A system and method for protecting user information security at the edge of a 5G network

Abstract

A system and method for protecting user information security at the edge of a 5G network are provided between a 5G core network and an edge computing application. The system comprises: an edge computing application policy module, for assigning an initial user privacy protection security grade to the edge computing application, and deducting or adding points during operation; a user policy module, for classifying user sensitivity; a user number protection module, for adopting different number protection measures for numbers transmitted by the edge computing application according to the security grade and user sensitivity, so as to implement different protection strategies for user number privacy, and also provide user information for the edge computing application for convenient and fast application usage experience such as user identity identification and authentication-free.

Description

Technical Field

[0001] The present invention belongs to the field of 5G edge computing applications and user privacy security technology, and relates to a system and method for protecting user information security in edge computing in a 5G network. Background Art

[0002] As 5G network-level application scenarios become more and more mature, edge computing is regarded as an indispensable key technology because it can meet the requirements of low latency, high bandwidth, and large-scale connections. Edge computing is widely carried out in all walks of life and accesses a large number of third-party Internet channels. At present, in 5G edge computing, it is possible to enhance the carrying of user mobile phone numbers through the UPF (User Plane Function) header, and transmit the user's mobile phone number to the edge computing application to facilitate the application to achieve convenient and fast identity authentication. If the operator of the edge computing application does not keep the user's mobile phone number properly or leaks it maliciously, it will bring great risks to the privacy of the user's number.

[0003] Patent document with publication number CN116319496A proposes a test method for UPF header enhancement function, which can complete the simulation of various abnormal scenarios and avoid the problem that the received packet does not conform to the abnormal test scenario and it is impossible to verify whether the UPF processing in the abnormal scenario is correct.

[0004] The patent document with publication number CN113691547A proposes a HTTPS header enhancement method for 5G UPF network elements, which realizes the insertion of user feature information into the Extension field of the ClientHello message of the own business / third-party cooperative business; ensuring that the original TCP Session between the user and the HTTPS Server is connected and communicates normally.

[0005] The Internet article "5G Private Network Campus Network Convergence Solution" (link address: http: / / www.jdkj.cc / index.php / post / 43.html) describes "UPF side: 1. For data packets diverted to the campus network, configure the "header enhancement" function on the UPF and add the MSISDN (user mobile phone number). The school learns the user's identity by identifying the MSISDN; 2. The Panabit device is connected in series between the operator's 5G network and the campus network to add MSISDN information. When the user data packet is transmitted to the school through the 5G network, the Panabit device identifies the MSISDN (user, mobile phone number) in the data packet to learn the user's identity, and records the correspondence between the IP and the user name." The article specifically explains how to use header enhancement to carry user numbers to achieve identity recognition in edge computing systems.

[0006] The above-mentioned existing patents or documents describe that the user number can be passed to the edge computing application side through header enhancement and other technologies, which greatly facilitates the edge computing application to obtain the user number and then perform user authentication-free application scenarios. However, this also brings about a greater problem of user privacy information protection. Summary of the invention

[0007] In order to address the above-mentioned deficiencies in the related prior art, the present invention provides a system and method for protecting user information security in edge computing in a 5G network. By adding a user privacy protection system between the 5G core network and the edge computing application, a hierarchical security management mechanism for the edge computing application is implemented and user sensitivity is analyzed to implement different user number transmission mechanisms. This protects the privacy of user numbers and provides user information for edge computing applications for user identity identification, authentication-free, and other convenient and fast application usage experiences.

[0008] In order to achieve the purpose of the present invention, the following scheme is proposed:

[0009] A 5G network edge computing user information security protection system is provided between the 5G core network and the edge computing application, comprising:

[0010] The edge computing application policy module is used to assign an initial user privacy protection security level score to the edge computing application when accessing the edge computing device according to the purpose, industry, and expected user scale of the edge computing application, and deduct the user privacy protection security level score of each edge computing application according to the rule-based content health detection method during operation;

[0011] The user policy module is used to collect historical complaint records of users from communication network operators in real time to analyze their sensitivity to number privacy. According to the number of complaints and consultations on number protection issues, the user's privacy sensitivity score will be deducted.

