Methods, apparatus, devices, and media for denial of service attack resolution

Abstract

The application discloses a denial of service attack solution method, device, equipment and medium, and belongs to the field of mobile communication. The method comprises the following steps: an SMF sends a PDR and a QER to a UPF, the PDR is used for identifying a target data packet sent by a terminal, and the QER is used for limiting the sending of the target data packet; wherein the target data packet is a data packet triggering a target core network element to initiate the denial of service attack to the SMF. The application enables the UPF to identify the target data packet and limit the sending of the target data packet, thereby preventing the DOS attack or the DDOS attack initiated by an abnormal UE and ensuring that the mobile communication system provides services for more UEs as much as possible.

Description

[0001] This application is a divisional application of the application filed on April 2, 2021, with application number “202110363831.5” and invention title “Solution, apparatus, device and medium for denial-of-service attacks”. Technical Field

[0002] This application relates to the field of mobile communications, and in particular to a solution, apparatus, device, and medium for denial-of-service attacks. Background Technology

[0003] In edge computing scenarios, Domain Name System (DNS) queries sent by User Equipment (UE) may be handled by the Edge Application Server Discovery Function (EASDF).

[0004] The Session Management Function (SMF) provides the EASDF with reporting and forwarding rules. The reporting rules specify how the EASDF sends reports to the SMF, while the forwarding rules specify how the EASDF forwards messages. After the UE sends a DNS query to the EASDF, the EASDF will send a report to the SMF according to the reporting rules.

[0005] When the uplink peak rate is high, if the UE uses malicious methods to frequently send DNS queries to the EASDF in a short period of time, the EASDF will frequently send reports to the SMF and trigger multiple subsequent signaling messages in the control plane, which will form a signaling storm in the mobile communication system, causing a denial-of-service (DOS) attack, and making the mobile communication system unable to provide services to all normal UEs. Summary of the Invention

[0006] This application provides a solution, apparatus, device, and medium for denial-of-service attacks, and offers a control scheme for defending against DOS attacks by controlling the User Plane Function (UPF) based on SMF. The technical solution is as follows:

[0007] According to one aspect of this application, a solution to a denial-of-service attack is provided, the method comprising:

[0008] SMF sends Packet Detection Rule (PDR) and Quality of Service Enforcement Rule (QER) to the User Plane Function (UPF). The PDR rule is used to identify target data packets sent by the terminal, and the QER rule is used to restrict the transmission of the target data packets.

[0009] The target data packet is the data packet that triggers the target core network element to send a message to the SMF.

[0010] According to another aspect of this application, a solution to a denial-of-service attack is provided, the method comprising:

[0011] UPF receives PDR and QER sent by SMF;

[0012] The UPF identifies the target data packet sent by the terminal based on the PDR;

[0013] The UPF restricts the transmission of the target data packet based on the QER;

[0014] The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF.

[0015] According to one aspect of this application, a denial-of-service attack mitigation apparatus is provided, the apparatus comprising:

[0016] The sending module is used to send PDR and QER to the UPF. The PDR is used to identify the target data packet sent by the terminal, and the QER is used to restrict the sending of the target data packet.

[0017] The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF.

[0018] According to another aspect of this application, a denial-of-service attack mitigation apparatus is provided, the apparatus comprising:

[0019] The receiving module is used to receive the PDR and QER sent by the SMF;

[0020] The processing module is configured to identify the target data packet sent by the terminal according to the PDR; and to restrict the transmission of the target data packet according to the QER;

[0021] The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF.

[0022] According to one aspect of this application, a network element device is provided, the network element device comprising: a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement a solution to a denial-of-service attack as described above.

[0023] According to another aspect of this application, a computer-readable storage medium is provided, the storage medium storing a computer program that is loaded and executed by a processor to implement the denial-of-service attack solution as described above.

[0024] According to another aspect of this application, a computer program product is provided, the computer program product including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform the denial-of-service attack solution provided in the above aspect.

[0025] The beneficial effects of the technical solutions provided in this application include at least the following:

[0026] By having the SMF provide PDR and QER to the UPF, the UPF can identify target data packets and restrict their transmission, thereby defending against DoS or DDoS attacks launched by abnormal UEs and ensuring that the mobile communication system can provide services to as many UEs as possible. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a block diagram of a mobile communication system provided in one embodiment of this application;

[0029] Figure 2 This is a communication diagram based on N3 / N9 provided in one embodiment of this application;

[0030] Figure 3 This is a communication diagram based on N6 provided in one embodiment of this application;

[0031] Figure 4 This is a communication diagram based on N19 provided in one embodiment of this application;

[0032] Figure 5 A flowchart illustrating a solution to a denial-of-service attack provided in one embodiment of this application is shown;

[0033] Figure 6 A flowchart illustrating a solution to a denial-of-service attack provided by another embodiment of this application is shown;

[0034] Figure 7 A flowchart illustrating a solution to a denial-of-service attack provided by another embodiment of this application is shown;

[0035] Figure 8 A flowchart illustrating a UPF resuming forwarding of target data packets according to an SMF instruction, provided in one embodiment of this application, is shown.

