Communication processing method, device and equipment

Abstract

The embodiment of the invention provides a communication processing method, device and equipment, and the method comprises the steps: receiving a first message sent by a second network element, and enabling the first message to be used for requesting the privacy information of a first user; according to the first message, first information is determined, and the first information is used for indicating that the international roaming service of the first user is opened or the international roaming service of the first user is not opened; and executing a first operation according to the first information, the first operation including sending the privacy information of the first user, not sending the privacy information of the first user, forwarding the first message, or intercepting the first message.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and specifically to a communication processing method, device and equipment. Background Art

[0002] In existing communication networks, the protection of user privacy information is becoming increasingly important. User privacy information contains sensitive data, such as random numbers, authentication responses, and encryption keys. Once these data are leaked, the user's identity may be stolen or subjected to malicious attacks, causing serious property losses and security risks to the user. Summary of the invention

[0003] The embodiments of the present application provide a communication processing method, apparatus and device to solve the problem of reducing the risk of user privacy information exposure.

[0004] In a first aspect, a communication processing method is provided, which is applied to a first network element, including:

[0005] receiving a first message sent by a second network element, where the first message is used to request privacy information of a first user;

[0006] determining, according to the first message, first information, where the first information is used to indicate that the international roaming service of the first user is activated or that the international roaming service of the first user is not activated;

[0007] A first operation is performed according to the first information, where the first operation includes sending the first user's private information, not sending the first user's private information, forwarding the first message, or intercepting the first message.

[0008] Optionally, the first network element is a non-gateway network element, and performing a corresponding first operation according to the first information includes:

[0009] When the first information is used to indicate that an international roaming service of the first user is activated, sending a second message to the second network element, where the second message includes the privacy information of the first user;

[0010] Alternatively, when the first information is used to indicate that the international roaming service of the first user is not activated, a third message is sent to the second network element, where the third message is used to indicate that the international roaming service of the first user is not activated.

[0011] Optionally, determining first information according to the first message includes:

[0012] Acquire, according to the first message, an identifier of the first user and information of a second network element;

[0013] In a case where the second network element and the first network element belong to the same network, executing the step of sending the second message to the second network element;

[0014] In the case that the second network element and the first network element do not belong to the same network, the first information is determined by querying the activation status information of the user's international roaming service through the first user identifier.

[0015] Optionally, the first network element includes at least one of the following: a home location register HLR, a home subscriber server HSS, and an authentication service function AUSF.

[0016] Optionally, the first network element is a gateway network element, and performing a corresponding first operation according to the first information includes:

[0017] When the first information is used to indicate that an international roaming service of the first user is activated, forwarding the first message;

[0018] Alternatively, when the first information is used to indicate that the international roaming service of the first user is not activated, the first message is intercepted.

[0019] Optionally, forwarding the first message includes at least one of the following:

[0020] Sending the first message to a third network element for processing, where the third network element and the first network element belong to the same network;

[0021] Sending the first message to a corresponding signaling security protection system or signaling security protection equipment or signaling security protection device for processing;

[0022] The first message is sent to a fourth network element for processing, and the fourth network element is used to determine whether the international roaming service of the first user is activated, and forward the first message according to the determination result, or intercept the first message, or send the privacy information of the first user, or not send the privacy information of the first user.

[0023] Optionally, before or after receiving the first message sent by the second network element, the method further includes:

[0024] Obtain the international roaming service activation status information of the first user.

[0025] Optionally, the first network element includes at least one of the following: an international signaling forwarding node ISTP, an IDRA, and a security edge protection agent SEPP.

[0026] In a second aspect, a communication processing device is provided, which is applied to a first network element, including: a first transceiver unit and a first processing unit;

[0027] A first transceiver unit, configured to receive a first message sent by a second network element, wherein the first message is used to request privacy information of a first user;

[0028] A first processing unit, configured to determine first information according to the first message, where the first information is used to indicate that the international roaming service of the first user is activated or that the international roaming service of the first user is not activated;

[0029] The first processing unit is further used to perform a first operation according to the first information, where the first operation includes sending the first user's private information, not sending the first user's private information, forwarding the first message, or intercepting the first message.