[0012] The user number protection module is used to receive messages from the UPF and call the user privacy protection security level and user privacy sensitivity score to determine the user number sending strategy:

[0013] If the user privacy protection security level score and the user privacy sensitivity score are both greater than the first preset value, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using a reversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the corresponding edge computing application, so that the edge computing application obtains the encrypted string and decrypts it to obtain the user information for identity authentication or to carry out application functions related to user information;

[0014] If the user privacy protection security level score and the user privacy sensitivity score are both greater than the second preset value and less than or equal to the first preset value, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using an irreversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the edge computing application, so that the edge computing application obtains the encrypted user information for identity authentication;

[0015] If the user privacy protection security level score and the user privacy sensitivity score are other cases, the message received from the UPF is passed to the edge computing application after removing the user number related fields from the enhanced fields of the HTTP header.

[0016] Furthermore, when the user number is encrypted using an irreversible encryption algorithm, the encryption key and encryption algorithm are the same each time for the same edge computing application.

[0017] Furthermore, the reversible encryption algorithm adopts one or more of DES, AES, 3DES, RSA, and DSA; the irreversible encryption algorithm adopts MD5 and / or SHS.

[0018] Further, the rule-based content health detection method includes:

[0019] Preprocess the content submitted by the edge computing application, including one or more of word segmentation, removal of stop words, and removal of special symbols;

[0020] Extracting features related to the violation from the preprocessed text, the features related to the violation including keyword frequency and / or text length;

[0021] The extracted features are matched with the rules in the preset rule library. If the match is successful, the edge computing application is considered to have violated the rules, and the user's privacy protection security level points are deducted according to the preset deduction rules;

[0022] The rules in the preset rule base include one or more of regular expressions, keyword blacklists, and grammatical patterns.

[0023] Furthermore, the initial user privacy protection security level is divided into 100 points, and 1 point will be deducted for each violation.

[0024] Furthermore, if there is one complaint about user number protection, 2 points will be deducted from the user privacy sensitivity score, and if there is one consultation about user number protection, 1 point will be deducted from the user privacy sensitivity score. The first preset value is 90 points, and the second preset value is 80 points.

[0025] A method for protecting user information security of edge computing in a 5G network, applied between a 5G core network and an edge computing application, comprises the following steps:

[0026] When accessing edge computing devices, an initial user privacy protection security level score is assigned to the edge computing application based on its purpose, industry, and expected user scale. During operation, the user privacy protection security level score of each edge computing application is deducted based on a rule-based content health detection method.

[0027] Collect users' historical complaint records with communication network operators in real time to analyze their sensitivity to number privacy, and deduct points from users' privacy sensitivity scores based on the number of complaints and inquiries about number protection issues;

[0028] Receive the message sent by UPF, and call the user privacy protection security level score and user privacy sensitivity score to determine the user number sending strategy:

[0029] If the user privacy protection security level score and the user privacy sensitivity score are both greater than the first preset value, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using a reversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the corresponding edge computing application, so that the edge computing application obtains the encrypted string and decrypts it to obtain the user information for identity authentication or to carry out application functions related to user information;

[0030] If the user privacy protection security level score and the user privacy sensitivity score are both greater than the second preset value and less than or equal to the first preset value, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, the user number is encrypted using an irreversible encryption algorithm and then replaced with the user number field in the enhanced field of the HTTP header, and then passed to the edge computing application, so that the edge computing application obtains the encrypted user information for identity authentication;

[0031] If the user privacy protection security level score and the user privacy sensitivity score are other cases, the message received from the UPF is passed to the edge computing application after removing the user number related fields from the enhanced fields of the HTTP header.

[0032] An electronic device comprises: at least one processor and a memory; wherein the memory stores computer execution instructions; the computer execution instructions stored in the memory are executed by the at least one processor, so that the at least one processor executes the edge computing user information security protection method in the 5G network.

[0033] A computer-readable storage medium having a computer program stored thereon, which, when the computer program is executed by a processor, controls the device where the storage medium is located to execute the method for protecting user information security in edge computing in a 5G network.

[0034] Beneficial effects of the present invention:

[0035] On the basis of UPF header enhancement, technical means of hierarchical processing of user numbers are adopted. By adding a user privacy protection system between the 5G core network and edge computing applications, a hierarchical security management mechanism of edge computing applications is implemented and user sensitivity is analyzed to implement different user number transmission mechanisms. This protects the privacy of user numbers and also provides user information for edge computing applications for user identity identification, authentication-free and other convenient and fast application usage experiences. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A structural block diagram of a protection system according to an embodiment of the present application is shown.

[0037] Figure 2 A flow chart of the protection method according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0038] To make the objectives, technical solutions and advantages of the embodiments of the present invention more clear, the implementation modes of the present invention are described in detail below with reference to the accompanying drawings. However, the embodiments described in the present invention are only part of the embodiments of the present invention, rather than all the embodiments.

