Network security policy generation method, network security protection method, device and equipment

Abstract

The invention discloses a network security policy generation method, a network security protection method, devices and equipment, and relates to the technical field of network security, and the network security policy generation method applied to a network data analysis function NWDAF comprises the following steps: receiving a network data report sent by a network monitoring platform; generating a network access policy according to the network data report and network service information of an operator network to which the NWDAF belongs, the network service information including at least one of user subscription information, service policy information and network state information; and sending the network access policy to a policy control function (PCF). According to the embodiment of the invention, the problem that the network service interruption is easily caused by adopting the existing network attack mode under the convergence scene of the industry private network and the public network can be solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security strategy generation method, a network security protection method, a device and equipment. Background Art

[0002] In the field of network security technology, Cyber ​​Resilience refers to the ability of a network to implement more intelligent and flexible security measures when it is attacked, unexpectedly fails, or encounters other adverse situations, maintain the continuity of key services, quickly resume normal operations, and conduct secure data transmission and adapt to environmental changes. The realization of network resilience consists of advanced monitoring systems, dynamic security policies, fast response mechanisms, flexible network architectures, and continuous network optimization.

[0003] At present, the integration of industry-specific networks and public networks means that industrial control systems and critical infrastructure are facing external network attacks. To deal with these network attacks, network segmentation and firewalls are usually used. However, the above-mentioned response methods are relatively simple and crude, which can easily cause network service interruptions. Summary of the invention

[0004] In order to solve the problem that the existing network attack methods are likely to cause network service interruption in the scenario of integration of industry private networks and public networks, the embodiments of the present application provide a network security policy generation method, network security protection method, device and equipment, which can provide a more secure, efficient and reliable network security environment for the integration scenario, and reduce security network risks.

[0005] In a first aspect, an embodiment of the present application provides a network security policy generation method, which is applied to a network data analysis function NWDAF, and the method includes:

[0006] Receive network data reports sent by the network monitoring platform;

[0007] Generate a network access policy according to the network data report and network service information of the operator network to which the NWDAF belongs, wherein the network service information includes at least one of user subscription information, service policy information and network status information;

[0008] The network admission policy is sent to the policy control function PCF.

[0009] Optionally, generating a network admission policy according to the network data report and network service information of the operator network to which the NWDAF belongs includes:

[0010] Inputting the network data report and the network service information into a pre-built model, predicting network security information output by the model, wherein the network security information includes network security events of the network at the prediction time;

[0011] The network access policy is generated based on the network security information.

[0012] In a second aspect, an embodiment of the present application further provides a network security protection method, which is applied to PCF, and the method includes:

[0013] Receive the network access policy sent by NWDAF;

[0014] Based on the network access policy, determine a network operation instruction corresponding to the target object, wherein the network operation instruction carries the network security policy corresponding to the target object;

[0015] Send the corresponding network operation instruction to the target object.

[0016] Optionally, the target object includes at least one of a user equipment, a mobility management function AMF, a session management function SMF, a user plane function UPF and an access network RAN ​​device.

[0017] Optionally, determining the network operation instruction corresponding to the target object based on the network admission policy includes:

[0018] Receive first indication information sent by the AMF; wherein the first indication information is used to indicate whether the user equipment is allowed to access the network, and the first indication information is carried by the network registration request;

[0019] Acquire a first policy suggestion in the network admission policy, where the first policy suggestion is associated with the access result indicated by the first indication information;

[0020] Based on the user subscription information of the user equipment and the first policy recommendation, the network operation instruction corresponding to the target object is determined.

[0021] Optionally, the sending the corresponding network operation instruction to the target object includes at least one of the following:

[0022] Sending a first operation instruction to the AMF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment to access the network, or to allow the user equipment to access the network if a first condition is met;

[0023] The first operation instruction is further used to instruct the AMF to send a second operation instruction to the user equipment, where the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network if the first condition is met;

[0024] The second operation instruction carries at least one of a condition for allowing the user equipment to access the network, a condition for denying the user equipment to access the network, and the first condition.

[0025] Optionally, determining the network operation instruction corresponding to the target object based on the network admission policy includes:

[0026] receiving second indication information sent by the SMF; wherein the second indication information is used to indicate whether to allow a session to be established between the user equipment and the network, and the second indication information is carried by the session establishment request;

[0027] Acquire a second policy suggestion in the network admission policy, where the second policy suggestion is associated with a session establishment result indicated by the second indication information;

[0028] Based on the user subscription information of the user equipment and the second policy recommendation, the network operation instruction corresponding to the target object is determined.

[0029] Optionally, the sending the corresponding network operation instruction to the target object includes at least one of the following:

[0030] Sending a third operation instruction to the SMF, where the third operation instruction carries a first security policy, where the first security policy is a rule instructing the SMF to process the session establishment request;

[0031] A fourth operation instruction is sent to the user equipment, where the fourth operation instruction carries a second security policy, where the second security policy is a rule instructing the user equipment to respond when a service request is received.

[0032] Optionally, determining the network operation instruction corresponding to the target object based on the network admission policy includes:

[0033] Determining a fifth operation instruction corresponding to the target object based on the third policy suggestion in the network access policy;

[0034] The third policy suggestion is used to indicate a session security policy applicable to the access network at the target time, and the fifth operation instruction carries the third security policy applicable to the target object at the target time.

[0035] Optionally, the sending the corresponding network operation instruction to the target object includes:

[0036] Sending a fifth operation instruction to the SMF, wherein the third security policy carried by the fifth operation instruction includes a first session rule, a second session rule, and a third session rule;

[0037] The fifth operation instruction is used to indicate at least one of the following:

[0038] The SMF sends the first session rule to the UPF;

[0039] The SMF sends the second session rule to the RAN;

[0040] The SMF sends the third session rule to the user equipment.

[0041] In a third aspect, an embodiment of the present application provides a network security protection method, which is applied to SMF, and the method includes:

[0042] Receive a network operation instruction sent by the PCF, wherein the network operation instruction carries a network security policy corresponding to the SMF;

[0043] Deploy the network security policy corresponding to the SMF.

[0044] Optionally, the receiving a network operation instruction sent by the PCF includes:

[0045] Receive the session establishment request sent by AMF;

[0046] Sending second indication information to the PCF, where the second indication information carries the session establishment request;

[0047] Receive a third operation instruction sent by the PCF, where the third operation instruction carries a first security policy, and the first security policy is a rule for the SMF to process a session establishment request.

[0048] Optionally, after receiving the third operation instruction sent by the PCF, the method further includes:

[0049] Sending a sixth operation instruction to the AMF;

[0050] The sixth operation instruction carries a fourth security policy, the fourth security policy is carried by the third operation instruction, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

[0051] Optionally, the receiving a network operation instruction sent by the PCF includes:

[0052] receiving a fifth operation instruction sent by the PCF, wherein the fifth operation instruction carries at least a third security policy applicable to the SMF at a target time, wherein the third security policy includes a first session rule, a second session rule, and a third session rule;

[0053] The fifth operation instruction is used to indicate at least one of the following:

[0054] The SMF sends the first session rule to the UPF;

[0055] The SMF sends the second session rule to the RAN;

[0056] The SMF sends the third session rule to the user equipment.

[0057] In a fourth aspect, an embodiment of the present application further provides a network security protection method, which is applied to AMF, and the method includes:

[0058] Receive a network operation instruction sent by the PCF and / or SMF, wherein the network operation instruction carries a network security policy corresponding to the AMF;

[0059] Deploy the network security policy corresponding to the AMF.

[0060] Optionally, the receiving a network operation instruction sent by the PCF includes:

[0061] receiving a first operation instruction sent by the PCF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment from accessing the network, or to allow the user equipment to access the network if a first condition is met;

[0062] Among them, the first operation instruction is also used to instruct the AMF to send a second operation instruction to the user equipment, and the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network when the first condition is met, and the second operation instruction carries at least one of the conditions for allowing the user equipment to access the network, the conditions for refusing the user equipment to access the network, and the first condition.

[0063] Optionally, the receiving a network operation instruction sent by the SMF includes:

[0064] Receiving a sixth operation instruction sent by the SMF;

[0065] The fifth operation instruction carries a fourth security policy, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

[0066] In a fifth aspect, an embodiment of the present application further provides a network security policy generation device, which is applied to NWDAF, and the device includes:

[0067] A first receiving module, used for receiving a network data report sent by a network monitoring platform;

[0068] A policy generation module, configured to generate a network access policy according to the network data report and network service information of the operator network to which the NWDAF belongs, wherein the network service information includes at least one of user contract information, service policy information and network status information;

[0069] The first sending module is used to send the network admission policy to the PCF.

[0070] In a sixth aspect, an embodiment of the present application further provides a network security protection device, applied to PCF, the device comprising:

[0071] The second receiving module is used to receive the network access policy sent by NWDAF;

[0072] A policy determination module, used to determine a network operation instruction corresponding to a target object based on the network access policy, wherein the network operation instruction carries a network security policy corresponding to the target object;

[0073] The second sending module is used to send the corresponding network operation instruction to the target object.

[0074] In a seventh aspect, an embodiment of the present application further provides a network security protection device, applied to SMF, the device comprising:

[0075] A third receiving module is used to receive a network operation instruction sent by the PCF, wherein the network operation instruction carries a network security policy corresponding to the SMF;

[0076] The first deployment module is used to deploy the network security policy corresponding to the SMF.

[0077] In an eighth aspect, an embodiment of the present application further provides a network security protection device, applied to AMF, the device comprising:

[0078] A fourth receiving module is used to receive a network operation instruction sent by the PCF and / or SMF, where the network operation instruction carries a network security policy corresponding to the AMF;

[0079] The second deployment module is used to deploy the network security policy corresponding to the AMF.

[0080] In the ninth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the network security policy generation method as described in any one of the first aspect are implemented; or, when the program or instructions are executed by the processor, the steps of the network security protection method as described in any one of the first aspect, the second aspect or the third aspect are implemented.

[0081] In the tenth aspect, an embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the network security policy generation method as described in any one of the first aspect are implemented; or when the computer program is executed by a processor, the steps in the network security protection method as described in any one of the first aspect, the second aspect or the third aspect are implemented.

[0082] In the eleventh aspect, an embodiment of the present application also provides a computer program product, which is stored in a storage medium, and the computer program product is executed by at least one processor to implement the steps in the network security policy generation method as described in any one of the first aspect; or the computer program product is executed by at least one processor to implement the steps in the network security protection method as described in any one of the first aspect, the second aspect or the third aspect.