[0030] In a fifth aspect, a communication device is provided, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0031] In a sixth aspect, a readable storage medium is provided, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0032] In a seventh aspect, a computer program product is provided, comprising computer instructions, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0033] In the present application, after receiving the first request for the privacy information of the first user, the first network element first performs a logical judgment on whether the first user has activated international roaming authority. The first network element performs a corresponding first operation based on the judgment result to prevent the authentication vector information of users who have not activated international roaming authority, thereby reducing the risk of being used for illegal attacks. In addition, the operation of querying the activation status of the user's international roaming service is performed in advance when requesting the authentication vector information, which can significantly reduce the risk of user privacy information exposure, especially for users who have not activated international roaming services, the risk of illegal acquisition attacks on their private information is greatly reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0035] Figure 1 This is a network diagram of the wireless man-in-the-middle attack environment;

[0036] Figure 2 This is a network diagram of the international roaming + wireless man-in-the-middle combined attack scenario;

[0037] Figure 3 is a flow chart of a communication processing method provided by an embodiment of the present application;

[0038] Figure 4 This is the LTE attachment flow chart;

[0039] Figure 5 is a flow chart of network element side protection processing provided by an embodiment of the present application;

[0040] Figure 6 This is a flow chart of a signaling gateway obtaining a user's international roaming service status provided by an embodiment of the present application;

[0041] Figure 7 It is a signaling gateway side protection processing flow chart provided by an embodiment of the present application;

[0042] Figure 8 is a schematic diagram of a communication processing device provided in an embodiment of the present application;

[0043] Fig. 9 It is a schematic diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] The term "comprise" and any variation thereof in the specification and claims of the present application are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units need not be limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. In addition, the use of "and / or" in the specification and claims to indicate at least one of the connected objects, such as A and / or B, means that A alone, B alone, and A and B exist in three cases.

[0046] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0047] In order to facilitate understanding of the implementation methods of this application, the following technical points are first introduced:

[0048] 1. The intercommunication signals between networks are divided into three categories based on the interconnection networking model:

[0049] Category 1 messages are only used within this network and should not appear in inter-network communication scenarios. For specific service signaling messages within this network that need to be enabled for inter-network communication, they should be released by creating a whitelist, and all other signaling messages should be intercepted.

[0050] The second category (Category 2) messages are business instructions sent by the home network to the visited network. If such messages appear in the inter-network communication scenario, it is only necessary to judge whether the operation is for non-network users based on the user identifier carried in the message. This can simply identify whether such signaling poses a security risk and release or intercept it.

[0051] The third category (Category 3) messages are service instructions sent by the visited network to the home network. Since users roam out to the visited network, compared to the controllable and manageable home network, the roaming users are uncontrollable in the visited network, and the visited network is unmanageable for the home network. Therefore, there is a possibility of sending false and forged attack signaling messages to the home network through the uncontrollable visited network.

[0052] 2. Wireless security attacks

[0053] See also Figure 1 A common method of wireless security attack in mobile communication networks is to build a Man-in-the-Middle Attack (MITM) environment to transparently take over the user's access network, which can transfer and save all the control plane signaling and user plane data of the user's original access to the legitimate operator's network, and achieve the effect of wireless security attack. The condition for the success of the man-in-the-middle attack is to replace the legitimate operator's network to implement some security access mechanisms for users, such as access authentication, confidentiality / integrity protection, etc.

[0054] In the traditional Global System for Mobile Communications (GSM) networking, if the operator network does not enable air interface encryption protection and only enables authentication, due to the design mechanism of one-way authentication of the GSM network authentication terminal, when a legitimate terminal accesses a fake base station in the middleman environment, the Public Land Mobile Network (PLMN) impersonated by the MITM middleman environment does not perform network-side authentication, and can easily build a successful middleman environment and absorb the legitimate terminal to achieve the corresponding illegal attack operation; and if the GSM operator network enables air interface encryption protection on the wireless side, the middleman environment does not obtain the encryption and decryption key Kc in the authentication vector information (random number (RAND), signed response (SRES), encryption key (Ciphering Key, Kc)), and the middleman environment cannot decrypt the encrypted information obtained through the middleman after absorbing the legitimate terminal, thereby achieving the acquisition of sensitive information and tampering of encrypted content in the attack. In order to carry out the attack operation on the encrypted content, it is necessary to obtain the encryption and decryption key Kc in the authentication vector information. It is impossible to obtain the authentication vector information containing the encryption and decryption key Kc from the wireless air interface alone with the existing technical means; but through the international intercommunication signaling channel, the authentication vector information containing the encryption and decryption key Kc can be directly obtained to crack the air interface encrypted information.