[0039] In one aspect of an embodiment of the present application, a 5G network edge computing user information security protection system is provided, which is arranged between a 5G core network and an edge computing application, such as Figure 1 shown.

[0040] in, Figure 1 Only part of the structure of the 5G core network related to the embodiment of the present application is shown, wherein:

[0041] UE: User Equipment, which can be a mobile phone, PAD, computer or other device connected to the 5G network. Users access the 5G network through UE to use edge computing applications.

[0042] AMF: The full name is Access and Mobility Management Function, which is mainly responsible for terminal access rights and switching.

[0043] SMF: Session Management Function, which provides service continuity and uninterrupted user experience, including changes in IP addresses and / or anchor points.

[0044] (R)AN: Radio Access Network, is part of the 5G network. It is a wireless access network used to connect user devices and the core network.

[0045] UPF: User Plane Function is a core component of the 5G core network. It is located between the user access layer (U-plane) and the control layer. Its main function is to provide user panel services, while the control layer is responsible for managing registration, authentication, transaction management and other functions.

[0046] like Figure 1 As shown, the system of this example includes an edge computing application policy module, a user policy module and a user number protection module.

[0047] When the edge computing application policy module accesses the edge computing device, it assigns an initial user privacy protection security level score to the edge computing application based on its purpose, industry, and expected user scale; and during operation, it deducts points from the user privacy protection security level score of each edge computing application based on a rule-based content health detection method.

[0048] The rule-based content health detection method includes the following steps:

[0049] A rule base is pre-set, and the rules in the rule base include one or more of regular expressions, keyword blacklists, and grammatical patterns.

[0050] First, the content submitted by the edge computing application is preprocessed, which includes one or more of word segmentation, removal of stop words, and removal of special symbols;

[0051] Then, features related to the violation are extracted from the preprocessed text, and the features related to the violation include keyword frequency and / or text length;

[0052] Finally, the extracted features are matched with the rules in the preset rule library. If the match is successful, the edge computing application is considered to have violated the rules, and the user's privacy protection security level points are deducted according to the preset deduction rules. For each violation, 1 point is deducted.

[0053] For example, if the main body of an edge computing application is a government unit, it is used for certificate application and belongs to a trusted industry. The user privacy protection security level of the application is 100 points. If the application has two illegal contents, the user privacy protection security level is 100-2=98 points. For another example, if the main body of an edge computing application is a bank, it is used for bill query, etc. Because the financial industry has marketing and other scenarios, the user privacy protection security level of the application is 95 points. According to the content security evaluation monitoring, the application has sent information three times involving business promotion, and the edge computing application strategy submodule automatically deducts 3 points, and the user privacy protection security level is 95-3=92 points.

[0054] The user policy module collects the user's historical complaint records from the communication network operator in real time to analyze their sensitivity to number privacy, and deducts points from the user's privacy sensitivity score based on the number of complaints and consultations on user number protection issues. For example, if the initial user privacy sensitivity score is 100 points, 2 points will be deducted from the user privacy sensitivity score if there is one complaint on user number protection issues, and 1 point will be deducted from the user privacy sensitivity score if there is one consultation on user number protection issues, that is, the user privacy sensitivity score = 100-number of complaints*2-number of consultations*1.

[0055] The user number protection module receives the message sent by the UPF and uses the user privacy protection security level and user privacy sensitivity score to determine the user number sending strategy:

[0056] If the user privacy protection security level score and the user privacy sensitivity score are both greater than the first preset value, such as 90 points, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using a reversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, wherein the reversible encryption algorithm uses one or more of DES, AES, 3DES, RSA, and DSA; and then passed to the corresponding edge computing application, so that the edge computing application obtains the encrypted string and decrypts it to obtain the user information for identity authentication or to carry out application functions related to user information.

[0057] If the user privacy protection security level score and the user privacy sensitivity score are both greater than the second preset value, such as 80 points, and less than or equal to the first preset value of 90 points, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using an irreversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, wherein the irreversible encryption algorithm uses MD5 and / or SHS, and then passed to the edge computing application. In order to facilitate user authentication by the computing application, the encryption key and encryption algorithm of the same edge computing application are the same each time, so that the encrypted string of user information obtained by the same edge computing application each time is the same, and the application can use this encrypted string as the user's identity authentication information. At the same time, due to the use of an irreversible encryption algorithm, the application cannot obtain the user's real number, which can better protect the security of the user number.

[0058] If the user privacy protection security level score and the user privacy sensitivity score are other cases, the message received from the UPF is passed to the edge computing application after removing the user number related fields from the enhanced fields of the HTTP header.