[0083] In an embodiment of the present application, through the coordination between the network and the external network monitoring system, the network data information is collected from multiple key nodes in the network in real time through the network monitoring system, and the NWDAF generates a network access policy based on the real-time network data report reported by the network monitoring system and the network service information of the operator network to which it belongs. In this way, in an industrial converged network environment, data from different network nodes can be combined with the operator's internal information to provide a more comprehensive network status view, provide a data basis for generating network security policies, generate more accurate, flexible, and highly adaptable network access policies, and reduce the occurrence of network service interruptions. This network access policy helps to more accurately identify and solve network security problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0085] Figure 1is a schematic diagram of a network security policy generation method applied to NWDAF in an embodiment of the present application;

[0086] Figure 2 yes Figure 1 A structural diagram of a network security management framework used in the embodiment;

[0087] Figure 3 is a schematic diagram of a network security protection method applied to PCF in an embodiment of the present application;

[0088] Figure 4 It is one of the schematic diagrams of a network security protection method in an embodiment of the present application;

[0089] Figure 5 yes Figure 4 The method embodiment corresponds to a schematic diagram of an extended implementation process of 3GPP;

[0090] Figure 6 This is a second schematic diagram of a network security protection method in an embodiment of the present application;

[0091] Figure 7 yes Figure 6 The method embodiment corresponds to a schematic diagram of an extended implementation process of 3GPP;

[0092] Figure 8 This is a third schematic diagram of a network security protection method in an embodiment of the present application;

[0093] Fig. 9 It is a schematic diagram of a network security protection method applied to SMF in an embodiment of the present application;

[0094] Fig.10 It is a schematic diagram of a network security protection method applied to AMF in an embodiment of the present application;

[0095] Fig.11 It is a structural diagram of a network security policy generating device provided in an embodiment of the present application;

[0096] Fig.12 This is one of the structural diagrams of a network security protection device provided in an embodiment of the present application;

[0097] Fig.13 This is a second structural diagram of a network security protection device provided in an embodiment of the present application;

[0098] Fig.14 This is a third structural diagram of a network security protection device provided in an embodiment of the present application;

[0099] Fig.15 It is one of the structural diagrams of an electronic device provided in an embodiment of the present application;

[0100] Fig.16 This is a second structural diagram of an electronic device provided in an embodiment of the present application;

[0101] Fig.17 This is a third structural diagram of an electronic device provided in an embodiment of the present application;

[0102] Fig.18 This is the fourth structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0103] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0104] In order to make the embodiments of the present application clearer, the relevant technical knowledge involved in the embodiments of the present application is first introduced as follows:

[0105] The realization of network resilience requires the following key components: Advanced monitoring system: Deployment of systems that can monitor network activities and user behaviors in real time to detect abnormal patterns and potential threats in a timely manner; Dynamic security policies: Develop security policies that can be dynamically adjusted based on monitoring data to adapt to the changing network environment and security needs; Rapid response mechanism: Establish a rapid response mechanism to take immediate measures once an attack or failure is detected, such as isolating the affected area, switching to a backup system, or rerouting traffic; Flexible network architecture: Design a flexible network architecture that can adapt to different workloads and communication requirements, and ensure the operation of key services even when some network components fail; Continuous network optimization: Based on real-time feedback and historical data analysis, continuously optimize network configuration and security measures to improve the overall performance and anti-attack capabilities of the network; Compliance and standardization: Ensure that all network operations comply with relevant laws, regulations and industry standards to reduce compliance risks. Through the above measures, industrial converged networks can maintain a high degree of resilience and stability in the face of various security challenges, thereby supporting the continuous development and innovation of the manufacturing industry in the industrial era.

[0106] In the relevant technical field, industrial converged network scenarios face the following limitations: security information inside and outside the 5th Generation (5G) communication system often cannot be synchronized in real time, resulting in the monitoring and response mechanism being unable to quickly adapt to dynamic changes in network status; security policy updates are delayed and unable to promptly reflect the latest security threats and business needs; there is a lack of in-depth analysis of user behavior and network traffic, making it difficult to identify complex attack patterns; the implementation of security measures can easily affect network performance, resulting in a decrease in service response speed.

[0107] In this regard, the present application proposes a network security policy generation method, a network security protection method, a device and equipment, which can generate accurate and effective security access policies, effectively improve the network elasticity in industrial converged network scenarios, adapt to changes in network status, and ensure that industrial converged networks can maintain high security and business continuity when facing ever-changing security threats. The following is a detailed description of the embodiments of the present application through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0108] See also Figure 1 , Figure 1 : is a schematic diagram of a network security policy generation method in an embodiment of the present application, which is applied to the network data analysis function NWDAF. The method specifically includes the following steps:

[0109] Step 101: Receive a network data report sent by a network monitoring platform.

[0110] It is worth mentioning that the embodiments of the present application can be applied to industrial converged network scenarios, and through the constructed intelligent and automated network security management framework, real-time security monitoring and dynamic access control of 5G, 6G and external network environments can be achieved. Figure 2 As shown in the figure, the network security management framework includes a network monitoring platform, core network equipment, and industry terminal equipment (such as 5G UE, customer premises equipment (CPE)), etc.) set up at key network nodes.

[0111] Among them, the network monitoring platform can be deployed at key nodes of the industrial converged network, including but not limited to 5G base stations, enterprise routers, data center servers, etc. The network monitoring platform can collect log data, security events and user access information of each key node. Specifically, the network monitoring platform can monitor and record all network traffic passing through its key nodes in real time, and capture security events such as port scans, intrusion attempts, abnormal traffic patterns and other events. At the same time, the network monitoring platform can also collect user access information, including the time of the access request, the source Internet Protocol Address (IP), the target IP, the requested service type, etc.

[0112] The core network equipment may include but is not limited to at least one of the following: core network nodes, core network functions, access and mobility management function (Access and Mobility Management Function, AMF), session management function (Session Management Function, SMF), user plane function (User Plane Function, UPF), policy control function (Policy Control Function, PCF), network data analysis function (Network Data Analytics Function, NWDAF), policy and charging rules function unit (Policy and Charging Rules Function, PCRF), unified data repository (Unified Data Repository, UDR), home subscriber server (Home Subscriber Server, HSS), centralized network configuration (Centralized network configuration, CNC), network storage function (Network Repository Function, NRF), network exposure function (Network Exposure Function, NEF), local NEF (Local NEF, or L-NEF), binding support function (Binding Support Function, BSF), application function (Application Function, AF), etc.

[0113] Furthermore, the network monitoring platform can collect network status information, network security events, etc. of each key node, and format the collected information according to the preset data template to generate a network data report to ensure the consistency and accuracy of the network data information. Among them, the preset data template may include event type, timestamp, source and destination IP, affected network segment, potential security risk level, etc. Subsequently, the formatted data information, i.e., the network data report, can be sent to NWDAF via NEF or a secure channel, and NWDAF can further analyze the network data report and generate a network security strategy.

[0114] Step 102: Generate a network access policy based on the network data report and network service information of the operator network to which the NWDAF belongs, wherein the network service information includes at least one of user subscription information, service policy information and network status information.

[0115] It is worth mentioning that the network service information of the operator network to which NWDAF belongs may include the operator's contract information, service policy information and network status information. The contract information may include the user's service level agreement (Service Level Agreement, SLA), service quality requirements (Quality of Service, QoS), data usage and other service restrictions. The service policy information may include priority policy (priority settings for different users or service types, such as high-priority users are given priority to ensure service quality when the network is congested), traffic management policy (management policy set for different types of traffic (such as video, voice, data, etc.), including traffic shaping and traffic restriction, etc.), access control policy (access rights settings for specific users or devices, which may include blacklist and whitelist mechanisms), billing policy (such as billing methods for different service levels and usage, including billing by traffic, billing by time or package billing, etc.), service elasticity policy (which may be a policy for dynamically adjusting service quality and resource allocation according to network load), etc. The network status information may include the network load of the operator network, network fault information, resource availability, user connection status, service quality monitoring, etc. In addition, the data information based on which the NWDAF generates the network access policy in the embodiment of the present application may also include various types of data, such as social media, weather information, traffic conditions and other related information, to provide a more comprehensive security situation awareness. The present application does not make specific restrictions on this, and it can be set according to actual measurements or according to specific application scenarios.

[0116] In the embodiment of the present application, after receiving the network data report sent by the network monitoring platform, NWDAF can combine the user contract information, business policy information and network status information of the operator network, use machine learning algorithms and security analysis tools, evaluate the security risks of the network and generate corresponding network access policy rules such as user access policy and business access policy. For example, if a large number of abnormal access requests from a certain IP address are detected in the network status information, NWDAF can combine the network data report, user contract information and business policy information to generate a network access policy, which can be used to limit or prohibit access to the IP address.

[0117] The embodiment of the present application collects network data information from multiple key nodes in the network in real time through coordination between 5G or 6G networks and external systems, and NWDAF can generate user and service access policies based on real-time network data reports and network service information of the operator network to which it belongs. In this way, in an industrial converged network environment, data from different network nodes can be combined with the operator's internal information to provide a more comprehensive network status view, provide a data basis for generating network security policies, and generate more accurate, flexible, and highly adaptable network access policies. This network access policy helps to more accurately identify and solve network security problems.

[0118] Step 103: Send the network admission policy to the policy control function PCF.

[0119] In the specific implementation, the generated network access policy can be sent to PCF through a standardized interface, and PCF is responsible for converting the policy into specific network operation instructions and sending them to network functional entities such as UE, CPE, AMF, SMF, etc. Among them, after AMF receives the network operation instructions for network access policy conversion issued by PCF, it can perform user access control, such as allowing or denying the user's connection request according to policy rules when the user tries to connect to the network. After SMF receives the network operation instructions for network access policy conversion issued by PCF, it can perform service access control, such as allowing or denying the establishment of specific service sessions according to policy rules, and allocating necessary network resources for service sessions that comply with the policy. For industry terminal devices, after receiving the network operation instructions for network access policy conversion issued by PCF, local security settings can be adjusted according to the policy, such as turning on or off specific network services, updating firewall rules, etc.

[0120] It is worth mentioning that all network functional entities in the embodiments of the present application, including UE, CPE, AMF, SMF, NWDAF, PCF and each key node in the network monitoring platform, can be in a real-time network monitoring state, and can upload relevant network information in real time or execute in real time according to the received network security policy deployment, so as to make rapid adjustments and responses to changes in the network environment.

[0121] For example, if a security threat is eliminated or the network load changes, PCF can promptly update the network operation instructions based on the network access policy sent by NWDAF, and send the network operation instructions to each entity to adapt to the changing network environment, improve the security and adaptability of the network, and ensure the continuity and reliability of key services.

[0122] Optionally, generating a network admission policy according to the network data report and network service information of the operator network to which the NWDAF belongs includes:

[0123] Inputting the network data report and the network service information into a pre-built model, predicting network security information output by the model, wherein the network security information includes network security events of the network at the prediction time;

[0124] The network access policy is generated based on the network security information.

