Information processing method and device, network node, storage medium and computer program product

Abstract

The invention discloses an information processing method and device, a network node, a storage medium and a computer program product. The method comprises the following steps: under the condition that a first terminal has accessed a visited network, a network node receives first information sent by a first network element in the visited network, and the first information is used for requesting to execute a service operation associated with the first terminal; second information is used for verifying the first information to obtain a verification result, the second information represents the real roaming state of one or more terminals in the visited network, and the verification result represents that the first information is false information or real information; and under the condition that the first information is real information, sending the first information to a second network element in a home network.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an information processing method, device, network node, storage medium and computer program product. Background Art

[0002] In the scenario of international roaming, a common attack method is the fake roaming attack, in which the attacker accesses the network element in the international network and forges the user (also called mobile user) who has not actually (can be understood as real) roamed out of the home network or the visited network to perform related operations (such as location update or authentication and authorization operations) to achieve further attack operations; among them, after successfully forging the user's access to the network, the attacker can trigger the receipt of the user's SMS to achieve attack operations such as using the SMS verification code to log in to a fake account, submit online transactions, and change payment passwords.

[0003] However, when a user accesses a visited network and is in true outbound roaming, there is currently no security protection solution against false roaming attacks. Summary of the invention

[0004] To solve related technical problems, the embodiments of the present application provide an information processing method, device, network node, storage medium and computer program product.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present application provides an information processing method, which is applied to a network node, including:

[0007] When the first terminal has accessed a visited network, receiving first information sent by a first network element in the visited network, where the first information is used to request execution of a service operation associated with the first terminal;

[0008] Verifying the first information using the second information to obtain a verification result, wherein the second information represents a real roaming state of one or more terminals in a visited network, and the verification result represents whether the first information is false information or real information;

[0009] In the case that the first information is true information, the first information is sent to a second network element in the home network.

[0010] In the above solution, the first information includes third information, the third information is used to identify the first terminal, and the verification process of the first information using the second information to obtain the verification result includes:

[0011] searching, from the second information, first roaming status information associated with the third information, where the second information includes roaming status information corresponding to each of the one or more terminals;

[0012] If the first roaming status information is not found, determining that the first information is false information;

[0013] When the first roaming status information is found, the first information is verified using the first roaming status information to obtain the verification result.

[0014] In the above solution, the first information further includes fourth information, where the fourth information is used to identify the first country corresponding to the current access of the first terminal, the first roaming status information includes fifth information, where the fifth information is used to identify the second country corresponding to the last access of the first terminal, and the verification processing of the first information using the first roaming status information to obtain the verification result includes:

[0015] In a case where the first country matches the second country, determining that the first information is authentic;

[0016] In the case that the first country does not match the second country, the first information is verified using the first roaming status information and the sixth information to obtain the verification result, and the sixth information includes port-related information for each of the one or more countries.

[0017] In the above solution, the first information further includes first time information corresponding to the first information, the first roaming state information further includes second time information corresponding to the last access of the first terminal, and the verification processing of the first information using the first roaming state information and the sixth information to obtain the verification result includes:

[0018] Using the sixth information, respectively determine the first port related information associated with the fourth information and the second port related information associated with the fifth information;

[0019] Determine seventh information using the first port-related information and the second port-related information, wherein the seventh information represents the distance between the first country and the second country;

[0020] The verification result is obtained by using the seventh information, the first time information and the second time information.

[0021] In the above solution, the use of the seventh information, the first time information and the second time information to obtain the verification result includes:

[0022] Obtaining time difference information using the first time information and the second time information;

[0023] Determine eighth information using the seventh information and the time difference information, where the eighth information represents a moving speed of the first terminal;

[0024] When the moving speed represented by the eighth information is less than or equal to the first threshold, determining that the first information is true information;

[0025] When the moving speed represented by the eighth information is greater than the first threshold, it is determined that the first information is false information.

[0026] In the above scheme, the method further comprises:

[0027] In the case that the first information is true information, the first roaming status information is updated using the first information to obtain updated first roaming status information.

[0028] In the above scheme, the method further comprises:

[0029] Determining that the first terminal accesses from a visited network to a home network;

[0030] The first roaming status information is deleted from the second information.

[0031] In the above solution, the determining that the first terminal accesses the home network from the visited network includes:

[0032] In the case of acquiring the ninth information sent by the second network element, determining that the first terminal accesses the home network from the visited network, the ninth information being used to instruct the first network element to cancel updating of the location-related information of the first terminal;

[0033] or,

[0034] In the case where the stored tenth information is updated, it is determined that the first terminal accesses the home network from the visited network, and the tenth information represents the actual roaming state of the first terminal in the home network.

[0035] In the above scheme, the method further comprises:

[0036] In the process of the one or more terminals accessing from the home network to the visited network, obtaining roaming state information corresponding to each of the one or more terminals;

[0037] The second information is generated by using the acquired roaming status information.

[0038] The present application also provides an information processing device, including:

[0039] A receiving unit, configured to receive, when the first terminal has accessed the visited network, first information sent by a first network element in the visited network, wherein the first information is used to request execution of a service operation associated with the first terminal;

[0040] a verification unit, configured to verify the first information using second information to obtain a verification result, wherein the second information represents a real roaming state of one or more terminals in a visited network, and the verification result represents whether the first information is false information or real information;

[0041] A sending unit is used to send the first information to a second network element in the home network when the first information is true information.

[0042] The embodiment of the present application also provides a network node, including: a processor and a communication interface; wherein,

[0043] The communication interface is used to receive, when the first terminal has accessed the visited network, first information sent by a first network element in the visited network, wherein the first information is used to request execution of a service operation associated with the first terminal;

[0044] The processor is used to use the second information to verify the first information to obtain a verification result, wherein the second information represents the actual roaming status of one or more terminals in the visited network, and the verification result represents that the first information is false information or true information; and when the first information is true information, the first information is sent to the second network element in the home network through the communication interface.

[0045] The embodiment of the present application further provides a network node, comprising: a processor and a memory for storing a computer program that can be run on the processor,

[0046] Wherein, the processor is used to execute the steps of any of the above-mentioned information processing methods when running the computer program.

[0047] An embodiment of the present application further provides a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the above-mentioned information processing methods.

[0048] An embodiment of the present application further provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned information processing methods when executed by a processor.