[0059] The above example implements a technical means of hierarchical processing of user numbers based on UPF header enhancement. On the basis of protecting the privacy of user numbers, it also provides user information for edge computing applications for user identity recognition, authentication-free and other convenient and fast application usage experiences.

[0060] Another aspect of the embodiment of the present application provides a method for protecting user information security of edge computing in a 5G network, which is applied between a 5G core network and an edge computing application, and refers to Figure 2 The process shown.

[0061] Specifically, the method for protecting user information security of edge computing in a 5G network of this example includes the following steps:

[0062] Step 1: When accessing edge computing devices, assign an initial user privacy protection security level score to the edge computing application based on its purpose, industry, and expected user scale, and deduct points from the user privacy protection security level score of each edge computing application during operation based on a rule-based content health detection method. The rule-based content health detection method includes the following steps:

[0063] A rule base is pre-set, and the rules in the rule base include one or more of regular expressions, keyword blacklists, and grammatical patterns;

[0064] First, the content submitted by the edge computing application is preprocessed, which includes one or more of word segmentation, removal of stop words, and removal of special symbols;

[0065] Then, features related to the violation are extracted from the preprocessed text, and the features related to the violation include keyword frequency and / or text length;

[0066] Finally, the extracted features are matched with the rules in the preset rule library. If the match is successful, the edge computing application is considered to have violated the rules, and the user's privacy protection security level points are deducted according to the preset deduction rules. For each violation, 1 point is deducted.

[0067] Step 2: Collect historical complaint records of users from communication network operators in real time to analyze their sensitivity to number privacy, and deduct points from the user's privacy sensitivity score based on the number of complaints and consultations on user number protection issues. The initial user privacy sensitivity score is 100 points. If there is one complaint about user number protection issues, 2 points will be deducted from the user privacy sensitivity score. If there is one consultation about user number protection issues, 1 point will be deducted from the user privacy sensitivity score, that is, user privacy sensitivity score = 100-number of complaints*2-number of consultations*1.

[0068] In practical applications, the order of step 1 and step 2 can be adjusted, or they can be executed simultaneously.

[0069] Step 3: Receive the message sent by UPF, and call the user privacy protection security level score and user privacy sensitivity score to determine the user number sending strategy:

[0070] If the user privacy protection security level score and the user privacy sensitivity score are both greater than the first preset value of 90 points, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using a reversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the corresponding edge computing application, so that the edge computing application obtains the encrypted string and decrypts it to obtain the user information for identity authentication or to carry out application functions related to user information;

[0071] If the user privacy protection security level score and the user privacy sensitivity score are both greater than the second preset value of 80 points and less than or equal to the first preset value of 90 points, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using an irreversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the edge computing application;

[0072] If the user privacy protection security level score and the user privacy sensitivity score are other cases, the message received from the UPF is passed to the edge computing application after removing the user number related fields from the enhanced fields of the HTTP header.

[0073] According to another aspect of the embodiments of the present application, an electronic device is provided, comprising: at least one processor and a memory; wherein the memory stores computer execution instructions; the computer execution instructions stored in the memory are executed by the at least one processor, so that the at least one processor executes the edge computing user information security protection method in the 5G network described in the previous embodiments.

[0074] On the other hand, a computer-readable storage medium stores a computer program, which, when executed by a processor, controls a device where the storage medium is located to execute the method for protecting user information security in edge computing in a 5G network as described in the foregoing embodiment.

[0075] The above description is only a preferred embodiment of the present invention, and is not intended to be the only one or to limit the present invention. Those skilled in the art should understand that various changes or equivalent substitutions made to the present invention without departing from the scope of the present invention are within the scope of protection of the present invention.

Claims

1. A 5G network edge computing user information security protection system, characterized in that: Located between the 5G core network and edge computing applications, including: The edge computing application policy module is used to assign an initial user privacy protection security level score to the edge computing application when accessing the edge computing device according to the purpose, industry, and expected user scale of the edge computing application, and deduct the user privacy protection security level score of each edge computing application according to the rule-based content health detection method during operation; The user policy module is used to collect historical complaint records of users from communication network operators in real time to analyze their sensitivity to number privacy. According to the number of complaints and consultations on number protection issues, the user's privacy sensitivity score will be deducted. The user number protection module is used to receive messages from the UPF and call the user privacy protection security level and user privacy sensitivity score to determine the user number sending strategy: If the user privacy protection security level score and the user privacy sensitivity score are both greater than the first preset value, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using a reversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the corresponding edge computing application, so that the edge computing application obtains the encrypted string and decrypts it to obtain the user information for identity authentication or to carry out application functions related to user information; If the user privacy protection security level score and the user privacy sensitivity score are both greater than the second preset value and less than or equal to the first preset value, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using an irreversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the edge computing application, so that the edge computing application obtains the encrypted user information for identity authentication; If the user privacy protection security level score and the user privacy sensitivity score are other cases, the message received from the UPF is passed to the edge computing application after removing the user number related fields from the enhanced fields of the HTTP header.