[0036] Figure 9 A flowchart illustrating the UPF's self-resumption of forwarding of the target data packet, provided in another embodiment of this application, is shown.

[0037] Figure 10 This illustration shows a block diagram of a denial-of-service attack mitigation apparatus according to an embodiment of this application;

[0038] Figure 11 This illustration shows a block diagram of a denial-of-service attack mitigation apparatus according to an embodiment of this application;

[0039] Figure 12 A schematic diagram of the structure of a network element device provided in one embodiment of this application is shown. Detailed Implementation

[0040] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0041] It should be understood that "several" in this article refers to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0042] In edge computing scenarios, the UE sends a PDU session establishment request to the SMF. The SMF locates and selects an EASDF for the UE. The SMF then sends a message to the selected EASDF, which carries the UE's IP address, the callback Uniform Resource Identifier (URI), and the rules for processing DNS messages. The callback address refers to the target resource URI requested by the EASDF when it initiates a message to the SMF.

[0043] Optionally, the SMF provides reporting rules to the EASDF, and the EASDF sends reports to the SMF under at least two of the following reporting rule categories:

[0044] 1. Reports triggered by DNS queries;

[0045] If the fully qualified domain name(s) (FQDN) of the Edge Application Server (EAS) in the DNS query matches the FQDN(s) filter in the reporting rule, the SMF can provide a reporting rule instructing the EASDF to send the EAS FQDN(s) to the SMF. The SMF then provides the EASDF with forwarding rules. The EASDF then forwards the DNS query to the local DNS or, after adding the ECS attribute, forwards the DNS query to the C-DNS.

[0046] 2. Reports triggered by DNS responses;

[0047] The SMF provides reporting rules to guide the EASDF in reporting the EAS IP address / FQDN to the SMF. This occurs if the EAS IP address in the DNS response matches the IP address range of the reporting rule, or if the FQDN in the DNS response matches the FQDN of the DNS message reporting rule. The SMF may then perform a UL CL insertion operation, which introduces significant signaling interaction. Specifically, the UE, RAN, AMF, I-UPF, and L-PSA all participate in this signaling interaction.

[0048] Because the SMF has configured reporting rules for the EASDF, if a UE sends a DNS query to the EASDF, it may trigger the EASDF to send a report (or report message) to the SMF. This report will trigger a significant amount of subsequent signaling and messages. For example, 5G's uplink peak rate can reach 300Mbps, meaning a UE can upload 300Mb of data per second. Let's do the math:

[0049] 300M / 8 / 1500 = 25,000 DNS queries per UE per second. Here, 8 represents the number of bits in one byte, and it is assumed that the length of a DNS query is 1500 bytes.

[0050] Because a DNS query can trigger signaling interaction with the SMF, and may also trigger signaling for the SMF's Uplink Classifier (UL CL) insertion operation, a signaling storm is formed in the mobile communication system, causing a DoS attack. The mobile communication system cannot serve all normal UEs (because the signaling of the 5G system is easily occupied by DoS, the mobile communication system may only serve a portion of normal UEs or be completely unable to serve normal UEs).

[0051] Furthermore, multiple UEs can simultaneously send DNS queries to EASDF through cooperation between different cells. This could lead to a DDoS attack, resulting in a more severe attack and rendering the mobile communication system virtually unusable for normal UEs.

[0052] In addition, since the SMF can also implement DHCP service, which is used to assign IP addresses or IP-related parameters to the UE, the UE can use the high speed of the user plane to send a large number of DHCP request packets to the SMF through the N4 interface. This generates a large amount of signaling on the N4 interface between the UPF and SMF. Simultaneously, by requesting SMF processing with these large numbers of DHCP request packets, the UE can occupy the SMF's time and resources for DHCP processing, thus enabling a Denial-of-Service (DoS) attack. Similarly, when multiple UEs cooperate to simultaneously send a large number of DHCP request packets to a single UPF and SMF, a DoS attack can be achieved. This application provides a solution to the denial-of-service attack problem to address the aforementioned technical issues.

[0053] Figure 1A block diagram of a mobile communication system provided in an exemplary embodiment of this disclosure is shown. This mobile communication system can be an NR-based 5G system, or it may include a 5G system based on the Evolved UMTS Terrestrial Radio Access Network (e-UTRAN) and subsequent evolution systems of 5G. The communication system is defined to support data connectivity and services, enabling the use of technologies such as Network Functions Virtualization (NFV) and Software Defined Networking (SDN) during network deployment. The communication system primarily consists of Network Functions (NFs), which are deployed in a distributed manner according to actual needs. The addition and removal of new network functions do not affect the overall network functionality. The communication system includes: User Equipment (UE), Radio Access Network ((R)AN), User Plane Function (UPF), Data Network (DN), and Control Plane Function.

[0054] The control plane functions include: Access and Mobility Management Function (AMF), Session Management Function (SMF), Policy Control Function (PCF), and Unified Data Management (UDM).

