Service identification method and device, user plane function and medium

Abstract

The invention discloses a service identification method and device, a user plane function and a medium, and relates to the field of wireless communication. The specific implementation scheme is as follows: obtaining a service data packet; judging whether a first connection exists in a first connection table hung under the target PF or not; wherein the first connection is a connection which is matched with the first IP quintuple and has been subjected to service identification; under the condition that the first connection does not exist in the first connection table, performing service identification on the service data packet to determine a first service identifier; wherein the first service identifier is used for indicating a target application accessed by a target terminal which sends or receives the service data packet; and the first IP quintuple and the first service identifier are sent to an SMF, so that the SMF establishes a target session for the target terminal, and the target session is used for performing QoS control and / or charging on a data packet when the target terminal accesses the target application. Therefore, service identification does not need to be carried out on all service data packets, and the processing speed and performance of the UPF can be improved.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a service identification method, device, user plane function and medium. Background Art

[0002] With the commercialization of 5G technology, there are more and more scenarios for QoS (Quality of Service) control and billing of data packets accessing specific APPs (Applications). In related technologies, UPF (UserPlane Function) needs to perform in-depth analysis or service identification on all data packets to determine which application each data packet corresponds to, so that targeted QoS control and billing can be performed on the data packets of each application.

[0003] However, in the above method, UPF needs to perform in-depth analysis or service identification on all data packets, which greatly affects the performance of UPF. The applicant tested UPF and found that if UPF performs service identification on all data packets, the performance will drop by 40%. Summary of the invention

[0004] The present application provides a method, device, user plane function and medium for service identification.

[0005] According to one aspect of the present application, a service identification method is provided, which is executed by UPF, and the method includes: obtaining a service data packet, and determining whether a first connection exists in the first connection table under the target packet filter PF; wherein the target PF is a PF that matches the first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service identified; if the first connection does not exist in the first connection table, service identification is performed on the service data packet to determine a first service identifier; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet; the first IP quintuple and the first service identifier are sent to a session management function SMF; wherein the first IP quintuple and the first service identifier are used by the SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on data packets of the target terminal accessing the target application.

[0006] As a possible implementation method, the UPF includes a flow template TFT business processing node and a deep packet inspection DPI business processing node; the judgment of whether there is a first connection in the first connection table hanging under the target packet filter PF includes: querying multiple candidate PFs according to the first IP quintuple through the TFT business processing node to determine the target PF matching the first IP quintuple from the multiple candidate PFs; extracting a DPI resolution identifier from the target PF through the TFT business processing node; wherein the DPI resolution identifier is used to indicate whether business identification is performed through the DPI business processing node; when the DPI resolution identifier indicates that business identification is performed through the DPI business processing node, obtaining the first connection table hanging under the target PF through the TFT business processing node; and judging whether there is a first connection matching the first IP quintuple in the first connection table through the TFT business processing node.

[0007] As a possible implementation manner, after extracting the DPI resolution identifier from the target PF, the method also includes: when the DPI resolution identifier indicates that service identification is not performed through the DPI service processing node, determining through the TFT service processing node whether the target PF contains a second service identifier; wherein the second service identifier is used to indicate an application that adopts a general processing policy, and the general processing policy includes a general service quality control policy and / or a general billing policy; when the target PF contains the second service identifier, the TFT service processing node adopts the default session corresponding to the first IP five-tuple to execute the general processing policy on the service data packet; when the target PF does not contain the second service identifier, the TFT service processing node sends the service data packet to the device indicated by the destination address in the first IP five-tuple.

[0008] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; when the first connection does not exist in the first connection table, the service data packet is service identified to determine the first service identifier, including: when the first connection does not exist in the first connection table, the service data packet is encapsulated by the TFT service processing node to obtain a first encapsulation packet, and the first encapsulation packet is sent to the DPI service processing node; the first encapsulation packet is decapsulated by the DPI service processing node to obtain the service data packet, and the service data packet is parsed to obtain the first IP five-tuple; the DPI service processing node determines whether there is a second connection matching the first IP five-tuple in the second connection table; wherein the second connection table is a connection table maintained by the DPI service processing node; when the second connection exists in the second connection table and the identification bit of the second connection indicates that the second connection has not been service identified, the service data packet is service identified by the DPI service processing node to obtain the application identifier of the target application, and the first service identifier is determined according to the application identifier.