[0049] The information processing method, device, network node, storage medium and computer program product provided by the embodiment of the present application, when a first terminal has accessed a visited network, the network node receives first information sent by a first network element in the visited network, the first information is used to request to execute a service operation associated with the first terminal; the first information is verified and processed by the second information to obtain a verification result, the second information represents the real roaming status of one or more terminals in the visited network, and the verification result represents whether the first information is false information or true information; when the first information is true information, the first information is sent to the second network element in the home network. The technical solution provided by the embodiment of the present application, in the scenario where the terminal actually accesses the visited network, the network node uses the international roaming status information (i.e., the second information) as the basis for judging the attack of false counterfeit roaming out of the home network, and uses the international roaming status information to verify the service message (i.e., the first information) transmitted between the visited network and the home network to identify whether the service message is a false message sent by the attacker, so that the false counterfeit roaming out of the home network attack can be accurately identified in the scenario where the terminal actually roams out of the country, thereby reducing the security risk of the terminal being falsely counterfeited roaming. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a structural diagram of the first false counterfeit roaming attack scenario in the related technology;

[0051] Figure 2 It is a structural diagram of the first false counterfeit roaming attack scenario in the related technology;

[0052] Figure 3 A schematic diagram of a method flow for information processing according to an embodiment of the present application;

[0053] Figure 4 This is a flowchart of a method for security protection processing of false counterfeit roaming out of the home network as an example of the application of this application;

[0054] Figure 5 This is a flowchart of a method for security protection processing of a false counterfeit roaming access network as an example of the application of this application;

[0055] Figure 6 A flowchart of a method for deleting information is provided as an example of the application of this application;

[0056] Figure 7 This is a schematic diagram of the structure of an information processing device according to an embodiment of the present application;

[0057] Figure 8 This is a schematic diagram of the network node structure of an embodiment of the present application. DETAILED DESCRIPTION

[0058] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0059] For false roaming attacks, they can be divided into two types: false roaming out of the home network attack and false roaming out of the visited network attack. Figure 1 As shown in the figure, if a user (i.e., user equipment (UE)) accesses the home network (also known as the home public land mobile network (HPLMN)) and does not actually roam abroad, but there is a Category 3 (which can be expressed in English as Category 3) access signaling message related to the user sent by a foreign visited network (also known as a visited public land mobile network (VPLMN)) (which can be understood as a message sent from the visited network to the home network), then this attack behavior can be called a false counterfeit roaming out of the home network attack. Figure 2 As shown, if the user has roamed out of the country and accessed the local visited network (also called VPLMN A), but there are unreasonable class 3 access signaling messages related to the user sent by other visited networks (also called VPLMN B), then this attack behavior can be called a false counterfeit roaming visited network attack. In the above two scenarios, since the user's current trusted location information that can be provided is different, the processing logic of the relevant security protection solutions is different.

[0060] It should be noted that, based on the relevant networking model, the relevant technology divides access signaling messages into three types, namely Class 1 (expressed as Category 1 in English) access signaling messages, Class 2 (expressed as Category 2 in English) access signaling messages and Class 3 access signaling messages; among them, Class 1 access signaling messages are only used within the home network, and the boundary network elements in the home network should intercept Class 1 access signaling messages and whitelist the related signaling of specific business functions opened with roaming partners; Class 2 access signaling messages are sent from the home network to the roaming network. For the related signaling of roaming users, the border network element in the home network should judge the Class 2 access signaling message, and release the signaling only when the user identifier in the visited network matches the identifier in the related signaling message sent by the home network, and intercept it when the two do not match. For example, an Insert-Subscriber-Data message is sent to users in other countries who roam into the domestic network. When the mobile country code (MCC) in the Insert-Subscriber-Data message (Origin-Host or Origin-Realm) is consistent with the MCC included in the User-Name, the above message is released; if the two are inconsistent, the above message is intercepted; Class 3 access signaling messages are related signaling of roaming users sent from the current visited network to the home network, that is, the user will roam out to the visited network. Since the home network cannot manage the visited network, there is a possibility that the visited network sends false and forged attack signaling messages to the home network.

[0061] Here, in the scenario of a false counterfeit roaming out of the home network attack, the principle of the relevant security protection scheme is to make a reasonable judgment on the time and space distance based on the latest location information of the user in the home network to determine whether the user's current roaming operation is normal business logic; if it is determined to be a false counterfeit roaming behavior, the Class 3 access signaling message is safely handled; wherein, the basic basis for the judgment (which can also be understood as an element) is the user's credible and latest time and space location information provided by the home network. For example, for domestic users who roam into other countries' networks, when SS7 signaling or Diameter signaling is frequently sent, the home network checks whether the MCC in different location update signaling messages meets the time and space distance rationality; if it is difficult to update the location within a certain period of time, that is, the time and space distance rationality is not met, the signaling needs to be intercepted; if the time and space distance rationality is met, the signaling is released.

[0062] In the scenario of a false counterfeit roaming attack on the visiting network, the relevant security protection scheme cannot obtain credible information related to the user's international roaming time and space location, and thus cannot perform security risk assessment of Class 3 access signaling messages. Therefore, there is a security risk of false counterfeit roaming attacks.

[0063] Based on this, in various embodiments of the present application, when a terminal accesses a visited network (also referred to as a terminal roaming out of a home network), a network node uses international roaming status data information as a basis for identifying false counterfeit roaming attacks (specifically, false counterfeit roaming out of a visited network attack) to identify whether a message transmitted from a visited network to a home network is a false message, thereby identifying a false counterfeit roaming attack.

[0064] The present application embodiment provides an information processing method, such as Figure 3 As shown, applied to a network node, the method includes:

[0065] Step 301: When a first terminal has accessed a visited network, receiving first information sent by a first network element in the visited network, where the first information is used to request execution of a service operation associated with the first terminal;

[0066] Step 302: Verify the first information using the second information to obtain a verification result, wherein the second information represents the real roaming status of one or more terminals in the visited network, and the verification result represents whether the first information is false information or real information;

[0067] Step 303: When the first information is true information, the first information is sent to a second network element in the home network.

[0068] In actual application, the network node can be deployed at the edge of the visited network, that is, deployed together with the gateway node of the visited network (such as the Security Edge Protection Proxy (SEPP)). Of course, the network node can also be deployed independently in the visited network. In this case, the network node can transmit information with the gateway node.

[0069] In actual application, before step 301, the network node needs to create the second information.

[0070] Based on this, in one embodiment, the method may further include:

[0071] In the process of the one or more terminals accessing from the home network to the visited network, obtaining roaming state information corresponding to each of the one or more terminals;

[0072] The second information is generated by using the acquired roaming status information.

[0073] The acquired roaming status information can be understood as the roaming status information of the terminal carried in the service message sent by the visited network during the process of the terminal accessing the visited network, that is, the roaming status information of the terminal obtained without the rationality judgment of the false counterfeit roaming out of the home network attack. In addition, the second information can be understood as the roaming status information of the terminal obtained after the rationality judgment of the false counterfeit roaming out of the home network attack, and can also be understood as the country-level location information of the terminal in the visited network when the terminal is actually accessed to the visited network; the second information can include the roaming status information corresponding to each of the one or more terminals, and the roaming status information can include one or more of the terminal's identification related information, time information and country related information, the identification related information is used to identify the terminal, the identification related information can include an International Mobile Subscriber Identity (IMSI) or a Mobile Station International Subscriber Directory Number (MSISDN), the time information represents the time corresponding to the last time the terminal actually accessed the visited network, the country related information is used to identify the country corresponding to the last time the terminal actually accessed the visited network, and the country related information can include MCC.

