A message association method and system, device, storage medium

Abstract

Embodiments of the present disclosure provide a message association method and system, device, and storage medium. The message association method comprises: obtaining core network signaling of a fifth generation mobile communication technology (5G) message, media data of the 5G message, and online data of the 5G message respectively through different communication interfaces; analyzing the core network signaling to obtain core network key fields; analyzing the media data to obtain media key fields; analyzing the online data to obtain service key fields; matching coincident fields among the core network key fields, the media key fields, and the service key fields to obtain an association result among the core network signaling of the 5G message, the media data of the 5G message, and the online data of the 5G message. The method provided in the present disclosure enables comprehensive association of the core network signaling and the media data and the online data of the 5G message, can further enable association of service data and user identity, and is helpful for effectively identifying 5G message content that a user is interested in, and facilitates subsequent content distribution.

Description

Technical Field

[0001] This disclosure relates to the field of mobile network data analysis, specifically to a message association method, system, device, and storage medium. Background Technology

[0002] 5G messaging, also known as Rich Communication Suite (RCS) or converged communication, is a communication method that integrates voice, messaging, and other communication services. 5G messaging can consist of at least one of the following: message signature, text content, detailed content link, image content, and video content. It has the potential to disrupt traditional application distribution models and is expected to become a strategic entry point for a massive number of lightweight applications that can be deployed and used immediately.

[0003] Currently, traditional identification and association methods in mobile networks are generally applied to applications. However, when 5G messaging adopts a new mode for communication of massive numbers of lightweight applications, the traditional mode has shortcomings in analyzing 5G messages and lacks countermeasures related to 5G messages. Summary of the Invention

[0004] In view of this, the main objective of this disclosure is to provide a message association method, system, device, and storage medium. The message association method proposed in this disclosure enables comprehensive association of core network signaling, media data, and internet access data for 5G messages. It further enables the association of service data and user identity, facilitating the effective identification of 5G message content of interest to users and simplifying subsequent content distribution.

[0005] To achieve the above objectives, the technical solution disclosed herein is implemented as follows: A first aspect of this disclosure provides a message association method, the method comprising: The core network signaling of the 5G message, the media data of the 5G message, and the Internet access data of the 5G message are obtained through different communication interfaces. Analyzing the core network signaling, key core network fields are obtained; Analyze the media data to obtain key media fields; Analyze the internet access data to obtain key business fields; By matching overlapping fields among the core network key fields, the media key fields, and the service key fields, the association results between the core network signaling of the 5G message, the media data of the 5G message, and the internet access data of the 5G message are obtained.

[0006] In some embodiments, the media key field includes a first key field and a second key field. Matching the overlapping fields among the core network key field, the media key field, and the service key field to obtain the association result between the core network signaling of the 5G message, the media data of the 5G message, and the internet access data of the 5G message includes: By matching overlapping fields between the first key field and the core network key field, a first association relationship between the core network signaling and the media data is obtained; By matching overlapping fields among the first key field, the second key field, and the business key field, a second association relationship between the media data and the internet access data is obtained. The association result is obtained based on the first association relationship and the second association relationship.

[0007] In some embodiments, the core network key fields include: a first user identifier and a first address information; The first key field includes: second user identifier, second address information, and first multimedia link; The second key field includes: the second multimedia link; The key business field includes: third multimedia link.

[0008] In some embodiments, matching overlapping fields between the first key field and the core network key field to obtain a first association between the core network signaling and the media data includes: If the first user identifier and the second user identifier match successfully, and / or if the first address information and the second address information match successfully, a first association relationship is established between the core network signaling and the media data.

[0009] In some embodiments, matching overlapping fields among the first key field, the second key field, and the business key field to obtain a second association between the media data and the internet access data includes: If the first multimedia link, the second multimedia link, and the third multimedia link are successfully matched, a second association relationship is established between the media data and the internet access data.

[0010] In some embodiments, analyzing the media data to obtain key media fields includes: Based on the media type of the media data, determine the first signaling data corresponding to the session initiation protocol and the second signaling data corresponding to the session relay protocol; Analyze the first signaling data to obtain the first key field; The second signaling data is analyzed to obtain the second key field.

[0011] In some embodiments, analyzing the first signaling data to obtain the first key field includes: Parse the first signaling data to obtain the user registration message and the first paging message; The user registration message is detected to obtain the second user identifier; Analyze the header of the first paging message to obtain the first communication number and communication identifier related to the user's identity; Analyze the payload portion of the first paging message to obtain the first media attribute and the first text type; Analyze the message body of the first paging message to obtain the second address information and the first multimedia link; The first key field is obtained based on the second user identifier, the first communication number, the communication identifier, the first media attribute, the first text type, the second address information, and the first multimedia link.

[0012] In some embodiments, the analysis of the second signaling data to obtain the second key field includes: The second signaling data is parsed to obtain the second paging message; Analyze the second paging message to obtain the second communication number related to the user's identity, the port number corresponding to the Session Relay Protocol, and the request message body; Analyzing the request message body yields a second text type and a second multimedia link; The second key field is obtained based on the second communication number, the port number, the second text type, and the second multimedia link.

[0013] In some embodiments, the analysis of the core network signaling to obtain core network key fields includes: Obtain the first user identifier from the core network signaling; A core network session window is established based on the first user identifier, and during the establishment or updating process of the core network session window, the data network name, the first tunnel information, and the first address information are obtained. Based on the first user identifier, the data network name, the first tunnel information, and the first address information, the core network key fields are obtained.

[0014] In some embodiments, the analysis of the internet access data to obtain key business fields includes: Based on the aforementioned internet data, determine the Hypertext Transfer Protocol (HTTP) data stream; Based on the Hypertext Transfer Protocol data stream, obtain the Internet Protocol quintuple; Obtain second tunnel information based on the outer Internet Protocol stack; Based on the data content related to multimedia data in the internet data, obtain the third multimedia link; Based on the Internet Protocol quintuple, the second tunnel information, and the third multimedia link, the key business fields are obtained.

[0015] In some embodiments, the step of acquiring the core network signaling of the 5G message, the media data of the 5G message, and the internet access data of the 5G message respectively through different communication interfaces includes: The core network signaling for the 5G message is obtained in at least one of the N4 and N11 interfaces; The media data is acquired from at least one of the N4 interface, the N11 interface, the N3 interface, and the N6 interface; The Internet access data is obtained from at least one of the N3 interface and the N6 interface.

[0016] A second aspect of this disclosure provides a message association system, the system comprising: The acquisition module is configured to acquire the core network signaling of the 5G message, the media data of the 5G message, and the Internet access data of the 5G message respectively through different communication interfaces; The core network analysis module is configured to analyze the core network signaling to obtain key core network fields. The media data analysis module is configured to analyze the media data and obtain key media fields; The Internet access data analysis module is configured to analyze the Internet access data to obtain key business fields; The association module is configured to obtain the association results between the core network signaling of the 5G message, the media data of the 5G message, and the Internet access data of the 5G message based on the core network key field, the media key field, and the service key field.

[0017] In some embodiments, the media key field includes a first key field and a second key field, and the association module includes: The first matching module is configured to match overlapping fields between the first key field and the core network key field to obtain a first association relationship between the core network signaling and the media data. The second matching module is configured to match overlapping fields among the first key field, the second key field, and the business key field to obtain a second association relationship between the media data and the internet access data. The two-level association module is configured to obtain the association result based on the first association relationship and the second association relationship.

[0018] In some embodiments, the core network key fields include: a first user identifier and a first address information; The first key field includes: second user identifier, second address information, and first multimedia link; The second key field includes: the second multimedia link; The key business field includes: third multimedia link.

[0019] In some embodiments, the first matching module is further configured to establish a first association between the core network signaling and the media data when the first user identifier and the second user identifier are successfully matched, and / or the first address information and the second address information are successfully matched.

[0020] In some embodiments, the second matching module is further configured to establish a second association between the media data and the internet access data if the first multimedia link, the second multimedia link, and the third multimedia link are successfully matched.

[0021] A third aspect of this disclosure provides a message association apparatus, the apparatus comprising: processor; Memory used to store processor-executable instructions; The processor is configured to execute the message association method as described in the embodiments of the first aspect of this disclosure.

[0022] In some embodiments, when executable instructions in the storage medium are executed by a processor, the message association method as described in the embodiments of the first aspect of this disclosure is implemented.

