Automatic distributed processing method for high-speed signaling analysis
By using an automated distributed processing method, signaling decoding and synthesis are decoupled, and traffic splitting rules are generated autonomously. This solves the problems of high dependence on network element parameter tables and insufficient scalability in existing signaling parsing systems, thereby improving the system's reliability and deployment efficiency.
Patent Information
- Application Number
- CN202411679428.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-22
- Publication Date
- 2025-01-07
AI Technical Summary
Existing signaling parsing technologies rely heavily on network element parameter tables, have complex rule configurations for aggregation and distribution equipment, and suffer from insufficient system scalability and reliability.
An automated distributed processing method is adopted, which distributes signaling to a signaling decoding device cluster through aggregation and distribution devices for decoding, and uses an automatic signaling distribution mechanism to distribute the decoded signaling to a signaling synthesis device cluster. This decouples signaling decoding and synthesis, autonomously generates distribution rules, and ensures the integrity of the signaling process and traffic balance.
It simplifies system deployment, improves system scalability and reliability, reduces reliance on network element parameter tables, and achieves efficient signaling parsing and processing.
Smart Images
Figure CN119276950A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of signaling analysis, and in particular to an automated distributed processing method for high-speed signaling analysis. Background Art
[0002] Since the operator's 5G mobile communication network began operation, due to the increasingly perfect characteristics and network construction of the 5G mobile communication network, the data traffic in the 5G network has increased rapidly, and the industry's demand for signaling quality monitoring has become increasingly urgent, which has put forward higher requirements on the performance, real-time and accuracy of massive signaling analysis.
[0003] When existing signaling analysis technology processes massive signaling, signaling decoding, signaling synthesis, and interface association functions are generally implemented in the same program. In order to ensure that the signaling of the same network element is centrally analyzed and synthesized, it is generally based on the network element. The IP address of each interface of this network element is configured through the aggregation and distribution equipment, and the signaling of all interfaces of this network element is sent to the same signaling analysis equipment for processing. This method is highly dependent on the engineering parameter tables of each network element in the core network, and a large number of complex rules need to be configured on the aggregation and distribution, and the system deployment is cumbersome. Summary of the invention
[0004] The embodiment of the present invention provides an automated distributed processing method for high-speed signaling analysis, so as to at least solve the technical problems of the existing signaling analysis technology having high dependence on network element engineering parameter tables, complex configuration of convergence and diversion equipment rules, and insufficient system scalability and reliability.
[0005] According to one aspect of an embodiment of the present invention, an automated distributed processing method for high-speed signaling parsing is provided. The method may include: obtaining the signaling of each interface of each service of the target task corresponding to the target network element, sending the signaling of each interface of each service to the convergence and diversion device, and obtaining the full signaling of the target network element, wherein the full signaling includes the signaling of each interface of each service; diverting the full signaling of the target network element to the target signaling decoding device in the signaling decoding device cluster in a load balancing manner according to the IP pair of each interface, decoding the full signaling of the target network element, and obtaining the data structure corresponding to the full signaling of the target network element; pushing the data structure corresponding to the full signaling of the target network element to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism, and obtaining the XDR of the signaling of each interface of each service; associating the XDR of the signaling of each interface of each service through the interface association device, and obtaining the information corresponding to the target task.
[0006] Optionally, after the target signaling decoding device decodes the full signaling of the target network element, the method further includes: outputting a data structure corresponding to the full signaling of the target network element after the SOCKET program based on the IP / TCP protocol decodes the full signaling of the target network element.
[0007] Optionally, the process of pushing the data structure corresponding to the full signaling of the target network element to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism is: obtaining the signaling diversion keyword of each interface of each service of the full signaling of the target network element; based on the signaling diversion keyword of each interface of each service, determining the target signaling synthesis device corresponding to the signaling of each interface of each service.
[0008] Optionally, the process of determining the target signaling synthesis device corresponding to the signaling of each interface of each service based on the signaling diversion keyword of each interface of each service is as follows: determining the remainder of the quotient between the signaling diversion keyword of each interface of each service and the number of signaling synthesis devices in the signaling synthesis device cluster as the serial number of the target signaling synthesis device corresponding to the signaling of each interface of each service; determining the target signaling synthesis device corresponding to the serial number of the target signaling synthesis device corresponding to the signaling of each interface of each service as the target signaling synthesis device corresponding to the signaling of each interface of each service.