[0074] In actual application, for each terminal, in the process of the terminal accessing from the home network to the visited network, the network node can obtain the eleventh information sent by the first network element in the visited network, the eleventh information is used to request to perform a service operation associated with the terminal in the home network, and the eleventh information at least includes the roaming status information of the terminal; then, the network node can use the twelfth information, the thirteenth information, the fourteenth information and the fifteenth information to verify the eleventh information, so as to realize the rationality judgment of the false counterfeit roaming out of the home network attack; wherein, the twelfth information can be understood as the location of the terminal at the level of the network device (specifically, it can be a base station) in the home network The twelfth information may include first location-related information of one or more terminals in the home network, and the first location-related information may include one or more of identification-related information of one or more terminals, access time information (which may be understood as time information of the latest access of one or more terminals to a network device), longitude and latitude information (which may be understood as longitude and latitude information corresponding to the latest access of one or more terminals to a network device), and cell information (which may also be referred to as location area information); the thirteenth information may be understood as data information of a country or region adjacent to (or bordering) the land in the home network, and the thirteenth information may include country or region data associated with the home network. The second location-related information of one or more countries adjacent to the home by land, the second location-related information may include one or more of identification-related information of one or more countries or regions adjacent to the home by land (such as country name or region name), identification-related information of a port (such as a port name), port type and port location information (such as longitude and latitude); the fourteenth information may be understood as data information of countries or regions adjacent to the home network that are not land-adjacent, the fourteenth information may include third location-related information of one or more countries adjacent to the home network that are not land-adjacent, the fourteenth information may include one or more third location-related information of one or more countries associated with the home network that are not land-adjacent One or more of the following information: regional identification related information (such as country name or regional name), port identification related information (such as port name, which can be the airport name of the port corresponding to international flights), port type (which can be set to an aviation port) and port location information (such as longitude and latitude); the fifteenth information can be understood as speed information corresponding to different travel modes associated with one or more terminals, and the fifteenth information can include speed thresholds corresponding to different travel modes (the values ​​can be pre-set as needed), such as the speed threshold for road travel is 250 kilometers per hour, the speed threshold for rail travel is 400 kilometers per hour, and the speed threshold for air travel is 900 kilometers per hour.

[0075] It should be noted that, for the twelfth information, the network node can obtain the twelfth information through the cell information carried in the location update message transmitted between the network device in the home network and the network element in the core network (such as the mobile switching center (MSC, Mobile Switching Center), the mobility management entity (MME, Mobility Management Entity) or the access and mobility management function (AMF, Access and Mobility Management Function)) and the location data of each network device recorded when the home network is deployed; for the thirteenth information and the fourteenth information, the network node can obtain them from the relevant database; for the fifteenth information, the network node can be pre-configured, of course, it can also be adjusted according to subsequent relevant information, and the embodiments of the present application are not limited to this.

[0076] Here, after completing the verification of the eleventh information corresponding to the one or more terminals, the network node can select one or more terminals that have passed the verification from the one or more terminals (which can be understood as terminals corresponding to the eleventh information as real information), and use the roaming status information corresponding to the selected one or more terminals to generate the second information.

[0077] Exemplarily, in the process of a network element in a visited network (specifically, an MME) sending the eleventh information corresponding to the terminal 1 to a network element in a home network (specifically, a home subscriber server (HSS)), the network node may obtain the eleventh information, and extract information from the eleventh information to obtain the roaming status information of the terminal 1. The roaming status information of the terminal 1 may include the terminal 1 identifier (which may be expressed as User-Name in English), the source domain name (which may be expressed as Origin-Realm in English) or the source host name, and time information, and the source domain name or the source host name may include the MCC. Then, the network node may search for the second location-related information matching the terminal 1 identifier from the thirteenth information; if the matching second location-related information is found, the network node may determine that the eleventh information comes from a land-adjacent country; if the matching second location-related information is not found, the network node may determine that the eleventh information comes from a non-land-adjacent country. In the case where the eleventh information comes from a country adjacent to the country by land, the network node can use the matching second location-related information to determine all port-related information of the country, and use the twelfth information and all port-related information to calculate the minimum distance between the network device most recently accessed by terminal 1 and the port of the country and the time difference between the time when terminal 1 most recently accessed the network device and the time when it accessed the country; use the minimum distance and time difference to calculate the moving speed of terminal 1, and use the moving speed of terminal 1 and the fifteenth information to verify the rationality of the eleventh information. In the case where the eleventh information comes from a country that is not land-adjacent, the network node can search the fourteenth information for third location-related information that matches the terminal 1 identifier, and use the matching third location-related information to determine all port-related information of the country; then, using the twelfth information and all port-related information, calculate the minimum distance between the network device that terminal 1 last accessed and the port of the country and the time difference between the time when terminal 1 last accessed the network device and the time when it accessed the country; use the minimum distance and time difference to calculate the moving speed of terminal 1, and use the moving speed of terminal 1 and the fifteenth information to verify the rationality of the eleventh information.

[0078] In actual application, on the basis of generating the second information, for the first terminal that has accessed the visited network (which can also be understood as the first terminal that has roamed out of the home network), the network node, as an intermediate transmission node, can receive the first information sent by the first network element to the second network element through the network node, and the first information can be understood as a class 3 access signaling message. For example, in the fifth generation mobile communication technology (5G) system, the first information can be an HTTP message; in the global mobile communication system (GSM) system, the first information can be an SS7 message; in the long term evolution (LTE) system, the first information can be a Diameter message; wherein, the first network element can include an MSC, an MME or an AMF, etc., and the embodiment of the present application does not limit the type of the first network element, as long as its function is realized; the second network element can include a home location register (HLR, Home Location Register), an HSS or a unified data repository (UDM, Unified Data Repository), etc., and the embodiment of the present application does not limit the type of the second network element, as long as its function is realized.

[0079] Here, in the process of verifying the first information, the network node can query whether there is roaming status information matching the first terminal in the second information, and then determine whether the first terminal is actually connected to the visited network; wherein, the first information may include third information, and the third information is used to identify the first terminal.

[0080] Specifically, in one embodiment, the specific implementation of step 302 may include:

[0081] searching, from the second information, first roaming status information associated with the third information, where the second information includes roaming status information corresponding to each of the one or more terminals;

[0082] If the first roaming status information is not found, determining that the first information is false information;

[0083] When the first roaming status information is found, the first information is verified using the first roaming status information to obtain the verification result.

[0084] The third information may be understood as identification-related information of the first terminal, and the third information may include IMSI or MSISDN. The embodiment of the present application does not limit the type of the third information.

[0085] In actual application, using the third information, the network node can search for the first roaming status information corresponding to the first terminal from the second information; if the first roaming status information is not found, it means that the first terminal is not truly connected to the visited network. In this case, the network node can determine that the first information is false information, that is, there is a false counterfeit roaming attack on the visited network.

[0086] Here, when the first roaming status information is found, it indicates that the first terminal is actually connected to the visited network. In this case, the network node can use the first roaming status information to further verify the rationality of the first information.

[0087] Specifically, in an embodiment, the first information further includes fourth information, the fourth information is used to identify a first country corresponding to the current access of the first terminal, the first roaming status information includes fifth information, the fifth information is used to identify a second country corresponding to the last access of the first terminal, and the verifying the first information using the first roaming status information to obtain the verification result includes:

[0088] In a case where the first country matches the second country, determining that the first information is authentic;

[0089] In the case that the first country does not match the second country, the first information is verified using the first roaming status information and the sixth information to obtain the verification result, and the sixth information includes port-related information for each of the one or more countries.

[0090] Among them, the fourth information may include country-related information of the first terminal, such as MCC, and the fourth information may be set on one or more fields in the source domain name, source host or GT code in the first information, which is not limited to this in the embodiment of the present application; the fifth information may include country-related information corresponding to the last time the first terminal actually accessed the visited network.