[0023] The technical solutions provided in this disclosure can include the following beneficial effects: In the message association method provided in this disclosure, core network signaling, media data, and internet access data of 5G messages are obtained from different communication interfaces of the core network. Overlapping fields are matched on the key fields obtained by parsing the core network signaling, media data, and internet access data respectively to obtain the association results between the core network signaling, media data, and internet access data of the 5G messages. Based on the association results obtained in this disclosure, the actual internet access data of the user plane can be associated with the user, providing data support for the subsequent analysis of the 5G mobile internet monitoring system. Furthermore, it can also perform joint analysis and reference on the multimedia content of users in IMS communication and internet access, improving the completeness of 5G message acquisition, helping to effectively identify the complete 5G message content that users are interested in, and facilitating the subsequent distribution of 5G message content. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating a message association method according to an exemplary embodiment; Figure 2 This is a schematic diagram of the structure of a message association system according to an exemplary embodiment. Figure 1 ; Figure 3 This is a schematic diagram of the structure of a message association system according to an exemplary embodiment. Figure 2 ; Figure 4 This is a schematic diagram illustrating the workflow of a core network signaling analysis module according to an exemplary embodiment; Figure 5 This is a schematic diagram illustrating the workflow of a SIP protocol analysis module according to an exemplary embodiment; Figure 6 This is a schematic diagram illustrating the workflow of an MSRP protocol analysis module according to an exemplary embodiment; Figure 7 This is a schematic diagram illustrating the workflow of an HTTP protocol analysis module according to an exemplary embodiment; Figure 8 This is a schematic diagram illustrating the workflow of a 5G message association module according to an exemplary embodiment; Figure 9 This is a block diagram illustrating a message association device according to an exemplary embodiment. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of this disclosure clearer, the specific technical solutions of the invention will be further described in detail below with reference to the accompanying drawings of the embodiments of this disclosure. The following embodiments are used to illustrate this disclosure, but are not intended to limit the scope of this disclosure.

[0026] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0027] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0029] Before providing a further detailed description of the embodiments of this disclosure, the nouns and terms involved in the embodiments of this disclosure will be explained, and the nouns and terms involved in the embodiments of this disclosure shall be interpreted as follows.

[0030] 1) Signaling: It is a signal of control circuit that is transmitted between different links in the communication network (such as base stations, mobile stations and mobile control switching centers) so that each link can analyze and process it and form a series of operations and controls through interaction. The role of signaling is to ensure the effective and reliable transmission of user information.

[0031] 2) Internet Protocol (IP): This is a network layer protocol in the TCP / IP architecture, used to provide information about various protocols to the transport layer.

[0032] 3) Access and Mobility Management Function (AMF): This is the control plane access point for user terminals and the radio core network, providing authentication and authorization functions for users accessing the core network.

[0033] 4) Session Management function (SMF): Responsible for tunnel maintenance, IP address allocation and management, policy enforcement and QoS control, billing data collection, roaming, etc.

[0034] 5) Authentication Server Function (AUSF): Used to implement authentication functions and manage authentication data in the core network.

[0035] 6) User plane function (UPF) is the function of user plane network elements in the core network, used to implement packet routing and forwarding, policy enforcement, traffic reporting, and Quality of Service (QoS) processing.

[0036] 7) Unified Data Management (UDM): This is a function of the control plane network elements in the core network, used to realize user identification, access authorization, registration, mobility, subscription, SMS management, etc.

[0037] 8) Radio Access Network (RAN): A part of a mobile communication system, which connects user terminals to the communication network based on radio access technology.

[0038] 9) Data Network (DN): A communication network used to transmit data services. It is a network that forms a global, national, and regional network with data switches as transfer points.

[0039] 10) Uniform Resource Locator (URL): A Uniform Resource Locator on the World Wide Web of the Internet, used to identify the network address of each information resource.

[0040] Currently, with the widespread application of 5G messaging, it can revolutionize the traditional messaging delivery model of application (APP) distribution. 5G messaging enables communication between users through short message signatures, text content, detailed content links, image content, and video content. Currently, 5G messaging is used in 4G or 5G network architectures. Specifically, for 5G messaging that includes multimedia content, it can be applied to IP Multimedia Subsystem (IMS) network architectures.

[0041] In 4G or 5G mobile communication technologies, the control plane and user plane of the core network are separated. The control plane connects to different control network elements through communication network interfaces (N11, N4, N12, N22, N7, etc.) and handles various connections and disconnections based on transmitted control signaling. For example, it implements functions such as identity authentication (through AUSF network elements), access and mobility management (through AMF network elements), and session management (through SMF network elements). The user plane connects to user plane function network elements (UPF) through communication network interfaces (N3, N6, N9, etc.) and is used to transmit actual internet data packets.

[0042] However, when 5G messaging is used in 4G or 5G network architectures, due to the separation of user plane and control plane, some 5G message pushes lack analysis of 5G messages on the user plane, and the control plane cannot reasonably implement 5G message push for users.

[0043] Furthermore, IP Multimedia Subsystem (IMS) is a novel form of multimedia service that can meet the needs of end customers for newer and more diverse multimedia services. IMS is considered a core technology of next-generation networks and an important way to solve the convergence of mobile and fixed networks, introducing differentiated services such as voice, data, and video triple convergence. Under the IMS network architecture, both multimedia communication data and user internet access data contain multimedia data that users are actually interested in. However, traditional analysis methods have not considered the relationship between the two, and the analysis of the multimedia information that different users are interested in is not comprehensive and specific enough. This is a problem that needs to be overcome when transmitting multimedia data via 5G messages under the IMS network.

[0044] In view of this, this disclosure proposes a message association method. See [link to relevant documentation]. Figure 1 , Figure 1 This is a flowchart illustrating a message association method according to an exemplary embodiment; such as Figure 1 As shown, the message association method proposed in this disclosure can be implemented through the following steps: Step 101: Obtain the core network signaling of 5G messages, the media data of 5G messages, and the Internet access data of 5G messages from different communication interfaces. Step 102: Analyze the core network signaling to obtain the key fields of the core network; Step 103: Analyze the media data to obtain key media fields; Step 104: Analyze internet access data to obtain key business fields; Step 105: Match the overlapping fields among the core network key fields, media key fields, and service key fields to obtain the association results between the core network signaling of 5G messages, the media data of 5G messages, and the internet access data of 5G messages.

[0045] Here, the message association method proposed in this embodiment can be applied to computer equipment (processor or processor cluster) in the backend of the IMS core network to obtain core network signaling, media data and Internet access data at each communication interface, so that the core network signaling, media data and Internet access data of 5G messages are fully associated, and further associate service data with user identity, which helps to effectively identify the 5G message content that users are interested in, and facilitates the subsequent distribution of multimedia-related content of 5G messages to users.

[0046] In step 101, the core network signaling is control plane signaling, obtained from the communication interface between at least two network elements in the control plane of the core network, and used to carry control information related to 5G messages; the media data is obtained from the communication interface between at least two network elements in the IMS core network used to implement IMS communication. Here, 5G messages include short messages and long messages. When the 5G message includes a long message, the media data disclosed above may only include control plane IMS signaling. In this case, the IMS signaling has a media link, through which IMS media content can be found; when the 5G message includes a short message, the media data disclosed above may include both control plane IMS signaling and IMS media content; the internet access data is user plane data. The internet access data does not carry user identity information, but has actual message content, such as Hyper Text Markup Language (HTML) files, query results, multimedia content, etc.

[0047] In some embodiments, the acquisition of the core network signaling, media data, and internet access data of 5G messages in step 101 through different communication interfaces can be implemented in the following manner: Core network signaling for obtaining 5G messages in at least one of the N4 and N11 interfaces; Media data is acquired from at least one of the N4, N11, N3, and N6 interfaces; Obtain internet data from at least one of the N3 and N6 interfaces.

[0048] For the core network signaling of 5G messaging, the core network signaling can be obtained from the N4 interface; the N4 interface is the interface between SMF network elements and UPF network elements, and the core network signaling obtained from the N4 interface contains control plane information transmitted between SMF network elements and UPF network elements; the core network signaling can also be obtained from the N11 interface, where the N11 interface is the interface between AMF network elements and SMF network elements, and the core network signaling obtained from the N11 interface contains control plane information transmitted between AMF network elements and SMF network elements; in some other examples, the core network signaling is a set of signaling obtained from the N4 and N11 interfaces.

[0049] In other embodiments, the core network signaling may also be obtained from the N8 interface, and this disclosure does not limit this.