[0009] Optionally, after pushing the data structure corresponding to the full signaling of the target network element to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism, and obtaining the XDR of each interface signaling of each service, the method also includes: when the target signaling synthesis device fails, pushing the data structure corresponding to the full signaling of the target network element to the next target signaling synthesis device through the signaling automatic diversion mechanism, wherein the serial number of the next target signaling synthesis device is the serial number of the failed target signaling synthesis device plus one.
[0010] Beneficial effects of the present invention: (1) Simple deployment: By decoupling the decoding function from the signaling synthesis function, only simple diversion rules need to be set at the aggregation and diversion. Compared with previous technologies, there is no need to rely on the network element engineering parameter table during deployment, no need to set complex diversion rules at the aggregation and diversion, and no need to process all interface signaling of the same network element on the same signaling parsing device.
[0011] (2) Scalability: Through the autonomous learning mechanism of diversion rules, when the operator's network element is expanded, it is possible to correctly process the expanded signaling without obtaining its working parameters.
[0012] (3) High reliability: When an individual device in the signaling synthesis equipment cluster fails and the signaling decoding device fails to send, the diversion keyword can be increased by 1, and its traffic can be naturally diverted to the next signaling synthesis device. BRIEF DESCRIPTION OF THE DRAWINGS
[0013] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings: Figure 1 is a flow chart of an automated distributed processing method for high-speed signaling parsing according to an embodiment of the present invention; Figure 2 is a flowchart of signaling processing according to an embodiment of the present invention. DETAILED DESCRIPTION
[0014] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only embodiments of a part of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0015] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0016] Example 1 According to an embodiment of the present invention, an automated distributed processing method for high-speed signaling parsing is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system comprising at least one set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.
[0017] Figure 1is a flow chart of an automated distributed processing method for high-speed signaling parsing according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps: Step S101, obtain the signaling of each interface of each service of the target task corresponding to the target network element, send the signaling of each interface of each service to the aggregation and distribution device, and obtain the full signaling of the target network element, wherein the full signaling includes the signaling of each interface of each service.
[0018] In this embodiment, Figure 2 is a flowchart of signaling processing according to an embodiment of the present invention. Figure 2 As shown, it includes: convergence and diversion equipment, signaling decoding equipment cluster, signaling synthesis equipment cluster and interface association equipment. The convergence and diversion equipment can divert the full amount of signaling according to simple rules such as signaling two-tuple or five-tuple, so as to evenly distribute the massive signaling to multiple signaling decoding equipment.
[0019] Step S102, according to the IP pair of each interface, the full signaling of the target network element is diverted to the target signaling decoding device in the signaling decoding device cluster in a load balancing manner, the full signaling of the target network element is decoded, and the data structure corresponding to the full signaling of the target network element is obtained.
[0020] In this embodiment, the full amount of signaling of the target network element pushed by the convergence and diversion device is received. The convergence and diversion can configure the signaling decoding device cluster into an output group, and divert the full amount of signaling of the target network element to the signaling decoding device in the cluster in a load balancing manner according to the IP pair. It must be ensured that the IP pair bidirectional signaling is diverted to the same signaling decoding device to prevent the disorder problem after the signaling is sent to the signaling synthesis device after being decoded. The main function of the signaling decoding device is to decode the signaling. It only needs to pay attention to the signaling encoding, not the signaling process. The decoded signaling generates a simple data structure and is pushed to the signaling synthesis device for synthesis processing according to the rules. In order to ensure the integrity of the signaling synthesis process, the signaling of the same network element / IP will still be sent to the same signaling synthesis device for processing through the signaling automatic diversion mechanism after passing through the decoding device.
[0021] Step S103: Push the data structure corresponding to the full signaling of the target network element to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism to obtain the XDR of each interface signaling of each service.
[0022] In this embodiment, the signaling synthesis device only focuses on the signaling process, receives the decoded signaling data structure, integrates the information contained in each signaling according to the signaling processes of different interfaces and different services, and finally generates various call records (X Detail Record, referred to as XDR) of the corresponding signaling.
[0023] The signaling automatic diversion mechanism is: The signaling decoding device uses a SOCKET program based on the IP / TCP protocol to decode the signaling and output it. The configured receiving end is not the server IP and port of a certain device, but the IP and port of all devices in the entire signaling synthesis cluster. Each signaling will obtain a diversion keyword, which determines which signaling synthesis device the signaling is sent to.
