5G sinking UPF security protection method, security gateway and 5G system

Abstract

The invention discloses a 5G sinking UPF security protection method, a security gateway and a 5G system, belongs to the technical field of network communication, and aims to solve the technical problem of how to improve security protection of industry private network sinking UPF. Comprising the following steps: adding a security gateway in a 5G system, and detecting password information of an N4 interface and user service flow of an N6 interface through the security gateway; the password information of the N4 interface is analyzed through the security gateway, security detection is carried out on a message obtained through analysis, whether an abnormal message exists or not is judged, and if yes, blocking and alarm reporting are carried out on the abnormal message; and performing security detection and evaluation based on the password information of the N4 interface and the user service flow of the N6 interface, judging whether the user service flow forwarded through the N6 interface accords with an execution condition specified in the password information so as to judge whether the UPF works normally, and if the UPF works abnormally, performing alarm reporting.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and specifically to a 5G sinking UPF security protection method, a security gateway and a 5G system. Background Art

[0002] At present, the security strategy for sinking UPF into industry-specific networks mainly provides security protection from the network level, and lacks effective protection against signaling and business risks.

[0003] How to improve the security protection of UPF in industry-specific networks is a technical problem that needs to be solved. Summary of the invention

[0004] The technical task of the present invention is to address the above deficiencies and provide a 5G UPF security protection method, a security gateway and a 5G system to solve the technical problem of how to improve the security protection of UPF for industry-specific networks.

[0005] In a first aspect, the present invention provides a 5G sinking UPF security protection method, which is used to perform security protection on the UPF in combination with the N4 interface password and the N6 interface user service flow, and includes the following steps:

[0006] Add a security gateway in the 5G system to detect the password information of the N4 interface and the user service flow of the N6 interface through the security gateway;

[0007] The password information of the N4 interface is parsed through the security gateway, and the parsed message is subjected to security detection to determine whether there are abnormal messages. If so, the abnormal message is blocked and an alarm is reported;

[0008] Security detection and assessment are performed based on the password information of the N4 interface and the user service traffic of the N6 interface to determine whether the user service traffic forwarded through the N6 interface complies with the execution status specified in the password information, so as to determine whether the UPF is working normally. If the UPF is working abnormally, an alarm is reported.

[0009] Preferably, a security check is performed on the parsed message through a security gateway to identify whether the N4 interface carries PFCP messages with abnormal and illegal IEs and excessively frequent signaling messages.

[0010] As a preferred embodiment, when performing security detection and evaluation based on the password information of the N4 interface and the user service traffic of the N6 interface, it is detected whether the actual forwarding behavior of the user service traffic of the N6 interface conforms to the action carried by the FAR in the signaling information of the N4 interface, so as to determine whether the UPF is working normally. If not, it is determined that the UPF is working abnormally;

[0011] The action carried by FAR in the N4 interface signaling information is used to identify the execution status of user service traffic, including forwarding, discarding, copying and caching messages.

[0012] In a second aspect, the present invention provides a security gateway for providing security protection for UPF through a 5G sinking UPF security protection method as described in any one of the first aspects, wherein the security gateway includes an interface detection service module, a security protection service module, and a traffic behavior execution perception service module;

[0013] The interface detection service module is used to perform the following: detect the password information of the N4 interface and the user service flow of the N6 interface;

[0014] The security protection service module is used to perform the following: parse the password information of the N4 interface, and perform security detection on the parsed message to determine whether there are abnormal messages. If so, block the abnormal message and report an alarm;

[0015] The traffic behavior execution perception service module is used to perform the following: perform security detection and evaluation based on the password information of the N4 interface and the user service traffic of the N6 interface, determine whether the user service traffic forwarded through the N6 interface complies with the execution status specified in the password information, so as to determine whether the UPF is working normally. If the UPF is working abnormally, an alarm will be reported.

[0016] Preferably, when performing security detection on the parsed message, the security protection service module is used to identify whether the N4 interface carries PFCP messages with abnormal and illegal IEs and excessively frequent signaling messages.

[0017] As a preferred embodiment, when security detection and evaluation are performed based on the password information of the N4 interface and the user service traffic of the N6 interface, the traffic behavior execution perception service module is used to perform the following operations: detect whether the actual forwarding behavior of the user service traffic of the N6 interface conforms to the action carried by the FAR in the signaling information of the N4 interface, so as to determine whether the UPF is working normally, and if not, determine that the UPF is working abnormally;

[0018] The action carried by FAR in the N4 interface signaling information is used to identify the execution status of user service traffic, including forwarding, discarding, copying and caching messages.

