise node can decrypt the fourth encrypted information according to the second public key and obtain the alarm information.

[0099] In this embodiment, when an abnormal access behavior of the target terminal is detected, the TEE can generate an alarm containing the abnormal terminal's IMSI, and encrypt the alarm information with a private key and send it to the DPI system and the enterprise node respectively.

[0100] Optionally, it also includes:

[0101] The TEE deletes the access information and access experience data of the target terminal.

[0102] In this embodiment, by using TEE technology, operator-side signaling data and enterprise user terminal behavior data are statistically processed in a trusted execution environment, and the identified results are returned to the enterprise user and the operator network administrator. Their respective data are securely destroyed after calculation. Abnormal terminal online / offline behavior identification is completed without the leakage of core data of both parties, and the identification accuracy is higher.

[0103] It should be noted that, in addition to deleting the access information and access experience data of the target terminal, the Trusted Execution Environment (TEE) used to perform the above steps can also be destroyed, thereby further ensuring data security.

[0104] In one specific embodiment, the abnormal terminal access detection method may include the following steps:

[0105] S01. The abnormal terminal access detection node creates a Trusted Execution Environment (TEE), initializes the key, and generates two key pairs, A and B.

[0106] S02. The abnormal terminal access detection node establishes a connection channel with the DPI system and sends the A public key to the DPI system node.

[0107] S03. The abnormal terminal access detection node establishes a connection channel with the enterprise edge gateway and sends the B public key to the enterprise node.

[0108] S04. The DPI system node uses the A public key to encrypt the terminal online / offline statistics and sends the encrypted data to the TEE node's trusted execution environment. The terminal online / offline statistics are obtained by the DPI system node from the core network after collecting signaling through the N4 interface.

[0109] S05. Enterprise nodes use the B public key to encrypt the terminal online / offline behavior experience data, and send the encrypted data to the trusted execution environment of the abnormal terminal access detection node.

[0110] S06. In the trusted execution environment of the abnormal terminal access detection node, use private key A and private key B respectively to decrypt the encrypted statistical information and behavioral experience data of the terminal going online and offline.

[0111] S07. In a trusted execution environment, statistical information is matched and detected based on behavioral experience data, such as the experience data for setting up enterprise nodes:

[0112] IMSI Behavior threshold time IMSI-A Online 3 T1, T2

[0113] The statistical information for the DPI system nodes is as follows:

[0114] time IMSI Behavior t1 IMSI-A Online t2 IMSI-A Online t3 IMSI-A Online t4 IMSI-A Online

[0115] S08. When the IMSI online / offline behavior exceeds the threshold set by the enterprise within the empirical data period, the Trusted Execution Environment generates an alarm message containing the abnormal terminal IMSI. This alarm message is then encrypted using private key A and private key B and sent to the DPI system node and the enterprise node respectively.

[0116] S09. The operator uses public key A and the enterprise user uses public key B to decrypt the encrypted data containing alarm information to obtain the final abnormal terminal online / offline alarm information.

[0117] S10. The Trusted Execution Environment deletes the statistical information on terminal online / offline status and behavioral experience data within it, and destroys the Trusted Execution Environment.

[0118] The abnormal terminal access detection method provided in this invention pre-configures a Trusted Execution Environment (TEE) at the abnormal terminal detection node. First, the TEE receives first encrypted data sent by a Deep Packet Inspection (DPI) system node, which includes access information of the target terminal. Then, the TEE receives second encrypted data sent by an enterprise node, which includes access experience data of the target terminal. Finally, the TEE compares the access information of the target terminal with the access experience data to determine whether the access information of the target terminal is abnormal. Because this invention uses a Trusted Execution Environment to ensure the security of publicly available terminal access experience data during the abnormal terminal access detection process, it solves the problem of high false alarm rates in existing abnormal terminal access detection technologies that cannot provide a secure detection environment and therefore cannot compare user data with accurate experience data.