[0024] After the signaling is decoded, in order to ensure the integrity of the signaling process of the same network element, the same interface signaling of the same network element still needs to be sent to the same signaling synthesis device. The first time the program is started, the diversion rules are generated through the autonomous learning mechanism. After the rules are generated, they are saved in the disk file. The next time it is started, only the rules in the file need to be loaded, and there is no need to regenerate the rules. The diversion rules used by different interface signaling are slightly different.
[0025] The diversion process can be simply described as follows: first decode the signaling, obtain the diversion keyword according to the different interfaces, use the diversion keyword to mod the number of signaling synthesis devices, and decide which signaling synthesis device the signaling is diverted to.
[0026] The traffic distribution rules for each interface are as follows:
[0027] Detailed signaling diversion rules between S1-MME and N2 interfaces: The S1-MME interface is similar to the N2 interface and is described here together. Mobility Management Entity / Access and Mobility Management Function (MME, AMF) is generally configured with multiple IPs at the S1-MME / N2 interface. To ensure the integrity of SCTP coupling, all IPs of the same MME / AMF must be processed by the same signaling synthesis device. To achieve this, the GUMMEI / GUAMI globally unique MME identifier / globally unique AMF identifier (GUMMEI, GUAMI) is used for traffic diversion. The GUMMEI / GUAMI cell is included in the "Initial Context Setup Request" message of the 4G S1AP protocol and the 5G interface application protocol (NG Application Protocal, NGAP). At the same time, the network layer IP protocol layer in this signaling can also obtain the IP address of the MME / AMF at the S1-MME / N2 port.
[0028] The detailed process is as follows: (1) The program starts and creates the S1-MME / N2 interface diversion rule table. The key is the IP address and the value is the diversion keyword K. The diversion rules in the file are read and inserted into the diversion rule table. If the diversion rule file has not been generated, it is not read.
[0029] (2) For the decoded S1-MME / N2 port signaling, first use the source IP address to query the diversion rule table. If found, return the diversion keyword K corresponding to this IP and jump to step (4); if not found, continue to use the destination IP to query the diversion rule table. If found, return the diversion keyword K corresponding to this IP and jump to step (4). If neither is found, jump to step (4).
[0030] (3) Determine whether the signaling is an "Initial Context Setup Request" message. If not, end. If yes, extract GUMMEI / GUAMI from the signaling, calculate the MD5 value, and take the last 8 bytes as the diversion keyword K. Then use the source IP address of the signaling, that is, the IP address of the MME / AMF on the S1-MME / N2 interface, as the key and the diversion keyword K as the value, insert it into the diversion rule table, and jump to step (4).
[0031] (4) Assuming that the number of signaling synthesis devices is n, the value obtained by K mod n is the signaling synthesis device to which the signaling is specifically diverted.
[0032] (5) When the program exits, the diversion rules corresponding to each IP are saved to the disk file.
[0033] Detailed signaling diversion rules for S11, N11 and N4 interfaces: S11, N11 and N4 interfaces all use IP addresses to generate traffic diversion keywords, which are described here together. According to the configuration selection, the S11 interface can use IP diversion on the MME or Serving Gateway (S-GW) side, the N11 interface can use IP diversion on the AMF or SMF side, and the N4 interface can use IP diversion on the Session Management Function (SMF) or User Plane Function (UPF) side.
[0034] The detailed process is as follows: (1) The program starts and creates the S11 / N11 / N4 interface diversion rule table. The key is the IP address and the value is the diversion keyword K. The diversion rules in the file are read and inserted into the diversion rule table. If the diversion rule file has not been generated, it is not read.
[0035] (2) For the decoded S11 / N11 / N4 port signaling, first use the source IP address to query the diversion rule table. If found, return the diversion keyword K corresponding to this IP and jump to step (4); if not found, continue to use the destination IP to query the diversion rule table. If found, return the diversion keyword K corresponding to this IP and jump to step (4). If neither is found, jump to step (3).
