Self-checking method for network flow access integrity
By learning the role and correspondence of network element from signaling traffic information, distinguishing and counting signaling surface and user surface traffic in the LTE core network, the traffic integrity check problem that relies on the working parameter table in the existing technology is solved, and the data is realized Automatic and intelligent traffic integrity judgment improves inspection efficiency.
Patent Information
- Application Number
- CN202411320382.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-20
- Publication Date
- 2024-12-17
AI Technical Summary
In the prior art, the integrity check of network traffic in the LTE core network relies on the work-metric table, which requires manual or tool verification when the core network changes, which is time-consuming and labor-intensive, and it is impossible to automatically determine whether the traffic is complete.
By learning the role and correspondence from the signaling traffic information, distinguishing the signaling surface traffic and user traffic, counting the traffic characteristics, and determining whether the corresponding IP network elements have traffic. If the corresponding network element IP IPs have the corresponding relationship are all If there is or there is no traffic, it is determined that the traffic is complete.
It realizes automatic inspection and intelligent analysis without relying on the work-based parameters table, and automatically determines whether the traffic access is complete, get rid of manual intervention and improves inspection efficiency.
Smart Images
Figure CN119155705A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of LTE mobile network, and in particular relates to a self-checking method for network flow access integrity. Background Art
[0002] In the prior art, the main interfaces of the LTE (Long Term Evolution) core network are S11, S1-U, S58-C, and S58-U, among which S11 and S58-C are control plane interfaces, and S1-U and S58-U are user plane interfaces. The control plane interface transmits gtpv2 signaling traffic, and the user plane interface transmits gtpu user plane traffic. There are many network elements involved in the LTE core network, among which the S11 interface network elements are MME (Mobility Management Entity) and SGW-C; the S1U interface network elements are eNB and SGW-U; the S58-C interface network elements are SGW-C and PGW-C; the S58-U interface network elements are SGW-U and PGW-U, such as Figure 2 As shown, the S1U interface and the S58-U interface are the same user plane traffic. In the existing network, generally only one of them is collected, and the corresponding signaling plane S11 and S58-C interfaces also only collect one of them.
[0003] When DPI (Deeply Packet Insect) processes traffic in the mobile core network, it needs to access user plane traffic and signaling plane traffic. There is a certain correspondence between these two types of traffic. Figure 2 It can be seen that there is the following corresponding relationship:
[0004] There is a corresponding relationship between S11 SGW-C and S1U SGW-U.
[0005] There is a corresponding relationship between S58C PGW-C and S58U PGW-U.
[0006] When the live network is implemented, the operator will provide the corresponding relationship (referred to as: engineering parameter table, including IP, IP network element role, network element corresponding relationship) for DPI to check whether the traffic access is complete. Some DPI manufacturers verify manually, while others verify through tools. Both methods count the traffic accessed to DPI from the IP dimension, and then compare it with the engineering parameter table to check whether the corresponding user plane traffic and signaling plane traffic have been accessed, so as to judge whether the traffic is complete.
[0007] At present, both manual and tool verification rely on the engineering parameter table. The core network often changes, and the addition or discontinuation of certain network elements will involve the addition and deletion of content in the engineering parameter table. Manual verification or tool verification and comparison with the engineering parameter table are required to determine whether the traffic is complete, which is time-consuming and laborious. Summary of the invention
[0008] The purpose of the present invention is to solve the problems in the prior art and to propose a self-checking method for network traffic access integrity, which can determine whether the traffic is complete without relying on engineering parameters.
[0009] In order to achieve the above object, the present invention adopts the following technical scheme.
[0010] Learn the correspondence between the network element role of a single IP and the IP network element role from the collected signaling traffic information;
[0011] Differentiate signaling plane traffic and user plane traffic based on traffic characteristics and perform traffic statistics.
[0012] It is determined based on the traffic statistics whether all the IP network elements with corresponding relationships have traffic. If all the network element IPs with corresponding relationships have traffic or have no traffic, the traffic is determined to be complete.
[0013] Furthermore, the learning of the correspondence between the network element role of a single IP and the IP network element role from the collected signaling traffic information includes: obtaining a single-user signaling traffic information packet, including a request stream and a response stream, obtaining the signaling plane network element role information of the control plane interface in the request stream, and the signaling plane network element role information and user plane network element role information of the control plane interface in the response stream.
[0014] Furthermore, the signaling plane network element roles include S11-SGW network element and S58C-PGW network element; the user plane network element roles include S1U-SGW network element and S58U-PGW network element.
[0015] Furthermore, the corresponding relationship between the roles of IP network elements is learned, that S11-SGW network element corresponds to S1U-SGW network element, and S58C-PGW network element corresponds to S58U-PGW network element.
[0016] Furthermore, the distinguishing signaling plane traffic and user plane traffic by traffic characteristics and performing traffic statistics includes: using port 2123 for signaling plane traffic and port 2152 for user plane traffic.