[0119] Example 2:

[0120] This embodiment provides a method for detecting abnormal terminal access, such as... Figure 3 As shown, this method, applied to a deep packet inspection (DPI) system node, includes:

[0121] Step S201: The first encrypted data is sent to the Trusted Execution Environment (TEE) in the abnormal terminal detection node, so that after receiving the first encrypted data and the second encrypted data sent by the enterprise node, the TEE compares the access information of the target terminal in the first encrypted data with the access experience data of the target terminal in the second encrypted data to determine whether the access information of the target terminal is abnormal.

[0122] In this embodiment, for the 5G MEC (Mobile Edge Computing) scenario, abnormal online / offline behavior of terminal access is detected, and the access information of the target terminal is divided into online information and offline information.

[0123] Optionally, before sending the first encrypted data to the Trusted Execution Environment (TEE) in the abnormal terminal detection node, the method further includes:

[0124] Collect core network signaling from the N4 interface of the core network;

[0125] The access information of the target terminal is statistically analyzed based on the core network signaling.

[0126] Receive the first public key sent by the TEE;

[0127] The access information of the target terminal is encrypted using the first public key, and the first encrypted data is generated.

[0128] In this embodiment, the DPI system node is connected to the N4 interface between the core network elements SMF and UPF, and is able to collect core network signaling.

[0129] Optionally, it also includes:

[0130] Receive the third encrypted information sent by the TEE, wherein the third encrypted information includes alarm information;

[0131] The first public key is used to decrypt the third encrypted information to obtain the alarm information.

[0132] In this embodiment, when an abnormal access behavior of the target terminal is detected, the TEE can generate an alarm containing the abnormal terminal's IMSI, and encrypt the alarm information with a private key and send it to the DPI system and the enterprise node respectively.

[0133] Example 3:

[0134] like Figure 4 As shown, this embodiment provides an abnormal terminal access detection device, which is set in a Trusted Execution Environment (TEE) pre-configured in the abnormal terminal detection node. The device includes:

[0135] The first encrypted receiving module 11 is used to receive first encrypted data sent by the deep packet inspection (DPI) system node, wherein the first encrypted data includes access information of the target terminal.

[0136] The second encryption receiving module 12 is connected to the first encryption receiving module 11 and is used to receive the second encryption data sent by the enterprise node, wherein the second encryption data includes target terminal access experience data.

[0137] The comparison module 13, connected to the second encrypted receiving module 12, is used to compare the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal.

[0138] Preferably, the device further includes:

[0139] A key generation module is used to generate a first key pair and a second key pair, wherein the first key pair includes a first public key and a first private key, and the second key pair includes a second public key and a second private key;

[0140] The first public key sending module is used to send the first public key to the deep packet inspection (DPI) system node, so that the DPI system node can encrypt the access information of the target terminal and generate the first encrypted data according to the first public key.

[0141] The second public key sending module is used to send the second public key to the enterprise node, so that the enterprise node encrypts the experience data and generates the second encrypted data according to the second public key;

[0142] The device further includes:

[0143] The first decryption module is used to decrypt the first encrypted information according to the first private key to obtain the access information of the target terminal;

[0144] The second decryption module is used to decrypt the encrypted information according to the second private key to obtain the target terminal access experience data.

[0145] Preferably, the access information of the target terminal includes the target terminal's card number, the target access behavior, and the time when the target access behavior occurred;

[0146] The target terminal access experience data includes the target terminal's card number, target access behavior, experience time period of the target access behavior, and the threshold of the target access behavior within the corresponding experience time period.

[0147] Preferably, the comparison module 13 specifically includes:

[0148] The judgment unit is used to determine whether the number of times the target terminal performs the target access behavior within the empirical time period of the target access behavior exceeds the target access behavior threshold. If so, the access information of the target terminal is abnormal; otherwise, the access information of the target terminal is normal.