[0055] The UE communicates with the RAN via the air interface. The RAN communicates with the UPF via the first reference point N3. The two UPFs communicate via the second reference point N9. The PSAUPF communicates with the DN via the third reference point N6.

[0056] There may be multiple UEs, RANs, UPFs, and DNs. When there are multiple UPFs, some of them are the UE's PDU Session Anchor User Plane Function (PSA UPF). Communication between two PDU Session Anchor User Plane Functions (PSA UPFs) is achieved through the fourth reference point N19. Figure 1 (Not shown in the image).

[0057] The UE and AMF communicate via the fifth reference point N1. The RAN and AMF communicate via the sixth reference point N2. The UPF and SMF communicate via the seventh reference point N4.

[0058] exist Figure 1 The network architecture shown includes the following reference points:

[0059] N1: Reference point between UE and AMF;

[0060] N2: The reference point between (R)AN and AMF;

[0061] N3: The reference point between (R)AN and UPF;

[0062] N4: Reference point between SMF and UPF;

[0063] N6: Reference point between PSA UPF and data network;

[0064] N9: Reference point between the two UPFs;

[0065] N14: Reference point between the two AMFs;

[0066] N19: Reference point between two PSA UPFs for 5G LAN type services (not shown in the figure).

[0067] exist Figure 1 The network architecture shown includes the following service-based interfaces:

[0068] Namf: A service-based interface demonstrated by AMF;

[0069] Nsmf: Service-based interface displayed by SMF;

[0070] Npcf: PCF demonstrates a service-based interface;

[0071] Nudm: UDM showcases a service-based interface.

[0072] In different implementation scenarios, the connection methods between UEs and between UEs and UPFs may include the following scenarios:

[0073] First, the connection method of local switching (based on the first reference point N3 or the second reference point N9);

[0074] Two UEs are connected to the same PSA UPF, and data is exchanged directly between the two UEs within the PSA UPF without having to send the data outside the third reference point N6 and then have it returned by an external router or switch.

[0075] Reference Figure 2UE1 communicates with RAN1, and RAN1 communicates with intermediate UPF1; UE2 communicates with RAN2, and RAN2 communicates with intermediate UPF2. Both UE1 and UE2 are connected to the same PSA UPF. When UE1 sends a data packet, the data packet is exchanged directly within the PSA UPF, thus sending the data packet to UE2 without having to send the data packet outside the third reference point N6.

[0076] Second, based on the third reference point N6;

[0077] When a UE communicates with a device on the DN, broadcast data between the UE and the device needs to be exchanged through N6.

[0078] Reference Figure 3 UE1 communicates with RAN1, RAN1 communicates with UPF1, and PSA UPF1 communicates with DN. When UE1 sends a data packet, it needs to pass the data packet to device 3 on DN via N6.

[0079] Third, based on the fourth reference point N19.

[0080] When two UEs are connected to different PSA UPFs, the data between the two UEs needs to be exchanged through the fourth reference point N19, and an N19 tunnel is established between the two PSA UPFs.

[0081] Reference Figure 4 UE1 communicates with RAN1, and RAN1 communicates with intermediate UPF1; UE4 communicates with RAN2, and RAN2 communicates with intermediate UPF2. UE1 and UE4 are connected to different PSA UPFs: PSA UPF1 and PSA UPF2, respectively. An N19 tunnel is established between the two PSA UPFs. When UE1 sends a data packet, it needs to exchange data packets through the N19 tunnel between the two PSA UPFs to send the data packet to UE4.

[0082] Figure 5 A flowchart illustrating a denial-of-service attack solution provided in an exemplary embodiment of this application is shown. This embodiment illustrates the method by example, performed by SMF and UPF. The method includes:

[0083] Step 120: SMF sends PDR and QER to UPF;

[0084] PDR is used to identify the target data packet sent by the terminal, and QER is used to restrict the terminal from sending the target data packet.

[0085] The target data packet is the data packet that triggers the target core network element to launch a denial-of-service attack against the SMF. The target data packet includes, but is not limited to, at least one of the following two types of data packets:

[0086] • DNS query packets;

[0087] DNS query packets are packets that trigger EASDF to send a report to SMF.

[0088] • DHCP request packet;

[0089] A DHCP request packet is a packet that triggers the UPF to forward messages to the SMF.

[0090] Optionally, the SMF sends a PDR and a QER to the UPF upon detecting a DoS attack. For example, the SMF sends a PDR and a QER to the UPF when the EASDF's reporting rate reaches a limit threshold. Alternatively, the SMF sends a PDR and a QER to the UPF when the UPF's DHCP request forwarding rate reaches a limit threshold.

[0091] Step 140: The UPF receives the PDR and QER sent by the SMF;

[0092] Step 160: The UPF identifies the target data packet sent by the terminal based on the PDR;

[0093] The PDR includes at least one of the first PDR and the second PDR.

[0094] • The first PDR is the PDR used to identify DNS query packets.

[0095] • The second PDR is used to identify DHCP request packets.

[0096] Step 180: UPF restricts the transmission of target data packets based on QER.

[0097] QER includes at least one of the first QER and the second QER.