[0009] As a possible implementation manner, the method also includes: updating the identification bit of the second connection by the DPI service processing node; wherein the updated identification bit of the second connection is used to indicate that the second connection has undergone service identification; and discarding the service data packet by the DPI service processing node.

[0010] As a possible implementation method, the first encapsulation package also includes the identification information of the target PF and the transmission direction of the service data packet. The sending of the first IP quintuple and the first service identifier to the session management function SMF includes: sending a first message for establishing a connection to the TFT service processing node through the DPI service processing node; wherein the first message includes the first service identifier, the first IP quintuple, the identification information and the first signaling traffic matching the transmission direction counted for the second connection; establishing a third connection through the TFT service processing node according to the first service identifier and the first IP quintuple, and adding the third connection to the first connection table under the target PF matching the identification information; sending the first service identifier and the first IP quintuple to the SMF through the TFT service processing node; wherein the first service identifier and the first IP quintuple are used by the SMF to establish a target session corresponding to the third connection; wherein the target session is used by the TFT service processing node to perform service quality control and / or billing on the data packet of the target terminal accessing the target application based on the first processing policy corresponding to the first service identifier and the first signaling traffic.

[0011] As a possible implementation manner, after determining whether there is a first connection in the first connection table under the target packet filter PF, the method further includes: if the first connection exists in the first connection table, obtaining a third service identifier indicated by the first connection; and performing service quality control and / or billing on the business data packet based on a second processing strategy corresponding to the third service identifier.

[0012] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; when the first connection exists in the first connection table, the method further includes: encapsulating the service data packet through the TFT service processing node to obtain a second encapsulation packet, and sending the second encapsulation packet to the DPI service processing node; decapsulating the second encapsulation packet through the DPI service processing node to obtain the service data packet, and parsing the service data packet to obtain the first IP five-tuple; when the protocol type in the first IP five-tuple is TCP, judging whether the service data packet is a TCP connection establishment message through the DPI service processing node; when the service data packet is the TCP connection establishment message, judging whether there is a fourth connection matching the first IP five-tuple in the second connection table through the DPI service processing node; wherein the second connection table is a connection table maintained by the DPI service processing node; when the fourth connection exists in the second connection table, discarding the service data packet through the DPI service processing node.

[0013] As a possible implementation manner, the second encapsulation packet also includes the transmission direction of the service data packet. After the DPI service processing node determines whether there is a fourth connection matching the first IP quintuple in the second connection table, the method also includes: if the fourth connection does not exist in the second connection table, establishing a fifth connection according to the first IP quintuple through the DPI service processing node; adding the fifth connection to the second connection table through the DPI service processing node; and determining, through the DPI service processing node, the second signaling traffic matching the transmission direction counted for the fifth connection based on the traffic of the service data packet.

[0014] As a possible implementation manner, after the DPI service processing node determines whether the service data packet is a TCP connection establishment message, the method further includes: when the service data packet is not the TCP connection establishment message, determining whether the service data packet is a TCP connection deletion message through the DPI service processing node; when the service data packet is the TCP connection deletion message, determining the sixth connection matching the first IP quintuple from the second connection table through the DPI service processing node; determining through the DPI service processing node whether the identification bit of the sixth connection indicates that the sixth connection has been service identified; when the identification bit of the sixth connection indicates that the sixth connection has been service identified, deleting the sixth connection in the second connection table through the DPI service processing node, and sending a second message for deleting the connection to the TFT service processing node; wherein the second message is used by the TFT service processing node to delete the first connection in the first connection table; when the identification bit of the sixth connection indicates that the sixth connection has not been service identified, deleting the sixth connection in the second connection table through the DPI service processing node, and discarding the service data packet.