[0149] Preferably, in response to an abnormality in the access information of the target terminal, the TEE generates alarm information;

[0150] Preferably, the device further includes:

[0151] The first alarm encryption module is used to encrypt the alarm information using the first private key to obtain the third encrypted information;

[0152] The second alarm encryption module is used to encrypt the alarm information using the second private key to obtain the fourth encrypted information;

[0153] The first alarm sending module is used to send the third encrypted information to the deep packet inspection (DPI) system node, so that the DPI system node can decrypt the third encrypted information according to the first public key and obtain the alarm information.

[0154] The second alarm sending module is used to send the fourth encrypted information to the enterprise node, so that the enterprise node can decrypt the fourth encrypted information according to the second public key and obtain the alarm information.

[0155] Preferably, the device further includes:

[0156] The deletion module is used to delete the access information of the target terminal and the access experience data of the target terminal.

[0157] Example 4:

[0158] like Figure 5 As shown, this embodiment provides an abnormal terminal access detection device, which is set on a Deep Packet Inspection (DPI) system node and is used to execute the abnormal terminal access detection method described in Embodiment 2 above, including:

[0159] The encrypted transmission module 21 is used to send the first encrypted data to the Trusted Execution Environment (TEE) in the abnormal terminal detection node, so that after receiving the first encrypted data and the second encrypted data sent by the enterprise node, the TEE compares the access information of the target terminal in the first encrypted data with the access experience data of the target terminal in the second encrypted data to determine whether the access information of the target terminal is abnormal.

[0160] Preferably, the device further includes:

[0161] The acquisition module is used to acquire core network signaling from the N4 interface of the core network;

[0162] The statistics module is used to collect statistics on the access information of the target terminal based on the core network signaling.

[0163] A public key receiving module is used to receive the first public key sent by the TEE;

[0164] The access information encryption module is used to encrypt the access information of the target terminal according to the first public key and generate the first encrypted data.

[0165] Preferably, the device further includes:

[0166] An alarm receiving module is used to receive third encrypted information sent by the TEE, wherein the third encrypted information includes alarm information;

[0167] An alarm decryption module is used to decrypt the third encrypted information using the first public key to obtain the alarm information.

[0168] Example 5:

[0169] like Figure 6 As shown, this embodiment provides an abnormal terminal access detection device for executing the above-described abnormal terminal access detection method. It includes a memory 31 and a processor 32. The memory 31 stores a computer program, and the processor 32 is configured to run the computer program to execute the abnormal terminal access detection method in Embodiment 1, or to implement the abnormal terminal access detection method as described in Embodiment 2.

[0170] The memory 31 is connected to the processor 32. The memory 31 can be a flash memory, a read-only memory or other memory, and the processor 32 can be a central processing unit or a microcontroller.

[0171] The abnormal terminal access detection method and apparatus provided in Examples 2 to 5 pre-configure a Trusted Execution Environment (TEE) at the abnormal terminal detection node. First, the TEE receives first encrypted data sent by a Deep Packet Inspection (DPI) system node, which includes access information of the target terminal. Then, the TEE receives second encrypted data sent by an enterprise node, which includes access experience data of the target terminal. Finally, the TEE compares the access information of the target terminal with the access experience data to determine whether the access information of the target terminal is abnormal. Because this invention ensures the security of publicly available terminal access experience data through a trusted execution environment during the abnormal terminal access detection process, it solves the problem of high false alarm rates in existing abnormal terminal access detection technologies that cannot provide a secure detection environment and therefore cannot compare user data with accurate experience data.