[0055] In the Long Term Evolution (LTE) networking, in order to solve the common problems of fake base stations, spam text messages, middlemen, etc. in GSM scenarios, the original one-way authentication design of the network to the user is upgraded to a two-way authentication design of the network and the user, and anti-tampering integrity protection is added on the basis of the original confidentiality protection. The information that plays a key role in realizing these access authentication and confidentiality / integrity protection mechanisms is still the authentication vector (RAND, response (RES), authentication token (AUTN), key access security management entity (KASME)). When a legitimate terminal accesses the MITM environment, it needs to send an authentication request message containing RAND and AUTN parameters to the legitimate terminal through the fake base station in the middleman environment to perform access legitimacy verification. However, the existing wireless attack technology cannot obtain the authentication vector information containing RAND and AUTN parameters; however, through the international intercommunication signaling channel, the authentication vector information containing RAND and AUTN parameters can be obtained relatively easily, thereby realizing the forgery of LTE wireless air interface access authentication; at the same time, the obtained authentication vector information can also be used to derive relevant key information for confidentiality and integrity protection, thereby realizing encryption, decryption and modification of information transmitted in the middleman environment.

[0056] A major factor that makes the above combined attack successful is that the attacker can obtain the user's authentication vector information through the international intercommunication scenario, see Figure 2 However, the current protection of this information is basically unprotected both on the network element side and on the international interconnection gateway side, and the relevant content can be obtained relatively easily.

[0057] See also Figure 3 A communication processing method of the present application is applied to a first network element, and the specific steps include: step 31, step 32 and step 33.

[0058] Step 31: receiving a first message sent by a second network element, where the first message is used to request privacy information of a first user;

[0059] Optionally, the first network element may be a non-gateway network element or a gateway network element, such as an international gateway.

[0060] Optionally, the second network element is a sender of the first message, such as a mobility management entity (Mobility Management Entity, MME).

[0061] Optionally, the privacy information of the first user includes but is not limited to authentication vector information required for identity authentication and network access of the first user, and the authentication vector information includes but is not limited to at least one of RAND, SRES, Kc, AUTN, and KASME.

[0062] Optionally, the first user may be a user or a user group.

[0063] Optionally, the first message includes but is not limited to at least one item of the identification of the first user and the information of the second network element.

[0064] Optionally, the first message may be a first category (Category 1) message, a second category (Category 2) message, or a third category (Category 3) message.

[0065] Step 32: determining first information according to the first message, where the first information is used to indicate that the international roaming service of the first user is activated or that the international roaming service of the first user is not activated;

[0066] Specifically, after receiving the first message, the first network element determines whether the international roaming service of the first user is activated.

[0067] Step 33: Perform a first operation according to the first information, where the first operation includes sending the first user's private information, not sending the first user's private information, forwarding the first message, or intercepting the first message.

[0068] In this embodiment, after receiving the first request for the privacy information of the first user, the first network element first performs a logical judgment on whether the first user has activated international roaming authority. According to the judgment result, the first network element performs a corresponding first operation to prevent the authentication vector information of users who have not activated international roaming authority, thereby reducing the risk of being used for illegal attacks. In addition, the operation of querying the activation status of the user's international roaming service is performed in advance when requesting the authentication vector information, which can significantly reduce the risk of user privacy information exposure, especially for users who have not activated international roaming services, the risk of illegal acquisition attacks on their private information is greatly reduced.

[0069] In an implementation manner of the present application, the first network element may be a non-gateway network element, and according to the first information, performing a corresponding first operation includes:

[0070] When the first information is used to indicate that an international roaming service of the first user is activated, sending a second message to the second network element, where the second message includes the privacy information of the first user;

[0071] Alternatively, when the first information is used to indicate that the international roaming service of the first user is not activated, a third message is sent to the second network element, where the third message is used to indicate that the international roaming service of the first user is not activated.

[0072] Specifically, when the international roaming service of the first user is activated, the first network element sends the first user's privacy information to the second network element, which is the requester of the first message; when the international roaming service of the first user is not activated, the first network element may refuse to send the first user's privacy information to the second network element.