[0098] • The first QER is the QER that limits the uplink bit rate of the target data packet.

[0099] • The second QER is the QER that instructs the UPF to stop forwarding the target data packet.

[0100] That is, the second QER is the QER that instructs the UPF to stop sending the terminal's DNS query packets to the EASDF, and / or the second QER is the QER that instructs the UPF to stop sending the terminal's DHCP request packets to the SMF.

[0101] Optionally, the PDR and QER described above are configured at the individual UE level. Alternatively, the PDR can be configured for multiple UEs, and the QER can be configured for a single UE, a PDU session within a single UE, or a specific QoS flow within a single UE. This specific QoS flow is a QoS flow dedicated to the target data packet. Alternatively, both the PDR and QER described above can be configured for multiple UEs.

[0102] In summary, the method provided in this embodiment enables the UPF to identify target data packets and restrict their transmission by having the SMF provide PDR and QER, thereby defending against DoS or DDoS attacks initiated by abnormal UEs and ensuring that the mobile communication system can provide services to as many UEs as possible.

[0103] For the first QER:

[0104] Figure 6 A flowchart illustrating a denial-of-service attack solution provided in an exemplary embodiment of this application is shown. This embodiment illustrates the method by way of execution by an SMF, a UPF, and a UE. The method includes:

[0105] Step 220: SMF sends PDR and first QER to UPF;

[0106] PDR is used to identify the target data packet sent by the terminal, and the first QER is used to limit the uplink bit rate of the target data packet.

[0107] The target data packet includes at least one of a DNS query packet and a DHCP request packet. Correspondingly, the PDR includes at least one of a first PDR and a second PDR. The first PDR is used to identify the DNS query packet. The second PDR is used to identify the DHCP request packet.

[0108] For example, the first PDR includes at least one of the following:

[0109] • The data packet type is UDP and the destination port number of the UDP data packet is 53;

[0110] At this point, the data packet is a DNS protocol running on top of the User Datagram Protocol (UDP), also known as a DNS over 53 type data packet.

[0111] • The data packet type is a UDP data packet, the destination IP address of the UDP data packet is the IP address of EASDF, and the destination port number of the UDP data packet is 53;

[0112] At this point, the data packet is a DNS packet of type DNS over53 (destination IP address is EASDF).

[0113] • The data packet type is a TCP data packet and the destination port number of the TCP data packet is 853;

[0114] At this point, the data packet is a data packet that DNS operates on top of the Transport Layer Security (TLS) protocol, referred to as a DOT type data packet.

[0115] • The data packet type is a TCP data packet, the destination IP address of the TCP data packet is the IP address of EASDF, and the destination port of the TCP data packet is 853 or 443.

[0116] If the destination port is 853, the data packet is a DNS data packet of type DOT (destination IP address is EASDF); if the destination port is 443, the data packet is a DNS data packet running on the Hypertext Transfer Protocol (HTTP) (destination IP address is EASDF).

[0117] For example, the second PDR includes at least one of the following:

[0118] The data packet type is a UDP packet and the destination port number of the UDP packet is 68. Alternatively, the data packet type is a UDP packet, the destination port number of the UDP packet is 68, and the source port number is 67. In this case, the data packet is a DHCP request packet.

[0119] The data packet type is a UDP packet, the destination port number is 67, and the source port number is 68. In this case, the data packet is a DHCP response packet.

[0120] Optionally, the SMF sends a PDR and a first QER to the UPF when the EASDF's reporting rate reaches a limit threshold. Alternatively, the SMF sends a PDR and a first QER to the UPF when the number of DHCP requests forwarded by the UPF reaches a limit threshold.

[0121] In some embodiments, if EASDF is only used for DNS services, DNS query packets can be more generally identified as packets with a destination IP address of EASDF and port numbers of 53 / 853 / 443. Alternatively, all UDP and TCP packets with a destination IP address of EASDF can be identified as DNS query packets.

[0122] Step 240: The UPF receives the PDR and the first QER sent by the SMF;

[0123] Step 260: The UPF identifies the target data packet sent by the terminal based on the PDR;

[0124] If the first PDR is satisfied, a DNS query packet is considered to have been identified.

[0125] If the second PDR is satisfied, the DHCP request packet is considered to have been identified.

[0126] Step 280: UPF limits the maximum uplink bit rate of the target data packet according to the first QER.

[0127] Optionally, the UPF limits the maximum uplink bit rate when the terminal sends the target data packet based on the first QER. Alternatively, the UPF limits its own maximum uplink bit rate when forwarding the target data packet based on the first QER.

[0128] In one embodiment, the target data packets include different types; the maximum uplink bit rate includes at least two maximum uplink bit rates, each applicable to a different type of target data packet. For example, the target data packets include DNS query packets and DHCP request packets.

[0129] The maximum uplink bit rate includes: a first maximum uplink bit rate for limiting DNS query packets, and a second maximum uplink bit rate for limiting DHCP request packets.