[0050] For Internet access data, it can be obtained from the N3 interface, which is the interface between the Radio Access Network (RAN) and the UPF network element. The Internet access data obtained from the N3 interface includes uplink and downlink user plane data transmitted between the RAN and the UPF network element. Internet access data can also be obtained from the N6 interface, which is the interface between the UPF network element and the data network (DN). The Internet access data obtained from the N6 interface includes uplink and downlink user plane data transmitted between the UPF network element and the data network (DN). In some other examples, the Internet access data is a collection of uplink and downlink user plane data obtained from both the N3 and N6 interfaces.

[0051] In other embodiments, the Internet data may also be obtained from the N9 interface, and this disclosure does not limit this.

[0052] For media data, i.e., IMS communication data, the media data can be obtained from at least one of the N4 and N11 interfaces. In this case, the media data includes IMS signaling. The media data can also be obtained from at least one of the N6 and N3 interfaces. Here, the media data includes IMS media content, such as text files, image files, etc. In other examples, the media data is also a long message obtained from the N4, N11, N3, and N6 interfaces, which includes IMS signaling and IMS media content.

[0053] In other embodiments, media data may also be obtained from the N9 and N8 interfaces, which is not a limitation of this disclosure.

[0054] This disclosure can obtain core network signaling, media data, and Internet access data from various communication interfaces of the IMS core network architecture. It can not only effectively associate user plane data streams and control plane signaling, but also effectively establish a vast interconnected network of 5G messages, increasing the comprehensiveness of 5G message analysis.

[0055] In step 102, the core network signaling is analyzed and processed to obtain user identity information, data packet processing and usage report policy rules and other control information recorded in the core network signaling. Here, the parsed user identity information and control information can be used as key fields of the core network. The control information includes first tunnel information, user identity information, etc.

[0056] It should be noted that analyzing and processing core network signaling can be implemented by performing disassembly, detection, and other processing methods on core network signaling during the establishment, management, and updating of core network sessions.

[0057] In step 103, the media data is analyzed and processed to obtain user identity information, multimedia communication content, etc. recorded in the media data. Here, the parsed user identity information, multimedia communication content, etc. can be used as media key fields.

[0058] It should be noted that media data analysis and processing can be implemented through methods such as authentication based on protocol type and paging message analysis.

[0059] In step 104, the Internet access data is analyzed to obtain tunnel information, multimedia data content, HTML file content, etc. recorded in the Internet access data; here, the parsed tunnel information, multimedia data content, HTML file content, etc. can be used as key business fields.

[0060] It should be noted that analyzing and processing Internet access data can be implemented through methods such as analyzing the Internet access data layer by layer based on the transport layer protocol stack.

[0061] In step 105, matching overlapping fields among core network key fields, media key fields, and service key fields can be implemented as follows: By identifying overlapping fields in the user identity information within the core network key fields and the user identity information within the media key fields, 5G messages belonging to the same user are determined, and the relationship between core network signaling and IMS communication data is bound. Similarly, by identifying overlapping fields in the tunnel information within the core network key fields and the tunnel information within the service key fields, the relationship between core network control plane signaling and user plane data is bound. Thus, through the relationship between core network control plane signaling and user plane data, user plane data can be associated with the user identity information on the core network control plane, realizing the association of actual service data with the user. Furthermore, by combining the relationship between core network signaling and IMS communication data, IMS communication data and internet access data also form a corresponding mapping relationship based on core network signaling. This enables joint analysis and reference of multimedia content in IMS communication and internet access, facilitating subsequent reasonable analysis of user preferences and enabling 5G message distribution and recommendations.

[0062] In the message association method provided in this disclosure, core network signaling, media data, and internet access data of 5G messages are obtained from different communication interfaces of the core network. Overlapping fields are matched on the key fields obtained by parsing the core network signaling, media data, and internet access data respectively to obtain the association results between the core network signaling, media data, and internet access data of the 5G messages. Based on the association results obtained in this disclosure, the actual internet access data of the user plane can be associated with the user, providing data support for the subsequent analysis of the 5G mobile internet monitoring system. Furthermore, it can also perform joint analysis and reference on the multimedia content of users in IMS communication and internet access, improving the completeness of 5G message acquisition, helping to effectively identify the complete 5G message content that users are interested in, and facilitating the subsequent distribution of 5G message content.

[0063] In some embodiments, the media key fields in the above embodiments of this disclosure include a first key field and a second key field. In step 105, matching overlapping fields among the core network key fields, media key fields, and service key fields to obtain the association results between the core network signaling of the 5G message, the media data of the 5G message, and the internet access data of the 5G message can be implemented in the following manner: By matching overlapping fields between the first key field and the core network key fields, the first association relationship between core network signaling and media data is obtained; By matching the overlapping fields among the first key field, the second key field, and the business key field, the second association relationship between media data and internet access data is obtained. Based on the first and second association relationships, the association results are obtained.

[0064] Here, the media key fields corresponding to the media data can be divided into a first key field and a second key field according to the protocol type. In this disclosure, the first key field and the second key field have both identical and different fields. The identical fields between the first and second key fields include the multimedia link and the user's mobile communication number; here, the user's mobile communication number includes the Mobile Station International ISDN number (MSISDN). In this disclosure, the first key field also includes the user's IP address and the local offload agent call session control network element address (LBO_P-CSCF_Address), and the second key field also includes the port number corresponding to the protocol type. It should be noted that some of the key fields proposed in this disclosure have identification functions. For example, the LBO_P-CSCF_Address in the first key field can be used to distinguish between IMS voice services and 5G messaging services; the port number in the second key field can help users distinguish specific session messaging services.

[0065] In this embodiment of the disclosure, the core network key fields obtained by parsing the core network signaling also include the user IP address and the local offload agent call session control network element address (LBO_P-CSCF_Address). Thus, by matching the user IP address and the local offload agent call session control network element address (LBO_P-CSCF_Address) in the core network key fields and the first key field, and performing overlapping field comparison, the first association relationship between the core network signaling and the media data is obtained.

[0066] In this embodiment of the disclosure, the business key fields obtained by parsing Internet access data also include multimedia links. Thus, this embodiment of the disclosure can match the multimedia links in the first key field with the multimedia links in the business key field, perform overlapping field comparison, and based on the matched identical multimedia links, associate the multimedia content between the media data and the Internet access data to obtain a second association relationship between the media data and the Internet access data. Here, this disclosure can also obtain the second association relationship by matching the multimedia connections in the second key field with the multimedia links in the business key field. This disclosure can also obtain the second association relationship by comparing the multimedia connections in the first key field and the second key field with the multimedia links in the business key field, and this disclosure does not impose further limitations on this.

[0067] This disclosure establishes a two-layer association by combining the first and second key fields to effectively compare overlapping fields. Through this two-layer association, a complete association network for 5G messages can be established, improving the accuracy of association and the completeness of information acquisition and organization.

[0068] In some embodiments, the core network key fields include: a first user identifier and first address information; The first key fields include: second user identifier, second address information, and first multimedia link; The second key field includes: the second multimedia link; Key business fields include: third-party multimedia links.

[0069] Here, the first user identifier and the second user identifier may each include at least one user identifier. When the first user identifier and the second user identifier have the same user identifier, the first user identifier and the second user identifier are successfully matched. Here, the user identifier may include: International Mobile Subscriber Identity (IMSI). Here, IMSI is an identification code used to distinguish different users in a cellular network and is unique in all cellular networks. It is used to represent the user's identity and can be understood as the user's ID card for accessing the Internet. Here, IMSI is a parameter in the user identity information described above in this disclosure.

[0070] The first address information and the second address information each include multiple address information, which can be the user's address information or the proxy server's address information. When the first address information and the second address information contain the same address information, the first address information and the second address information are successfully matched. Here, the user's address information includes the user's IP address; the proxy server's address information includes the local offload proxy call session control network element address (LBO_P-CSCF_Address).

[0071] In some embodiments, the method proposed in this disclosure for matching overlapping fields between the first key field and the core network key field to obtain the first association relationship between core network signaling and media data can be implemented in the following ways: If the first user identifier and the second user identifier are successfully matched, and / or if the first address information and the second address information are successfully matched, a first association relationship is established between the core network signaling and the media data.

[0072] Specifically, if the IMSI of the first user identifier and the second user identifier are the same, and / or the user IP addresses of the first address information and the second address information are the same, and / or the local offload agent call session control network element addresses (LBO_P-CSCF_Address) of the first address information and the second address information are the same, a first association relationship is established between the core network signaling and the media data.

[0073] This disclosure enables the establishment of a primary association between core network signaling and media data through overlapping matching of user identifiers and / or address information, and enables the association between IMS voice services and core network control signaling, thereby improving the completeness of 5G message acquisition and processing.