[0125] In some embodiments of the present application, the process of NWDAF generating a network access policy may include data collection, internal state information integration, model analysis, and model strategy generation. Specifically, data collection may refer to NWDAF receiving network security data collected by a network monitoring platform or server, and these network security data may include real-time collected and historically stored data. Specifically, it may include abnormal traffic patterns, unauthorized access attempts, virus infection rates, etc. Internal state information integration may refer to NWDAF integrating internal network status and business information collected from other network functions (such as NF) of the cellular network. The collected information may specifically be network load, user density, service quality requirements, etc. Model analysis may be NWDAF inputting network data reports and network business information into a pre-built model. This model can analyze the input data to evaluate the current network security status and predict possible security incidents in the future, and predict the network security information output by the model.

[0126] Furthermore, NWDAF can generate corresponding network access policies based on the network security information output by the model analysis. The network access policies may include policies related to the UE registration process, session establishment process, and session transmission process. The network access policies may specifically indicate the processing and interaction methods of each process for each related network element. For example, in the UE registration process, the network access policy may include allowing the UE to access the network, denying the UE to access the network, or allowing the UE to retry to access the network after meeting certain conditions.

[0127] In some other embodiments, the process of NWDAF generating network access policies may include data collection and analysis, session security assessment, and policy generation. The data collection process includes NWDAF obtaining real-time and historical network security data from the network monitoring platform, including abnormal traffic patterns, unauthorized access attempts, virus infection rates, etc. Subsequently, the session is security assessed, and NWDAF can evaluate the security status of each session, including the session's network exposure, potential security threats, and the session's use of network resources. Finally, NWDAF uses AI and machine learning algorithms to generate session-granular access control policies based on the collected data and security assessment results.

[0128] It should be noted that the above-mentioned pre-built model can be an artificial intelligence (AI) model, which can be collected through a large amount of data, including network data reports (real-time network traffic, user behavior, connection requests, etc.), network business information (network operator's service quality indicators, user needs, etc.), historical security event data (network security events that occurred in the past, attack patterns, vulnerability information, etc.). And extract key features from the data, including traffic patterns (normal traffic and abnormal traffic), user behavior characteristics (login time, access frequency, etc.), network status indicators (bandwidth utilization, latency, etc.). Subsequently, model selection can be performed, for example, as a deep learning model (such as Convolutional Neural Network (CNN) and Recurrent Neural Network (RNN), suitable for processing complex time series data). Finally, model training can be performed to ensure that the model can identify normal and abnormal network behaviors and predict potential security incidents.

[0129] In addition, the above-mentioned network access policy generation can also adopt an adaptive learning algorithm, so that the NWDAF can automatically adjust its monitoring and response strategies according to new security threats and network conditions.

[0130] It is understandable that the core function of the model is to predict network security events that may occur at a certain point in the future based on the input network data and business information, which may include distributed denial of service (DDoS) attacks, malware propagation, data leakage, etc. The model can assess the risk level of the current network status and help operators understand potential security threats so that NWDAF can further generate network access policies based on them and improve the rationality and security of the generated policies.

[0131] See also Figure 3 , Figure 3 Schematic diagram of a network security protection method applied to PCF in an embodiment of the present application, which specifically includes the following steps:

[0132] Step 201: Receive the network admission policy sent by NWDAF.

[0133] It should be noted that the specific method for generating the network access policy sent by the above-mentioned NWDAF can refer to the relevant description in the embodiment shown in the aforementioned network security policy generation method executed by NWDAF. To avoid repeated description, this embodiment will not be repeated.

[0134] It is worth mentioning that the above steps are the premise for deploying corresponding network security policies for each target object in network security protection. The network monitoring platform or server can send network data reports to NWDAF, and NWDAF generates network access policies based on network data reports and network service information of the operator to which it belongs. Among them, the network monitoring platform / server can send information to NWDAF directly or through NEF, and this application does not make specific restrictions on this.

[0135] Step 202: Based on the network access policy, determine a network operation instruction corresponding to the target object, where the network operation instruction carries the network security policy corresponding to the target object.

[0136] It is worth mentioning that the above-mentioned target objects can be multiple network elements in the core network, such as AMF, SMF, RAN and other network functional entities, or various devices in the industrial converged network, including UE, CPE, industrial terminal equipment, etc.

[0137] In the embodiment of the present application, since the network access policy is generated based on the network data report reported by the network monitoring platform and the network service information of the operator, NWDAF can evaluate based on the network status of the current network, the network capabilities of the user, etc., and the network access policy it generates can display the evaluation results.

[0138] For example, if the network security monitoring information in the network data report shows that the current network status is normal, and the UE capability information in the network service information shows that the UE is capable of accessing the network, then the network access policy generated by NWDAF may include a policy or recommendation for allowing all UEs with basic network resilience to register and access. For another example, if the network data report includes information such as abnormal traffic or signs of attack detected, the network access policy generated by NWDAF may restrict or reject registration requests from certain UEs, specifically UEs that have not indicated support for advanced security protocols or emergency access capabilities. Based on this, the network operation instructions corresponding to the target object determined by PCF may include operation instructions for entities such as AMF, UE, and CPE, which are used to indicate whether to allow UE or other industrial equipment to access, reject, or allow access to the network again under certain conditions.

[0139] In some other embodiments, the network admission policy generated by the session establishment process may include the following contents:

[0140] 1) Dynamic access control: Dynamically adjust session access rights based on the current network security status and session QoS requirements. For example, when the network is under attack or congestion, the data transmission rate of certain sessions may be temporarily limited or the establishment of non-critical sessions may be delayed.

[0141] 2) Conditional triggers: Set specific conditions, such as when the network load drops below a safety threshold, to allow previously restricted sessions to be established.

[0142] 3) Retry strategy: If the session establishment request is rejected, NWDAF provides a retry strategy, including the retry time interval, number of times, and conditions.

[0143] 4) Security protocols and encryption mechanisms: Recommend appropriate security protocols and encryption mechanisms for the session to protect the security of session data transmission.

[0144] 5) Emergency service priority: For emergency services or mission-critical sessions, NWDAF may generate a network admission policy that prioritizes session establishment, even when network resources are limited.

[0145] With respect to the contents included in the network access policy in the above embodiment, the PCF may generate network operation instructions corresponding to each network element, network operation instructions corresponding to each terminal, etc. Specifically, the network operation instructions corresponding to the target object determined by the PCF may include operation instructions for entities such as AMF, SMF, UPF, UE, CPE, etc. For example, the operation instructions for UPF in the network operation instructions may include data traffic encryption instructions (used to indicate the use of specific encryption algorithms and encryption strengths, such as AES-256, to protect user data traffic of the N3 interface), session isolation instructions (used to indicate the implementation of session isolation measures to ensure that traffic from different users or services is isolated from each other on the user plane), data packet filtering instructions (used to indicate the implementation of a defined number of data packet filtering rules, based on IP addresses, port numbers or other network parameters, to allow or block specific data packets), etc. This application does not list them one by one here, and the operation instructions corresponding to each target object can be determined according to the contents of the network access policy generated by the aforementioned session establishment process.

[0146] Step 203: Send the corresponding network operation instruction to the target object.

[0147] Therefore, in the embodiment of the present application, the PCF issues corresponding network operation instructions to each network function entity, such as 5G UE, 5G CPE, AMF and SMF, during the UE registration process, the UE-initiated session establishment process, the session transmission process or other processes to execute user and service access control policies. This can improve the utilization efficiency of network resources and the reliability of network services while ensuring network security, and meet the requirements of industrial converged network scenarios for high elasticity and high security.

[0148] Optionally, the target object includes at least one of a user equipment, a mobility management function AMF, a session management function SMF, a user plane function UPF and an access network RAN ​​device.

[0149] In some specific embodiments, different target objects are involved in different network processes, and different target objects in these different processes can also deploy different network security policies. For example, in the process of UE initiating a session, the target objects may include UE, CPE, AMF, etc. Among them, AMF can directly receive network operation instructions from PCF, and the network operation instructions may carry multiple network security policies, including network security policies that can be deployed by itself, and network security policies deployed by UE or CPE. In this way, AMF can directly deploy the network security policies corresponding to it carried in the network operation instructions, and also initiate operation instructions to terminal devices such as UE and CPE, and the operation instructions may carry the network security policies corresponding to the terminal devices such as UE and CPE (that is, the registration of terminal devices such as UE and CPE, including the access permission policies enabled by terminal devices such as UE and CPE, etc.). In addition, the network security policies received by terminal devices such as UE and CPE can also be forwarded and received by RAN, and AMF sends the network security policies corresponding to the terminal devices such as UE and CPE to RAN, and then RAN sends them to the corresponding terminal devices such as UE and CPE. This application does not limit this.

[0150] In some other specific embodiments, during the session establishment process initiated by the UE, the target objects may include UE, CPE, AMF, SMF, etc. Among them, the PCF may directly send a network operation instruction to the SMF, and the network operation instruction may carry a session establishment policy applied to the SMF, and may also include respective network security policies for the UE, CPE, AMF, etc. Subsequently, the SMF may send it to the AMF, and then the AMF may send the corresponding network security policy (i.e., the session permission policy applied to the terminal device) to the terminal devices such as the UE and CPE. Based on this, the PCF can provide customized services and resource allocation for each terminal device or network element according to different usage scenarios and application requirements, thereby optimizing the user experience and improving the utilization efficiency of network resources.

[0151] Optionally, determining the network operation instruction corresponding to the target object based on the network admission policy includes:

[0152] Receive first indication information sent by the AMF; wherein the first indication information is used to indicate whether the user equipment is allowed to access the network, and the first indication information is carried by the network registration request;

[0153] Acquire a first policy suggestion in the network admission policy, where the first policy suggestion is associated with the access result indicated by the first indication information;

[0154] Based on the user subscription information of the user equipment and the first policy recommendation, the network operation instruction corresponding to the target object is determined.

[0155] For some examples, please refer to Figure 4 , Figure 4 This is one of the schematic diagrams of a network security protection method in an embodiment of the present application, which specifically includes the following steps:

[0156] S301, an industry device in an industrial converged network sends a service request message to a user device;

[0157] In the above steps, the industry equipment can send a service request message to the gateway device and the user equipment (such as 5G UE or 5G CPE). The sending of the service request message can be a prerequisite for triggering the user equipment to send a registration request to the RAN. After the user equipment receives the service request message, the UE registration request can be triggered, and the user equipment requests registration with the core network.

[0158] S302: After receiving the service request message, the user equipment triggers a network registration request and sends a network registration request to the RAN;

[0159] S303: RAN sends a network registration request to AMF.

[0160] S304. The AMF sends first indication information to the PCF, where the first indication information is used to indicate whether to allow the user equipment to access the network;

[0161] In some specific embodiments, the user equipment may initiate a network registration request to the AMF in the core network through the RAN, and the network registration request may carry first indication information, which may be an indication information of supporting network elasticity. Subsequently, the AMF determines with the PCF whether to allow the UE to access based on the network elasticity indication information (i.e., the first indication information) carried in the network registration request message. Figure 5 As shown in steps 1 and 3, this step involves the changes in the existing 3GPP UE registration process involving the registration request (Registration Request) initiated by the UE to the RAN, and the Registration Request sent by the RAN to the AMF. It can also support the network resilience capability indication in the industrial converged network. The AMF needs to use the network resilience capability information provided by the UE to evaluate its adaptability to network changes, and initiate an access control query to the PCF accordingly.