[0073] In this embodiment, the second message or the third message is a response message of the first message, for example, the first message may be an authentication information request (Authentication Information Request), and the second message or the third message may be an authentication information answer (Authentication Information Answer); or, the first message may be an update location request (Update Location Request), and the second message or the third message may be an update location answer (UpdateLocation ACK); or, the first message may be a notification request (Notify Request), and the second message or the third message may be a notification response (Notify Response). Alternatively, the first message may also be a send authentication information parameter message (SendAuthenticationInfoArg) or a user equipment authentication message (UE-authentications).

[0074] In an implementation manner of the present application, the first network element may be a non-gateway network element, and determining the first information according to the first message includes:

[0075] Acquire, according to the first message, an identifier of the first user and information of a second network element;

[0076] In a case where the second network element and the first network element belong to the same network, executing the step of sending the second message to the second network element;

[0077] In the case that the second network element and the first network element do not belong to the same network, the first information is determined by querying the activation status information of the user's international roaming service through the first user identifier.

[0078] Specifically, in a non-inter-network interconnection scenario, the first network element may not perform a logical judgment on whether the first user has activated international roaming authority and directly send the second message to the second network element; in an inter-network interconnection scenario, the first network element needs to perform a logical judgment on whether the first user has activated international roaming authority to obtain the first information.

[0079] In one implementation of the present application, the non-gateway network element includes at least one of the following: a Home Location Register (HLR), a Home Subscriber Server (HSS), and an Authentication Server Function (AUSF).

[0080] In an implementation manner of the present application, the first network element is a gateway network element, and performing a corresponding first operation according to the first information includes:

[0081] When the first information is used to indicate that an international roaming service of the first user is activated, forwarding the first message;

[0082] Alternatively, when the first information is used to indicate that the international roaming service of the first user is not activated, the first message is intercepted.

[0083] In this embodiment, by advancing the security protection of the first message to the gateway network element side, the attack signaling message that illegally obtains user privacy information can be directly intercepted on the gateway network element side, which can effectively reduce the overhead of processing such attack signaling on the non-gateway network element side; it also effectively reduces the risk of attacks on users who have not activated international roaming services to illegally obtain their privacy information.

[0084] In one implementation of the present application, forwarding the first message includes at least one of the following:

[0085] Sending the first message to a third network element for processing, where the third network element and the first network element belong to the same network;

[0086] Sending the first message to a corresponding signaling security protection system, device or apparatus for processing;

[0087] The first message is sent to a fourth network element for processing, and the fourth network element is used to determine whether the international roaming service of the first user is activated, and forward the first message according to the determination result, or intercept the first message, or send the privacy information of the first user, or not send the privacy information of the first user.

[0088] Optionally, the fourth network element includes but is not limited to HLR, HSS, and AUSF.

[0089] In one implementation of the present application, before or after receiving the first message sent by the second network element, the method further includes:

[0090] Obtain the international roaming service activation status information of the first user.

[0091] Optionally, an international roaming service activation status database is established on the first network element side, and the first network element obtains the international roaming service activation status information of the first user from the international roaming service activation status database. Further, the first network element queries the business operation support system (Business Operation Support System, BOSS) system for the international roaming service activation status information of all users and saves it in the international roaming service activation status database.

[0092] In one embodiment of the present application, the gateway network element includes at least one of the following: an International Signaling Transfer Point (ISTP), an International Diameter Routing Agent (IDRA), and a Security Edge Protection Proxy (SEPP).

[0093] In this embodiment, by advancing the query of the user's international roaming service activation status to the time of requesting authentication vector information, the exposure of user privacy information can be greatly reduced, especially the risk of attacks that illegally obtain the privacy information of users who have not activated international roaming services.

[0094] The security protection measures that can be provided by existing non-gateway network elements (for example, HLR or HSS or AUSF), gateway network elements (for example, ISTP or IDRA or SEPP), signaling security protection systems, equipment, and devices will not determine whether the user has activated international roaming permissions when requesting authentication vector information in international roaming scenarios, and will leak the authentication vector information of users who have not activated international roaming permissions.