[0091] In actual application, by matching the fourth information and the fifth information, the network node can determine whether the first country and the second country match, that is, whether the first information and the eleventh information corresponding to the first terminal are from the same country, which can also be understood as whether the first terminal is located in the same country when the first network element transmits the first information and the eleventh information; if the first country matches the second country, the network node can determine that the first information is true information.

[0092] Here, if the first country does not match the second country, the network node can use the first roaming status information and the sixth information to determine the movement of the first terminal from the first country to the second country, thereby verifying the rationality of the first information; wherein the sixth information can be understood as port-related information for each country in one or more countries around the world, and the port-related information can include country identification information (such as country name), port identification-related information (such as port name, which can be the airport name of the country's aviation port), port type (such as aviation port) and port location information (such as longitude and latitude); in addition, the sixth information can be obtained from a related database. Of course, the sixth information can also be obtained based on related aviation port data. The embodiment of the present application does not limit the specific method of obtaining the sixth information.

[0093] Specifically, in one embodiment, the first information further includes first time information corresponding to the first information, the first roaming state information further includes second time information corresponding to the last access of the first terminal, and the verifying the first information by using the first roaming state information and the sixth information to obtain the verification result includes:

[0094] Using the sixth information, respectively determine the first port related information associated with the fourth information and the second port related information associated with the fifth information;

[0095] Determine seventh information using the first port-related information and the second port-related information, wherein the seventh information represents the distance between the first country and the second country;

[0096] The verification result is obtained by using the seventh information, the first time information and the second time information.

[0097] In actual application, the first time information represents the first time when the first information is generated, and the second time information represents the second time corresponding to the last time when the first terminal actually accessed the visited network.

[0098] In actual application, the network node can respectively search for the first port related information corresponding to the first country and the second port related information corresponding to the second country from the sixth information, the first port related information at least including the port location information corresponding to one or more first ports in the first country, and the second port related information at least including the port location information corresponding to one or more second ports in the second country; then, the port location information corresponding to each first port and the port location information corresponding to the second port are used in turn to calculate the shortest distance between the first port and the second port, and based on the calculated shortest distance, the seventh information is obtained, that is, the seventh information represents the shortest distance between the first country and the second country.

[0099] Here, after determining the seventh information, the network node may verify the rationality of the first information based on the moving speed of the first terminal from the first country to the second country.

[0100] Specifically, in one embodiment, the using the seventh information, the first time information and the second time information to obtain the verification result includes:

[0101] Obtaining time difference information using the first time information and the second time information;

[0102] Determine eighth information using the seventh information and the time difference information, where the eighth information represents a moving speed of the first terminal;

[0103] When the moving speed represented by the eighth information is less than or equal to the first threshold, determining that the first information is true information;

[0104] When the moving speed represented by the eighth information is greater than the first threshold, it is determined that the first information is false information.

[0105] Here, by performing a difference processing on the first time represented by the first time information and the second time represented by the second time information, the network node can calculate the time difference information and then obtain the eighth information. At the same time, using the distance represented by the seventh information, the network node can determine the travel mode that the first terminal can adopt, and the time difference information represents the time interval between the first time and the second time; then, based on the determined travel mode, the corresponding speed threshold is searched from the fifteenth information to obtain the first threshold, that is, the value of the first threshold is associated with the travel mode; then, by comparing the moving speed represented by the eighth information with the first threshold, the network node can determine whether the moving speed is within a reasonable range and then judge the rationality of the first information.

[0106] Exemplarily, when the distance represented by the seventh information is greater than or equal to a second threshold (which can be set as needed, such as 2,000 kilometers), the network node determines that the travel mode that the first terminal can adopt is air travel, then the first threshold determined from the fifteenth information is 900 kilometers per hour; in this case, if the moving speed represented by the eighth information is less than or equal to the first threshold, it means that the moving speed of the first terminal is within a reasonable range, that is, the first terminal can use air travel to reach the second country from the first country within the time interval between the first time and the second time, therefore, the first information is true information; if the moving speed represented by the eighth information is greater than the first threshold, it means that the moving speed of the first terminal is not within a reasonable range, therefore, the first information is false information.

[0107] Exemplarily, when the distance represented by the seventh information is less than the second threshold and greater than or equal to the third threshold (which can be set as needed, such as 1,000 kilometers), the network node determines that the travel mode that the first terminal can adopt is rail travel, then the first threshold determined from the fifteenth information is 400 kilometers per hour; in this case, if the moving speed represented by the eighth information is less than or equal to the first threshold, it means that the moving speed of the first terminal is within a reasonable range, that is, the first terminal can use rail travel to reach the second country from the first country within the time interval between the first time and the second time, therefore, the first information is true information; if the moving speed represented by the eighth information is greater than the first threshold, it means that the moving speed of the first terminal is not within a reasonable range, therefore, the first information is false information.

[0108] Exemplarily, when the distance represented by the seventh information is less than the third threshold, the network node determines that the travel mode that the first terminal can adopt is road travel, then the first threshold determined from the fifteenth information is 250 kilometers per hour; in this case, if the moving speed represented by the eighth information is less than or equal to the first threshold, it means that the moving speed of the first terminal is within a reasonable range, that is, the first terminal can use road travel to reach the second country from the first country within the time interval between the first time and the second time, therefore, the first information is true information; if the moving speed represented by the eighth information is greater than the first threshold, it means that the moving speed of the first terminal is not within a reasonable range, therefore, the first information is false information.

[0109] In actual application, when the first information is determined to be false information through security risk judgment of false counterfeit roaming out of the home network, the network node can determine that there is an attack behavior of false counterfeit roaming out of the visited network, and therefore, it can stop sending the first information to the second network element (which can also be understood as intercepting the first information).

[0110] In actual application, when the security risk of false counterfeit roaming out of the home network is judged and the first information is determined to be true information, the network node can determine that there is no false counterfeit roaming out of the visited network attack behavior, and therefore, the first information can be sent (also called released or transmitted) to the second network element.

[0111] Here, in the case that the first information is real information, the network node may also update the first roaming status information in real time.

[0112] Based on this, in one embodiment, the method may further include:

[0113] In the case that the first information is true information, the first roaming status information is updated using the first information to obtain updated first roaming status information.

[0114] In actual application, when the first information is determined to be true information by matching the first country with the second country, the network node can use the first time information to update the first roaming status information; wherein the first time information can be used to replace the second time information to achieve the update of the first roaming status.

[0115] In addition, when the first information is determined to be true information by means of the moving speed represented by the eighth information being less than or equal to the first threshold, the network node can use the first time information and the fourth information to update the first roaming status information; wherein, the first time information can be used to replace the second time information, and the fourth information can be used to replace the fifth information to achieve the update of the first roaming status.

[0116] In actual application, for a terminal that has returned from a visited network to a home network, the network node may also delete the roaming status information corresponding to the terminal in the second information, so as to accurately identify the attack behavior of falsely roaming out of the visited network later.

[0117] Based on this, in one embodiment, the method may further include:

[0118] Determining that the first terminal accesses from a visited network to a home network;

[0119] The first roaming status information is deleted from the second information.

[0120] Here, in actual application, the network node may determine whether the first terminal returns from the visited network to the home network in different ways; wherein, the information transmitted by the second network may be monitored.

[0121] Specifically, in one embodiment, determining that the first terminal accesses the home network from the visited network includes:

[0122] When the ninth information sent by the second network element is acquired, it is determined that the first terminal accesses the home network from the visited network, and the ninth information is used to instruct the first network element to cancel updating of the location-related information of the first terminal.