[0162] Specifically, the first indication information may be a mechanism for the UE to indicate to the network that it supports specific network resilience measures. The indication information of the network resilience capability includes a dynamic access control strategy that may be adopted when the network faces security threats or abnormal situations. The setting of the indication information of the network resilience capability may be achieved by adding new parameters or using new information elements in the UE capability information. For example, the first indication information may include one or more of the following:

[0163] 1) Access control capability: The access control measures supported by the UE in the event of network anomalies. For example, when the network detects abnormal traffic, can the UE accept restricted network services?

[0164] 2) Retry strategy: After the UE receives a response from the network rejecting access, it supports the retry strategy, including the retry time interval and the number of retries.

[0165] 3) Conditional triggers: The UE is able to identify and respond to conditional triggers specified by the network, which may instruct the UE to try to access the network again under certain conditions.

[0166] 4) Security protocol support: The security protocols and encryption mechanisms supported by the UE can protect the security of UE and network communications when the network is attacked.

[0167] 5) Network status perception: Whether the UE can perceive changes in network status, such as congestion, attack or other anomalies, and adjust its network requests accordingly.

[0168] 6) Emergency service access: The ability of UE to access emergency services in emergency situations, such as disaster response or when critical services are needed.

[0169] The above information can dynamically instruct the PCF to decide whether to allow UE access and under what conditions to allow access to the user equipment based on the capabilities of the UE and the current state of the network, on the basis of allowing real-time security monitoring of the network. Therefore, the first indication information, on the basis of the relevant information including the UE registration request, is extended to include information on network resilience capabilities, so that the PCF can respond based on the real-time security status information in the first indication information, and can also perform more refined security management based on the network resilience capabilities of the UE, thereby improving the overall resilience and security of the network.

[0170] S305. The NWDAF sends a first policy suggestion to the PCF, where the first policy suggestion is associated with the access result indicated by the first indication information;

[0171] It should be noted that PCF can interact with NWDAF to obtain the first policy recommendation, and the network access policy generated by NWDAF may include the first policy recommendation. In the industrial converged network scenario, the UE initiates a registration request to the network, and the first policy recommendation sent by NWDAF can be used as part of the network operation instruction corresponding to the target object determined by the PCF decision. It can be understood that the first policy recommendation is associated with the access result indicated by the first indication information. For example, if the first indication information indicates that the UE can access the network, the first policy recommendation given can be generated based on real-time data or historical data related to the UE accessing the network obtained from the network monitoring platform or server. The first policy recommendation can also be generated in combination with other relevant information related to the UE accessing the network, such as the internal network status and service information of the 5G cellular network.

[0172] In this way, the first policy recommendation generated can be based on the latest network data information and can best meet the needs of UE access network registration in the current industrial integration scenario. It can provide more accurate and comprehensive network security policies for target objects such as UE and AMF, and can meet the specific security needs of different target objects in different business scenarios. It ensures that key businesses can continue to operate in the face of security threats or network anomalies, thereby ensuring the high availability of the network.

[0173] In addition, please continue to see Figure 5 In steps 16 and 17, compared with the method in the related art where PCF independently decides on network security policies, the above steps introduce the first policy recommendation in the network access policy provided by NWDAF to PCF, so that PCF can make decisions based on more comprehensive network security status information. At the same time, the first policy recommendation provided by NWDAF is generated based on real-time and historical network security monitoring status information data, which enables policy recommendations to be dynamically generated based on the latest network conditions.

[0174] S306. Determine the network operation instruction corresponding to the target object based on the user subscription information of the user equipment and the first policy recommendation, where the target object includes the AMF and the user equipment;

[0175] In some optional embodiments, PCF can determine the current network operation instructions for each target object based on the first policy recommendation obtained from NWDAF and the user contract information of the user device. Each network operation instruction may include a network security policy corresponding to the target object. This network security policy can be deployed by the corresponding target object to improve the network security protection effect and ensure the normal operation of network services.

[0176] Specifically, the first policy suggestion received by the PCF may be a UE access policy suggestion generated based on information such as the real-time network security monitoring status. The first policy suggestion may be generated using AI technology, which can reflect the current network health, potential security threats, and the availability of network resources. In addition, the PCF may combine the first policy suggestion provided by the NWDAF with the UE contract information maintained internally by the operator, and comprehensively evaluate the network status information provided by the NWDAF and the UE contract information to determine the most appropriate access policy. The network operation instructions corresponding to the target object are determined based on these access policies, and the network operation instructions may include adjustments to data rates, delays, connection stability, and security measures. In addition, the contract information may include the user's service level agreement (SLA), quality of service requirements (QoS), data usage, and other service restrictions. It is worth mentioning that the PCF can use its decision engine to dynamically formulate network operation instructions corresponding to the target object, which can take into account the operating status and security requirements of the entire network while meeting the UE service requirements.

[0177] S307. PCF sends a first operation instruction to AMF.

[0178] S308. The AMF sends a second operation instruction to the user equipment.

[0179] Subsequently, after the PCF determines the network operation instructions corresponding to the target object, it can send these network operation instructions to the corresponding target object, for example, sending a first operation instruction to the AMF, which executes and provides the UE with corresponding network access rights. At the same time, the first operation instruction sent by the PCF to the AMF can also instruct the AMF to send a second operation instruction to the user equipment. The AMF can monitor the network status and UE behavior to ensure the continuous adaptability of the strategy. Figure 5 As shown in step 21, the present application corresponds to the access policy enabled by the UE in the registration reply step.

[0180] In a specific implementation, the first operation instruction sent by the PCF to the AMF may carry a UE access permission policy, which may be used to instruct the AMF to allow the UE to register for network access, to deny the UE from registering for network access, or to allow the UE to try to apply for network access again when a certain condition is met.

[0181] In addition, AMF can also send a second operation instruction to devices such as 5G gateways (5G UE / CPE). The second operation instruction can be a UE registration response. The UE registration response may include the UE-enabled access permission policy sent by the PCF to the UE, including conditions for allowing the UE to register for access to the network, conditions for refusing the UE to register for access to the network, or allowing the UE to try to apply for access to the network again under certain conditions.

[0182] S309: Based on the second operation instruction, the user equipment sends a service response request to the industry equipment.

[0183] In addition, if the registration of the 5G gateway (5G UE / CPE) is triggered by step S301, the 5G gateway (5G UE / CPE) etc. can send a service request response to the industry terminal.

[0184] Optionally, the sending the corresponding network operation instruction to the target object includes:

[0185] Sending a first operation instruction to the AMF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment to access the network, or to allow the user equipment to access the network if a first condition is met;

[0186] The first operation instruction is further used to instruct the AMF to send a second operation instruction to the user equipment, where the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network if the first condition is met;

[0187] The second operation instruction carries at least one of a condition for allowing the user equipment to access the network, a condition for denying the user equipment to access the network, and the first condition.

[0188] It is understandable that the specific implementation of this embodiment can refer to the aforementioned Figure 4 To avoid repeated description, the relevant descriptions in the embodiment shown in the method are not repeated in this embodiment.

[0189] Optionally, determining the network operation instruction corresponding to the target object based on the network admission policy includes:

[0190] receiving second indication information sent by the SMF; wherein the second indication information is used to indicate whether to allow a session to be established between the user equipment and the network, and the second indication information is carried by the session establishment request;

[0191] Acquire a second policy suggestion in the network admission policy, where the second policy suggestion is associated with a session establishment result indicated by the second indication information;

[0192] Based on the user subscription information of the user equipment and the second policy recommendation, the network operation instruction corresponding to the target object is determined.

[0193] In some other embodiments, please refer to Figure 6 , Figure 6 This is a second schematic diagram of a network security protection method in an embodiment of the present application, which specifically includes the following steps:

[0194] S401, the industry device sends a service request message to the user device;

[0195] In the above steps, the industry device can send a service request message to the gateway device and the user device (such as 5G UE or 5G CPE). The sending of the service request message can be a prerequisite for triggering the user device to send a session establishment request to the core network. After the user device receives the service request message from the gateway device, a session establishment request can be triggered. At this time, the user device requests the core network to establish a session.

[0196] S402: The user equipment sends a session establishment request to the AMF;

[0197] It should be noted that when the UE sends a session establishment request to the AMF, in addition to the traditional connection information, it can also carry network resilience capability indication information, which can include the adaptability and resilience of the UE and / or session process to network changes. Figure 7 As shown in steps 1 and 3, the embodiment of the present application sets a network resilience indication in the 3GPP process, wherein the network resilience indication information includes at least one of UE-granularity network resilience indication information and session-granularity network resilience indication information.

[0198] When the established session supports network resilience, a mechanism can be provided to the network to indicate that the session can adapt to the dynamic access control policies adopted by the network when facing security threats or abnormal situations, as well as the security protocols and encryption mechanisms that the session can adopt. The following are some examples of capabilities involved in sessions that support network resilience:

[0199] 1) Access control capability: The session can adapt to the access restriction measures implemented by the network when abnormal security events or abnormal traffic are detected. The session can respond to the network's dynamic access control policies, such as temporarily not starting the session or limiting the data transmission rate or suspending non-critical services during a specific time period.

[0200] 2) Retry strategy: If the session establishment request is rejected by the network, the session can be retried according to a predefined retry strategy, including setting a reasonable retry interval and number of retries.

[0201] 3) Conditional triggers: The session can recognize conditional triggers specified by the network, such as signals that the network load is reduced or a security threat has been removed, and retry access under these conditions.

[0202] 4) Security protocol support: Sessions support the latest security protocols and encryption mechanisms to protect data transmission from network attacks, such as end-to-end encryption.

[0203] 5) Emergency service access: In emergency situations, such as disaster response or critical service needs, sessions can have priority access to the network and may receive higher quality of service guarantees.

[0204] 6) Data protection and recovery: Sessions can take data protection measures, such as data backup and recovery point settings, to ensure data integrity and recoverability when facing security threats.

[0205] Through the above capabilities, the established session can not only improve its survivability in network anomalies, but also work with the network to achieve more efficient resource utilization and stronger security protection. Therefore, through the setting of network resilience measures in the embodiments of the present application, the close collaboration between the network and the UE can be strengthened to achieve real-time monitoring and analysis of the network status.

[0206] S403: Based on the session establishment request, AMF and SMF establish a session context;

[0207] In a specific implementation, when processing the UE's session establishment request, the AMF may pass the UE's network resilience capability indication information as a key parameter to the SMF. Figure 7 As shown in steps 8 and 9, compared with the related art in which AMF passes indication information related to the session establishment request to SMF, AMF in the embodiment of the present application will also pass additional network resilience capability information to SMF so that SMF can consider this information during the session establishment process.