[0017] Further, the distinguishing signaling plane traffic and user plane traffic by traffic characteristics and performing traffic statistics includes:
[0018] Statistics on signaling plane traffic, including IP address, IP signaling plane network element role, and IP traffic size; statistics on user plane traffic, including IP address, IP user plane network element role, and IP traffic size.
[0019] Furthermore, the distinguishing signaling plane traffic and user plane traffic by traffic characteristics and performing traffic statistics includes: generating a statistical information table according to the statistical signaling plane traffic information and user plane traffic information.
[0020] Furthermore, the determination of whether all IP network elements with corresponding relationships have traffic, if all network element IPs with corresponding relationships have traffic or have no traffic, then determining that the traffic is complete includes:
[0021] If one NE IP has traffic and the other NE IP has no traffic, the traffic is considered incomplete;
[0022] If one NE IP has no traffic and the other NE IP has no traffic, the traffic is considered intact;
[0023] If one network element IP has traffic and the other network element IP has traffic, the traffic is determined to be complete.
[0024] In order to achieve the above-mentioned purpose, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a program running on the processor, and when the processor runs the program, the steps of the self-check method for network traffic access integrity as described above are executed.
[0025] In order to achieve the above object, the present invention also provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the steps of the self-checking method for network traffic access integrity as described above are executed.
[0026] The present invention proposes a self-checking method for network traffic access integrity, which has the following beneficial effects:
[0027] (1) Automatically check the integrity of traffic access without relying on engineering parameters.
[0028] (2) Learn the information elements in the signaling, accumulate the corresponding relationships between network elements, and count the traffic of the network element IPs with corresponding relationships to determine whether the current system traffic access is complete.
[0029] (3) Through intelligent analysis of signaling traffic, the system gets rid of the reliance on engineering parameter tables and can automatically determine whether traffic access is complete without human intervention.
[0030] Other features and advantages of the present invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:
[0032] Figure 1 It is a flow chart of a self-checking method of network traffic access integrity of the present invention;
[0033] Figure 2 A schematic diagram of an LTE core network interface network element as background technology;
[0034] Figure 3 A schematic diagram of a learning s58c-PGW network element of the present invention;
[0035] Figure 4 It is a schematic diagram of the learning result of the s58c-PGW network element of the present invention;
[0036] Figure 5 It is a schematic diagram of the learning s11-SGW network element, S1U-SGW network element, and S58U-PGW network element of the present invention;
[0037] Figure 6 This is a schematic diagram of the learning results of the s11-SGW network element, S1U-SGW network element, and S58U-PGW network element of the present invention. DETAILED DESCRIPTION
[0038] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.
[0039] Example 1
[0040] Figure 1 The flowchart of the self-check method for network traffic access integrity according to the present invention is as follows. Figure 1 , the self-checking method for network traffic access integrity of the present invention is described in detail.
[0041] In step 101, the network element role of a single IP and the correspondence between the signaling plane IP network element role and the user plane IP network element role are learned from the information carried by the signaling traffic.
[0042] As an example, obtain the signaling plane traffic and user plane traffic of a mobile phone number for one Internet access, obtain the single-user signaling traffic information packet from s11, including the request flow and the response flow, obtain the signaling plane IP address of the request control plane interface, and the response flow includes the signaling plane IP address of a control plane interface and two user plane IP addresses.
[0043] Optionally, the signaling plane network element roles include S11-SGW and S58C-PGW; the user plane network element roles include S1U-SGW and S58U-PGW.
[0044] Optionally, learn the correspondence between the signaling plane IP network element roles and the user plane IP network element roles: S11-SGW and S1U-SGW; S58C-PGW and S58U-PGW.
[0045] As an example, Figure 3 As shown, learn the network element role of a single IP, and learn s58c-PGW from CreateSessionReq. Figure 3 The CreateSessionRequest process is initiated by MME-C and sent to SGW-C. In this process, the IP address 220.206.132.148 of the IP network element role of the S58 PGW-C signaling plane is carried. The learning results are as follows: Figure 4 As shown. Figure 5 As shown, from CreateSessionResp, learn s11-SGW, S1U-SGW, S58U-PGW, Figure 5 The CreateSessionResponse process is initiated by SGW-C and sent to MME-C. In this process, the IP network element role of S11 SGW-C signaling plane is ip116.79.240.100; the IP network element role of S1U SGW-U user plane is ip10.100.32.182; and the IP network element role of S58 PGW-U user plane is ip220.206.132.149. The learning results are as follows: Figure 6 As shown in the figure, the signaling plane traffic and user plane traffic of a mobile phone number for one Internet access are obtained from S11, including the request flow and the response flow, and the signaling plane IP address of the request control plane interface is obtained. The response flow includes the signaling plane IP address of a control plane interface and two user plane IP addresses.
[0046] As an example, learn the correspondence between two IP network element roles: a signaling plane network element and a user plane network element, which are assigned to a mobile phone as the network element through which Internet access flows. The two form a correspondence.