[0130] In one embodiment, the maximum uplink bit rate includes at least one of the following:

[0131] The UE's Aggregate Maximum Bit Rate (AMBR);

[0132] AMBR for Protocol Data Unit (PDU) sessions;

[0133] The maximum uplink bit rate (MBR) of the Quality of Service (QoS) stream.

[0134] In other words, UPF can limit the maximum uplink bit rate of the target data packet according to UE granularity, PDU granularity, or QoS stream granularity.

[0135] In summary, the method provided in this embodiment provides PDR and a first QER to the UPF through the SMF, enabling the UPF to limit the maximum uplink bit rate of the target data packet, thereby defending against DOS or DDOS attacks initiated by abnormal UEs and ensuring that the mobile communication system can provide services to more UEs as much as possible.

[0136] Regarding the second QER:

[0137] Figure 7 A flowchart illustrating a denial-of-service attack solution provided in an exemplary embodiment of this application is shown. This embodiment illustrates the method by way of execution by an SMF, a UPF, and a UE. The method includes:

[0138] Step 320: SMF sends PDR and second QER to UPF;

[0139] The PDR is used to identify the target data packet sent by the terminal, and the second QER is used to limit the uplink bit rate of the target data packet.

[0140] The target data packet includes at least one of a DNS query packet and a DHCP request packet. Correspondingly, the PDR includes at least one of a first PDR and a second PDR. The first PDR is used to identify the DNS query packet. The second PDR is used to identify the DHCP request packet.

[0141] For example, the first PDR includes at least one of the following:

[0142] • The data packet type is UDP and the destination port number of the UDP data packet is 53;

[0143] • The data packet type is a UDP data packet, the destination IP address of the UDP data packet is the IP address of EASDF, and the destination port number of the UDP data packet is 53;

[0144] • The data packet type is a TCP data packet and the destination port number of the TCP data packet is 853;

[0145] • The data packet type is a TCP data packet, the destination IP address of the TCP data packet is the IP address of EASDF, and the destination port of the TCP data packet is 853 or 443.

[0146] For example, the second PDR includes:

[0147] The packet type is a UDP packet and the destination port number of the UDP packet is 68. Alternatively, the packet type is a UDP packet, the destination port number of the UDP packet is 68 and the source port number is 67.

[0148] Optionally, if the EASDF's reporting rate reaches a limit threshold, the SMF sends a PDR and a second QER to the UPF. Alternatively, if the UPF's forwarding of DHCP requests reaches a limit threshold, the SMF sends a PDR and a second QER to the UPF.

[0149] Optionally, the second QER may further include: a backoff time (optional), which is the duration for which the UPF stops forwarding the target data packet.

[0150] Step 340: The UPF receives the PDR and the second QER sent by the SMF;

[0151] Step 360: UPF identifies the target data packet sent by the terminal based on PDR;

[0152] If the first PDR is satisfied, a DNS query packet is considered to have been identified.

[0153] If the second PDR is satisfied, the DHCP request packet is considered to have been identified.

[0154] Step 380: UPF stops forwarding the target data packet according to the second QER.

[0155] Optionally, the UPF may stop forwarding DNS query packets to the EASDF based on the second QER, and / or stop forwarding DHCP request packets to the SMF based on the second QER. That is, depending on the configuration of the second QER, the forwarding of both DNS query packets and DHCP request packets may be stopped simultaneously, or only the forwarding of DNS query packets may be stopped, or only the forwarding of DHCP request packets may be stopped.

[0156] If the second QER includes a backoff time, the UPF stops forwarding the target data packet according to the second QER before the backoff time expires.

[0157] The 3GPP communication protocol TS23.501 provides the message format for PDR. Table 1 below shows the message format of this PDR:

[0158] Table 1

[0159]

[0160]

[0161] Correspondingly, the 3GPP communication protocol TS23.501 provides the message format for QER. Table 2 below shows the message format of this QER:

[0162] Table 2

[0163]

[0164]

[0165] Upon detecting a DoS attack, the SMF sets the uplink switch in the second QER to "off". Optionally, a backoff time (e.g., 5 minutes) can be added to the second QER. Because the uplink switch is set to "off", the UPF stops sending DNS query packets to the N6 or N9 interface.

[0166] After the UPF stops forwarding the target data packet, it can resume forwarding the target data packet according to the SMF's instructions. Optionally, such as Figure 8 As shown:

[0167] Step 392: The SMF sends a third QER to the UPF. The third QER is used to instruct the UPF to resume the QER for forwarding the target data packet.

[0168] If the second QER does not carry a backoff time or the timer corresponding to the backoff time has not expired, the SMF can, after a certain period of time, send the GateStatus UL setting to "On" in the third QER contained in the N4 Session Modification Request message to the UPF again. In this way, the DNS interaction function between the UE and EASDF is restored.

[0169] Step 394: UPF receives the third QER sent by SMF;

[0170] Step 396: UPF forwards the target data packet according to the third QER recovery.

[0171] Optionally, the UPF can resume forwarding DNS query packets to the EASDF based on the third QER, and / or resume forwarding DHCP request packets to the SMF based on the third QER. That is, depending on the configuration of the third QER, the forwarding of both DNS query packets and DHCP request packets can be resumed simultaneously, or only the forwarding of DNS query packets can be resumed, or only the forwarding of DHCP request packets can be resumed.