[0074] Here, the multimedia link mentioned above in this disclosure can be a first multimedia link, a second multimedia link, and a third multimedia link, all of which can link to the corresponding multimedia content; the first multimedia link and the second multimedia link obtained from media data analysis each include multiple identical or different multimedia links, and the third multimedia link obtained from Internet access data analysis includes multiple multimedia links. When there are identical multimedia links in the first multimedia link and the second multimedia link, the first multimedia link, the second multimedia link, and the third multimedia link are successfully matched.

[0075] In some embodiments, the method proposed in this disclosure for matching overlapping fields among the first key field, the second key field, and the business key field to obtain a second association relationship between media data and internet access data can be implemented in the following ways: If the first, second, and third multimedia links are successfully matched, a second association is established between the media data and the internet access data.

[0076] This disclosure establishes a second association between media data and internet access data by matching overlapping multimedia link fields. This allows for joint analysis and reference of multimedia content in IMS communication and internet access, which helps in the subsequent rational analysis of user preferences and the realization of 5G message distribution and recommendation.

[0077] In some embodiments, the method of analyzing media data to obtain key media fields according to the present disclosure can be implemented in the following ways: Based on the media type of the media data, determine the first signaling data corresponding to the session initiation protocol and the second signaling data corresponding to the session relay protocol; Analyze the first signaling data to obtain the first key field; Analyze the second signaling data to obtain the second key field.

[0078] Here, the Session Initiation Protocol (SIP) is an application-layer control protocol used to create, modify, or terminate multimedia sessions involving one or more participants, such as internet telephony calls, audio and video communications, and games. The first signaling data corresponding to the SIP is SIP signaling data, which can carry request or response messages. Here, a request message is a SIP message sent by the terminal to the server to activate a specific operation, and a response message is a SIP message sent by the server back to the terminal in response to a specific operation.

[0079] The Message Session Relay Protocol (MSRP) is an instant messaging protocol based on SIP that enables text exchange and message passing within SIP conferences.

[0080] In this disclosure, the first signaling data (SIP signaling) in the media data is parsed using the Session Initiation Protocol and the second data signaling (MSRP signaling) is parsed using the Session Relay Protocol to obtain the first key field and the second key field, so that subsequent comparison of overlapping fields can be performed based on the first key field and the second key field.

[0081] In this embodiment of the disclosure, the media data may further include multimedia content associated with the first signaling data and multimedia content associated with the second signaling data. In this case, the first key field may include other fields corresponding to the corresponding multimedia content, and the second key field may also include other fields corresponding to the corresponding multimedia content. Here, the aforementioned other fields may be data packet size, data packet format, etc. The aforementioned other fields can also be used for subsequent overlapping field matching and association, which will not be further elaborated in this disclosure.

[0082] This disclosure enables data analysis based on media type using different protocols to obtain different key fields, and establishes the relationship between core network signaling and Internet access data through different key fields, thereby improving matching accuracy and further ensuring the accuracy of 5G message association.

[0083] In some embodiments, the method of analyzing the first signaling data to obtain the first key field, as proposed in this disclosure, can be implemented in the following ways: Parse the first signaling data to obtain the user registration message and the first paging message; Detect user registration messages to obtain the second user identifier; Analyze the header of the first paging message to obtain the first communication number and communication identifier related to the user's identity; Analyze the payload portion of the first paging message to obtain the first media attribute and the first text type; Analyze the message body of the first paging message to obtain the second address information and the first multimedia link; Based on the second user identifier, the first communication number, the communication identifier, the first media attribute, the first text type, the second address information, and the first multimedia link, the first key field is obtained.

[0084] Here, the first signaling data (SIP signaling) carries a user registration message and a first paging message; the user registration message carries a second user identifier, which is used to complete user authentication and call registration in IMS calls; the second user identifier includes the IMSI, which can be obtained by parsing the data packet of the registration message in the SIP signaling.

[0085] In this disclosure, the first paging message carried in the SIP signaling is the information transmitted by the paging action in an IMS call. Here, the paging action is to notify the network side that there is signaling or data to be sent to the user terminal. After receiving the paging message, the user terminal can actively trigger the action, and the user terminal actively establishes a connection relationship with the network side, so that the user terminal enters the connection state, enabling the user terminal to conduct IMS calls with the wireless network.

[0086] Here, the first paging message includes a header message, a payload, and a message body.

[0087] Parsing the header message yields a first communication number and a communication identifier. Here, the first communication number includes the Mobile Station International ISDN Number (MSISDN), which is the number used by the user to initiate and receive IMS calls and is used to bind the user's identity. The communication identifier includes the IMS Communication Service Identifier (ICSI) or the IMS Application Reference Identifier (IARI). Here, ICSI / IARI can be used as parameters to distinguish between IMS voice services and 5G messaging services, and can also be used as parameters to distinguish related service tags within 5G messages.

[0088] In this disclosure, after obtaining the MSISDN from the header message, the registration message and paging message can be associated through the MSISDN and the IMSI parsed from the user registration message to complete authentication and identification. Here, a user IMS session window can also be established based on the MSISDN and IMSI. The user IMS session window serves as a message transmission channel, and the first key field obtained by parsing the SIP signaling can be transmitted to the association module through the user IMS session window for overlapping field matching. Furthermore, after obtaining the association result proposed in the above embodiments of this disclosure, the control information in the core network signaling and the data content in the Internet access data determined based on the association result can be backfilled with messages through the user IMS session window.

[0089] In this disclosure, the payload portion of the first paging message is analyzed to obtain the first media attribute and the first text type. Here, the payload portion of the first paging message includes a Session Description Protocol (SDP). The SDP protocol describes the details of the streaming media used in the session; specifically, the streaming media details can describe which IP port is used, which codec is employed, etc. Here, the Session Description Protocol is analyzed to obtain the first media attribute and the first text type. The first media attribute includes a Media Attribute, which is used to extend the media session level of the SDP and can also serve as a parameter to distinguish between IMS voice services and 5G messaging services. The first text type includes a Content-type, which is used to identify the information content carried in the paging message, or the type of information content corresponding to the paging message. Therefore, the Content-type can serve as a parameter to distinguish between 5G message content such as text, video, and files.

[0090] In this disclosure, analyzing the paging message body yields second address information and a first multimedia link; specifically, the second address information is obtained through the source IP address or destination IP address; here, the second address information includes: the local offload agent call session control network element address (LBO_P-CSCF_Address) and the user IP address; this disclosure also obtains the corresponding first multimedia link by parsing the paging message body, where the first multimedia link includes a multimedia link URL, which represents the network address of the multimedia content that can be found, and can match the URL information in the Internet access data, so as to associate multimedia content under the same network address.

[0091] Thus, the first key field obtained in this disclosure based on the second user identifier, the first communication number, the communication identifier, the first media attribute, the first text type, the second address information, and the first multimedia link includes: using IMSI, MSISDN, ICSI / IARI, LBO_P-CSCF_Address address, user IP address, Media Attribute, Content-type, and multimedia link URL as the first key field, so as to perform overlapping field matching based on the first key field.

[0092] It should be noted that the first key field of this disclosure may also include other extended fields, such as paging area, paging cycle, etc.

[0093] The embodiments disclosed herein can parse the first signaling data to obtain multiple parameters. These parameters can be used as first key fields to participate in subsequent overlapping field matching work to improve the association accuracy. On the other hand, some parameters also have an identification function, which can be used to distinguish between IMS voice services and 5G messaging services, or as related service tags within 5G messages. They can also distinguish message types, thereby improving the effectiveness of subsequent data analysis on the association results.

[0094] In some embodiments, the method of analyzing the second signaling data to obtain the second key field, as proposed in this disclosure, can be implemented in the following ways: Parse the second signaling data to obtain the second paging message; Analyze the second paging message to obtain the second communication number associated with the user's identity, the port number corresponding to the Session Relay Protocol, and the request message body; Analyze the request message body to obtain the second text type and the second multimedia link; The second key field is obtained based on the second communication number, port number, second text type, and second multimedia link.

[0095] Here, the second signaling data (such as MSRP signaling) carries the second paging message. The media attribute corresponding to the second paging message is the MSRP message, which is used to transmit the information transmitted by the paging action in the IMS call. Here, the MSRP message is information transmitted in conjunction with the SIP protocol for the interaction of instant messages.

[0096] This disclosure analyzes the second paging message to obtain a second communication number; here, the second communication number includes MSISDN; through MSISDN, a user MSRP session window can be established, and the user MSRP session window serves as a message transmission channel. The second key field obtained by parsing the MSRP signaling can be transmitted to the association module through the user MSRP session window for overlapping field matching; and, after obtaining the association result proposed in the above embodiments of this disclosure, the control information in the core network signaling and the data content in the Internet access data determined according to the association result can be backfilled with messages through the user MSRP session window.