[0015] As a possible implementation manner, the method also includes: when the service data packet is not the TCP connection deletion message, or when the protocol type is UDP, determining by the DPI service processing node whether there is a seventh connection matching the first IP five-tuple in the second connection table; when the seventh connection exists in the second connection table, performing protocol parsing on the service data packet according to the protocol type by the DPI service processing node to obtain a protocol parsing result; when the identification bit of the seventh connection indicates that the seventh connection has been service identified, determining by the DPI service processing node whether the service data packet is a UDP termination message according to the protocol parsing result; when the service data packet is a UDP termination message, deleting the seventh connection in the second connection table by the DPI service processing node; and sending a third message for deleting the connection to the TFT service processing node by the DPI service processing node; wherein the third message is used by the TFT service processing node to delete the first connection in the first connection table.

[0016] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; the method further includes: judging, by the DPI service processing node, whether there is a target connection in the second connection table; wherein the target connection is a connection established according to the second IP five-tuple; wherein the second connection table is a connection table maintained by the DPI service processing node; if the target connection exists in the second connection table, judging, by the DPI service processing node, whether the identification bit of the target connection indicates that the target connection has been service identified; if the identification bit of the target connection indicates that the target connection has not been service identified, deleting the target connection in the second connection table by the DPI service processing node; if the identification bit of the target connection indicates that the target connection has been service identified, deleting the target connection in the second connection table by the DPI service processing node, and sending a fourth message for deleting the connection to the TFT service processing node; wherein the fourth message carries the second IP five-tuple and the target service identifier indicated by the target connection, and is used by the TFT service processing node to delete the eighth connection matching the second IP five-tuple in the first connection table.

[0017] As a possible implementation manner, determining whether there is a target connection in the second connection table through the DPI service processing node includes: for any connection in the second connection table, obtaining, through the DPI service processing node, a reception time of a third encapsulation packet corresponding to the any connection; wherein the third encapsulation packet is a most recently received encapsulation packet containing an IP five-tuple indicated by the any connection; determining, through the DPI service processing node, whether a time difference between a reception time of the third encapsulation packet corresponding to the any connection and a current time is less than a set duration; when the time difference corresponding to the any connection is greater than or equal to the set duration, determining that there is a target connection in the second connection table, and using the any connection as the target connection; when the time differences corresponding to all connections in the second connection table are less than the set duration, determining that there is no target connection in the second connection table.

[0018] As a possible implementation manner, when the first connection does not exist in the first connection table, the method further includes: sending the service data packet to a device indicated by a destination address in the first IP quintuple.

[0019] According to another aspect of the present application, a UPF is provided, comprising:

[0020] Memory, transceiver, processor:

[0021] A memory for storing a computer program; a transceiver for sending and receiving data under the control of the processor; a processor for reading the computer program in the memory and performing the following operations: obtaining a service data packet, and determining whether a first connection exists in a first connection table under a target packet filter PF; wherein the target PF is a PF that matches a first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service-identified; in the case that the first connection does not exist in the first connection table, performing service identification on the service data packet to determine a first service identifier; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet; sending the first IP quintuple and the first service identifier to a session management function SMF; wherein the first IP quintuple and the first service identifier are used by the SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on data packets of the target terminal accessing the target application.

[0022] As a possible implementation method, the UPF includes a flow template TFT business processing node and a deep packet inspection DPI business processing node; the processor executes a judgment on whether there is a first connection in the first connection table hanging under the target packet filter PF, specifically: querying multiple candidate PFs according to the first IP quintuple through the TFT business processing node to determine the target PF matching the first IP quintuple from the multiple candidate PFs; extracting a DPI resolution identifier from the target PF through the TFT business processing node; wherein the DPI resolution identifier is used to indicate whether business identification is performed through the DPI business processing node; when the DPI resolution identifier indicates that business identification is performed through the DPI business processing node, obtaining the first connection table hanging under the target PF through the TFT business processing node; and judging whether there is a first connection matching the first IP quintuple in the first connection table through the TFT business processing node.

[0023] As a possible implementation method, after the processor executes the extraction of the DPI resolution identifier from the target PF, it is also used to perform the following operations: when the DPI resolution identifier indicates that service identification is not performed through the DPI service processing node, determining through the TFT service processing node whether the target PF contains a second service identifier; wherein the second service identifier is used to indicate an application that adopts a general processing policy, and the general processing policy includes a general service quality control policy and / or a general billing policy; when the target PF contains the second service identifier, the default session corresponding to the first IP five-tuple is adopted through the TFT service processing node to execute the general processing policy on the service data packet; when the target PF does not contain the second service identifier, the service data packet is sent to the device indicated by the destination address in the first IP five-tuple through the TFT service processing node.