[0095] In the present application, in the above-mentioned non-gateway network element and gateway network element, a logical judgment can be made on whether to activate the international roaming authority check according to the identifier of the first user contained in the request authentication vector information message (i.e., the first message), so as to prevent the risk of the authentication vector information of users who have not activated the international roaming authority being leaked through the international intercommunication scenario and then being used for other illegal attacks. It can effectively prevent the security risks brought about by the illegal leakage of authentication vector information when the user has not activated the international roaming authority. Specifically, the protection idea on the non-gateway network element side (HLR or HSS or AUSF) is to first determine whether the first user has activated the international roaming authority for the received request user authentication vector information message (i.e., the first message), and then return the authentication vector information or return the response error code according to the determination result. On the gateway network element side (ISTP or IDRA or SEPP) side or in the signaling security protection system, equipment or device, it is necessary to receive the user's international roaming service activation status information and establish a corresponding information database. After receiving the message requesting user authentication vector information, first query the international roaming service activation status information of the first user, and then release or intercept the message according to the international roaming service activation status information of the first user.

[0096] See also Figure 4 , LTE attachment process, the specific steps include:

[0097] Step 1: UE sends an Attach Request to the eNodeB;

[0098] Step 2: The base station sends an attach request to the new MME;

[0099] Step 3: The new MME sends an Identification Request to the old MME or the Serving GPRS Support Node (SGSN), and the old MME or the SGSN sends an Identification Response to the new MME.

[0100] Step 4: The new MME sends an identity request (Identity Request) to the UE, and the UE sends an identity response (Identity Response) to the new MME.

[0101] Step 5a: UE and new MME authentication or security (Authentication / Security); the new MME sends an authentication information request (Authentication Information Request) to the HSS, and the HSS sends an authentication information response (Authentication Information Answer) to the new MME.

[0102] Step 5b: The UE and the new MME transmit an Identity Request / Response, and an ME Identity Check is performed between the new MME and the Equipment Identity Register (EIR).

[0103] Step 6: The new MME sends a Ciphered Options Request to the UE, and the UE sends a Ciphered Options Request to the new MME.

[0104] Step 7: The new MME sends a Delete Session Request to the Packet Data Network GateWay (PDN GW) through the serving gateway (Gateway, GW), the PDN GW sends a Delete Session Response to the new MME or SGSN through the serving GW, and the PDN GW and the Policy and Charging Rules Function (PCRF) execute the Policy and Charging Enforcement Function (PCEF) to initiate IP-CAN session termination.

[0105] Step 8: The new MME sends an Update Location Request to the HSS.

[0106] Step 9: The HSS sends a Cancel Location message to the old MME or SGSN, and the old MME or SGSN sends a Cancel Location Ack message to the HSS.

[0107] Step 10: The old MME or SGSN sends a Delete Session Request to the PDN GW, the PDN GW sends a Delete Session Response to the old MME or SGSN, and the PDN GW and PCRF execute PCEF-initiated IP-CAN session termination.

[0108] Step 11: The HSS sends an Update Location ACK to the new MME.

[0109] Step 12: The new MME sends a Create Session Request to the Serving GW.

[0110] Step 13: The serving GW sends a Create Session Request to the PDN GW.

[0111] Step 14: PCEF initiates IP-CAN session termination between PDN GW and PCRF.

[0112] Step 15: The PDN GW sends a Create Session Response to the Serving GW.

[0113] Step 16: The Serving GW sends a Create Session Response to the new MME.

[0114] Step 17: The new MME sends an Initial Context Setup Request or Downlink NAS transport with Attach Accept to the eNodeB.

[0115] Step 18: The eNodeB sends a Radio Resource Control (RRC) connection reconfiguration or RRC Direct Transfer to the terminal.

[0116] Step 19: The UE sends an RRC Connection Reconfiguration Complete message to the eNodeB.

[0117] Step 20: The eNodeB sends an Initial Context Setup Response to the new MME.

[0118] Step 21: UE directly transmits to eNodeB (Direct Transfer).

[0119] Step 22: The eNodeB sends an Attach Complete message to the new MME.

[0120] Step 23: The new MME sends a Modify Bearer Request to the Serving GW.

[0121] Step 23a: The serving GW sends a modify bearer request to the PDN GW.

[0122] Step 23b: The PDN GW sends a Modify Bearer Response to the Serving GW.

[0123] Step 24: The serving GW sends a modify bearer response to the new MME.

[0124] Step 25: The new MME sends a Notify Request to the HSS.

[0125] Step 26: The new MME sends a Notify Response to the HSS.

[0126] In this embodiment, the first message may be the Authentication Information Request in step 5a, and the second message may be the Authentication Information Answer in step 5a; or, the first message may be the Update Location Request in step 8, and the second message may be the UpdateLocation ACK in step 11; or, the first message may be the Notify Request in step 25, and the second message may be the Notify Response in step 26.