[0097] The MSRP port number can be obtained from the media attribute field of the second signaling data. Here, the MSRP port number can be used to bind the relationship between the MSRP media content and the user's MSRP session. After binding the user's MSRP session based on the MSRP port number, the transmission of request message bodies in MSRP can be performed.

[0098] In this disclosure, after obtaining the request message body, the request message body is parsed to obtain a second text type and a second multimedia link. Here, the request message body is represented by the client's request message MSRP SEND. The second text type includes a Content-type, which identifies the information content carried in the second paging message, or the type of information content corresponding to the second paging message. Therefore, Content-type can be used as a parameter to distinguish 5G message content such as text, video, and files. The second multimedia link includes a multimedia link URL, which represents the network address of the multimedia content that can be found. It can match the URL information in the internet data to associate multimedia content under the same network address.

[0099] Thus, the second key field obtained in this disclosure based on the second communication number, port number, second text type, and second multimedia link includes: using MSISDN, MSRP port number, Content-type, and multimedia link URL as the second key field, and performing overlapping field matching based on the second key field.

[0100] It should be noted that the second key field of this disclosure may also include other extended fields, such as the third text type corresponding to the response message body.

[0101] The embodiments disclosed herein can parse the second signaling data to obtain multiple parameters. These parameters can be used as second key fields to participate in subsequent overlapping field matching work, thereby improving the accuracy of association. On the other hand, some parameters also have an identification function, which can distinguish message types and improve the effectiveness of subsequent data analysis on the association results.

[0102] In some embodiments, the analysis of core network signaling to obtain key core network fields as described above in this disclosure can be implemented in the following ways: Obtain the first user identifier from the core network signaling; A core network session window is established based on the first user identifier, and the data network name, first tunnel information and first address information are obtained during the establishment or updating of the core network session window. Based on the first user identifier, data network name, first tunnel information, and first address information, the core network key fields are obtained.

[0103] In this disclosure, the core network signaling carries a first user identifier, which is used to indicate the control object corresponding to the control information carried by the core network, that is, to characterize the user's identity. Here, the first user identifier includes the IMSI; the IMSI can be obtained by parsing the data packets of the core network signaling.

[0104] Here, after obtaining the user identifier, a core network session window is established based on the first user identifier; the core network session window serves as a message transmission channel, and the core network key fields obtained by parsing the core network signaling can be transmitted to the association module for overlapping field matching through the core network session window; furthermore, after obtaining the association result proposed in the above embodiments of this disclosure, the data content in the media data and Internet access data determined according to the association result can be backfilled with messages through the core network session window.

[0105] In this disclosure, during the establishment or update process of the core network session window, the data network name, first tunnel information, and first address information are obtained, specifically as follows: During the establishment of the core network session window, when the association method proposed in this disclosure is applied to a 5G data network architecture, the Data Network Name (DNN) is obtained; when the association method proposed in this disclosure is applied to a 4G data network architecture, the Access Point Name (APN) is obtained. Here, the DNN or APN can be used as a parameter to distinguish between IMS voice services and 5G messaging services.

[0106] During the core network session window carrying, establishment, or update process, the first tunnel information is obtained. Here, the first tunnel information includes user uplink and downlink control plane data information. The first tunnel information can be used as a parameter to distinguish the user's 5G messaging service from IMS voice service and Internet access service. The second tunnel information in the service key field corresponding to the Internet access data can be matched to associate the control plane data and user plane data of the same user.

[0107] During the core network session window update process, the first address information is obtained. Here, the first address information includes: the user IP address and the local offload agent call session control network element address; among them, the local offload agent call session control network element address (LBO_P-CSCF_Address) can be used as a parameter to distinguish between IMS voice service and 5G messaging service.

[0108] Thus, the core network key fields obtained in this disclosure based on the first user identifier, data network name, first tunnel information, and first address information include: using IMSI, DNN / APN, first tunnel information, LBO_P-CSCF_Address address, and user IP address as core network key fields, and performing overlapping field matching based on the core network key fields.

[0109] It should be noted that the core network key fields disclosed herein may also include other extended fields, such as authentication information, billing data, roaming information, etc.

[0110] The embodiments disclosed herein can parse core network signaling to obtain multiple parameters. These parameters can be used as key fields of the core network to participate in subsequent overlapping field matching work, thereby improving the correlation accuracy. On the other hand, some parameters also have an identification function, which can be used to distinguish between IMS voice services, 5G messaging services, or Internet access services, thereby improving the effectiveness of data analysis.

[0111] In some embodiments, analyzing internet access data yields key business fields, including: Based on internet data, determine the Hypertext Transfer Protocol (HTTP) data stream; Based on the Hypertext Transfer Protocol data stream, obtain the Internet Protocol quintuple; Obtain second tunnel information based on the outer Internet Protocol stack; Based on the data content related to multimedia data in the internet data, obtain third-party multimedia links; Based on the Internet Protocol quintuple, the second tunnel information, and the third multimedia link, the key business fields are obtained.

[0112] Here, Hypertext Transfer Protocol (HTTP) data streams are determined based on internet access data. HTTP is a simple request-response protocol that typically runs on top of Transmission Control Protocol (TCP). HTTP specifies what messages a client might send to the server and what responses it might receive. After establishing the HTTP data stream, this disclosure extracts the Internet Protocol 5-tuple. The Internet Protocol 5-tuple is a network data packet that includes the following attributes: source IP, destination IP, source port, destination port, and application protocol type. Here, the Internet Protocol 5-tuple can serve as a parameter to identify different 5G messaging services.

[0113] In this disclosure, second tunnel information is obtained through the outer Internet Protocol stack. The second tunnel information includes uplink and downlink user plane data. Here, the second tunnel information can be used as a parameter to distinguish the data of the corresponding user from that of other users, and can also be used as a parameter to distinguish IMS voice service, Internet access service and 5G messaging service.

[0114] Here, based on the data content related to multimedia data in the Internet data, specifically, based on the data content related to multimedia data in the HTTP data stream, relevant URL information is extracted as a third multimedia link.

[0115] Thus, the business key fields obtained in this disclosure based on the Internet Protocol quintuple, the second tunnel information, and the third multimedia link include: using the source IP, destination IP, source port, destination port, application protocol type, second tunnel information, and URL information as business key fields, and performing overlapping field matching based on the business key fields.

[0116] It should be noted that the key business fields disclosed in this document may also include other extended fields, such as routing strategies and data traffic.

[0117] The embodiments disclosed herein can parse Internet access data to obtain multiple parameters. These parameters can be used as key business fields to participate in subsequent overlapping field matching work to improve the correlation accuracy. On the other hand, some parameters also have an identification function, which can be used to distinguish different users, or to distinguish IMS voice service, 5G messaging service or Internet access service, so as to effectively locate the specified user in subsequent data monitoring or analysis and improve the accuracy and effectiveness of analysis.

[0118] In some embodiments, matching overlapping fields among the core network key fields, the media key fields, and the service key fields to obtain the association results between the core network signaling of the 5G message, the media data of the 5G message, and the internet access data of the 5G message can be implemented in the following manner: The core network key fields are parsed to store IMSI, DNN / APN, first tunnel information, user IP address, and LBO_P-CSCF_Address address, etc.; the media key fields are parsed to store IMSI, MSISDN, ICSI / IARI, LBO_P-CSCF_Address address, user IP address, Media Attribute, Content-type, and multimedia link URL for the SIP part, and MSISDN, MSRP port number, Content-type, and multimedia link URL for the MSRP part; the service key fields are parsed to store source IP, destination IP, source port, destination port, application protocol type, second tunnel information, and URL information, etc.; by comparing overlapping fields through the above parameters, that is, comparing the parameter values ​​of the same parameters, the association of key fields is realized when the same parameter values ​​exist, so as to further realize the association of signaling and data. For example, user identifiers are obtained and associated through IMSI and MSISDN; session message services are associated through MSRP port numbers; user 5G messages are associated with IMS voice and internet services through ICSI / IARI, DNN / APN, tunnel information, user IP address, and LBO_P-CSCF_Address; and IMS messages are associated with multimedia service content through link URLs and URL information. In this disclosure, the above-mentioned key fields also have identification functions. For example, ICSI / IARIN distinguishes the service tags of 5G messages, MSRP port numbers distinguish specific session message services, and Content-type distinguishes text, video, and files. Other extended fields besides the key fields can identify more attributes of 5G users.