[0024] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; the processor performs service identification on the service data packet to determine the first service identifier when the first connection does not exist in the first connection table, specifically: when the first connection does not exist in the first connection table, the service data packet is encapsulated by the TFT service processing node to obtain a first encapsulation packet, and the first encapsulation packet is sent to the DPI service processing node; the first encapsulation packet is decapsulated by the DPI service processing node to obtain the service data packet, and the service data packet is parsed to obtain the first IP five-tuple; the DPI service processing node determines whether there is a second connection matching the first IP five-tuple in the second connection table; wherein the second connection table is a connection table maintained by the DPI service processing node; when the second connection exists in the second connection table and the identification bit of the second connection indicates that the second connection has not been service identified, the service data packet is service identified by the DPI service processing node to obtain the application identifier of the target application, and the first service identifier is determined according to the application identifier.

[0025] As a possible implementation method, the processor is also used to perform the following operations: updating the identification bit of the second connection through the DPI service processing node; wherein the updated identification bit of the second connection is used to indicate that the second connection has undergone service identification; and discarding the service data packet through the DPI service processing node.

[0026] As a possible implementation manner, the first encapsulation packet also includes the identification information of the target PF and the transmission direction of the service data packet, and the processor executes sending the first IP quintuple and the first service identifier to the session management function SMF, specifically: sending a first message for establishing a connection to the TFT service processing node through the DPI service processing node; wherein the first message includes the first service identifier, the first IP quintuple, the identification information and the first signaling traffic matching the transmission direction counted for the second connection; establishing a third connection through the TFT service processing node according to the first service identifier and the first IP quintuple, and adding the third connection to the first connection table under the target PF matching the identification information; sending the first service identifier and the first IP quintuple to the SMF through the TFT service processing node; wherein the first service identifier and the first IP quintuple are used by the SMF to establish a target session corresponding to the third connection; wherein the target session is used by the TFT service processing node to perform service quality control and / or billing on the data packet of the target terminal accessing the target application based on the first processing policy corresponding to the first service identifier and the first signaling traffic.

[0027] As a possible implementation manner, after the processor executes the determination whether there is a first connection in the first connection table under the target packet filter PF, it is also used to perform the following operations: if the first connection exists in the first connection table, obtain a third service identifier indicated by the first connection; based on the second processing strategy corresponding to the third service identifier, perform service quality control and / or billing on the business data packet.

[0028] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; when the first connection exists in the first connection table, the processor is further used to perform the following operations: encapsulate the service data packet through the TFT service processing node to obtain a second encapsulation packet, and send the second encapsulation packet to the DPI service processing node; decapsulate the second encapsulation packet through the DPI service processing node to obtain the service data packet, and parse the service data packet to obtain the first IP five-tuple; when the protocol type in the first IP five-tuple is TCP, determine whether the service data packet is a TCP connection establishment message through the DPI service processing node; when the service data packet is the TCP connection establishment message, determine whether there is a fourth connection matching the first IP five-tuple in the second connection table through the DPI service processing node; wherein the second connection table is a connection table maintained by the DPI service processing node; when the fourth connection exists in the second connection table, discard the service data packet through the DPI service processing node.

[0029] As a possible implementation method, the second encapsulation package also includes the transmission direction of the service data packet. After the processor executes the determination through the DPI service processing node whether there is a fourth connection matching the first IP quintuple in the second connection table, it is also used to perform the following operations: if the fourth connection does not exist in the second connection table, establish a fifth connection according to the first IP quintuple through the DPI service processing node; add the fifth connection to the second connection table through the DPI service processing node; and determine, through the DPI service processing node, the second signaling traffic matching the transmission direction counted for the fifth connection based on the traffic of the service data packet.