[0172] After the UPF stops forwarding the target data packet, it can automatically resume forwarding the target data packet. Optionally, such as Figure 9 As shown:

[0173] Step 398: After the rollback timeout, the UPF resumes forwarding the target data packet.

[0174] If the UPF does not receive the third QER sent by the SMF, the UPF will automatically resume forwarding the target data packet after the backoff time expires.

[0175] When the second QER carries a backoff time, the UPF automatically sets the uplink switch status to "on" after the timer corresponding to the backoff time expires. In this way, the UPF can continue to forward DNS query data packets to the N6 or N9 interface, so that the UE can send DNS query data packets to the EASDF, and the EASDF can send reports to the SMF.

[0176] Optionally, the third QER carries a shared backoff time, which is a backoff time shared by at least two types of target packets of EASDF. In this case, if the UPF does not receive the third QER sent by the SMF, the UPF will automatically resume forwarding the two types of target packets after the shared backoff time expires.

[0177] Optionally, the third QER carries at least one of a first rollback time and a second rollback time. The first rollback time is the rollback time corresponding to the DNS query packet, and the second rollback time is the rollback time corresponding to the DHCP request packet.

[0178] In this scenario, if the UPF does not receive the third QER sent by the SMF, the UPF will automatically resume forwarding DNS query packets after the first rollback timeout; the UPF will automatically resume forwarding DHCP request packets after the second rollback timeout.

[0179] In summary, the method provided in this embodiment actively controls the UPF to stop or resume forwarding target data packets by sending a stop instruction based on the second QER or a start instruction based on the third QER to the UPF. This enables the SMF to actively control the forwarding of target data packets in the core network, thereby defending against DOS or DDOS attacks initiated by abnormal UEs and ensuring that the mobile communication system provides services to as many UEs as possible.

[0180] Furthermore, SMF can proactively resume the forwarding of DNS query packets, thereby proactively restoring the EASDF reporting mechanism and ensuring the normal operation of functions such as UL CL insertion and BP insertion.

[0181] Figure 10 A flowchart illustrating a denial-of-service attack mitigation apparatus provided in an exemplary embodiment of this application is shown. This apparatus can be implemented as an SMF, or as part of an SMF, or applied within an SMF.

[0182] The device includes:

[0183] The sending module 1020 is used to send Packet Detection Rules (PDR) and Quality of Service Flow Enforcement Rules (QER) to the User Plane Function (UPF). The PDR is used to identify target data packets sent by the terminal, and the QER is used to restrict the sending of the target data packets.

[0184] The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF.

[0185] In one embodiment, the QER includes: a first QER; the first QER is a QER used to limit the maximum uplink bit rate of the target data packet.

[0186] In one embodiment, the target data packet includes different types; the maximum uplink bit rate includes at least two maximum uplink bit rates, each applicable to a different type of target data packet.

[0187] In one embodiment, the maximum uplink bit rate includes at least one of the following: the aggregated maximum uplink bit rate AMBR of the terminal; the AMBR of the PDU session; and the maximum uplink bit rate MBR of the QoS stream.

[0188] In one embodiment, the QER includes a second QER; the second QER is a QER used to instruct the UPF to stop forwarding the target data packet.

[0189] In one embodiment, the second QER further includes a backoff time; the backoff time is the duration for which the UPF stops forwarding the target data packet.

[0190] In one embodiment, the sending module 1020 is further configured to send a third QER to the UPF, the third QER being a QER used to instruct the UPF to resume forwarding the target data packet.

[0191] In one embodiment, the target data packet includes a DNS query data packet, and the PDR includes a first PDR for identifying the DNS query data packet.

[0192] In one embodiment, the first PDR includes at least one of the following: the data packet type is a UDP data packet and the destination port number of the UDP data packet is 53; the data packet type is a UDP data packet, the destination IP address of the UDP data packet is the IP address of the EASDF, and the destination port number of the UDP data packet is 53; the data packet type is a TCP data packet and the destination port number of the TCP data packet is 853; the data packet type is a TCP data packet, the destination IP address of the TCP data packet is the IP address of the EASDF, and the destination port of the TCP data packet is 853 or 443.

[0193] In one embodiment, the target data packet includes a DHCP request data packet; the PDR includes a second PDR for identifying the DHCP request data packet.

[0194] In one embodiment, the second PDR includes: a data packet of type UDP and the destination port number of the UDP data packet is 68.

[0195] In one embodiment, the sending module 1020 is further configured to send a PDR and a QER to a UPF, including: the SMF sending the PDR and the QER to a Protocol Data Unit Session Anchor (PSA) UPF, wherein the PSA UPF is a UPF connected to a Data Network (DN); or, in the presence of at least two cascaded intermediate UPFs, the SMF sending the PDR and the QER to a first intermediate UPF, wherein the first intermediate UPF is any one of the at least two intermediate UPFs.