[0119] This disclosure also provides a message association system; see [link to relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of the structure of a message association system according to an exemplary embodiment. Figure 1 ;like Figure 2 As shown, the message association system 200 proposed in this disclosure includes: The acquisition module 201 is configured to acquire the core network signaling of the 5G message, the media data of the 5G message, and the Internet access data of the 5G message respectively through different communication interfaces; Core network analysis module 202 is configured to analyze the core network signaling to obtain core network key fields. Media data analysis module 203 is configured to analyze the media data to obtain key media fields; Internet access data analysis module 204 is configured to analyze the internet access data to obtain key business fields; The association module 205 is configured to obtain the association results between the core network signaling of the 5G message, the media data of the 5G message, and the Internet access data of the 5G message based on the core network key field, the media key field, and the service key field.

[0120] The message association system proposed in this disclosure can be applied in computer equipment (processors or processor clusters) in the backend of the IMS core network to associate core network signaling and media data and Internet access data of 5G messages, so as to associate service data with user identity, which helps to effectively identify the 5G message content that users are interested in, and facilitates the subsequent distribution of multimedia-related content of 5G messages to users.

[0121] Here, the message association system proposed in this disclosure also includes different communication interfaces, combined with Figure 2 Here, the communication interface may include the N4 interface and the N11 interface, the N3 interface and the N6 interface, etc.

[0122] In this disclosure, core network signaling refers to the general term for signaling on various interfaces of the core network. In some examples, core network signaling may be obtained from at least one of the N4 interface and the N11 interface. Here, media data is IMS interface data, which is SIP protocol data and MSRP protocol data related to 5G messages. IMS interface data may be obtained from at least one of the N4 interface, the N11 interface, the N3 interface, or the N6 interface. It is the multimedia plane content data in 5G messages, which may be obtained from at least one of the N3 interface and the N6 interface.

[0123] Here, the core network analysis module 202 is the module that extracts key fields of the 5G core network; the media data analysis module 203 is the module that extracts key media fields through the SIP and MSRP protocols corresponding to the 5G messages respectively; the internet access data analysis module 204 is the module that extracts key service fields corresponding to the 5G messages. Specifically, the internet access data analysis module 204 is used to extract key media plane fields of internet access data; and the association module 205 is the key module used to integrate the core network key fields, media key fields, and service key fields to associate the multimedia content and user information of the 5G messages, thereby realizing the analysis and association of 5G messages in the mobile network.

[0124] Here, each module in the information association system of this disclosure can implement the steps corresponding to the above method embodiments and has similar beneficial effects as the method embodiments. Therefore, this disclosure will not elaborate further here.

[0125] In some embodiments, the media key field includes a first key field and a second key field, and the association module 205 includes: The first matching module is configured to match overlapping fields between the first key field and the core network key field to obtain a first association relationship between the core network signaling and the media data. The second matching module is configured to match overlapping fields among the first key field, the second key field, and the business key field to obtain a second association relationship between the media data and the internet access data. The two-level association module is configured to obtain the association result based on the first association relationship and the second association relationship.

[0126] In some embodiments, the core network key fields include: a first user identifier and a first address information; The first key field includes: second user identifier, second address information, and first multimedia link; The second key field includes: the second multimedia link; The key business field includes: third multimedia link.

[0127] In some embodiments, the first matching module is further configured to establish a first association between the core network signaling and the media data when the first user identifier and the second user identifier are successfully matched, and / or the first address information and the second address information are successfully matched.

[0128] In some embodiments, the second matching module is further configured to establish a second association between the media data and the internet access data if the first multimedia link, the second multimedia link, and the third multimedia link are successfully matched.

[0129] In some embodiments, the media data analysis module 203 includes: The determination module is configured to determine, based on the media type of the media data, first signaling data corresponding to the session initiation protocol and second signaling data corresponding to the session relay protocol; The session initiation protocol analysis module is configured to analyze the first signaling data to obtain the first key field; The Session Relay Protocol Analysis Module is configured to analyze the second signaling data to obtain the second key field.

[0130] Here, the first signaling data includes SIP signaling data based on the SIP protocol; the second signaling data includes MSRP signaling data based on the MSRP protocol.

[0131] In some embodiments, the session initiation protocol analysis module is further configured to parse the first signaling data to obtain a user registration message and a first paging message; detect the user registration message to obtain a second user identifier; analyze the header of the first paging message to obtain a first communication number and a communication identifier related to the user's identity; analyze the payload portion of the first paging message to obtain a first media attribute and a first text type; analyze the message body of the first paging message to obtain second address information and a first multimedia link; and obtain the first key field based on the second user identifier, the first communication number, the communication identifier, the first media attribute, the first text type, the second address information, and the first multimedia link.

[0132] In some embodiments, the Session Relay Protocol (SRT) analysis module is further configured to parse the second signaling data to obtain a second paging message; analyze the second paging message to obtain a second communication number related to the user's identity, a port number corresponding to the SRT, and a request message body; analyze the request message body to obtain a second text type and a second multimedia link; and obtain the second key field based on the second communication number, the port number, the second text type, and the second multimedia link.

[0133] In some embodiments, the core network analysis module 202 is further configured to obtain a first user identifier in the core network signaling; establish a core network session window based on the first user identifier, and obtain a data network name, a first tunnel information, and a first address information during the establishment or updating process of the core network session window; and obtain the core network key fields based on the first user identifier, the data network name, the first tunnel information, and the first address information.

[0134] In some embodiments, the Internet access data analysis module 204 is further configured to: determine a Hypertext Transfer Protocol (HTTP) data stream based on the Internet access data; obtain an Internet Protocol (IP) quintuple based on the HTTP data stream; obtain second tunnel information based on the outer IP stack; obtain a third multimedia link based on the data content related to multimedia data in the Internet access data; and obtain the business key field based on the IP quintuple, the second tunnel information, and the third multimedia link.

[0135] The association system proposed in this disclosure enables comprehensive association of core network signaling, media data, and internet access data for 5G messages. It further enables the association of business data and user identity, which helps to effectively identify the 5G message content that users are interested in and facilitates subsequent content distribution.

[0136] The following describes a specific application embodiment of the message association method and system proposed in the above embodiments of this disclosure.

[0137] See Figure 3 , Figure 3 This is a schematic diagram of the structure of a message association system according to an exemplary embodiment. Figure 2 ; Figure 3 The message association system 300 proposed in this disclosure includes 5G core network signaling 301, 5G message IMS interface data 302, 5G message multimedia HTTP data 303; and an association message center, which includes an acquisition module 304, a 5G core network signaling analysis module 305 (an example of the core network signaling analysis module proposed in this disclosure), a SIP protocol analysis module 306 (an example of the session initiation protocol analysis module proposed in this disclosure), an MSRP protocol analysis module 307 (an example of the session intermediate protocol analysis module proposed in this disclosure), and an HTTP protocol analysis module 308 (an example of the Internet access data analysis module proposed in this disclosure); and a 5G message association module 309 (an example of the association module proposed in this disclosure).

[0138] It should be noted that the 5G core network signaling 301 is a collection of one or more signaling signals in the core network signaling of the 5G message proposed in the above embodiments of this disclosure. The 5G message IMS interface data 302 is a collection of one or more data items in the media data of the 5G message proposed in the above embodiments of this disclosure. Here, the IMS interface data includes SIP signaling data based on the SIP protocol and MSRP signaling data based on the MSRP protocol; in other examples, the 5G message IMS interface data also carries specific multimedia content; the 5G message multimedia HTTP data 303 is a collection of one or more data items in the Internet access data of the 5G message proposed in the above embodiments of this disclosure.

[0139] The message association method proposed in this embodiment is described below, in conjunction with the associated message center including the acquisition module 304, the 5G core network signaling analysis module 305, the SIP protocol analysis module 306, the MSRP protocol analysis module 307, and the HTTP protocol analysis module 308; and the 5G message association module 309. Specifically: The associated module 304 serves as a window for message reception and forwarding. It is used to receive 5G core network signaling 301 and forward it to the 5G core network signaling analysis module 305; it is also used to receive 5G message IMS interface data 302 and forward it to the SIP protocol analysis module 306 and the MSRP protocol analysis module 307 according to the protocol type; it is also used to receive 5G message multimedia HTTP data 303 and forward it to the HTTP protocol analysis module 308.

[0140] See Figure 4 , Figure 4 This is a schematic diagram illustrating the workflow of a core network signaling analysis module according to an exemplary embodiment; such as Figure 4 As shown, the workflow of the 5G core network signaling analysis module 305 can be implemented through the following steps: Step 401, Begin; Here, the message for establishing a user session is detected based on the 5G core network signaling, the IMSI is obtained, and a core network session window is established based on the IMSI.