[0030] As a possible implementation manner, after the processor executes the determination through the DPI service processing node whether the service data packet is a TCP connection establishment message, it is also used to perform the following operations: when the service data packet is not the TCP connection establishment message, determine through the DPI service processing node whether the service data packet is a TCP connection deletion message; when the service data packet is the TCP connection deletion message, determine through the DPI service processing node a sixth connection matching the first IP five-tuple from the second connection table; determine through the DPI service processing node whether the identification bit of the sixth connection indicates that the sixth connection has been service identified; when the identification bit of the sixth connection indicates that the sixth connection has been service identified, delete the sixth connection in the second connection table through the DPI service processing node, and send a second message for deleting the connection to the TFT service processing node; wherein the second message is used by the TFT service processing node to delete the first connection in the first connection table; when the identification bit of the sixth connection indicates that the sixth connection has not been service identified, delete the sixth connection in the second connection table through the DPI service processing node, and discard the service data packet.

[0031] As a possible implementation manner, the processor is also used to perform the following operations: when the service data packet is not the TCP connection deletion message, or when the protocol type is UDP, determine, through the DPI service processing node, whether there is a seventh connection matching the first IP five-tuple in the second connection table; when the seventh connection exists in the second connection table, perform protocol parsing on the service data packet according to the protocol type through the DPI service processing node to obtain a protocol parsing result; when the identification bit of the seventh connection indicates that the seventh connection has been service identified, determine, through the DPI service processing node, whether the service data packet is a UDP termination message according to the protocol parsing result; when the service data packet is a UDP termination message, delete the seventh connection in the second connection table through the DPI service processing node; and send a third message for deleting the connection to the TFT service processing node through the DPI service processing node; wherein the third message is used by the TFT service processing node to delete the first connection in the first connection table.

[0032] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; the processor is further used to perform the following operations: determining, by the DPI service processing node, whether there is a target connection in the second connection table; wherein the target connection is a connection established according to the second IP five-tuple; wherein the second connection table is a connection table maintained by the DPI service processing node; if the target connection exists in the second connection table, determining, by the DPI service processing node, whether the identification bit of the target connection indicates that the target connection has been service identified; if the identification bit of the target connection indicates that the target connection has not been service identified, deleting the target connection in the second connection table by the DPI service processing node; if the identification bit of the target connection indicates that the target connection has been service identified, deleting the target connection in the second connection table by the DPI service processing node, and sending a fourth message for deleting the connection to the TFT service processing node; wherein the fourth message carries the second IP five-tuple and the target service identifier indicated by the target connection, and is used by the TFT service processing node to delete the eighth connection matching the second IP five-tuple in the first connection table.

[0033] As a possible implementation manner, the processor executes the determination through the DPI service processing node whether there is a target connection in the second connection table, specifically: for any connection in the second connection table, obtaining the reception time of the third encapsulation packet corresponding to the any connection through the DPI service processing node; wherein the third encapsulation packet is the most recently received encapsulation packet containing the IP five-tuple indicated by the any connection; determining through the DPI service processing node whether the time difference between the reception time of the third encapsulation packet corresponding to the any connection and the current time is less than a set duration; when the time difference corresponding to any connection is greater than or equal to the set duration, determining that there is a target connection in the second connection table, and using any connection as the target connection; when the time differences corresponding to all connections in the second connection table are less than the set duration, determining that there is no target connection in the second connection table.

[0034] As a possible implementation manner, when the first connection does not exist in the first connection table, the processor is further configured to perform the following operations: sending the service data packet to a device indicated by a destination address in the first IP quintuple.

[0035] According to another aspect of the present application, a service identification device is provided, which is applied to a UPF, including:

[0036] An acquisition unit, used for acquiring a service data packet;

[0037] A judging unit, used to judge whether there is a first connection in the first connection table under the target packet filter PF; wherein the target PF is a PF that matches the first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service identified;

[0038] an identification unit, configured to perform service identification on the service data packet to determine a first service identifier when the first connection does not exist in the first connection table; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet;

[0039] A sending unit, configured to send the first IP quintuple and the first service identifier to a session management function SMF;

[0040] Among them, the first IP quintuple and the first service identifier are used by the SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on the data packets of the target terminal accessing the target application.

[0041] As a possible implementation method, the UPF includes a flow template TFT business processing node and a deep packet inspection DPI business processing node; the judgment unit is specifically used to: query multiple candidate PFs according to the first IP quintuple through the TFT business processing node to determine the target PF matching the first IP quintuple from the multiple candidate PFs; extract the DPI resolution identifier from the target PF through the TFT business processing node; wherein the DPI resolution identifier is used to indicate whether business identification is performed through the DPI business processing node; when the DPI resolution identifier indicates that business identification is performed through the DPI business processing node, obtain the first connection table under the target PF through the TFT business processing node; and judge through the TFT business processing node whether there is a first connection matching the first IP quintuple in the first connection table.