[0196] In one embodiment, the PDR and the QER are carried in the N4 session establishment / modification request.

[0197] Figure 11 A flowchart illustrating an exemplary embodiment of this application provides a denial-of-service attack mitigation apparatus. This apparatus can be implemented as part of or incorporated into a UPF. The apparatus includes:

[0198] Receiver module 1120 is used to receive Packet Inspection Rule (PDR) and Service Quality Flow Enforcement Rule (QER) sent by Session Management Function (SMF).

[0199] Processing module 1140 is configured to identify the target data packet sent by the terminal according to the PDR; and to restrict the transmission of the target data packet according to the QER;

[0200] The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF.

[0201] In one embodiment, the QER includes: a first QER; the processing module 1140 is configured to limit the maximum uplink bit rate of the target data packet according to the first QER.

[0202] In one embodiment, the target data packet includes different types; the maximum uplink bit rate includes at least two maximum uplink bit rates, each applicable to a different type of target data packet.

[0203] In one embodiment, the maximum uplink bit rate includes at least one of the following: the aggregated maximum uplink bit rate AMBR of the terminal; the AMBR of the PDU session; and the maximum uplink bit rate MBR of the QoS stream.

[0204] In one embodiment, the QER includes: a second QER; the processing module 1140 is configured to stop forwarding the target data packet according to the second QER.

[0205] In one embodiment, the second QER further includes: a backoff time; the processing module 1140 is configured to stop forwarding the target data packet before the backoff time expires.

[0206] In one embodiment, the receiving module 1020 is further configured to receive the third QER sent by the SMF; the UPF resumes forwarding the target data packet according to the third QER.

[0207] In one embodiment, the target data packet includes a DNS query data packet, and the PDR includes a first PDR for identifying the DNS query data packet.

[0208] In one embodiment, the first PDR includes at least one of the following: the data packet type is a UDP data packet and the destination port number of the UDP data packet is 53; the data packet type is a UDP data packet, the destination IP address of the UDP data packet is the IP address of the EASDF, and the destination port number of the UDP data packet is 53; the data packet type is a TCP data packet and the destination port number of the TCP data packet is 853; the data packet type is a TCP data packet, the destination IP address of the TCP data packet is the IP address of the EASDF, and the destination port of the TCP data packet is 853 or 443.

[0209] In one embodiment, the target data packet includes a DHCP request data packet; the PDR includes a second PDR for identifying the DHCP request data packet.

[0210] In one embodiment, the second PDR includes: a data packet of type UDP and the destination port number of the UDP data packet is 68.

[0211] In one embodiment, the UPF is a Protocol Data Unit Session Anchor (PSA) UPF, which is a UPF connected to a Data Network (DN); or, the UPF is a first intermediate UPF, which is any one of at least two intermediate UPFs connected in series.

[0212] In one embodiment, the PDR and the QER are carried in the N4 session establishment / modification request.

[0213] It should be noted that the sending module is used to execute the sending-related steps in the above method embodiments; the receiving module is used to execute the receiving-related steps in the above method embodiments; and the processing module is used to execute other steps in the above method embodiments besides the sending and receiving steps, which will not be described in detail in this embodiment.

[0214] Figure 12 This diagram illustrates the structure of a network element device according to an embodiment of this application. For example, this network element device can be used to implement the above-described solution to a denial-of-service attack. Specifically, the network element device 1200 may include: a processor 1201, a receiver 1202, a transmitter 1203, a memory 1204, and a bus 1205.

[0215] The processor 1201 includes one or more processing cores. The processor 1201 executes various functional applications and information processing by running software programs and modules.

[0216] The receiver 1202 and the transmitter 1203 can be implemented as a transceiver 1206, which can be a communication chip.

[0217] The memory 1204 is connected to the processor 1201 via the bus 1205.

[0218] The memory 1204 can be used to store computer programs, and the processor 1201 is used to execute the computer programs to implement the various steps performed by the network element device, access network entity, core network element or core network entity in the above method embodiments.

[0219] In this embodiment, transmitter 1203 is used to perform the steps related to transmission in the above-described method embodiments; receiver 1202 is used to perform the steps related to reception in the above-described method embodiments; and processor 1201 is used to perform other steps in the above-described embodiments besides the transmission and reception steps.

[0220] Furthermore, the memory 1204 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, including but not limited to: RAM (Random-Access Memory) and ROM (Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other solid-state storage technologies, CD-ROM (Compact Disc Read-Only Memory), DVD (Digital Video Disc) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage or other magnetic storage devices.

[0221] In an exemplary embodiment, a network element device is also provided, the network element device including: a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement the denial-of-service attack solution as described above.

[0222] This application also provides a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the denial-of-service attack solution provided in the above method embodiments.

[0223] Optionally, this application also provides a computer program product comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the denial-of-service attack solution provided above.