[0141] Step 402: Obtain the data network name or access point name; During the bearer and session establishment process, the data network name (DNN) or access point name (APN) is obtained. The DNN / APN is used as one of the parameters to distinguish between IMS voice services and 5G messaging services.

[0142] Step 403: Obtain tunnel information; Here, the tunnel information is the first tunnel information; in the process of bearer and session establishment or update, the first tunnel information is obtained and is used as one of the parameters to distinguish the user's 5G messaging service from IMS voice service and Internet access service.

[0143] In this disclosure, the user's IP address can also be obtained during the session establishment or update process.

[0144] Step 404: Obtain the address of the local offload agent call session control network element; Here, when the bearer and session establishment or update is completed, the local offload agent call session control network element address (LBO_P-CSCF_Address) is obtained from the core network signaling 5G signaling as one of the parameters to distinguish between IMS voice service and 5G messaging service.

[0145] Step 405: Send core network key fields to the 5G message association module; The core network key fields, namely IMSI, DNN / APN, first tunnel information, user IP address and LBO_P-CSCF_Address, are sent to the 5G message association module 309, along with other extended fields.

[0146] Step 406, End.

[0147] See Figure 5 , Figure 5 This is a schematic diagram illustrating the workflow of a SIP protocol analysis module according to an exemplary embodiment; as shown below. Figure 5 As shown, the workflow of the SIP protocol analysis module 306 can be implemented through the following steps: Step 501, Begin; Detect user IMS registration messages in SIP signaling and obtain IMSI.

[0148] Step 502: Analyze the paging header message; Here, the paging header message is analyzed to obtain the MSISDN, and the MSISDN and IMSI are associated with the registration message. The user's IMS session window is then established based on the ISDN and MSISDN. In this disclosure, the analysis of the paging header message is also used to obtain ICSI or IARI. ICSI / IARI can be used as one of the parameters to distinguish between IMS voice services and 5G messaging services, as well as related service tags within 5G messages.

[0149] Step 503: Analyze the paging message payload; Here, we analyze the Session Description Protocol (SDP) to obtain the Media Attribute and Content-type. The Media Attribute is one of the parameters that distinguishes between IMS voice services and 5G messaging services, while the Content-type is a parameter that distinguishes between 5G message content such as text, video, and files.

[0150] Step 504: Analyze the paging message IP address Here, the paging message IP address is analyzed, and the user IP address and LBO_P-CSCF_Address address are obtained through the source IP or destination IP address.

[0151] Step 505: Analyze the paging message body; Here, the paging message body is analyzed to obtain the corresponding multimedia link URL; the multimedia link URL represents the network address of the multimedia content that can be found, and it can be matched with the URL information in the Internet access data so that multimedia content under the same location address can be associated.

[0152] Step 506: Send the first key field to the 5G message association module; Here, the first key fields, namely IMSI, MSISDN, ICSI / IARIN, user IP address and LBO_P-CSCF_Address, Media Attribute and Content-type, and multimedia link URL, are sent to the 5G message association module 309, along with other extended fields.

[0153] Step 507, End.

[0154] See Figure 6 , Figure 6 This is a schematic diagram illustrating the workflow of an MSRP protocol analysis module according to an exemplary embodiment; as shown below. Figure 6As shown, the workflow of the MSRP protocol analysis module 307 can be implemented through the following steps: Step 601, Begin; Here, the second paging message of MSRP signaling is detected, the message with media attribute MSRP is obtained, and the user MSRP session window is established based on the obtained MSISDN; Step 602: Obtain the Message Relay Protocol (MSRP) media attributes; Here, we retrieve the MSRP media attribute field and then obtain the MSRP port number based on the MSRP media attribute field.

[0155] Step 603: Analyze the MSRP port number; Here, the MSRP media content is bound to the user's MSRP session based on the MSRP port number.

[0156] Step 604: Analyze the MSRP SEND message; Here, the MSRP SEND message is obtained based on MSRP signaling, and the MSRP SEND message is analyzed to obtain the Content-type, which is used as a parameter to distinguish 5G message content such as text, video, and file; and the corresponding multimedia link URL is obtained by analyzing the MSRP SEND message body. Step 605: Send the second key field to the 5G message association module; Here, the second key fields, namely MSISDN, MSRP port number, Content-type, and multimedia link URL, are sent to the 5G message association module 309, along with other extended fields.

[0157] Step 606, End.

[0158] See Figure 7 , Figure 7 This is a schematic diagram illustrating the workflow of an HTTP protocol analysis module according to an exemplary embodiment; as follows: Figure 7 As shown, the workflow of the HTTP protocol analysis module 308 can be implemented through the following steps: Step 701, Begin; Here, 5G message multimedia HTTP data is received to establish an HTTP data stream, and the Internet Protocol IP 5-tuple (source and destination IP, source and destination ports, and application protocol type) is extracted. The IP 5-tuple is used as one of the parameters to identify different 5G message services.

[0159] Step 702: Obtain tunnel information; Here, the multimedia HTTP data of 5G messages is analyzed, and tunnel information is obtained through the outer IP protocol stack. The tunnel information is the second tunnel information, which serves as one of the parameters for distinguishing a user's 5G messaging service from IMS voice service and Internet access service, and also serves as a parameter for distinguishing IMS voice service, Internet access service and 5G messaging service.

[0160] Step 703: Obtain Uniform Resource Locator (URL) information; Extracting URL information from the data content of multimedia HTTP data based on 5G messages; Step 704: Send key business fields to the 5G message association module; The key business fields, namely source and destination IP, source and destination port, application protocol type, tunnel information, and URL information, are sent to the 5G message association module 309, along with other extended fields.

[0161] Step 705, End.

[0162] See Figure 8 , Figure 8 This is a schematic diagram illustrating the workflow of a 5G message association module according to an exemplary embodiment; as follows: Figure 8 As shown, the workflow of the 5G message association module 309 can be implemented through the following steps: Step 801, Begin; Here, we are preparing to receive key fields sent by the 5G core network signaling analysis module 305, SIP protocol analysis module 306, MSRP protocol analysis module 307, and HTTP protocol analysis module 308.

[0163] Step 802: Analyze key fields of the core network; Here, key core network fields are parsed, and information such as IMSI, DNN / APN, tunnel information, user IP address, and LBO_P-CSCF_Address is stored.

[0164] Step 803: Analyze the first and second key fields; Here, the first key field is parsed to store information related to the SIP portion, such as IMSI, MSISDN, ICSI / IARI, LBO_P-CSCF_Address, user IP address, Media Attribute and Content-type, and multimedia link URL.

[0165] Here, the second key field is parsed to store information related to the MSRP section, such as MSISDN, MSRP port number, Content-type, and multimedia link URL.

[0166] Step 804: Analyze key business fields; Here, key business fields are parsed, and source IP, destination IP, source port, destination port, application protocol type, second tunnel information, and URL information are stored.

[0167] Step 805: Associate key fields of 5G messages; Here, overlapping fields are compared using the aforementioned parameters, i.e., the values ​​of identical parameters are compared. When identical values ​​exist among the same parameters, key fields are associated to further link signaling and data. For example, user identifiers are obtained and associated through IMSI and MSISDN; session message services are associated through MSRP port numbers; user 5G messages are associated with IMS voice and internet services through ICSI / IARI, DNN / APN, tunnel information, user IP address, and LBO_P-CSCF_Address; and IMS messages are associated with multimedia service content through link URLs and URL information. In this disclosure, the aforementioned key fields also have identification functions. For example, ICSI / IARIN distinguishes the service label of 5G messages, MSRP port numbers distinguish specific session message services, and Content-type distinguishes text, video, and files. Other extended fields besides key fields can identify more attributes of 5G users.

[0168] Step 806, End.

[0169] This embodiment forwards 5G core network signaling to the 5G core network signaling analysis module, extracts key core network fields, and sends them to the 5G message association module; it forwards 5G message IMS interface data according to protocol type to the SIP protocol analysis module and the MSRP protocol analysis module, extracts key IMS fields, and sends them to the 5G message association module; it forwards 5G message multimedia HTTP data to the HTTP protocol analysis module, extracts key service fields, and sends them to the 5G message association module; the 5G message association module integrates core network key fields, media key fields, and service key fields to associate the multimedia content and user information of 5G messages, thereby realizing the analysis and association of 5G messages in the mobile network.