[0019] In a third aspect, the present invention provides a computer-readable medium having computer instructions stored thereon, wherein when the computer instructions are executed by a processor, the processor executes any of the methods described in the first aspect.

[0020] In a fourth aspect, the present invention provides a 5G system, wherein the 5G system is configured with a security gateway as described in any one of the first aspects.

[0021] The 5G sinking UPF security protection method, security gateway and 5G system of the present invention have the following advantages: the password information of the N4 interface and the user service flow of the N6 interface are detected by the security gateway, the password information of the N4 interface is parsed, and the parsed message is security checked to determine whether there are abnormal messages, and security checks and assessments are performed based on the password information of the N4 interface and the user service flow of the N6 interface to determine whether the user service flow forwarded through the N6 interface complies with the execution status specified in the password information, so as to more effectively protect the 5G system of the sinking UPF from the business level. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] The present invention is further described below in conjunction with the accompanying drawings.

[0024] Figure 1 This is a flowchart of a 5G sinking UPF security protection method in Example 1;

[0025] Figure 2 This is an architectural block diagram of a security gateway in a 5G system according to Example 2. DETAILED DESCRIPTION

[0026] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0027] The embodiments of the present invention provide a 5G UPF security protection method, a security gateway and a 5G system to solve the technical problem of how to improve the security protection of UPF for industry-specific networks.

[0028] Embodiment 1:

[0029] The present invention provides a 5G sinking UPF security protection method, which is used to combine the N4 interface password and the N6 interface user service flow to perform security protection on the UPF. The method includes the following steps:

[0030] Step S100: Add a security gateway in the 5G system, and detect the password information of the N4 interface and the user service flow of the N6 interface through the security gateway;

[0031] Step S200: parse the password information of the N4 interface through the security gateway, and perform security detection on the parsed message to determine whether there is an abnormal message. If so, block the abnormal message and report an alarm;

[0032] Step S300, perform security detection and assessment based on the password information of the N4 interface and the user service traffic of the N6 interface, determine whether the user service traffic forwarded through the N6 interface complies with the execution status specified in the password information, so as to determine whether the UPF is working normally. If the UPF is working abnormally, an alarm is reported.

[0033] In step S100 of this embodiment, the security gateway performs security detection on the parsed message to identify whether the N4 interface carries PFCP messages with abnormal and illegal IEs and excessively frequent signaling messages.

[0034] When performing security detection and evaluation based on the password information of the N4 interface and the user service traffic of the N6 interface in step S200, it is detected whether the actual forwarding behavior of the user service traffic of the N6 interface conforms to the action carried by the FAR in the N4 interface signaling information to determine whether the UPF is working normally. If not, it is determined that the UPF is working abnormally. Among them, the action carried by the FAR in the N4 interface signaling information is used to identify the execution status of the user service traffic, and the execution status includes forwarding, discarding, copying and caching messages, etc.

[0035] The method of this embodiment adds a security gateway to the 5G system of the sinking UPF. The security gateway simultaneously detects the N4 interface signaling and the N6 interface user service traffic, provides security protection services for the N4 interface, parses the signaling of the N4 interface through the security protection service, and identifies the N4 interface signaling anomalies to provide security protection services. It is determined whether there are anomalies. The PFCP message carrying abnormal illegal IE and excessively frequent signaling messages on the N4 interface can be identified, and the messages of abnormal situations are blocked and alarms are reported. At the same time, a traffic behavior execution perception service is provided. Based on the password information of the N4 interface and the user service traffic of the N6 interface, security detection and evaluation are performed through the traffic behavior execution perception service. The actual forwarding behavior of the traffic in the N6 interface is detected and compared with the action carried by FAR in the N4 signaling, it is determined whether the UPF is working normally, thereby providing security protection from the service level.

[0036] Embodiment 2:

[0037] The invention discloses a security gateway, comprising an interface detection service module, a security protection service module and a flow behavior execution perception service module.

[0038] The interface detection service module is used to perform the following: detect the password information of the N4 interface and the user service flow of the N6 interface.

[0039] The security protection service module is used to perform the following: parse the password information of the N4 interface, and perform security detection on the parsed message to determine whether there are abnormal messages. If so, block the abnormal message and report an alarm.

[0040] In this embodiment, the security protection service module in the security gateway is used to perform security detection on the parsed messages, and identify whether the N4 interface carries PFCP messages with abnormal and illegal IEs and excessively frequent signaling messages.