[0123] In which, in actual application, the ninth information may include the third information, and the ninth information may be called cancellation location update information. The embodiment of the present application does not limit the name of the ninth information as long as its function is realized.

[0124] Here, when the first terminal accesses the home network, the second network element can send the ninth information to the first network element through the network node; in the above process, the network node can obtain the ninth information, and then delete the first roaming status information from the second information.

[0125] In addition, the network node may also monitor the update status of the information associated with the first terminal in the twelfth information to determine whether the first terminal is connected to the home network.

[0126] Specifically, in one embodiment, determining that the first terminal accesses the home network from the visited network includes:

[0127] In the case where the stored tenth information is updated, it is determined that the first terminal accesses the home network from the visited network, and the tenth information represents the actual roaming state of the first terminal in the home network.

[0128] Among them, the tenth information can be understood as the first location related information corresponding to the first terminal in the twelfth information, and the tenth information can include one or more of the identification related information of the first terminal, access time information (which can be understood as the time information of the first terminal's latest access to the network device), longitude and latitude information (which can be understood as the longitude and latitude information corresponding to the network device the first terminal last accessed) and cell information (also called location area information).

[0129] Here, in the process of the first terminal accessing the home network, the network node can update the tenth information based on the current access status of the first terminal (such as updating the access time information or the longitude and latitude information), and at the same time, delete the first roaming status information.

[0130] In addition, the network node may also monitor the access time information included in the tenth information; and delete the first roaming status information when the third time represented by the access time information is later than the second time represented by the second time information in the first roaming status information.

[0131] The information processing method provided by the embodiment of the present application is that when a first terminal has accessed a visited network, a network node receives a first message sent by a first network element in the visited network, the first message is used to request to execute a service operation associated with the first terminal; the first message is verified and processed using the second information to obtain a verification result, the second information represents the real roaming status of one or more terminals in the visited network, and the verification result represents whether the first information is false information or true information; when the first information is true information, the first information is sent to the second network element in the home network. The technical solution provided by the embodiment of the present application is that when the terminal actually accesses the visited network, the network node uses the international roaming status information (i.e., the second information) as a basis for judging the attack of false counterfeit roaming out of the home network, and uses the international roaming status information to verify the service message (i.e., the first information) transmitted between the visited network and the home network to identify whether the service message is a false message sent by the attacker. In this way, the false counterfeit roaming out of the home network attack can be accurately identified in the scenario where the terminal actually roams out of the country, thereby reducing the security risk of the terminal being falsely counterfeited roaming.

[0132] The present application is described in further detail below in conjunction with application examples.

[0133] In the related art, after a user roams out of a home network, since the user cannot obtain credible space-time vector information in the currently accessed visited network, it is impossible to effectively and accurately identify the false roaming attack when the user currently accesses the visited network.

[0134] In response to the above problems, in the application example of this application, a security identification scheme for false counterfeit roaming attacks on visited networks in international intercommunication is proposed; in the above scheme, the space-time vector information obtained after the rationality judgment of the false counterfeit roaming to the home network is used to create international roaming status data information, so as to identify false counterfeit roaming attacks on visited networks in the scenario where the user has actually accessed the local visited network.

[0135] Specifically, as shown in FIG. 4 , taking the Diameter message in the LTE system as an example, the process of the security protection system (i.e., the above-mentioned network node) identifying the false counterfeit flooding attack out of the home network includes the following steps:

[0136] Step 401: The security protection system receives a roaming request message (ie, the eleventh information) sent by the MME (ie, the first network element) to the HSS (ie, the second network element).

[0137] Here, the security protection system can pre-configure the land-adjacent country / region data information of the home network (i.e., the thirteenth information mentioned above), the non-land-adjacent country / region data information of the home network (i.e., the fourteenth information mentioned above), and the travel mode speed limit configuration data information (i.e., the fifteenth information mentioned above) based on the relevant open port information and airport information; wherein, the travel mode speed limit configuration data information can provide the corresponding speed limits for road, rail and air travel. The security protection system can also make adjustments to the travel mode speed limit configuration data information as needed later.

[0138] In addition, based on the user's access status, the security protection system can also generate domestic roaming status data information for the user (i.e. the twelfth information mentioned above), and the domestic roaming status data information can record the user's base station-level location information in the home network in real time.

[0139] Step 402: The security protection system extracts the user identification, source domain name and timestamp key data information from the roaming request message;

[0140] Step 403: The security protection system queries the latitude and longitude information of the base station the user last accessed from the domestic roaming status data information according to the user identifier;

[0141] Step 404: The security protection system uses the MCC in the source domain name to search from the land-adjacent country / region data information of the home network to determine whether the roaming request message comes from a land-adjacent neighboring country;

[0142] If the roaming request message does not come from a neighboring country bordering on land, execute step 405 ; if the roaming request message comes from a neighboring country bordering on land, execute step 411 .

[0143] It should be noted that the execution order of step 403 and step 404 is not specific.

[0144] Step 405: The security protection system uses the MCC in the source domain name to search for the latitude and longitude information of the aviation border port from the data information of the non-land adjacent countries / regions in the home network;

[0145] Step 406: The security protection system uses the latitude and longitude information of each aviation border port and the queried latitude and longitude information of the base station to calculate the shortest distance between the aviation border port and the base station;

[0146] Step 407: The security protection system calculates the speed using the closest distance value and the difference between the entry request message and the time of the last access to the domestic base station;

[0147] Step 408: The safety protection system determines whether the speed is greater than the aviation speed limit;

[0148] Among them, the aviation speed limit value, such as 900 kilometers per hour, can be obtained from the travel mode speed limit configuration data information.

[0149] Here, if the speed is greater than the aviation speed limit, it is determined that there is a false counterfeit out-of-home network attack, and step 409 is executed; if the speed is less than or equal to the aviation speed limit, step 410 is executed.

[0150] Step 409: The security protection system performs an interception action;

[0151] That is, the security protection system intercepts the roaming request message and stops transmitting the roaming request message to the HSS.

[0152] Step 410: The security protection system releases a communication command;

[0153] That is, the security protection system transmits the roaming request message to the HSS.

[0154] Step 411: The security protection system uses the MCC in the source domain name to find the latitude and longitude information of the land border port from the land adjacent country / region data information of the home network;

[0155] Step 412: The security protection system uses the longitude and latitude information of each land border port and the longitude and latitude information of the base station found to calculate the shortest distance between the land border port and the base station;

[0156] Step 413: The security protection system calculates the speed using the closest distance value and the time difference between the entry request message and the time of the last access to the domestic base station;

[0157] Step 414: The security protection system determines whether the shortest distance value calculated between the longitude and latitude information of the land border port and the longitude and latitude of the base station is less than 2000 kilometers;

[0158] Wherein, when the closest distance value is less than 2000 kilometers, step 415 is executed; when the closest distance value is greater than or equal to 2000 kilometers, step 408 is executed.

[0159] Step 415: The security protection system determines the type of land border crossing corresponding to the closest distance value;

[0160] Here, if the land border port type is road, step 416 is executed; if the land border port type is railway, step 418 is executed.

[0161] Step 416: The safety protection system determines whether the speed is greater than the highway speed limit;

[0162] Among them, the highway speed limit value, such as 250 kilometers per hour, can be obtained from the travel mode speed limit configuration data information.