2. The 5G network edge computing user information security protection system according to claim 1, characterized in that: When the user number is encrypted using an irreversible encryption algorithm, the encryption key and encryption algorithm are the same each time for the same edge computing application.

3. The 5G network edge computing user information security protection system according to claim 1, characterized in that: The reversible encryption algorithm adopts one or more of DES, AES, 3DES, RSA, and DSA.

4. The 5G network edge computing user information security protection system according to claim 1, characterized in that: The irreversible encryption algorithm uses MD5 and / or SHS.

5. The 5G network edge computing user information security protection system according to claim 1, characterized in that: Rules-based content health detection methods include: Preprocess the content submitted by the edge computing application, including one or more of word segmentation, removal of stop words, and removal of special symbols; Extracting features related to the violation from the preprocessed text, the features related to the violation including keyword frequency and / or text length; The extracted features are matched with the rules in the preset rule library. If the match is successful, the edge computing application is considered to have violated the rules, and the user's privacy protection security level points are deducted according to the preset deduction rules; The rules in the preset rule base include one or more of regular expressions, keyword blacklists, and grammatical patterns.

6. The 5G network edge computing user information security protection system according to claim 5, characterized in that: For each violation, 1 point will be deducted; the initial user privacy sensitivity score is 100 points. If there is one complaint about user number protection issues, 2 points will be deducted from the user privacy sensitivity score. If there is one consultation about user number protection issues, 1 point will be deducted from the user privacy sensitivity score. The first preset value is 90 points, and the second preset value is 80 points.

7. A method for protecting user information security of edge computing in a 5G network, characterized in that: Applied between 5G core network and edge computing applications, including the following steps: When accessing edge computing devices, an initial user privacy protection security level score is assigned to the edge computing application based on its purpose, industry, and expected user scale. During operation, the user privacy protection security level score of each edge computing application is deducted based on a rule-based content health detection method. Collect users' historical complaint records with communication network operators in real time to analyze their sensitivity to number privacy, and deduct points from users' privacy sensitivity scores based on the number of complaints and inquiries about number protection issues; Receive the message sent by UPF, and call the user privacy protection security level and user privacy sensitivity score to determine the user number sending strategy: If the user privacy protection security level score and the user privacy sensitivity score are both greater than the first preset value, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using a reversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the corresponding edge computing application, so that the edge computing application obtains the encrypted string and decrypts it to obtain the user information for identity authentication or to carry out application functions related to user information; If the user privacy protection security level score and the user privacy sensitivity score are both greater than the second preset value and less than or equal to the first preset value, the user number is obtained from the enhanced field of the HTTP header in the message received from the UPF, and the user number is encrypted using an irreversible encryption algorithm to replace the user number field in the enhanced field of the HTTP header, and is passed to the edge computing application, so that the edge computing application obtains the encrypted user information for identity authentication; If the user privacy protection security level score and the user privacy sensitivity score are other cases, the message received from the UPF is passed to the edge computing application after removing the user number related fields from the enhanced fields of the HTTP header.

8. The method for protecting user information security of edge computing in a 5G network according to claim 7, characterized in that: Rules-based content health detection methods include: Preprocess the content submitted by the edge computing application, including one or more of word segmentation, removal of stop words, and removal of special symbols; Extracting features related to the violation from the preprocessed text, the features related to the violation including keyword frequency and / or text length; The extracted features are matched with the rules in the preset rule library. If the match is successful, the edge computing application is considered to have violated the rules, and the user's privacy protection security level points are deducted according to the preset deduction rules; The rules in the preset rule base include one or more of regular expressions, keyword blacklists, and grammatical patterns.

9. An electronic device, comprising: At least one processor and a memory; wherein the memory stores computer-executable instructions; characterized in that the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the edge computing user information security protection method in the 5G network as described in claim 7 or 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the device where the storage medium is located is controlled to execute the method for protecting user information security in edge computing in a 5G network as described in claim 7 or 8.

Images