[0208] S404, receiving second indication information sent by the SMF; wherein the second indication information is used to indicate whether to allow a session to be established between the user equipment and the network, and the second indication information is carried by the session establishment request;

[0209] Specifically, SMF can establish a session context with AMF based on the network resilience capability indication in the session establishment request. In addition, SMF can send a second indication message to PCF, and consult PCF through the second indication message whether to allow the session to be established. Compared with the related art, in the embodiment of the present application, SMF can determine the consultation strategy for session establishment based on the network resilience capability, and PCF decides whether to establish the session.

[0210] S405: The PCF obtains a second policy suggestion from the NWDAF, where the second policy suggestion is associated with a session establishment result indicated by the second indication information;

[0211] It is understandable that PCF and NWDAF can interact, and PCF requests NWDAF to obtain the policy recommendations for establishing a session in a network resilience scenario. The second policy recommendation can be used as one of the information for PCF to decide whether to allow the establishment of a session, so the second policy recommendation can indicate the result of the session establishment. Before determining the session establishment policy, PCF can interact with NWDAF to obtain the second policy recommendation based on the network security monitoring status.

[0212] It is worth mentioning that the second strategy recommendation process generated by NWDAF includes:

[0213] 1) Obtain real-time and historical network security data from the network monitoring platform, including abnormal traffic patterns, unauthorized access attempts, virus infection rates, etc.

[0214] 2) For each session, NWDAF evaluates its security status, including the session's network exposure, potential security threats, and the session's use of network resources.

[0215] 3) NWDAF uses AI and machine learning algorithms to generate session-level access control policies based on collected data and security assessment results.

[0216] 4) NWDAF can continuously monitor session and network status and use feedback loops to optimize policies to adapt to dynamic changes in the network environment.

[0217] 5) NWDAF may send the generated second policy suggestion including the session granularity access control policy to PCF for PCF to make a decision during the session establishment process.

[0218] In addition, the access control policy generated by the NWDAF may specifically include:

[0219] 1) Dynamic access control: Dynamically adjust session access rights based on the current network security status and session QoS requirements. For example, when the network is under attack or congestion, the data transmission rate of certain sessions may be temporarily limited or the establishment of non-critical sessions may be delayed.

[0220] 2) Conditional triggers: Set specific conditions, such as when the network load drops below a safety threshold, to allow previously restricted sessions to be established.

[0221] 3) Retry strategy: If the session establishment request is rejected, NWDAF provides a retry strategy, including the retry time interval, number of times, and conditions.

[0222] 4) Security protocols and encryption mechanisms: Recommend appropriate security protocols and encryption mechanisms for the session to protect the security of session data transmission.

[0223] 5) Emergency service priority: For emergency services or mission-critical sessions, NWDAF may recommend priority establishment, even when network resources are limited.

[0224] S406. The PCF determines the network operation instruction corresponding to the target object based on the user subscription information of the user equipment and the second policy recommendation, where the target object includes the AMF and the user equipment;

[0225] In a specific embodiment of the present application, the PCF can determine the session establishment policy corresponding to each target object of the current session based on the second policy recommendation and other policy information of the session, and determine the network operation instructions corresponding to each target object based on the session establishment policy. Among them, the PCF can combine the second policy recommendation of the NWDAF and the contract information related to the UE, session, etc., as well as other session-related policy information to determine the final policy for session establishment.

[0226] It is worth mentioning that compared with the way PCF formulates session policies in related technologies, this step, in addition to considering existing information, also combines the second policy recommendations related to network resilience scenarios provided by NWDAF, further improving the adaptability and security of the network.

[0227] S407, the PCF sends a third operation instruction to the SMF, where the third operation instruction carries a first security policy, where the first security policy is a rule instructing the SMF to process a session establishment request;

[0228] It should be noted that the PCF can send the formulated corresponding session establishment strategy to the SMF through a third operation instruction, and the third operation instruction may include policies and operation instructions for the UE and / or SMF. It can be seen that the third operation instruction sent by the PCF in the embodiment of the present application includes a customized session strategy based on network elasticity, which is received and executed by the SMF, AMF and user equipment.

[0229] Specifically, the session permission policy sent by PCF to SMF is carried by a set of instructions (i.e., the third operation instruction), which can be used to control how SMF handles session establishment requests. The first security policy in the third operation instruction can be based on PCF's comprehensive assessment of the network status, including response measures under specific security events. For example, PCF may instruct SMF to reject the establishment of certain non-critical sessions when the network load is high, or enable a higher level of encryption for the affected sessions when a specific security threat is detected. SMF performs corresponding operations based on these policies, such as adjusting session parameters or rejecting session establishment.

[0230] S408. SMF sends a fourth operation instruction to AMF;

[0231] In addition, the third operation instruction may also include an instruction to send a fourth operation instruction to the user equipment, and the fourth operation instruction may include a strategy of how the PCF responds to the user equipment for a session. Thus, the SMF may send the fourth operation instruction to the AMF, and the AMF may forward the fourth operation instruction to the user equipment.

[0232] S409. The AMF sends a fourth operation instruction to the user equipment, where the fourth operation instruction carries a second security policy, where the second security policy is a rule for instructing the user equipment to respond when a service request is received.

[0233] In the above steps, the fourth operation instruction sent by the PCF to the UE may carry the second security policy corresponding to the user equipment, which may be a set of rules that guide the UE on how to respond when receiving a service request, which may include whether to allow session establishment, retry strategies when the network status is poor, and specific security measures taken when facing security threats. For example, if the network detects abnormal traffic, the second security policy may instruct the UE to temporarily delay the establishment of a session for non-critical services, or in an emergency, give priority to access to critical services even if network resources are tight.

[0234] It is worth mentioning that Figure 7 As shown in steps 11, 12 and 13, in the embodiment of the present application, relative to the session policy deployment method in the related art, the PCF can send the second security policy to the AMF, which is then forwarded to the RAN by the AMF and then sent to the user equipment.

[0235] For another example, the second security policy of UE is shown in Table 1 below. The session filter template is defined according to specific network attributes (such as DNN), application information, and session type, and is used to match and filter session requests from industry terminals to 5G gateways (including 5G UE or 5G CPE, etc.). The corresponding specific policy examples are generated based on the session filter template. In this way, the policies in Table 1 illustrate which session requests are allowed under given network conditions, as well as the specific network quality of service (QoS) requirements for these sessions.

[0236] Table 1

[0237]

[0238] S410: Based on the fourth operation instruction, send a service response request to the industry device.

[0239] Therefore, through the second security policy in the fourth operation instruction, the network can provide customized services and resource allocation for different usage scenarios and application requirements, thereby optimizing user experience and improving the utilization efficiency of network resources.

[0240] Optionally, the sending the corresponding network operation instruction to the target object includes at least one of the following:

[0241] Sending a third operation instruction to the SMF, where the third operation instruction carries a first security policy, where the first security policy is a rule instructing the SMF to process the session establishment request;

[0242] A fourth operation instruction is sent to the user equipment, where the fourth operation instruction carries a second security policy, where the second security policy is a rule instructing the user equipment to respond when a service request is received.

[0243] It is understandable that the specific implementation of this embodiment can refer to the aforementioned Figure 6 To avoid repeated description, the relevant descriptions in the embodiment shown in the method are not repeated in this embodiment.

[0244] Optionally, determining the network operation instruction corresponding to the target object based on the network admission policy includes:

[0245] Determining a fifth operation instruction corresponding to the target object based on the third policy suggestion in the network access policy;

[0246] The third policy suggestion is used to indicate a session security policy applicable to the access network at the target time, and the fifth operation instruction carries the third security policy applicable to the target object at the target time.

[0247] For some examples, please refer to Figure 8 , Figure 8 This is a third schematic diagram of a network security protection method in an embodiment of the present application, which specifically includes the following steps:

[0248] S501, NWDAF sends a third policy suggestion to PCF, where the third policy suggestion includes a real-time session strategy of a target object in a network elasticity scenario;

[0249] It is worth mentioning that the third policy recommendation sent by NWDAF to PCF can be a real-time session security policy, which can be generated by NWDAF based on a report summarizing the network security status data reported in real time by the network monitoring platform. The network security status data may include traffic anomalies, unauthorized access attempts, etc.

[0250] Specifically, the third strategy suggestion may include the following:

[0251] 1) Access control: Execute the allow / deny policy for session requests from a specific destination IP address range to ensure that only sessions with trusted destination addresses can continue to conduct business.

[0252] 2) Encryption requirements: Implement key management strategies to enable encryption algorithm updates and key updates during business transmission.

[0253] 3) Traffic monitoring: Implement a real-time traffic monitoring system to detect and respond to abnormal traffic patterns, such as sudden increases in traffic or atypical communication patterns. For example, set traffic thresholds to automatically trigger security alerts and response measures when the threshold is exceeded.

[0254] 4) Abnormal behavior detection: Use behavioral analysis technology to identify and block potential malicious behavior, such as automated DDoS attacks or data leakage attempts.

[0255] 5) Implement Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) to monitor and defend against network attacks.

[0256] 6) Emergency Response: Develop and implement emergency response plans to take prompt action when serious security incidents are detected. When a security incident occurs, the session transmission path can be quickly switched or the affected services can be isolated to reduce damage.

[0257] 7) User authentication: In a specific security monitoring environment, the UE may be required to perform strong authentication during the session, using multi-factor authentication methods such as one-time password (OTP) or biometrics. This ensures that only authenticated authorized users can access sensitive or critical services.

[0258] Through the above policy content, NWDAF can provide necessary security protection for sessions in the network, ensuring session security and service quality even in the face of ever-changing network environments and security threats.

[0259] S502. The PCF determines the network operation instruction corresponding to the target object based on the third policy recommendation, where the target object includes the SMF, UPF, RAN and user equipment;

[0260] It should be noted that PCF can integrate NWDAF's third-party policy recommendations and other relevant information of the session (such as user contract information, service quality requirements, etc.) to determine the real-time security policy rules applicable to the current session, and correspond these real-time security policy rules to specific target objects, and determine the corresponding network operation instructions for the target objects.

[0261] S503: The PCF sends a fifth operation instruction to the SMF, where the third security policy carried by the fifth operation instruction includes the first session rule, the second session rule, and the third session rule;

[0262] In the specific implementation, PCF can send the session real-time security policy rules formulated for SMF to SMF so that SMF can manage the establishment and maintenance of sessions accordingly. It can also send the session real-time security policy rules corresponding to UPF, RAN and user equipment to SMF, which will forward them to the corresponding target objects.

[0263] S504, SMF sends the first session rule to the UPF;

[0264] Specifically, the SMF may forward the first session rule for the UPF carried in the fifth operation instruction to the UPF to instruct the UPF on how to process the data traffic of the session. The first session rule may include the following contents:

[0265] 1) Data traffic encryption: Specify the encryption algorithm and encryption strength that must be used, such as AES-256, to protect user data traffic on the N3 interface.