[0041] The traffic behavior execution perception service module is used to perform the following: perform security detection and evaluation based on the password information of the N4 interface and the user service traffic of the N6 interface, determine whether the user service traffic forwarded through the N6 interface complies with the execution status specified in the password information, so as to determine whether the UPF is working normally. If the UPF is working abnormally, an alarm will be reported.

[0042] In this embodiment, when security detection and evaluation are performed based on the password information of the N4 interface and the user service traffic of the N6 interface, the traffic behavior execution perception service module is used to detect whether the actual forwarding behavior of the user service traffic of the N6 interface conforms to the action carried by the FAR in the N4 interface signaling information, so as to determine whether the UPF is working normally. If not, the UPF is judged to be abnormal. Among them, the action carried by the FAR in the N4 interface signaling information is used to identify the execution status of the user service traffic, and the execution status includes forwarding, discarding, copying and caching messages, etc.

[0043] The security gateway of this embodiment can execute the method disclosed in Example 1 to provide security protection for 5G sinking UPF.

[0044] Embodiment 3:

[0045] The present invention provides a computer-readable medium on which computer instructions are stored. When the computer instructions are executed by a processor, the processor executes the method disclosed in Example 1.

[0046] Embodiment 4:

[0047] The present invention provides a 5G system, in which a security gateway as disclosed in Example 2 is configured.

[0048] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. A 5G sinking UPF security protection method, characterized in that: It is used to combine the N4 interface password and the N6 interface user service traffic to provide security protection for UPF, including the following steps: Add a security gateway in the 5G system to detect the password information of the N4 interface and the user service flow of the N6 interface through the security gateway; The password information of the N4 interface is parsed through the security gateway, and the parsed message is subjected to security detection to determine whether there are abnormal messages. If so, the abnormal message is blocked and an alarm is reported; Security detection and assessment are performed based on the password information of the N4 interface and the user service traffic of the N6 interface to determine whether the user service traffic forwarded through the N6 interface complies with the execution status specified in the password information, so as to determine whether the UPF is working normally. If the UPF is working abnormally, an alarm is reported.

2. The 5G sinking UPF security protection method according to claim 1 is characterized in that: The security gateway performs security checks on the parsed messages to identify whether the N4 interface carries abnormal and illegal IE PFCP messages and excessively frequent signaling messages.

3. The 5G sinking UPF security protection method according to claim 1 is characterized in that: When performing security detection and assessment based on the password information of the N4 interface and the user service traffic of the N6 interface, detect whether the actual forwarding behavior of the user service traffic of the N6 interface conforms to the action carried by the FAR in the signaling information of the N4 interface to determine whether the UPF is working normally. If not, it is determined that the UPF is working abnormally; The action carried by FAR in the N4 interface signaling information is used to identify the execution status of user service traffic, including forwarding, discarding, copying and caching messages.

4. A security gateway, characterized in that: Used to provide security protection for UPF through a 5G sinking UPF security protection method as described in any one of claims 1-3, the security gateway includes an interface detection service module, a security protection service module and a traffic behavior execution perception service module; The interface detection service module is used to perform the following: detect the password information of the N4 interface and the user service flow of the N6 interface; The security protection service module is used to perform the following: parse the password information of the N4 interface, and perform security detection on the parsed message to determine whether there are abnormal messages. If so, block the abnormal message and report an alarm; The traffic behavior execution perception service module is used to perform the following: perform security detection and evaluation based on the password information of the N4 interface and the user service traffic of the N6 interface, determine whether the user service traffic forwarded through the N6 interface complies with the execution status specified in the password information, so as to determine whether the UPF is working normally. If the UPF is working abnormally, an alarm will be reported.

5. The security gateway according to claim 4, characterized in that: When performing security detection on the parsed message, the security protection service module is used to identify whether the N4 interface carries PFCP messages with abnormal and illegal IEs and excessively frequent signaling messages.

6. The security gateway according to claim 4, characterized in that: When security detection and evaluation is performed based on the password information of the N4 interface and the user service traffic of the N6 interface, the traffic behavior execution perception service module is used to perform the following operations: detect whether the actual forwarding behavior of the user service traffic of the N6 interface conforms to the action carried by the FAR in the signaling information of the N4 interface, so as to determine whether the UPF is working normally. If not, it is determined that the UPF is working abnormally; The action carried by FAR in the N4 interface signaling information is used to identify the execution status of user service traffic, including forwarding, discarding, copying and caching messages.

7. A computer-readable medium, characterized in that The computer readable medium stores computer instructions, which, when executed by a processor, enable the processor to execute any one of the methods of claims 1 to 3.

8. A 5G system, characterized in that: The 5G system is configured with a security gateway as described in any one of claims 4-6.

Images