[0170] Furthermore, this embodiment of the present disclosure can identify the correspondence between user IMS information and 5G messages by associating 5G messages with the HTTP and IMS interfaces; and can identify the correspondence between user 5G core network information and 5G messages by associating 5G messages with the HTTP and 5G core network signaling. Through the above two associations, the accuracy of association and the completeness of information acquisition can be improved, which facilitates various operations for subsequent application protocol analysis. The message association system and method proposed in this disclosure are also applicable to the identification and association of 5G message communication through 3G and 4G networks.

[0171] This disclosure also provides a message association device. See also Figure 9 , Figure 9 This is a block diagram illustrating a message association apparatus according to an exemplary embodiment. (Refer to...) Figure 9 The message association device 900 can be a computer device at the back end of the IMS core network. The message association device 900 includes a processing component 922, which further includes one or more processors, and memory resources represented by a memory 932 for storing instructions, such as application programs, that can be executed by the processing component 922. The application programs stored in the memory 932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 922 is configured to execute instructions to perform the aforementioned message association method.

[0172] The message association device 900 may also include a power supply component 926 configured to perform power management of the message association device 900, a wired or wireless network interface 950 configured to connect the message association device 900 to a network, and an input / output (I / O) interface 958. The message association device 900 can operate on an operating system stored in memory 932, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, or similar.

[0173] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 932 including executable instructions, which can be executed by the processing component 922 of the message association apparatus to complete the message association method described above.

[0174] In some embodiments, the non-transitory computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0175] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0176] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0177] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0178] The above description is merely an embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A message association method, characterized in that, The method includes: The core network signaling of the 5G message, the media data of the 5G message, and the Internet access data of the 5G message are obtained through different communication interfaces. Analyzing the core network signaling, key core network fields are obtained; Analyze the media data to obtain key media fields; Analyze the internet access data to obtain key business fields; By matching overlapping fields between the core network key fields and the media key fields, the relationship between the core network signaling and the media data can be obtained. Matching overlapping fields between the core network key fields and the service key fields, or matching overlapping fields between the media key fields and the service key fields, yields a matching result; based on the relationship between the core network signaling and the media data and the matching result, the association result between the core network signaling of the 5G message, the media data of the 5G message, and the internet access data of the 5G message is obtained.

2. The method according to claim 1, characterized in that, The media key fields include a first key field and a second key field. Matching the overlapping fields between the core network key fields and the media key fields to obtain the relationship between the core network signaling and the media data includes: By matching overlapping fields between the first key field and the core network key field, a first association relationship between the core network signaling and the media data is obtained; The matching of overlapping fields between the media key fields and the business key fields to obtain matching results includes: By matching overlapping fields among the first key field, the second key field, and the business key field, a second association relationship between the media data and the internet access data is obtained. The association result obtained based on the relationship between the core network signaling and the media data and the matching result, and the association result between the core network signaling of the 5G message, the media data of the 5G message, and the internet access data of the 5G message, includes: The association result is obtained based on the first association relationship and the second association relationship.

3. The method according to claim 2, characterized in that, The core network key fields include: first user identifier and first address information; The first key field includes: second user identifier, second address information, and first multimedia link; The second key field includes: the second multimedia link; The key business field includes: third multimedia link.

4. The method according to claim 3, characterized in that, The process of matching overlapping fields between the first key field and the core network key field to obtain the first association relationship between the core network signaling and the media data includes: If the first user identifier and the second user identifier match successfully, and / or if the first address information and the second address information match successfully, a first association relationship is established between the core network signaling and the media data.

5. The method according to claim 3, characterized in that, The process of matching overlapping fields among the first key field, the second key field, and the business key field to obtain a second association between the media data and the internet access data includes: If the first multimedia link, the second multimedia link, and the third multimedia link are successfully matched, a second association relationship is established between the media data and the internet access data.

6. The method according to any one of claims 2 to 5, characterized in that, The analysis of the media data yields key media fields, including: Based on the media type of the media data, determine the first signaling data corresponding to the session initiation protocol and the second signaling data corresponding to the session relay protocol; Analyze the first signaling data to obtain the first key field; The second signaling data is analyzed to obtain the second key field.

7. The method according to claim 6, characterized in that, The analysis of the first signaling data yields the first key field, including: Parse the first signaling data to obtain the user registration message and the first paging message; The user registration message is detected to obtain the second user identifier; Analyze the header of the first paging message to obtain the first communication number and communication identifier related to the user's identity; Analyze the payload portion of the first paging message to obtain the first media attribute and the first text type; Analyze the message body of the first paging message to obtain the second address information and the first multimedia link; The first key field is obtained based on the second user identifier, the first communication number, the communication identifier, the first media attribute, the second address information, the first text type, and the first multimedia link.

8. The method according to claim 6, characterized in that, The analysis of the second signaling data yields the second key field, including: The second signaling data is parsed to obtain the second paging message; Analyze the second paging message to obtain the second communication number related to the user's identity, the port number corresponding to the Session Relay Protocol, and the request message body; Analyzing the request message body yields a second text type and a second multimedia link; The second key field is obtained based on the second communication number, the port number, the second text type, and the second multimedia link.

9. The method according to any one of claims 1 to 5, characterized in that, The analysis of the core network signaling yields key core network fields, including: Obtain the first user identifier from the core network signaling; A core network session window is established based on the first user identifier, and during the establishment or updating process of the core network session window, the data network name, the first tunnel information, and the first address information are obtained. Based on the first user identifier, the data network name, the first tunnel information, and the first address information, the core network key fields are obtained.

10. The method according to any one of claims 1 to 5, characterized in that, The analysis of the internet access data yields key business fields, including: Based on the aforementioned internet data, determine the Hypertext Transfer Protocol (HTTP) data stream; Based on the Hypertext Transfer Protocol data stream, obtain the Internet Protocol quintuple; Obtain second tunnel information based on the outer Internet Protocol stack; Based on the data content related to multimedia data in the internet data, obtain the third multimedia link; Based on the Internet Protocol quintuple, the second tunnel information, and the third multimedia link, the key business fields are obtained.

11. The method according to any one of claims 1 to 5, characterized in that, The process of acquiring the core network signaling of 5G messages, the media data of the 5G messages, and the internet access data of the 5G messages through different communication interfaces includes: The core network signaling for the 5G message is obtained in at least one of the N4 and N11 interfaces; The media data is acquired from at least one of the N4 interface, the N11 interface, the N3 interface, and the N6 interface; The Internet access data is obtained from at least one of the N3 interface and the N6 interface.

12. A message association system, characterized in that, The system includes: The acquisition module is configured to acquire the core network signaling of the 5G message, the media data of the 5G message, and the Internet access data of the 5G message respectively through different communication interfaces; The core network analysis module is configured to analyze the core network signaling to obtain key core network fields. The media data analysis module is configured to analyze the media data and obtain key media fields; The Internet access data analysis module is configured to analyze the Internet access data to obtain key business fields; The association module is configured to obtain the relationship between the core network signaling and the media data based on the overlapping fields between the core network key fields and the media key fields; match the overlapping fields between the core network key fields and the service key fields, or match the overlapping fields between the media key fields and the service key fields to obtain a matching result; and obtain the association result between the core network signaling of the 5G message, the media data of the 5G message, and the internet access data of the 5G message based on the relationship between the core network signaling and the media data and the matching result.

13. The system according to claim 12, characterized in that, The media key fields include a first key field and a second key field, and the association module includes: The first matching module is configured to match overlapping fields between the first key field and the core network key field to obtain a first association relationship between the core network signaling and the media data. The second matching module is configured to match overlapping fields among the first key field, the second key field, and the business key field to obtain a second association relationship between the media data and the internet access data. The two-level association module is configured to obtain the association result based on the first association relationship and the second association relationship.

14. The system according to claim 13, characterized in that, The core network key fields include: first user identifier and first address information; The first key field includes: second user identifier, second address information, and first multimedia link; The second key field includes: the second multimedia link; The key business field includes: third multimedia link.

15. The system according to claim 14, characterized in that, The first matching module is further configured to establish a first association between the core network signaling and the media data when the first user identifier and the second user identifier are successfully matched, and / or the first address information and the second address information are successfully matched.

16. The system according to claim 14, characterized in that, The second matching module is further configured to establish a second association between the media data and the internet access data if the first multimedia link, the second multimedia link, and the third multimedia link are successfully matched.

17. A message association device, characterized in that, The device includes: processor; Memory used to store processor-executable instructions; The processor is configured to perform the message association method as described in any one of claims 1 to 11.

18. A non-transitory computer-readable storage medium, characterized in that, When the executable instructions in the storage medium are executed by a processor, the message association method as described in any one of claims 1 to 11 is implemented.

Images