[0266] 2) Session isolation: Implement session isolation measures to ensure that traffic from different users or services is isolated from each other on the user plane.

[0267] 3) Packet filtering: Define packet filtering rules to allow or block specific packets based on IP address, port number or other network parameters.

[0268] 4) Load balancing: Guides UPF to distribute traffic across multiple network paths to optimize resource usage and improve network resiliency.

[0269] S505. The SMF sends the second session rule to the RAN.

[0270] Specifically, the SMF may also send a second session rule to the RAN, and the SMF sends the security policy rules applicable to the wireless access network to the RAN so that the RAN can implement corresponding wireless resource management and security control measures. The second session rule may specifically include the following:

[0271] 1) Wireless signal encryption: Specify wireless signal encryption requirements, such as using specific wireless encryption protocols, to prevent wireless monitoring and interference.

[0272] 2) Inter-cell switching: Set the inter-cell switching strategy to ensure that the security of the session is not affected during user mobility.

[0273] 3) Wireless network monitoring: Implement wireless network monitoring to promptly detect and respond to wireless attacks or abnormal behaviors.

[0274] S506. SMF sends the third session rule to the user equipment.

[0275] Specifically, the SMF may send security policy rules (i.e., third session rules) applicable to the user equipment to the UE, so that the UE can adjust its communication behavior according to these rules. The third session rules may specifically include the following:

[0276] 1) Device authentication: The UE is required to perform authentication during the session establishment process to ensure the legitimacy of the communication.

[0277] 2) Security configuration: guides the UE on how to configure air interface security parameters, such as encryption algorithms and keys, to meet the security requirements of the network.

[0278] 3) Data backup: UE is required to implement data backup strategy to protect critical data when the network is unstable or under attack.

[0279] 4) Path switching: guides the UE on how to switch to an alternative path or network when a network anomaly is detected.

[0280] 5) Security behavior: defines the security behavior that the UE should take in the network, such as automatically disconnecting or warning the user in certain situations.

[0281] 6) Software update: guide the UE to perform necessary software updates to fix security vulnerabilities or improve security performance.

[0282] S507: The user equipment, RAN and UPF process session transmission based on the received corresponding session rules.

[0283] It can be seen that in the above embodiments of the present application. UE, RAN and UPF can work together to process the transmission of the session according to the received real-time security policy or session rules. The session rules may include switching the session transmission path according to security requirements, adjusting encryption parameters, implementing access control and other operations to ensure the security and service quality of the session, ensure the security and adaptability of the session in the network, enable the network to flexibly respond to various security threats and abnormal situations, and at the same time ensure the continuity and quality of critical communications.

[0284] Optionally, the sending the corresponding network operation instruction to the target object includes:

[0285] Sending a fifth operation instruction to the SMF, wherein the third security policy carried by the fifth operation instruction includes a first session rule, a second session rule, and a third session rule;

[0286] The fifth operation instruction is used to indicate at least one of the following:

[0287] The SMF sends the first session rule to the UPF;

[0288] The SMF sends the second session rule to the RAN;

[0289] The SMF sends the third session rule to the user equipment.

[0290] It is understandable that the specific implementation of this embodiment can refer to the aforementioned Figure 8 To avoid repeated description, the relevant descriptions in the embodiment shown in the method are not repeated in this embodiment.

[0291] See also Fig. 9 , Fig. 9 : is a schematic diagram of a network security protection method applied to SMF in an embodiment of the present application, and the method specifically includes the following steps:

[0292] Step 601: Receive a network operation instruction sent by the PCF, where the network operation instruction carries a network security policy corresponding to the SMF;

[0293] Step 602: Deploy the network security policy corresponding to the SMF.

[0294] Optionally, the receiving a network operation instruction sent by the PCF includes:

[0295] Receive the session establishment request sent by AMF;

[0296] Sending second indication information to the PCF, where the second indication information carries the session establishment request;

[0297] Receive a third operation instruction sent by the PCF, where the third operation instruction carries a first security policy, and the first security policy is a rule for the SMF to process a session establishment request.

[0298] Optionally, after receiving the third operation instruction sent by the PCF, the method further includes:

[0299] Sending a sixth operation instruction to the AMF;

[0300] The sixth operation instruction carries a fourth security policy, the fourth security policy is carried by the third operation instruction, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

[0301] Optionally, the receiving a network operation instruction sent by the PCF includes:

[0302] receiving a fifth operation instruction sent by the PCF, wherein the fifth operation instruction carries at least a third security policy applicable to the SMF at a target time, wherein the third security policy includes a first session rule, a second session rule, and a third session rule;

[0303] The fifth operation instruction is used to indicate at least one of the following:

[0304] The SMF sends the first session rule to the UPF;

[0305] The SMF sends the second session rule to the RAN;

[0306] The SMF sends the third session rule to the user equipment.

[0307] It is understandable that the specific implementation of this embodiment can refer to the aforementioned Figure 1 , Figure 3 To avoid repeated description, the relevant descriptions in the embodiment shown in the method are not repeated in this embodiment.

[0308] See also Fig.10 , Fig.10 : is a schematic diagram of a network security protection method applied to AMF in an embodiment of the present application, and the method specifically includes the following steps:

[0309] Step 701: Receive a network operation instruction sent by the PCF and / or SMF, where the network operation instruction carries a network security policy corresponding to the AMF;

[0310] Step 702: Deploy the network security policy corresponding to the AMF.

[0311] Optionally, the receiving a network operation instruction sent by the PCF includes:

[0312] receiving a first operation instruction sent by the PCF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment from accessing the network, or to allow the user equipment to access the network if a first condition is met;

[0313] Among them, the first operation instruction is also used to instruct the AMF to send a second operation instruction to the user equipment, and the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network when the first condition is met, and the second operation instruction carries at least one of the conditions for allowing the user equipment to access the network, the conditions for refusing the user equipment to access the network, and the first condition.

[0314] Optionally, the receiving a network operation instruction sent by the SMF includes:

[0315] Receiving a sixth operation instruction sent by the SMF;

[0316] The fifth operation instruction carries a fourth security policy, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

[0317] It is understandable that the specific implementation of this embodiment can refer to the aforementioned Figure 1 , Figure 3 To avoid repeated description, the relevant descriptions in the embodiment shown in the method are not repeated in this embodiment.

[0318] See also Fig.11 The embodiment of the present application provides a network security policy generation device 800, which is applied to NWDAF, and the device includes:

[0319] The first receiving module 801 is used to receive a network data report sent by a network monitoring platform;

[0320] A policy generating module 802, configured to generate a network access policy according to the network data report and the network service information of the operator network to which the NWDAF belongs, wherein the network service information includes at least one of user subscription information, service policy information and network status information;

[0321] The first sending module 803 is used to send the network admission policy to the PCF.

[0322] Optionally, the strategy generation module 802 includes:

[0323] An information prediction unit, used for inputting the network data report and the network service information into a pre-built model, and predicting network security information output by the model, wherein the network security information includes network security events of the network at the prediction time;

[0324] A policy generating unit is used to generate the network admission policy based on the network security information.

[0325] It should be noted that the network security policy generation device 800 provided in the embodiment of the present application can achieve the above Figure 1 The network security policy generation method steps implemented by the method embodiment shown can achieve the same technical effects, and the parts and beneficial effects of this embodiment that are the same as those of the method embodiment will not be described in detail here.

[0326] Please refer to Fig.12 The embodiment of the present application further provides a network security protection device 810, which is applied to PCF, and the device includes:

[0327] The second receiving module 811 is used to receive the network admission policy sent by the NWDAF;

[0328] A policy determination module 812, configured to determine a network operation instruction corresponding to a target object based on the network access policy, wherein the network operation instruction carries a network security policy corresponding to the target object;

[0329] The second sending module 813 is used to send the corresponding network operation instruction to the target object.

[0330] Optionally, the target object includes at least one of a user equipment, a mobility management function AMF, a session management function SMF, a user plane function UPF and an access network RAN ​​device.

[0331] Optionally, the policy determination module 812 includes:

[0332] A first receiving unit, configured to receive first indication information sent by the AMF; wherein the first indication information is used to indicate whether to allow the user equipment to access the network, and the first indication information is carried by the network registration request;

[0333] A first acquisition unit, configured to acquire a first policy suggestion in the network admission policy, where the first policy suggestion is associated with an access result indicated by the first indication information;

[0334] The first determination unit is used to determine the network operation instruction corresponding to the target object based on the user subscription information of the user equipment and the first policy recommendation.

[0335] Optionally, the second sending module 813 includes at least one of the following:

[0336] A first sending unit, configured to send a first operation instruction to the AMF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment from accessing the network, or to allow the user equipment to access the network if a first condition is met;

[0337] The first operation instruction is further used to instruct the AMF to send a second operation instruction to the user equipment, where the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network if the first condition is met;

[0338] The second operation instruction carries at least one of a condition for allowing the user equipment to access the network, a condition for denying the user equipment to access the network, and the first condition.

[0339] Optionally, the policy determination module 812 includes:

[0340] A second receiving unit, configured to receive second indication information sent by the SMF; wherein the second indication information is used to indicate whether to allow a session to be established between the user equipment and the network, and the second indication information is carried by the session establishment request;

[0341] A second acquisition unit, configured to acquire a second policy suggestion in the network admission policy, where the second policy suggestion is associated with a session establishment result indicated by the second indication information;

[0342] The second determining unit is used to determine the network operation instruction corresponding to the target object based on the user subscription information of the user equipment and the second policy recommendation.

[0343] Optionally, the second sending module 813 includes at least one of the following:

[0344] A second sending unit is used to send a third operation instruction to the SMF, where the third operation instruction carries a first security policy, where the first security policy is a rule instructing the SMF to process the session establishment request;

[0345] The third sending unit is used to send a fourth operation instruction to the user equipment, where the fourth operation instruction carries a second security policy, and the second security policy is a rule instructing the user equipment to respond when a service request is received.

[0346] Optionally, the policy determination module 812 includes:

[0347] A third determining unit, configured to determine a fifth operation instruction corresponding to the target object based on a third policy suggestion in the network admission policy;

[0348] The third policy suggestion is used to indicate a session security policy applicable to the access network at the target time, and the fifth operation instruction carries the third security policy applicable to the target object at the target time.

[0349] Optionally, the second sending module 813 includes:

[0350] A fourth sending unit, configured to send a fifth operation instruction to the SMF, wherein the third security policy carried by the fifth operation instruction includes a first session rule, a second session rule, and a third session rule;

[0351] The fifth operation instruction is used to indicate at least one of the following:

[0352] The SMF sends the first session rule to the UPF;

[0353] The SMF sends the second session rule to the RAN;

[0354] The SMF sends the third session rule to the user equipment.