[0036] (3) Obtain the network element IP through specific signaling and configuration, and independently generate diversion rules. If it is S11 interface signaling, extract the MME or SGW side IP address from the "Modify Bearer Request" signaling according to the configuration as the diversion IP; if it is N11 interface signaling, then " / nsmf-pdusession / v1 / sm-context" or " " message, extract the AMF side or SMF side IP address according to the configuration as the diversion IP; if it is N4 interface signaling, extract the SMF or UPF side IP address from the "PFCP Session Modification Request" signaling according to the configuration as the diversion IP. The extracted diversion IP is used to calculate the MD5 value, and the last 8 bytes are taken as the diversion keyword K. Then, with the diversion IP as the key and the diversion keyword K as the value, it is inserted into the diversion rule table and jumps to step (4).
[0037] (4) Assuming that the number of signaling synthesis devices is n, the value obtained by K mod n is the signaling synthesis device to which the signaling is specifically diverted.
[0038] (5) When the program exits, the diversion rules corresponding to each IP are saved to the disk file.
[0039] Step S104, the XDR of each interface signaling of each service is associated through the interface association device to obtain information corresponding to the target task.
[0040] In this embodiment, the XDR of each interface signaling of each service is associated through the interface association device, including: association of GUTI to IMSI / SUPI, association of IMSI / SUPI to MSISDN / GPSI, handover association across network elements, and NAS decryption related association. Globally Unique Temporary Identifier (GUTI), International Mobile Subscriber Identity (IMSI), Subscription Permanent Identifier (SUPI), Mobile Station International Subscriber Directory Number (MSISDN), Generic Public Subscription Identifier (GPSI).
[0041] The above method of this embodiment is further introduced below.
[0042] As an optional implementation method, in step S102, after the target signaling decoding device decodes the full signaling of the target network element, the method also includes: outputting the data structure corresponding to the full signaling of the target network element after the SOCKET program based on the IP / TCP protocol decodes the full signaling of the target network element.
[0043] In this embodiment, the data structure corresponding to the full signaling of the target network element after decoding the full signaling of the target network element according to the SOCKET program of the IP / TCP protocol is output.
[0044] As an optional implementation method, step S103, the process of pushing the data structure corresponding to the full signaling of the target network element to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism is: obtaining the signaling diversion keyword of each interface of each service of the full signaling of the target network element; based on the signaling diversion keyword of each interface of each service, determining the target signaling synthesis device corresponding to the signaling of each interface of each service.
[0045] In this embodiment, the signaling diversion keyword of each interface of each service of the full signaling of the target network element is obtained, and the keyword can be 10. According to the signaling diversion keyword of each interface of each service, the target signaling synthesis device corresponding to the signaling of each interface of each service is obtained.
[0046] As an optional implementation method, the process of determining the target signaling synthesis device corresponding to the signaling of each interface of each service based on the signaling diversion keyword of each interface of each service is as follows: the remainder of the quotient between the signaling diversion keyword of each interface of each service and the number of signaling synthesis devices in the signaling synthesis device cluster is determined as the serial number of the target signaling synthesis device corresponding to the signaling of each interface of each service; and the target signaling synthesis device corresponding to the serial number of the target signaling synthesis device corresponding to the signaling of each interface of each service is determined as the target signaling synthesis device corresponding to the signaling of each interface of each service.
[0047] In this embodiment, for example, when the diversion keyword of the signaling of each interface of each service is 10, the number of signaling synthesis devices in the signaling synthesis device cluster is 4, and the serial number of the target signaling synthesis device corresponding to the signaling of each interface of each service is 3 (2 plus 1), the signaling synthesis device corresponding to the serial number 3 is determined as the target signaling synthesis device corresponding to the signaling of each interface of each service.
[0048] As an optional implementation method, step S103, after the data structure corresponding to the full signaling of the target network element is pushed to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism, and the XDR of each interface signaling of each service is obtained, the method also includes: when the target signaling synthesis device fails, the data structure corresponding to the full signaling of the target network element is pushed to the next target signaling synthesis device through the signaling automatic diversion mechanism, wherein the sequence number of the next target signaling synthesis device is the sequence number of the failed target signaling synthesis device plus one.
[0049] In this embodiment, when an individual device in the signaling synthesis device cluster fails and the signaling decoding device fails to send, the diversion keyword can be increased by 1, and its traffic can be naturally diverted to the next signaling synthesis device.