[0163] If the speed is greater than the highway speed limit, it is determined that there is a false counterfeit out-of-home network attack, and step 417 is executed; if the speed is less than or equal to the aviation speed limit, step 410 is executed.

[0164] Step 417: The security protection system performs an interception action;

[0165] Step 418: The safety protection system determines whether the speed is greater than the railway speed limit;

[0166] Among them, the railway speed limit value, such as 400 kilometers per hour, can be obtained from the travel mode speed limit configuration data information.

[0167] If the speed is greater than the railway speed limit, it is determined that there is a false counterfeit out-of-home network attack, and step 417 is executed; if the speed is less than or equal to the aviation speed limit, step 419 is executed.

[0168] Step 419: The security protection system sends a communication command.

[0169] In the above scheme, the reasonableness of the speed provided by the relevant travel mode is used to determine the false counterfeit roaming attack that users who roam out of the home network for the first time may face, which can accurately identify the signaling security risks faced by the false counterfeit roaming out of the home network scenario.

[0170] Here, in order to reduce the security risk of false and counterfeit roaming access network attacks, when the security protection system releases the roaming request message, it can also dynamically generate an international roaming status data information table (i.e., the second information mentioned above) based on the space-time vector information in the roaming request message (specifically, it can be the user ID, source domain name and timestamp key data information). The international roaming status data information table contains at least the user ID, the timestamp corresponding to the roaming request message, and the country code information corresponding to the roaming request message.

[0171] Specifically, as shown in FIG. 5 , taking the Diameter message in the LTE system as an example, the process of the security protection system identifying the false spoofed flooding attack on the visited network includes the following steps:

[0172] Step 501: The security protection system receives a roaming request message sent by the MME to the HSS;

[0173] The roaming request message is a type 3 roaming request signaling.

[0174] Here, the security protection system can pre-configure global country / region data information (ie, the sixth information mentioned above) based on relevant open port information and airport information.

[0175] Step 502: The security protection system extracts the user identifier (i.e., the third information mentioned above), the source domain name (also referred to as the source host name) (i.e., the fourth information mentioned above) and the timestamp key data information (i.e., the first time information mentioned above) from the roaming request message;

[0176] Step 503: The security protection system uses the user identifier to search the international roaming status data information for relevant record information of the user (ie, the first roaming status information mentioned above);

[0177] If there is relevant record information of the user, it means that the user has not actually roamed out of the home network. In this case, execute the above steps 403 to 419; if there is no relevant record information of the user, it means that the user has actually roamed out of the home network. In this case, execute step 504.

[0178] Step 504: The security protection system determines whether the MCC in the roaming request message is the same as the country code corresponding to the user identifier in the international roaming status data information (ie, the fifth information mentioned above);

[0179] Among them, if the country code corresponding to the MCC and the user identifier in the roaming request message is the same, it means that the roaming request message comes from the same country. In this case, execute step 505; if the country code corresponding to the MCC and the user identifier in the roaming request message is different, it means that the roaming request message comes from different countries. At this time, execute step 507.

[0180] Step 505: The security protection system sends a communication signal;

[0181] That is, the security protection system transmits the roaming request message to the HSS.

[0182] Step 506: The security protection system updates the relevant record information corresponding to the user in the international roaming status data information using the MCC and / or timestamp key data information in the roaming request message;

[0183] Here, when the MCC in the roaming request message is the same as the country code corresponding to the user identity, the timestamp key data information is used to update the information corresponding to the user in the international roaming status data information.

[0184] Step 507: The security protection system uses the country code corresponding to the MCC and the user identity in the roaming request message to search for the corresponding longitude and latitude information of the aviation border port (i.e., the first port related information and the second port related information mentioned above) from the global country / region data information;

[0185] Step 508: The security protection system uses the found latitude and longitude information of the aviation border ports to calculate the shortest distance between the two aviation border ports;

[0186] Step 509: The security protection system calculates the speed (i.e., the eighth information) by using the closest distance value and the time difference (i.e., the seventh information) between the timestamp in the roaming request message and the timestamp corresponding to the user identity (i.e., the second time information) mentioned above.

[0187] Step 510: The safety protection system determines whether the calculated minimum distance value is less than 2000 kilometers;

[0188] If the shortest distance value is greater than or equal to 2000 kilometers, step 511 is executed; if the shortest distance value is less than 2000 kilometers, step 513 is executed.

[0189] Step 511: determining whether the calculated speed is greater than the aviation speed limit (i.e., the first threshold value mentioned above);

[0190] Among them, the aviation speed limit value, such as 900 kilometers per hour, can be obtained from the travel mode speed limit configuration data information.

[0191] Here, if the speed is greater than the aviation speed limit, it is determined that the speed is not within a reasonable range (i.e., the user cannot use the corresponding means of transportation to reach the corresponding country within the time difference between the two signaling messages), and there may be a false counterfeit outbound visiting network attack, and step 512 is executed; if the speed is less than or equal to the aviation speed limit, it means that the user can use the corresponding means of transportation to reach the corresponding country within the time difference between the two signaling messages, therefore, step 505 is executed.

[0192] Step 512: The security protection system performs an interception action;

[0193] That is, the security protection system intercepts the roaming request message and stops transmitting the roaming request message to the HSS.

[0194] Step 513: The safety protection system determines whether the closest distance value is less than 1000 kilometers;

[0195] If the closest distance value is greater than or equal to 1000 kilometers, step 514 is executed; if the closest distance value is less than 1000 kilometers, step 516 is executed.

[0196] Step 514: The safety protection system determines whether the speed is greater than the railway speed limit (i.e., the first threshold value mentioned above);

[0197] Among them, the railway speed limit value, such as 400 kilometers per hour, can be obtained from the travel mode speed limit configuration data information.

[0198] Here, if the speed is greater than the railway speed limit, it is determined that the speed is not within a reasonable range, and there may be a false counterfeit outbound access network attack, so step 512 is executed; if the speed is less than or equal to the railway speed limit, it means that the speed is within a reasonable range, and step 515 is executed.

[0199] Step 515: The security protection system sends a communication command and uses the MCC and timestamp key data information in the roaming request message to update the relevant record information corresponding to the user in the international roaming status data information, that is, executing step 506.

[0200] Step 516: The safety protection system determines whether the speed is greater than the highway speed limit (i.e., the first threshold value mentioned above);

[0201] Among them, the highway speed limit value, such as 250 kilometers per hour, can be obtained from the travel mode speed limit configuration data information.

[0202] Here, if the speed is greater than the highway speed limit, it is determined that the speed is not within a reasonable range, and there may be a false counterfeit outbound access network attack, so step 517 is executed; if the speed is less than or equal to the railway speed limit, it means that the speed is within a reasonable range, and step 515 is executed.

[0203] Step 517: The security protection system performs an interception action.

[0204] From the above description, it can be seen that when the user reasonably roams from the visited network of the current country to the visited network of other countries or performs access updates within the visited network, after sending a communication command based on the above scheme, the security protection system should update the relevant record information of the user in the international roaming status data information table in real time. Specifically, the timestamp in the relevant record information and the country code information recorded in the current roaming request message can be updated.

[0205] In addition, when the user returns from the visited network to the home network, the security protection system can also delete the user's related record information in the international roaming status data information table.