[0355] It should be noted that the network security protection device 810 provided in the embodiment of the present application can achieve the above Figure 3 The network security protection method steps applied to PCF implemented by the method embodiment shown can achieve the same technical effects, and the parts and beneficial effects of this embodiment that are the same as those of the method embodiment will not be described in detail here.

[0356] Please refer to Fig.13 The embodiment of the present application further provides a network security protection device 820, which is applied to SMF, and the device includes:

[0357] The third receiving module 821 is used to receive the network operation instruction sent by the PCF, where the network operation instruction carries the network security policy corresponding to the SMF;

[0358] The first deployment module 822 is used to deploy the network security policy corresponding to the SMF.

[0359] Optionally, the third receiving module 821 includes:

[0360] A third receiving unit is used to receive a session establishment request sent by the AMF;

[0361] A sixth sending unit, configured to send second indication information to the PCF, where the second indication information carries the session establishment request;

[0362] The fourth receiving unit is used to receive a third operation instruction sent by the PCF, where the third operation instruction carries a first security policy, and the first security policy is a rule for the SMF to process a session establishment request.

[0363] Optionally, after receiving the third operation instruction sent by the PCF, the device further includes:

[0364] A third sending module, configured to send a sixth operation instruction to the AMF;

[0365] The sixth operation instruction carries a fourth security policy, the fourth security policy is carried by the third operation instruction, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

[0366] Optionally, the third receiving module 821 includes:

[0367] a fifth receiving unit, configured to receive a fifth operation instruction sent by the PCF, wherein the fifth operation instruction carries at least a third security policy applicable to the SMF at a target time, wherein the third security policy includes a first session rule, a second session rule, and a third session rule;

[0368] The fifth operation instruction is used to indicate at least one of the following:

[0369] The SMF sends the first session rule to the UPF;

[0370] The SMF sends the second session rule to the RAN;

[0371] The SMF sends the third session rule to the user equipment.

[0372] It should be noted that the network security protection device 820 provided in the embodiment of the present application can achieve the above Fig. 9 The network security protection method steps applied to SMF implemented by the method embodiment shown can achieve the same technical effects. The parts and beneficial effects that are the same as those in the method embodiment will not be described in detail here.

[0373] See also Fig.14 The embodiment of the present application further provides a network security protection device 830, which is applied to AMF, and the method includes:

[0374] The fourth receiving module 831 is used to receive a network operation instruction sent by the PCF and / or SMF, where the network operation instruction carries the network security policy corresponding to the AMF;

[0375] The second deployment module 832 is used to deploy the network security policy corresponding to the AMF.

[0376] Optionally, the fourth receiving module 831 includes:

[0377] a sixth receiving unit, configured to receive a first operation instruction sent by the PCF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment from accessing the network, or to allow the user equipment to access the network if a first condition is met;

[0378] Among them, the first operation instruction is also used to instruct the AMF to send a second operation instruction to the user equipment, and the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network when the first condition is met, and the second operation instruction carries at least one of the conditions for allowing the user equipment to access the network, the conditions for refusing the user equipment to access the network, and the first condition.

[0379] Optionally, the fourth receiving module 831 includes:

[0380] A seventh receiving unit, configured to receive a sixth operation instruction sent by the SMF;

[0381] The fifth operation instruction carries a fourth security policy, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

[0382] It should be noted that the network security protection device 830 provided in the embodiment of the present application can achieve the above Fig.10 The network security protection method steps applied to AMF implemented by the method embodiment shown can achieve the same technical effects. The parts and beneficial effects that are the same as those in the method embodiment will not be described in detail here.

[0383] The present application also provides an electronic device. Fig.15 , Fig.15 is a structural diagram of an electronic device provided in an embodiment of the present application. Since the principle of solving the problem by the electronic device is similar to the network security policy generation method applied to the electronic device in the embodiment of the present application, the implementation of the electronic device can refer to Figure 1 The implementation of the method shown will not be repeated in detail.

[0384] like Fig.15 As shown, the electronic device includes: a processor 900, which is used to read the program in the memory 920 and execute the following process:

[0385] Receiving a network data report sent by a network monitoring platform through a transceiver 910;

[0386] Generate a network access policy according to the network data report and network service information of the operator network to which the NWDAF belongs, wherein the network service information includes at least one of user subscription information, service policy information and network status information;

[0387] Sending the network admission policy to the policy control function PCF via the transceiver 910;

[0388] The transceiver 910 is configured to receive and send data under the control of the processor 900 .

[0389] Among them, Fig.16In the embodiment of the present invention, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 900 and memory represented by memory 920. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface.

[0390] Optionally, the processor 900 is further configured to read a program in the memory 920 and execute the following steps:

[0391] Inputting the network data report and the network service information into a pre-built model, predicting network security information output by the model, wherein the network security information includes network security events of the network at the prediction time;

[0392] The network access policy is generated based on the network security information.

[0393] The electronic device provided in the embodiment of the present application can perform the above Figure 1 The implementation principle and technical effect of the method embodiment shown are similar, and this embodiment will not be repeated here.

[0394] The present application embodiment further provides an electronic device. Since the principle of solving the problem by the electronic device is similar to the network security protection method performed by the PCF in the present application embodiment, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated. Fig.16 As shown, the electronic device of the embodiment of the present application includes: a processor 1000, which is used to read the program in the memory 1020 and execute the following process:

[0395] Receiving the network access policy sent by NWDAF through the transceiver 1010;

[0396] Based on the network access policy, determine a network operation instruction corresponding to the target object, wherein the network operation instruction carries the network security policy corresponding to the target object;

[0397] Sending the corresponding network operation instruction to the target object through the transceiver 1010;

[0398] The transceiver 1010 is configured to receive and send data under the control of the processor 1000 .

[0399] Among them, Fig.17In the embodiment of the present invention, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1000 and memory represented by memory 1020. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface.

[0400] Optionally, the target object includes at least one of a user equipment, a mobility management function AMF, a session management function SMF, a user plane function UPF and an access network RAN ​​device.

[0401] Optionally, the processor 1000 is further configured to read a program in the memory 1020 and execute the following steps:

[0402] Receive, by the transceiver 1010, first indication information sent by the AMF; wherein the first indication information is used to indicate whether to allow the user equipment to access the network, and the first indication information is carried by the network registration request;

[0403] Acquire a first policy suggestion in the network admission policy, where the first policy suggestion is associated with the access result indicated by the first indication information;

[0404] Based on the user subscription information of the user equipment and the first policy recommendation, the network operation instruction corresponding to the target object is determined.

[0405] Optionally, the processor 1000 is further configured to read a program in the memory 1020, and further perform at least one of the following steps:

[0406] Sending a first operation instruction to the AMF through the transceiver 1010, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment from accessing the network, or to allow the user equipment to access the network if a first condition is met;

[0407] The first operation instruction is further used to instruct the AMF to send a second operation instruction to the user equipment, where the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network if the first condition is met;

[0408] The second operation instruction carries at least one of a condition for allowing the user equipment to access the network, a condition for denying the user equipment to access the network, and the first condition.

[0409] Optionally, the processor 1000 is further configured to read a program in the memory 1020 and execute the following steps:

[0410] Receiving, by the transceiver 1010, second indication information sent by the SMF; wherein the second indication information is used to indicate whether to allow a session to be established between the user equipment and the network, and the second indication information is carried by the session establishment request;

[0411] Acquire a second policy suggestion in the network admission policy, where the second policy suggestion is associated with a session establishment result indicated by the second indication information;

[0412] Based on the user subscription information of the user equipment and the second policy recommendation, the network operation instruction corresponding to the target object is determined.

[0413] Optionally, the processor 1000 is further configured to read a program in the memory 1020, and further perform at least one of the following steps:

[0414] Sending a third operation instruction to the SMF through the transceiver 1010, wherein the third operation instruction carries a first security policy, and the first security policy is a rule instructing the SMF to process the session establishment request;

[0415] A fourth operation instruction is sent to the user equipment through the transceiver 1010, the fourth operation instruction carries a second security policy, and the second security policy is a rule instructing the user equipment to respond when a service request is received.

[0416] Optionally, the processor 1000 is further configured to read a program in the memory 1020 and execute the following steps:

[0417] Determining a fifth operation instruction corresponding to the target object based on the third policy suggestion in the network access policy;

[0418] The third policy suggestion is used to indicate a session security policy applicable to the access network at the target time, and the fifth operation instruction carries the third security policy applicable to the target object at the target time.

[0419] Optionally, the processor 1000 is further configured to read a program in the memory 1020 and execute the following steps:

[0420] Sending a fifth operation instruction to the SMF through the transceiver 1010, wherein the third security policy carried by the fifth operation instruction includes a first session rule, a second session rule and a third session rule;

[0421] The fifth operation instruction is used to indicate at least one of the following:

[0422] The SMF sends the first session rule to the UPF;

[0423] The SMF sends the second session rule to the RAN;

[0424] The SMF sends the third session rule to the user equipment.

[0425] like Fig.17 As shown, the present application also provides an electronic device, including: a processor 1100, configured to read a program in a memory 1120, and execute the following process:

[0426] Receive the network operation instruction sent by the PCF through the transceiver 1110, wherein the network operation instruction carries the network security policy corresponding to the SMF;

[0427] Deploy the network security policy corresponding to the SMF;

[0428] The transceiver 1110 is configured to receive and send data under the control of the processor 1100 .

[0429] Among them, Fig.17 In the embodiment of the present invention, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 1100 and memory represented by memory 1120. The bus architecture may also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface.

[0430] Optionally, the processor 1100 is further configured to read a program in the memory 1120 and execute the following steps:

[0431] Receiving a session establishment request sent by the AMF through the transceiver 1110;

[0432] Sending second indication information to the PCF through the transceiver 1110, where the second indication information carries the session establishment request;

[0433] The third operation instruction sent by the PCF is received through the transceiver 1110, and the third operation instruction carries a first security policy, and the first security policy is a rule for the SMF to process a session establishment request.

[0434] Optionally, the processor 1100 is further configured to read a program in the memory 1120 and execute the following steps:

[0435] Sending a sixth operation instruction to the AMF through the transceiver 1110;

[0436] The sixth operation instruction carries a fourth security policy, the fourth security policy is carried by the third operation instruction, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

[0437] Optionally, the processor 1100 is further configured to read a program in the memory 1120 and execute the following steps:

[0438] receiving, through the transceiver 1110, a fifth operation instruction sent by the PCF, wherein the fifth operation instruction carries at least a third security policy applicable to the SMF at the target time, wherein the third security policy includes a first session rule, a second session rule, and a third session rule;

[0439] The fifth operation instruction is used to indicate at least one of the following:

[0440] The SMF sends the first session rule to the UPF;

[0441] The SMF sends the second session rule to the RAN;

[0442] The SMF sends the third session rule to the user equipment.