[0224] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0225] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0226] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A solution to a denial-of-service attack, characterized in that, The method includes: When the EASDF reporting rate reaches the limit threshold, or the User Plane Function (UPF) DHCP request forwarding rate reaches the limit threshold, the Session Management Function (SMF) sends a Packet Inspection Rule (PDR) and a Quality of Service Flow Enforcement Rule (QER) to the UPF. The PDR is used to identify the target data packet sent by the terminal, and the QER is used to restrict the transmission of the target data packet. The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF. The target data packet includes a Domain Name System (DNS) query data packet. The PDR includes a first PDR, which is used to identify the DNS query data packet.

2. The method according to claim 1, characterized in that, The QER includes: a first QER; The first QER is a QER used to limit the maximum uplink bit rate of the target data packet.

3. The method according to claim 2, characterized in that, The target data packets include different types; The maximum uplink bit rate includes at least two maximum uplink bit rates, each applicable to a different type of target data packet.

4. The method according to claim 2, characterized in that, The maximum uplink bit rate includes at least one of the following: The terminal's Aggregated Maximum Uplink Bit Rate (AMBR); AMBR for Protocol Data Unit (PDU) sessions; Maximum uplink bit rate (MBR) for Quality of Service (QoS) streams.

5. The method according to claim 1, characterized in that, The QER includes: a second QER; The second QER is a QER used to instruct the UPF to stop forwarding the target data packet.

6. The method according to claim 5, characterized in that, The second QER further includes: a backoff time; the backoff time is the duration for which the UPF stops forwarding the target data packet.

7. The method according to claim 5, characterized in that, The method further includes: The SMF sends a third QER to the UPF, which is a QER used to instruct the UPF to resume forwarding the target data packet.

8. The method according to any one of claims 1 to 7, characterized in that, The first PDR includes at least one of the following: The data packet type is User Datagram Protocol (UDP) data packet and the destination port number of the UDP data packet is 53; The data packet type is a UDP data packet, the destination Internet Protocol IP address of the UDP data packet is the IP address of the EASDF, and the destination port number of the UDP data packet is 53; The data packet type is a Transmission Control Protocol (TCP) data packet and the destination port number of the TCP data packet is 853; The data packet type is a TCP data packet, the destination IP address of the TCP data packet is the IP address of the EASDF, and the destination port of the TCP data packet is 853 or 443.

9. The method according to any one of claims 1 to 7, characterized in that, The target data packet includes a DHCP request data packet; The PDR includes a second PDR, which is used to identify the DHCP request packet.

10. The method according to claim 9, characterized in that, The second PDR includes: The data packet type is User Datagram Protocol (UDP) data packet and the destination port number of the UDP data packet is 68.

11. The method according to any one of claims 1 to 10, characterized in that, The SMF sends PDR and QER to the UPF, including: The SMF sends the PDR and the QER to the Protocol Data Unit Session Anchor (PSA UPF), where the PSA UPF is a UPF connected to the data network DN. or, In the presence of at least two intermediate UPFs connected in series, the SMF sends the PDR and the QER to the first intermediate UPF, which is any one of the at least two intermediate UPFs.

12. A solution to a denial-of-service attack, characterized in that, The method includes: The User Plane Function (UPF) receives Packet Inspection Rules (PDR) and Service Quality Flow Enforcement Rules (QER) sent by the Session Management Function (SMF). The PDR and QER are sent by the SMF when the EASDF reporting rate reaches a limit threshold or the UPF DHCP request forwarding rate reaches a limit threshold. The UPF identifies the target data packet sent by the terminal based on the PDR; The UPF restricts the transmission of the target data packet based on the QER; The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF. The target data packet includes a Domain Name System (DNS) query data packet. The PDR includes a first PDR, which is used to identify the DNS query data packet.

13. A device for resolving denial-of-service attacks, characterized in that, The device includes: The sending module is used to send a Packet Inspection Rule (PDR) and a Quality of Service Flow Enforcement Rule (QER) to the UPF when the EASDF reporting rate reaches a limit threshold or the forwarding rate of the User Plane Function (UPF) DHCP request reaches a limit threshold. The PDR is used to identify the target data packet sent by the terminal, and the QER is used to restrict the sending of the target data packet. The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF. The target data packet includes a Domain Name System (DNS) query data packet. The PDR includes a first PDR, which is used to identify the DNS query data packet.

14. A device for resolving denial-of-service attacks, characterized in that, The device includes: The receiving module is used to receive the Packet Inspection Rule (PDR) and Service Quality Flow Enforcement Rule (QER) sent by the Session Management Function (SMF). The PDR and QER are sent by the SMF when the EASDF reporting rate reaches the limit threshold or the UPF DHCP request forwarding rate reaches the limit threshold. The processing module is configured to identify the target data packet sent by the terminal according to the PDR; and to restrict the transmission of the target data packet according to the QER; The target data packet is the data packet that triggers the target core network element to launch the denial-of-service attack to the SMF. The target data packet includes a Domain Name System (DNS) query data packet. The PDR includes a first PDR, which is used to identify the DNS query data packet.

15. A network element device, characterized in that, The network element device includes a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement a solution to a denial-of-service attack as described in any one of claims 1 to 12.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that is loaded and executed by a processor to implement a solution to a denial-of-service attack as described in any one of claims 1 to 12.

Images