[0206] Specifically, the security protection system deletes the user's relevant record information, such as Figure 6 As shown, the following steps are included:

[0207] Step 601: The security protection system determines that there is user-related record information in the international roaming status data information table;

[0208] Step 602: The security protection system deletes the user record by monitoring the outbound cancellation location update message (i.e., the ninth message mentioned above);

[0209] Here, the security protection system monitors the cancel location update message sent from the network element of the home network, and when the cancel location update message associated with the user identity is obtained, the relevant record information of the user is deleted from the international roaming status data information table.

[0210] Step 604: When the security protection system updates the domestic roaming status data information, the user record is deleted synchronously;

[0211] Here, when the user returns to the home network from the visited network, the security protection system updates the roaming status data information corresponding to the user in the domestic roaming status data information (ie, the tenth information mentioned above), and deletes the relevant record information of the user from the international roaming status data information table.

[0212] Step 604: The security protection system deletes the user record by monitoring the records in the domestic roaming status data information.

[0213] Here, when the time recorded in the latest domestic successful location update data information of the user is later than the time recorded in the international roaming status data information table, the security protection system deletes the relevant record information of the user in the international roaming status data information table.

[0214] In the application example of this application, international roaming status data information is created, and the international roaming status data information is used as a reliable basis for determining the risk of false counterfeit roaming out of the visited network, so that in the subsequent scenario where the user actually accesses the local visited network, the signaling of false counterfeit roaming out of the visited network attack can be accurately identified, thereby improving the accuracy of signaling security protection.

[0215] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an information processing device, which is set on a network node, such as Figure 7 As shown, the device comprises:

[0216] A receiving unit 701 is configured to receive, when a first terminal has accessed a visited network, first information sent by a first network element in the visited network, where the first information is used to request execution of a service operation associated with the first terminal;

[0217] a verification unit 702, configured to verify the first information using second information to obtain a verification result, wherein the second information represents a real roaming state of one or more terminals in a visited network, and the verification result represents whether the first information is false information or real information;

[0218] The sending unit 703 is configured to send the first information to a second network element in the home network when the first information is true information.

[0219] In one embodiment, the first information includes third information, where the third information is used to identify the first terminal, and the verification unit 702 is configured to:

[0220] searching, from the second information, first roaming status information associated with the third information, where the second information includes roaming status information corresponding to each of the one or more terminals;

[0221] If the first roaming status information is not found, determining that the first information is false information;

[0222] When the first roaming status information is found, the first information is verified using the first roaming status information to obtain the verification result.

[0223] In one embodiment, the first information further includes fourth information, where the fourth information is used to identify a first country corresponding to the current access of the first terminal, the first roaming status information includes fifth information, where the fifth information is used to identify a second country corresponding to the last access of the first terminal, and the verification unit 702 is used to:

[0224] In a case where the first country matches the second country, determining that the first information is authentic;

[0225] In the case that the first country does not match the second country, the first information is verified using the first roaming status information and the sixth information to obtain the verification result, and the sixth information includes port-related information for each of the one or more countries.

[0226] In one embodiment, the first information further includes first time information corresponding to the first information, and the first roaming status information further includes second time information corresponding to the last access of the first terminal, and the verification unit 702 is used to:

[0227] Using the sixth information, respectively determine the first port related information associated with the fourth information and the second port related information associated with the fifth information;

[0228] Determine seventh information using the first port-related information and the second port-related information, wherein the seventh information represents the distance between the first country and the second country;

[0229] The verification result is obtained by using the seventh information, the first time information and the second time information.

[0230] In one embodiment, the verification unit 702 is used to:

[0231] Obtaining time difference information using the first time information and the second time information;

[0232] Determine eighth information using the seventh information and the time difference information, where the eighth information represents a moving speed of the first terminal;

[0233] When the moving speed represented by the eighth information is less than or equal to the first threshold, determining that the first information is true information;

[0234] When the moving speed represented by the eighth information is greater than the first threshold, it is determined that the first information is false information.

[0235] In one embodiment, the verification unit 702 is further configured to, when the first information is true information, update the first roaming status information using the first information to obtain updated first roaming status information.

[0236] In one embodiment, the verification unit 702 is further configured to:

[0237] Determining that the first terminal accesses from a visited network to a home network;

[0238] The first roaming status information is deleted from the second information.

[0239] In one embodiment, the verification unit 702 is used to:

[0240] In the case of acquiring the ninth information sent by the second network element, determining that the first terminal accesses the home network from the visited network, the ninth information being used to instruct the first network element to cancel updating of the location-related information of the first terminal;

[0241] or,

[0242] In the case where the stored tenth information is updated, it is determined that the first terminal accesses the home network from the visited network, and the tenth information represents the actual roaming state of the first terminal in the home network.

[0243] In one embodiment, the receiving unit 701 is further configured to obtain roaming status information corresponding to each of the one or more terminals during the process of the one or more terminals accessing from the home network to the visited network;

[0244] The verification unit 702 is further configured to generate the second information by using the acquired roaming status information.

[0245] In actual application, the receiving unit 701 and the sending unit 703 can be implemented by a communication interface in an information processing device; the verification unit 702 can be implemented by a processor in the information processing device.

[0246] It should be noted that: when the information processing device provided in the above embodiment performs information processing, only the division of the above program modules is used as an example. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the information processing device provided in the above embodiment and the information processing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0247] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a network node, such as Figure 8 As shown, the network node 800 includes:

[0248] Communication interface 801, capable of exchanging information with other devices;

[0249] A processor 802, connected to the communication interface 801 to implement information interaction with other devices, and used to execute the method provided by one or more of the above technical solutions when running a computer program;

[0250] A memory 803 , on which the computer program is stored.

[0251] Specifically, the communication interface 801 is used to receive first information sent by a first network element in a visited network when the first terminal has accessed the visited network, where the first information is used to request execution of a service operation associated with the first terminal;

[0252] The processor 802 is used to use the second information to verify the first information to obtain a verification result, wherein the second information represents the actual roaming status of one or more terminals in the visited network, and the verification result represents whether the first information is false information or true information; and when the first information is true information, the first information is sent to the second network element in the home network through the communication interface 801.

[0253] In one embodiment, the first information includes third information, where the third information is used to identify the first terminal, and the processor 802 is configured to:

[0254] searching, from the second information, first roaming status information associated with the third information, where the second information includes roaming status information corresponding to each of the one or more terminals;

[0255] If the first roaming status information is not found, determining that the first information is false information;

[0256] When the first roaming status information is found, the first information is verified using the first roaming status information to obtain the verification result.

[0257] In an embodiment, the first information further includes fourth information, where the fourth information is used to identify a first country corresponding to the current access of the first terminal, the first roaming status information includes fifth information, where the fifth information is used to identify a second country corresponding to the last access of the first terminal, and the processor 802 is configured to:

[0258] In a case where the first country matches the second country, determining that the first information is authentic;

[0259] In the case that the first country does not match the second country, the first information is verified using the first roaming status information and the sixth information to obtain the verification result, and the sixth information includes port-related information for each of the one or more countries.

[0260] In one embodiment, the first information further includes first time information corresponding to the first information, and the first roaming status information further includes second time information corresponding to the last access of the first terminal, and the processor 802 is configured to:

[0261] Using the sixth information, respectively determine the first port related information associated with the fourth information and the second port related information associated with the fifth information;

[0262] Determine seventh information using the first port-related information and the second port-related information, wherein the seventh information represents the distance between the first country and the second country;

[0263] The verification result is obtained by using the seventh information, the first time information and the second time information.