[0443] The electronic device provided in the embodiment of the present application can perform the above-mentioned Fig. 9 The implementation principle and technical effect of the method embodiment shown are similar, and this embodiment will not be repeated here.

[0444] like Fig.18 As shown, Fig.18 The fourth structural diagram of an electronic device provided in an embodiment of the present application includes: a processor 1200, which is used to read a program in a memory 1220 and execute the following process:

[0445] Receive a network operation instruction sent by the PCF and / or SMF through the transceiver 1210, wherein the network operation instruction carries the network security policy corresponding to the AMF;

[0446] Deploy the network security policy corresponding to the AMF;

[0447] The transceiver 1210 is configured to receive and send data under the control of the processor 1200 .

[0448] Among them, Fig.18In the embodiment of the present invention, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 1200 and memory represented by memory 1220. The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface.

[0449] Optionally, the processor 1200 is further configured to read a program in the memory 1220 and execute the following steps:

[0450] receiving, through the transceiver 1210, a first operation instruction sent by the PCF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment from accessing the network, or to allow the user equipment to access the network if a first condition is met;

[0451] Among them, the first operation instruction is also used to instruct the AMF to send a second operation instruction to the user equipment, and the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network when the first condition is met, and the second operation instruction carries at least one of the conditions for allowing the user equipment to access the network, the conditions for refusing the user equipment to access the network, and the first condition.

[0452] Optionally, the processor 1200 is further configured to read a program in the memory 1220 and execute the following steps:

[0453] Receiving, through the transceiver 1210, a sixth operation instruction sent by the SMF;

[0454] The fifth operation instruction carries a fourth security policy, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

[0455] The electronic device provided in the embodiment of the present application can perform the above-mentioned Fig.10 The implementation principle and technical effect of the method embodiment shown are similar, and this embodiment will not be repeated here.

[0456] The present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned Figure 1 Network security policy generation method, or implement Figure 3 , Fig. 9 or Fig.10The various processes of the network security protection method embodiment in the embodiment can achieve the same technical effect, and are not repeated here to avoid repetition. Among them, the computer-readable storage medium, such as read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc.

[0457] The present application embodiment further provides a computer program / program product, wherein the computer program / program product is stored in a storage medium, and the computer program / program product is executed by at least one processor to implement the above-mentioned Figure 1 Network security policy generation method, or implement Figure 3 , Fig. 9 or Fig.10 The various processes of the network security protection method implementation example in the embodiment can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0458] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0459] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may be physically included separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0460] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform some steps of the sending and receiving methods described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0461] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles described in the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A network security strategy generation method, characterized in that: Applied to the network data analysis function NWDAF, the method comprises: Receive network data reports sent by the network monitoring platform; Generate a network access policy according to the network data report and network service information of the operator network to which the NWDAF belongs, wherein the network service information includes at least one of user subscription information, service policy information and network status information; The network admission policy is sent to a policy control function PCF.

2. The method according to claim 1, characterized in that The generating a network access strategy according to the network data report and the network service information of the operator network to which the NWDAF belongs includes: Inputting the network data report and the network service information into a pre-built model, predicting network security information output by the model, wherein the network security information includes network security events of the network at the prediction time; The network access policy is generated based on the network security information.

3. A network security protection method, characterized in that: Applied to PCF, the method comprises: Receive the network access policy sent by NWDAF; Based on the network access policy, determining a network operation instruction corresponding to the target object, the network operation instruction carrying the network security policy corresponding to the target object; Send the corresponding network operation instruction to the target object.

4. The method according to claim 3, characterized in that The target object includes at least one of a user equipment, a mobility management function AMF, a session management function SMF, a user plane function UPF and an access network RAN ​​device.

5. The method according to claim 3, characterized in that: The determining, based on the network admission policy, a network operation instruction corresponding to the target object includes: Receive first indication information sent by the AMF; wherein the first indication information is used to indicate whether the user equipment is allowed to access the network, and the first indication information is carried by the network registration request; Acquire a first policy suggestion in the network admission policy, where the first policy suggestion is associated with the access result indicated by the first indication information; Based on the user subscription information of the user equipment and the first policy recommendation, the network operation instruction corresponding to the target object is determined.

6. The method according to claim 5, characterized in that The sending the corresponding network operation instruction to the target object includes at least one of the following: Sending a first operation instruction to the AMF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment to access the network, or to allow the user equipment to access the network if a first condition is met; The first operation instruction is further used to instruct the AMF to send a second operation instruction to the user equipment, where the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network if the first condition is met; The second operation instruction carries at least one of a condition for allowing the user equipment to access the network, a condition for denying the user equipment to access the network, and the first condition.

7. The method according to claim 4, characterized in that The determining, based on the network admission policy, a network operation instruction corresponding to the target object includes: receiving second indication information sent by the SMF; wherein the second indication information is used to indicate whether to allow a session to be established between the user equipment and the network, and the second indication information is carried by the session establishment request; Acquire a second policy suggestion in the network admission policy, where the second policy suggestion is associated with a session establishment result indicated by the second indication information; Based on the user subscription information of the user equipment and the second policy recommendation, the network operation instruction corresponding to the target object is determined.

8. The method according to claim 7, characterized in that The sending the corresponding network operation instruction to the target object includes at least one of the following: Sending a third operation instruction to the SMF, where the third operation instruction carries a first security policy, where the first security policy is a rule instructing the SMF to process the session establishment request; A fourth operation instruction is sent to the user equipment, where the fourth operation instruction carries a second security policy, where the second security policy is a rule instructing the user equipment to respond when a service request is received.

9. The method according to claim 4, characterized in that The determining, based on the network admission policy, a network operation instruction corresponding to the target object includes: Determining a fifth operation instruction corresponding to the target object based on the third policy suggestion in the network access policy; The third policy suggestion is used to indicate a session security policy applicable to the access network at the target time, and the fifth operation instruction carries the third security policy applicable to the target object at the target time.

10. The method according to claim 9, characterized in that The sending the corresponding network operation instruction to the target object includes: Sending a fifth operation instruction to the SMF, wherein the third security policy carried by the fifth operation instruction includes a first session rule, a second session rule, and a third session rule; The fifth operation instruction is used to indicate at least one of the following: The SMF sends the first session rule to the UPF; The SMF sends the second session rule to the RAN; The SMF sends the third session rule to the user equipment.

11. A network security protection method, characterized in that: Applied to SMF, the method comprises: Receive a network operation instruction sent by the PCF, wherein the network operation instruction carries a network security policy corresponding to the SMF; Deploy the network security policy corresponding to the SMF.

12. The method according to claim 11, characterized in that The receiving of the network operation instruction sent by the PCF includes: Receive the session establishment request sent by AMF; Sending second indication information to the PCF, where the second indication information carries the session establishment request; Receive a third operation instruction sent by the PCF, where the third operation instruction carries a first security policy, and the first security policy is a rule for the SMF to process a session establishment request.

13. The method according to claim 12, characterized in that After receiving the third operation instruction sent by the PCF, the method further includes: Sending a sixth operation instruction to the AMF; The sixth operation instruction carries a fourth security policy, the fourth security policy is carried by the third operation instruction, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

14. The method according to claim 11, characterized in that The receiving of the network operation instruction sent by the PCF includes: receiving a fifth operation instruction sent by the PCF, wherein the fifth operation instruction carries at least a third security policy applicable to the SMF at a target time, wherein the third security policy includes a first session rule, a second session rule, and a third session rule; The fifth operation instruction is used to indicate at least one of the following: The SMF sends the first session rule to the UPF; The SMF sends the second session rule to the RAN; The SMF sends the third session rule to the user equipment.

15. A network security protection method, characterized in that: Applied to AMF, the method comprises: Receive a network operation instruction sent by the PCF and / or SMF, wherein the network operation instruction carries a network security policy corresponding to the AMF; Deploy the network security policy corresponding to the AMF.

16. The method according to claim 15, characterized in that The receiving the network operation instruction sent by the PCF includes: receiving a first operation instruction sent by the PCF, where the first operation instruction is used to instruct the AMF to allow the user equipment to access the network, to deny the user equipment from accessing the network, or to allow the user equipment to access the network if a first condition is met; Among them, the first operation instruction is also used to instruct the AMF to send a second operation instruction to the user equipment, and the second operation instruction is used to instruct the user equipment to access the network, refuse to access the network, or access the network when the first condition is met, and the second operation instruction carries at least one of the conditions for allowing the user equipment to access the network, the conditions for refusing the user equipment to access the network, and the first condition.

17. The method according to claim 16, characterized in that The receiving the network operation instruction sent by the SMF includes: Receiving a sixth operation instruction sent by the SMF; The fifth operation instruction carries a fourth security policy, and the fourth security policy is a rule instructing the AMF to process a session establishment request.

18. A network security strategy generating device, characterized in that: Applied to NWDAF, the device comprises: A first receiving module, used for receiving a network data report sent by a network monitoring platform; A policy generation module, configured to generate a network access policy according to the network data report and network service information of the operator network to which the NWDAF belongs, wherein the network service information includes at least one of user contract information, service policy information and network status information; The first sending module is used to send the network admission policy to the PCF.

19. A network security protection device, characterized in that: Applied to PCF, the device comprises: The second receiving module is used to receive the network access policy sent by NWDAF; A policy determination module, used to determine a network operation instruction corresponding to a target object based on the network access policy, wherein the network operation instruction carries a network security policy corresponding to the target object; The second sending module is used to send the corresponding network operation instruction to the target object.

20. A network security protection device, characterized in that: Applied to SMF, the device comprises: A third receiving module is used to receive a network operation instruction sent by the PCF, wherein the network operation instruction carries a network security policy corresponding to the SMF; The first deployment module is used to deploy the network security policy corresponding to the SMF.

21. A network security protection device, characterized in that: Applied to AMF, the device comprises: A fourth receiving module is used to receive a network operation instruction sent by the PCF and / or SMF, where the network operation instruction carries a network security policy corresponding to the AMF; The second deployment module is used to deploy the network security policy corresponding to the AMF.

22. An electronic device, characterized in that: It includes a processor and a memory, the memory stores a program or instruction that can be run on the processor, and when the program or instruction is executed by the processor, it implements the steps in the network security policy generation method as described in any one of claims 1 to 2; or, when the program or instruction is executed by the processor, it implements the steps in the network security protection method as described in any one of claims 3 to 17.

23. A computer-readable storage medium for storing a computer program, characterized in that: When the computer program is executed by the processor, the steps in the network security policy generation method as described in any one of claims 1 to 2 are implemented; or, when the computer program is executed by the processor, the steps in the network security protection method as described in any one of claims 3 to 17 are implemented.

24. A computer program product, characterized in that It includes computer instructions, which, when executed by a processor, implement the steps in the network security policy generation method as described in any one of claims 1 to 2; or, when executed by a processor, the computer instructions implement the steps in the network security protection method as described in any one of claims 3 to 17.

Images