[0172] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal terminal access, characterized in that, The method, applied to an abnormal terminal detection node pre-configured with a Trusted Execution Environment (TEE), includes: The TEE receives the first encrypted data sent by the Deep Packet Inspection (DPI) system node. The first encrypted data includes the access information of the target terminal. The access information of the target terminal is divided into online information and offline information. The access information of the target terminal is obtained by the DPI system node from the core network N4 interface by collecting core network signaling and statistically analyzing the core network signaling. The TEE receives second encrypted data sent by the enterprise node, wherein the second encrypted data includes target terminal access experience data; The TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal. The access information of the target terminal includes the target terminal's card number, target access behavior, and the time of occurrence of the target access behavior. The target access behavior is divided into online and offline. The target terminal access experience data includes the target terminal's card number, target access behavior, experience time period of the target access behavior, and the target access behavior threshold within the corresponding experience time period. The target access behavior threshold is experience data summarized by the enterprise node based on the historical online and offline data of the target terminal. The abnormal terminal detection node uses the security environment provided by TEE to prevent the enterprise node from obtaining the access information of the target terminal from the DPI system node, and to prevent the DPI system node from obtaining the target terminal access experience data from the enterprise node. The TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal, including: The TEE determines whether the number of times the target terminal performs the target access behavior within the empirical time period of the target access behavior exceeds the target access behavior threshold. If so, the access information of the target terminal is abnormal; otherwise, the access information of the target terminal is normal.

2. The abnormal terminal access detection method according to claim 1, characterized in that, Before the TEE receives the first encrypted data sent by the Deep Packet Inspection (DPI) system node, it also includes: The TEE generates a first key pair and a second key pair, wherein the first key pair includes a first public key and a first private key, and the second key pair includes a second public key and a second private key; The TEE sends the first public key to the Deep Packet Inspection (DPI) system node, so that the DPI system node encrypts the access information of the target terminal and generates the first encrypted data based on the first public key. The TEE sends the second public key to the enterprise node, so that the enterprise node encrypts the experience data and generates second encrypted data based on the second public key; Before the TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal, it also includes: The TEE decrypts the first encrypted data using the first private key to obtain the access information of the target terminal; The TEE decrypts the second encrypted data using the second private key to obtain the target terminal access experience data.

3. The abnormal terminal access detection method according to claim 2, characterized in that, In response to an abnormality in the access information of the target terminal, the TEE generates an alarm message; After the TEE generates alarm information, it also includes: The TEE uses the first private key to encrypt the alarm information to obtain the third encrypted information; The TEE uses the second private key to encrypt the alarm information to obtain the fourth encrypted information; The TEE sends the third encrypted information to the Deep Packet Inspection (DPI) system node, so that the DPI system node can decrypt the third encrypted information according to the first public key and obtain the alarm information. The TEE sends the fourth encrypted information to the enterprise node, so that the enterprise node can decrypt the fourth encrypted information according to the second public key and obtain the alarm information.

4. The abnormal terminal access detection method according to claim 3, characterized in that, Also includes: The TEE deletes the access information and access experience data of the target terminal.

5. A method for detecting abnormal terminal access, characterized in that, Applied to nodes in deep packet inspection (DPI) system nodes, including: Collect core network signaling from the N4 interface of the core network; The access information of the target terminal is statistically analyzed based on the core network signaling. The first encrypted data is sent to the Trusted Execution Environment (TEE) in the abnormal terminal detection node. The first encrypted data includes the access information of the target terminal, which is divided into online information and offline information. After receiving the first encrypted data and the second encrypted data sent by the enterprise node, the TEE compares the access information of the target terminal in the first encrypted data with the access experience data of the target terminal in the second encrypted data to determine whether the access information of the target terminal is abnormal. The target terminal's access information includes the target terminal's SIM card number, target access behavior, and the time of occurrence of the target access behavior, which is divided into online and offline. The target terminal's access experience data includes the target terminal's SIM card number, target access behavior, the experience time period of the target access behavior, and the target access behavior threshold within the corresponding experience time period. The target access behavior threshold is experience data summarized by the enterprise node based on the historical online and offline data of the target terminal. The abnormal terminal detection node uses the security environment provided by TEE to prevent the enterprise node from obtaining the target terminal's access information from the DPI system node, and to prevent the DPI system node from obtaining the target terminal's access experience data from the enterprise node. The TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal, including: The TEE determines whether the number of times the target terminal performs the target access behavior within the empirical time period of the target access behavior exceeds the target access behavior threshold. If so, the access information of the target terminal is abnormal; otherwise, the access information of the target terminal is normal.