[0264] In one embodiment, the processor 802 is configured to:

[0265] Obtaining time difference information using the first time information and the second time information;

[0266] Determine eighth information using the seventh information and the time difference information, where the eighth information represents a moving speed of the first terminal;

[0267] When the moving speed represented by the eighth information is less than or equal to the first threshold, determining that the first information is true information;

[0268] When the moving speed represented by the eighth information is greater than the first threshold, it is determined that the first information is false information.

[0269] In an embodiment, the processor 802 is further configured to, when the first information is true information, update the first roaming status information using the first information to obtain updated first roaming status information.

[0270] In one embodiment, the processor 802 is further configured to:

[0271] Determining that the first terminal accesses from a visited network to a home network;

[0272] The first roaming status information is deleted from the second information.

[0273] In one embodiment, the processor 802 is further configured to:

[0274] In the case of acquiring the ninth information sent by the second network element, determining that the first terminal accesses the home network from the visited network, the ninth information being used to instruct the first network element to cancel updating of the location-related information of the first terminal;

[0275] or,

[0276] In the case where the stored tenth information is updated, it is determined that the first terminal accesses the home network from the visited network, and the tenth information represents the actual roaming state of the first terminal in the home network.

[0277] In one embodiment, the communication interface 801 is further used to obtain roaming status information corresponding to each of the one or more terminals during the process of the one or more terminals accessing from the home network to the visited network;

[0278] The processor 802 is further configured to generate the second information by using the acquired roaming status information.

[0279] It should be noted that the specific processing process of the processor 802 and the communication interface 801 can be understood by referring to the above method.

[0280] Of course, in actual application, the various components in the network node 800 are coupled together through the bus system 804. It can be understood that the bus system 804 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 8Various buses are labeled as bus system 804 .

[0281] The memory 803 in the embodiment of the present application is used to store various types of data to support the operation of the network node 800. Examples of such data include: any computer program used to operate on the network node 800.

[0282] The method disclosed in the above embodiment of the present application can be applied to the processor 802, or implemented by the processor 802. The processor 802 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 802 or an instruction in the form of software. The above-mentioned processor 802 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 802 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 803, and the processor 802 reads the information in the memory 803 and completes the steps of the above method in combination with its hardware.

[0283] In an exemplary embodiment, the network node 800 may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

[0284] It can be understood that the memory (memory 803) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAMbus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.

[0285] In an exemplary embodiment, the embodiment of the present application further provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, including a memory 803 storing a computer program, and the computer program can be executed by a processor 802 of a network node 800 to complete the steps of the aforementioned network node side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0286] In an exemplary embodiment, the embodiment of the present application further provides a computer program product, including a computer program, which can be executed by the processor 802 of the network node 800 to complete the steps of the aforementioned network node side method.

[0287] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0288] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0289] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An information processing method, characterized in that: Applied to network nodes, including: When the first terminal has accessed a visited network, receiving first information sent by a first network element in the visited network, where the first information is used to request execution of a service operation associated with the first terminal; Verifying the first information using the second information to obtain a verification result, wherein the second information represents a real roaming state of one or more terminals in a visited network, and the verification result represents whether the first information is false information or real information; In the case that the first information is true information, the first information is sent to a second network element in the home network.

2. The method according to claim 1, characterized in that The first information includes third information, the third information is used to identify the first terminal, and the verification process is performed on the first information using the second information to obtain a verification result, including: searching, from the second information, first roaming status information associated with the third information, where the second information includes roaming status information corresponding to each of the one or more terminals; If the first roaming status information is not found, determining that the first information is false information; When the first roaming status information is found, the first information is verified using the first roaming status information to obtain the verification result.

3. The method according to claim 2, characterized in that The first information further includes fourth information, where the fourth information is used to identify a first country corresponding to the current access of the first terminal, the first roaming status information includes fifth information, where the fifth information is used to identify a second country corresponding to the last access of the first terminal, and the verifying the first information using the first roaming status information to obtain the verification result includes: In a case where the first country matches the second country, determining that the first information is authentic; In the case that the first country does not match the second country, the first information is verified using the first roaming status information and the sixth information to obtain the verification result, and the sixth information includes port-related information for each of the one or more countries.

4. The method according to claim 3, characterized in that The first information further includes first time information corresponding to the first information, the first roaming state information further includes second time information corresponding to the last access of the first terminal, and the verifying the first information by using the first roaming state information and the sixth information to obtain the verification result includes: Using the sixth information, respectively determine the first port related information associated with the fourth information and the second port related information associated with the fifth information; Determine seventh information using the first port-related information and the second port-related information, wherein the seventh information represents the distance between the first country and the second country; The verification result is obtained by using the seventh information, the first time information and the second time information.

5. The method according to claim 4, characterized in that The obtaining the verification result by using the seventh information, the first time information and the second time information includes: Obtaining time difference information using the first time information and the second time information; Determine eighth information using the seventh information and the time difference information, where the eighth information represents a moving speed of the first terminal; When the moving speed represented by the eighth information is less than or equal to the first threshold, determining that the first information is true information; When the moving speed represented by the eighth information is greater than the first threshold, it is determined that the first information is false information.

6. The method according to claim 2, characterized in that The method further comprises: In the case that the first information is true information, the first roaming status information is updated using the first information to obtain updated first roaming status information.

7. The method according to claim 2, characterized in that The method further comprises: Determining that the first terminal accesses from a visited network to a home network; The first roaming status information is deleted from the second information.

8. The method according to claim 7, characterized in that The determining that the first terminal accesses from a visited network to a home network includes: In the case of acquiring the ninth information sent by the second network element, determining that the first terminal accesses the home network from the visited network, the ninth information being used to instruct the first network element to cancel updating of the location-related information of the first terminal; or, In the case where the stored tenth information is updated, it is determined that the first terminal accesses the home network from the visited network, and the tenth information represents the actual roaming state of the first terminal in the home network.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: In the process of the one or more terminals accessing from the home network to the visited network, obtaining roaming state information corresponding to each of the one or more terminals; The second information is generated by using the acquired roaming status information.

10. An information processing device, characterized in that: include: A receiving unit, configured to receive, when the first terminal has accessed the visited network, first information sent by a first network element in the visited network, wherein the first information is used to request execution of a service operation associated with the first terminal; a verification unit, configured to verify the first information using second information to obtain a verification result, wherein the second information represents a real roaming state of one or more terminals in a visited network, and the verification result represents whether the first information is false information or real information; A sending unit is used to send the first information to a second network element in the home network when the first information is true information.

11. A network node, characterized in that: include: Processor and communication interface; wherein, The communication interface is used to receive, when the first terminal has accessed the visited network, first information sent by a first network element in the visited network, wherein the first information is used to request execution of a service operation associated with the first terminal; The processor is used to use the second information to verify the first information to obtain a verification result, wherein the second information represents the actual roaming status of one or more terminals in the visited network, and the verification result represents that the first information is false information or true information; and when the first information is true information, the first information is sent to the second network element in the home network through the communication interface.

12. A network node, characterized in that: include: a processor and a memory for storing a computer program capable of being executed on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 9.

13. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images