[0047] like Figure 6 As shown:
[0048] S11 SGW-C signaling plane IP network element role 116.79.240.100----S1U SGW-U user plane IP network element role 10.100.32.182;
[0049] S58 PGW-C signaling plane IP network element role 220.206.132.148----S58 PGW-U user plane IP network element role 220.206.132.149.
[0050] In step 102, signaling plane traffic and user plane traffic are distinguished by traffic characteristics.
[0051] Optionally, the signaling plane traffic is counted, including the IP, the signaling plane network element role of the IP, and the traffic size of the IP; the user plane traffic is counted, including the IP, the user plane network element role of the IP, and the traffic size of the IP.
[0052] As an example, traffic statistics are shown in Table 1. Signaling plane traffic and user plane traffic are distinguished by traffic characteristics. Signaling plane traffic uses port 2123, and user plane traffic uses port 2152.
[0053] Table 1
[0054] Ip Traffic size (packet) Role Signaling plane traffic 116.79.240.100 16 S11SGW-C User plane traffic 10.100.32.182 28 S1USGW-U Signaling plane traffic 220.206.132.148 0 S58PGW-C User plane traffic 220.206.132.149 0 S58PGW-U
[0055] In step 103, it is determined whether the two corresponding IPs both have traffic. If there is a situation where one of the two network element IPs has traffic and the other does not have no traffic, it is determined that the traffic is complete.
[0056] Optionally, if one network element IP has traffic and the other network element IP has no traffic, the traffic is determined to be incomplete; if one network element IP has no traffic and the other network element IP has no traffic, the traffic is determined to be complete; if one network element IP has traffic and the other network element IP has traffic, the traffic is determined to be complete.
[0057] The present invention proposes a self-check method for network traffic access integrity, which learns the corresponding relationship between network elements by learning the information carried in the signaling, so as to determine whether the current system traffic access is complete.
[0058] Those skilled in the art can understand that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention is described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions recorded in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A self-checking method for network traffic access integrity, characterized in that: include: Learn the correspondence between the network element role of a single IP and the IP network element role from the collected signaling traffic information; Differentiate signaling plane traffic and user plane traffic based on traffic characteristics and perform traffic statistics. It is determined based on the traffic statistics whether all the IP network elements with corresponding relationships have traffic. If all the network element IPs with corresponding relationships have traffic or have no traffic, the traffic is determined to be complete.
2. A method for self-checking network traffic access integrity according to claim 1, characterized in that: The learning of the correspondence between the network element role of a single IP and the IP network element role from the collected signaling traffic information includes: obtaining a single-user signaling traffic information packet, including a request stream and a response stream, obtaining the signaling plane network element role information of the control plane interface in the request stream, and the signaling plane network element role information and user plane network element role information of the control plane interface in the response stream.
3. A method for self-checking network traffic access integrity according to claim 1 or 2, characterized in that: The signaling plane network element roles include S11-SGW network element and S58C-PGW network element; User plane network element roles include S1U-SGW network element and S58U-PGW network element.
4. A method for self-checking network traffic access integrity according to claim 3, characterized in that: The corresponding relationship between the roles of IP network elements is that S11-SGW network elements correspond to S1U-SGW network elements, and S58C-PGW network elements correspond to S58U-PGW network elements.
5. A method for self-checking network traffic access integrity according to claim 1, characterized in that: The method of distinguishing signaling plane traffic and user plane traffic by traffic characteristics and performing traffic statistics includes: using port 2123 for signaling plane traffic and port 2152 for user plane traffic.
6. A method for self-checking network traffic access integrity according to claim 1 or 5, characterized in that: The distinguishing signaling plane traffic and user plane traffic by traffic characteristics and performing traffic statistics includes: Statistics on signaling plane traffic, including IP address, IP signaling plane network element role, and IP traffic size; statistics on user plane traffic, including IP address, IP user plane network element role, and IP traffic size.
7. A method for self-checking network traffic access integrity according to claim 6, characterized in that: The method of distinguishing signaling plane traffic and user plane traffic by traffic characteristics and performing traffic statistics includes: generating a statistical information table according to the statistical signaling plane traffic information and user plane traffic information.
8. A method for self-checking network traffic access integrity according to claim 6, characterized in that: The determination of whether all IP network elements with corresponding relationships have traffic, if all network element IPs with corresponding relationships have traffic or have no traffic, then determining that the traffic is complete includes: If one NE IP has traffic and the other NE IP has no traffic, the traffic is considered incomplete; If one NE IP has no traffic and the other NE IP has no traffic, the traffic is considered intact; If one network element IP has traffic and the other network element IP has traffic, the traffic is determined to be complete.
9. An electronic device, characterized in that: It comprises a memory and a processor, wherein the memory stores a program running on the processor, and the processor executes a self-checking method for network traffic access integrity as described in any one of claims 1-8 when running the program.
10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed, a self-checking method for network traffic access integrity as described in any one of claims 1 to 8 is executed.