[0127] See also Figure 5 The protection process on the NE side is as follows:

[0128] Step 1: The first network element receives a request authentication vector information message (i.e., a first message) sent by the second network element;

[0129] Step 2: The first network element extracts the identifier of the first user and the information of the second network element from the authentication vector information request message.

[0130] Step 3: The first network element determines whether the second network element is a network element of the same network; if not, execute step 4; if yes, execute step 5.

[0131] Step 4: query whether the international roaming service of the user is activated through the identifier of the first user; if activated, the first network element executes step 5; if not activated, the first network element executes step 6.

[0132] Step 5: Construct a response message (ie, a second message) and send the authentication vector information of the first user to the second network element.

[0133] Step 6: construct a roaming not allowed (ROAMING_NOT_ALLOWED) response message (ie, the second message) and send it to the second network element.

[0134] In this embodiment, after receiving the authentication vector information request message (i.e., the first message), the first network element extracts the identifier of the first user and the information of the second network element in the authentication vector information request message, and then determines whether the second network element is a network element of the local network; if the second network element is a network element of the local network, the original process is executed, and a response message (i.e., the second message) is constructed to return the authentication vector information of the first user to the second network element; if the second network element is not a network element of the local network, the international roaming service activation status information of the first user is queried through the identifier of the first user, usually the HLR or HSS or AUSF network element queries the business operation support system (Business Operation Support System, BOSS) for the international roaming service activation status information of the first user, and according to the international roaming service activated by the first user, a response message is constructed to send the authentication vector information of the first user to the second network element; if the first user has not activated the international roaming service, a response message (i.e., the third message) with a result code (Result-Code) of 5004 (ROAMING_NOT_ALLOWED) is constructed and sent to the second network element. By advancing the query of the international roaming service activation status of the first user to the time of requesting authentication vector information, the risk of exposing user privacy information, especially the risk of illegal acquisition of privacy information of users who have not activated international roaming services, can be greatly reduced.

[0135] Since the gateway network element does not have a direct link to the service support BOSS system like the HLR, HSS or AUSF network element, it cannot check the international roaming service activation status information of the first user at any time like the HLR, HSS or AUSF network element. It is necessary to add a service link between BOSS and the gateway network element, and when BOSS operates the international roaming service status of the user (activates or closes), the international roaming service activation status information of the relevant users of the gateway network element is synchronized in real time to ensure that the gateway network element has the latest international roaming service activation status information of all users in this network.

[0136] See also Figure 6 , the process of BOSS synchronizing the user's international roaming service status to the gateway network element:

[0137] Step 1: The Operation and Maintenance Center (OMC) sends an account registration or activation and deactivation of international roaming services to BOSS.

[0138] Step 2: BOSS synchronizes the international roaming service activation status information of the first user to ISTP or IDRA or SEPP.

[0139] Step 3: ISTP or IDRA or SEPP records the activation status of the international roaming service of the first user.

[0140] See also Figure 7 The main process of implementing security protection for gateway network elements is as follows:

[0141] Step 1: Receive a request for authentication vector information message (ie, the first message).

[0142] Step 2: Extract the identifier of the first user in the request authentication vector information message.

[0143] Step 3: query the international roaming service activation status information of the first user from the international roaming service activation status database through the first user's identifier. If the first user has activated the international roaming service, execute step 4 or step 5 or step 6; if the first user has not activated the international roaming service, execute step 7.

[0144] Optionally, the international roaming service activation status information is the real-time and latest international roaming service activation status information of the user in the home network. The information should at least include: user identification (for example, international mobile subscriber identity code (International Mobile Subscriber Identity, IMSI) or mobile station international subscriber directory number (Mobile Station International Subscriber Directory Number, MSISDN)), international roaming service activation status (activated or not activated).

[0145] Step 4: Send the authentication vector information request message to the signaling security protection system, device or apparatus for processing.

[0146] Step 5: Forward the authentication vector information request message to the third network element of the network for processing.

[0147] Step 6: Send the authentication vector information request message to the fourth network element for processing, the fourth network element is used to determine whether the international roaming service of the first user is activated, and forward the authentication vector information request message according to the determination result, or intercept the authentication vector information request message, or send the authentication vector information of the first user, or not send the authentication vector information of the first user.

[0148] Step 7: Intercept the request authentication vector information message.