[0050] In the embodiment of the present invention, by acquiring the signaling of each interface of each service of the target task corresponding to the target network element, the signaling of each interface of each service is sent to the convergence and shunting device to obtain the full signaling of the target network element, wherein the full signaling includes the signaling of each interface of each service; the full signaling of the target network element is shunted to the target signaling decoding device in the signaling decoding device cluster in a load balancing manner according to the IP pair of each interface to decode the full signaling of the target network element to obtain the data structure corresponding to the full signaling of the target network element; the data structure corresponding to the full signaling of the target network element is pushed to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic shunting mechanism to obtain the X structure of the signaling of each interface of each service. DR; associate the XDR of each interface signaling of each service through the interface association device to obtain the information corresponding to the target task, which solves the technical problems of the existing signaling analysis technology's high dependence on the network element engineering parameter table, complex configuration of aggregation and diversion equipment rules, and insufficient system scalability and reliability. It achieves the decoupling of signaling decoding, signaling synthesis, and interface association functions. After decoupling, the logic of each functional module is more concise and efficient, and the deployment no longer needs to rely on the network element engineering parameter table. According to the characteristics of different interface signaling, corresponding diversion methods are designed for interfaces with large traffic. The diversion rules can be generated autonomously through the self-learning mechanism. While ensuring the integrity of the signaling process, it ensures a more balanced traffic distribution and fully utilizes the technical effect of hardware resources.
[0051] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.
[0052] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0053] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.
[0054] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.
[0055] In addition, each functional unit in each embodiment of the present invention may be integrated into a first processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0056] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. An automated distributed processing method for high-speed signaling analysis, characterized in that: include: Obtain the signaling of each interface of each service of the target task corresponding to the target network element, send the signaling of each interface of each service to the convergence and distribution device, and obtain the full signaling of the target network element, wherein the full signaling includes the signaling of each interface of each service; According to the IP pair of each interface, the full signaling of the target network element is distributed to the target signaling decoding device in the signaling decoding device cluster in a load balancing manner, and the full signaling of the target network element is decoded to obtain the data structure corresponding to the full signaling of the target network element; The data structure corresponding to the full signaling of the target network element is pushed to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism to obtain the XDR of each interface signaling of each service; The XDR of each interface signaling of each service is associated through the interface association device to obtain the information corresponding to the target task.
2. The method according to claim 1, characterized in that After the target signaling decoding device decodes the full amount of signaling of the target network element, the method further includes: The SOCKET program based on the IP / TCP protocol decodes the full signaling of the target network element and outputs the data structure corresponding to the full signaling of the target network element.
3. The method according to claim 1, characterized in that The process of pushing the data structure corresponding to the full signaling of the target network element to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism is as follows: Obtain the signaling diversion keyword of each interface of each service of the full signaling of the target network element; Based on the diversion keyword of the signaling of each interface of each service, a target signaling synthesis device corresponding to the signaling of each interface of each service is determined.
4. The method according to claim 3, characterized in that The process of determining the target signaling synthesis device corresponding to the signaling of each interface of each service based on the diversion keyword of the signaling of each interface of each service is as follows: The remainder of the quotient between the signaling diversion keyword of each interface of each service and the number of signaling synthesis devices in the signaling synthesis device cluster is determined as the sequence number of the target signaling synthesis device corresponding to the signaling of each interface of each service; The target signaling synthesis device corresponding to the serial number of the target signaling synthesis device corresponding to the signaling of each interface of each service is determined as the target signaling synthesis device corresponding to the signaling of each interface of each service.
5. The method according to claim 1, characterized in that After the data structure corresponding to the full signaling of the target network element is pushed to the target signaling synthesis device of the signaling synthesis device cluster through the signaling automatic diversion mechanism, and the XDR of each interface signaling of each service is obtained, the method further includes: When a target signaling synthesis device fails, the data structure corresponding to the full signaling of the target network element is pushed to the next target signaling synthesis device through the signaling automatic diversion mechanism, where the serial number of the next target signaling synthesis device is the serial number of the failed target signaling synthesis device plus one.
6. A computer system, characterized in that include: One or more processors, and a computer-readable storage medium for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method of claim 1.
7. A computer-readable storage medium, characterized in that Computer executable instructions are stored, and when the instructions are executed, they are used to implement the method of claim 1.
8. A computer program product, characterized in that The invention comprises computer executable instructions, which are used to implement the method of claim 1 when being executed.