6. The abnormal terminal access detection method according to claim 5, characterized in that, Before sending the first encrypted data to the Trusted Execution Environment (TEE) in the abnormal terminal detection node, the process also includes: Receive the first public key sent by the TEE; The access information of the target terminal is encrypted using the first public key, and the first encrypted data is generated.

7. The abnormal terminal access detection method according to claim 6, characterized in that, Also includes: Receive the third encrypted information sent by the TEE, wherein the third encrypted information includes alarm information; The first public key is used to decrypt the third encrypted information to obtain the alarm information.

8. An abnormal terminal access detection device, characterized in that, The device, located in a Trusted Execution Environment (TEE) pre-configured on the abnormal terminal detection node, includes: The first encrypted receiving module is used to receive the first encrypted data sent by the Deep Packet Inspection (DPI) system node. The first encrypted data includes the access information of the target terminal. The access information of the target terminal is divided into online information and offline information. The access information of the target terminal is obtained by the DPI system node from the core network N4 interface collecting core network signaling and statistically analyzing the core network signaling. The second encrypted receiving module is connected to the first encrypted receiving module and is used to receive the second encrypted data sent by the enterprise node, wherein the second encrypted data includes target terminal access experience data; The comparison module, connected to the second encrypted receiving module, is used to compare the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal. The access information of the target terminal includes the target terminal's card number, target access behavior, and the time of occurrence of the target access behavior. The target access behavior is divided into online and offline. The target terminal access experience data includes the target terminal's card number, target access behavior, experience time period of the target access behavior, and the target access behavior threshold within the corresponding experience time period. The target access behavior threshold is experience data summarized by the enterprise node based on the historical online and offline data of the target terminal. The abnormal terminal detection node uses the security environment provided by TEE to prevent the enterprise node from obtaining the access information of the target terminal from the DPI system node, and to prevent the DPI system node from obtaining the target terminal access experience data from the enterprise node. The comparison module specifically includes: The judgment unit is used to determine whether the number of times the target terminal performs the target access behavior within the empirical time period of the target access behavior exceeds the target access behavior threshold. If so, the access information of the target terminal is abnormal; otherwise, the access information of the target terminal is normal.

9. An abnormal terminal access detection device, characterized in that, Configured on the DPI system node for deep packet inspection, including: The acquisition module is used to acquire core network signaling from the N4 interface of the core network; The statistics module is used to collect statistics on the access information of the target terminal based on the core network signaling. An encrypted transmission module is used to send first encrypted data to the Trusted Execution Environment (TEE) in the abnormal terminal detection node. The first encrypted data includes access information of the target terminal, which is divided into online information and offline information. After receiving the first encrypted data and the second encrypted data sent by the enterprise node, the TEE compares the access information of the target terminal in the first encrypted data with the access experience data of the target terminal in the second encrypted data to determine whether the access information of the target terminal is abnormal. The target terminal's access information includes the target terminal's SIM card number, target access behavior, and the time of occurrence of the target access behavior, which is divided into online and offline. The target terminal's access experience data includes the target terminal's SIM card number, target access behavior, the experience time period of the target access behavior, and the target access behavior threshold within the corresponding experience time period. The target access behavior threshold is experience data summarized by the enterprise node based on the historical online and offline data of the target terminal. The abnormal terminal detection node uses the security environment provided by TEE to prevent the enterprise node from obtaining the target terminal's access information from the DPI system node, and to prevent the DPI system node from obtaining the target terminal's access experience data from the enterprise node. The TEE compares the access information of the target terminal with the access experience data of the target terminal to determine whether the access information of the target terminal is abnormal, including: The TEE determines whether the number of times the target terminal performs the target access behavior within the empirical time period of the target access behavior exceeds the target access behavior threshold. If so, the access information of the target terminal is abnormal; otherwise, the access information of the target terminal is normal.

10. An abnormal terminal access detection device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to implement the abnormal terminal access detection method as described in any one of claims 1-4, or to implement the abnormal terminal access detection method as described in any one of claims 5-7.

Images