[0149] In this embodiment, after receiving the request authentication vector information message (i.e., the first message), the gateway network element extracts the identifier of the first user in the request authentication vector information message, and uses the identifier of the first user to query the activation status information of the international roaming service activation status database; if activated, the request authentication vector information message can be allowed to enter the corresponding destination network element of this network for processing, or the request authentication vector information message can be judged as a false counterfeit roaming, and a release or interception operation can be performed based on the judgment result, or the request authentication vector information message can be sent to the corresponding signaling security protection system, equipment or device for further processing; if not activated, the request authentication vector information message is directly intercepted.

[0150] By advancing the security protection of the authentication vector information request message to the gateway network element side, the attack signaling message that illegally obtains the user's privacy information can be directly intercepted on the gateway side, which can effectively reduce the overhead of processing such attack signaling on the network element side; it also effectively reduces the risk of attacks on users who have not activated international roaming services to illegally obtain their privacy information.

[0151] The above-mentioned gateway network element side establishes an international roaming service activation status database and a security protection processing flow, which can be applied to the transformation of existing signaling security protection systems, equipment, devices or related security protection methods, realize their protection processing logic, and effectively solve illegal attacks on users who have not activated international roaming services. The specific information contained in the international roaming service activation status database mentioned therein can be designed with reference to the following content. Optionally, the international roaming service activation status information is the real-time and latest international roaming service activation status information of the user in the home network, which should at least include: user identification (for example, IMSI, MSISDN), international roaming service activation status (activated or not activated).

[0152] See also Figure 8 , an embodiment of the present application provides a communication processing device, applied to a first network element, the device 800 includes: a first transceiver unit 801 and a first processing unit 802;

[0153] The first transceiver unit 801 is configured to receive a first message sent by a second network element, where the first message is used to request privacy information of a first user;

[0154] A first processing unit 802 is configured to determine first information according to the first message, where the first information is used to indicate that the international roaming service of the first user is activated or that the international roaming service of the first user is not activated;

[0155] The first processing unit 802 is further used to perform a first operation according to the first information, where the first operation includes sending the first user's private information, not sending the first user's private information, forwarding the first message, or intercepting the first message.

[0156] In one embodiment of the present application, the first processing unit 802 is further used to send a second message to the second network element when the first information is used to indicate that the international roaming service of the first user is activated, and the second message includes the privacy information of the first user; or, when the first information is used to indicate that the international roaming service of the first user is not activated, send a third message to the second network element, and the third message is used to indicate that the international roaming service of the first user is not activated.

[0157] In one embodiment of the present application, the first processing unit 802 is further used to obtain the identification of the first user and the information of the second network element according to the first message; when the second network element and the first network element belong to the same network, execute the step of sending the second message to the second network element; when the second network element and the first network element do not belong to the same network, query the user's international roaming service activation status information through the first user identification to determine the first information.

[0158] In one implementation manner of the present application, the first network element includes at least one of the following: HLR, HSS, AUSF.

[0159] In one embodiment of the present application, the first processing unit 802 is further used to forward the first message when the first information is used to indicate that the international roaming service of the first user is activated; or to intercept the first message when the first information is used to indicate that the international roaming service of the first user is not activated.

[0160] In one implementation of the present application, forwarding the first message includes at least one of the following:

[0161] Sending the first message to a third network element for processing, where the third network element and the first network element belong to the same network;

[0162] Sending the first message to a corresponding signaling security protection system or signaling security protection equipment or signaling security protection device for processing;

[0163] The first message is sent to a fourth network element for processing, and the fourth network element is used to determine whether the international roaming service of the first user is activated, and forward the first message according to the determination result, or intercept the first message, or send the privacy information of the first user, or not send the privacy information of the first user.

[0164] In an implementation manner of the present application, the first transceiver unit 801 is further configured to obtain activation status information of an international roaming service of the first user.

[0165] In one implementation manner of the present application, the first network element includes at least one of the following: ISTP, IDRA, SEPP.

[0166] The device provided in the embodiment of the present application can achieve Figure 3 The various processes implemented by the method embodiment shown achieve the same technical effect and will not be described again here to avoid repetition.

[0167] like Fig. 9 As shown, the embodiment of the present application also provides a communication device 900, including a processor 901, a memory 902, a program or instruction stored in the memory 902 and executable on the processor 901, and the program or instruction is executed by the processor 901 to implement the above Figure 3 The various processes of the method embodiment can achieve the same technical effect. To avoid repetition, they will not be described here.

[0168] The embodiment of the present application also provides a readable storage medium on which a program or instruction is stored. When the program or instruction is executed by a processor, the above Figure 3 The various processes of the method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0169] The processor is the processor in the terminal described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0170] The steps of the method or algorithm described in conjunction with the contents disclosed in this application can be implemented in hardware or by executing software instructions in a processor. The software instructions can be composed of corresponding software modules, and the software modules can be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disks, mobile hard disks, read-only optical disks, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be carried in an ASIC. In addition, the ASIC can be carried in a core network interface device. Of course, the processor and the storage medium can also exist in the core network interface device as discrete components.

[0171] Those skilled in the art should be aware that in one or more of the above examples, the functions described in this application can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a general or special-purpose computer can access.

[0172] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation methods of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the scope of protection of the present application.

[0173] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the embodiments of the present application may adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0174] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0175] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0176] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0177] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A communication processing method, applied to a first network element, characterized in that: include: receiving a first message sent by a second network element, where the first message is used to request privacy information of a first user; determining, according to the first message, first information, where the first information is used to indicate that the international roaming service of the first user is activated or that the international roaming service of the first user is not activated; A first operation is performed according to the first information, where the first operation includes sending the first user's private information, not sending the first user's private information, forwarding the first message, or intercepting the first message.

2. The method according to claim 1, characterized in that The first network element is a non-gateway network element, and according to the first information, performs a corresponding first operation, including: When the first information is used to indicate that an international roaming service of the first user is activated, sending a second message to the second network element, where the second message includes the privacy information of the first user; Alternatively, when the first information is used to indicate that the international roaming service of the first user is not activated, a third message is sent to the second network element, where the third message is used to indicate that the international roaming service of the first user is not activated.

3. The method according to claim 2, characterized in that Determining first information according to the first message includes: Acquire, according to the first message, an identifier of the first user and information of a second network element; In a case where the second network element and the first network element belong to the same network, executing the step of sending the second message to the second network element; In the case that the second network element and the first network element do not belong to the same network, the first information is determined by querying the activation status information of the user's international roaming service through the first user identifier.

4. The method according to any one of claims 1 to 3, characterized in that: The first network element includes at least one of the following: a home location register HLR, a home subscriber server HSS, and an authentication service function AUSF.

5. The method according to claim 1, characterized in that The first network element is a gateway network element, and according to the first information, a corresponding first operation is performed, including: When the first information is used to indicate that an international roaming service of the first user is activated, forwarding the first message; Alternatively, when the first information is used to indicate that the international roaming service of the first user is not activated, the first message is intercepted.

6. The method according to claim 5, characterized in that Forwarding the first message includes at least one of the following: Sending the first message to a third network element for processing, where the third network element and the first network element belong to the same network; Sending the first message to a corresponding signaling security protection system or signaling security protection equipment or signaling security protection device for processing; The first message is sent to a fourth network element for processing, and the fourth network element is used to determine whether the international roaming service of the first user is activated, and forward the first message according to the determination result, or intercept the first message, or send the privacy information of the first user, or not send the privacy information of the first user.

7. The method according to claim 5, characterized in that Before or after receiving the first message sent by the second network element, the method further includes: Obtain the international roaming service activation status information of the first user.

8. The method according to claim 1, 5 or 6, characterized in that: The first network element includes at least one of the following: an international signaling forwarding node ISTP, an inter-routing agent IDRA, and a security edge protection agent SEPP.

9. A communication processing device, applied to a first network element, characterized in that: include: a first transceiver unit and a first processing unit; A first transceiver unit, configured to receive a first message sent by a second network element, wherein the first message is used to request privacy information of a first user; A first processing unit, configured to determine first information according to the first message, where the first information is used to indicate that the international roaming service of the first user is activated or that the international roaming service of the first user is not activated; The first processing unit is further used to perform a first operation according to the first information, where the first operation includes sending the first user's private information, not sending the first user's private information, forwarding the first message, or intercepting the first message.

10. A communication device, characterized in that: The method comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction implements the steps of the method according to any one of claims 1 to 8 when executed by the processor.

11. A readable storage medium, characterized in that: The readable storage medium stores a program or an instruction, and when the program or the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

Images