[0042] As a possible implementation method, the device also includes: a first processing unit, used to determine whether the target PF contains a second service identifier through the TFT service processing node when the DPI resolution identifier indicates that service identification is not performed through the DPI service processing node; wherein the second service identifier is used to indicate an application that adopts a general processing policy, and the general processing policy includes a general service quality control policy and / or a general billing policy; when the target PF contains the second service identifier, the default session corresponding to the first IP quintuple is adopted by the TFT service processing node to execute the general processing policy on the service data packet; when the target PF does not contain the second service identifier, the service data packet is sent to the device indicated by the destination address in the first IP quintuple through the TFT service processing node.

[0043] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; the identification unit is specifically used to: when the first connection does not exist in the first connection table, encapsulate the service data packet through the TFT service processing node to obtain a first encapsulation packet, and send the first encapsulation packet to the DPI service processing node; decapsulate the first encapsulation packet through the DPI service processing node to obtain the service data packet, and parse the service data packet to obtain the first IP five-tuple; determine through the DPI service processing node whether there is a second connection matching the first IP five-tuple in the second connection table; wherein the second connection table is a connection table maintained by the DPI service processing node; when the second connection exists in the second connection table and the identification bit of the second connection indicates that the second connection has not been service identified, perform service identification on the service data packet through the DPI service processing node to obtain the application identifier of the target application, and determine the first service identifier based on the application identifier.

[0044] As a possible implementation method, the device also includes: a second processing unit, used to update the identification bit of the second connection through the DPI service processing node; wherein the updated identification bit of the second connection is used to indicate that the second connection has been service identified; and discard the service data packet through the DPI service processing node.

[0045] As a possible implementation method, the first encapsulation package also includes the identification information of the target PF and the transmission direction of the service data packet, and the sending unit is specifically used to: send a first message for establishing a connection to the TFT service processing node through the DPI service processing node; wherein the first message includes the first service identifier, the first IP quintuple, the identification information and the first signaling traffic that matches the transmission direction counted for the second connection; establish a third connection through the TFT service processing node according to the first service identifier and the first IP quintuple, and add the third connection to the first connection table under the target PF matching the identification information; send the first service identifier and the first IP quintuple to the SMF through the TFT service processing node; wherein the first service identifier and the first IP quintuple are used by the SMF to establish a target session corresponding to the third connection; wherein the target session is used by the TFT service processing node to perform service quality control and / or billing on the data packet of the target terminal accessing the target application based on the first processing policy corresponding to the first service identifier and the first signaling traffic.

[0046] As a possible implementation manner, the device also includes: a third processing unit, which is used to obtain a third service identifier indicated by the first connection when the first connection exists in the first connection table; and perform service quality control and / or billing on the business data packet based on a second processing strategy corresponding to the third service identifier.

[0047] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; the device also includes: a fourth processing unit, which is used to encapsulate the service data packet through the TFT service processing node to obtain a second encapsulation packet, and send the second encapsulation packet to the DPI service processing node when the first connection exists in the first connection table; decapsulate the second encapsulation packet through the DPI service processing node to obtain the service data packet, and parse the service data packet to obtain the first IP five-tuple; when the protocol type in the first IP five-tuple is TCP, determine whether the service data packet is a TCP connection establishment message through the DPI service processing node; when the service data packet is the TCP connection establishment message, determine whether there is a fourth connection matching the first IP five-tuple in the second connection table through the DPI service processing node; wherein the second connection table is a connection table maintained by the DPI service processing node; when the fourth connection exists in the second connection table, discard the service data packet through the DPI service processing node.

[0048] As a possible implementation method, the second encapsulation package also includes the transmission direction of the business data packet, and the fourth processing unit is also used to: when the fourth connection does not exist in the second connection table, establish a fifth connection according to the first IP quintuple through the DPI business processing node; add the fifth connection to the second connection table through the DPI business processing node; determine the second signaling traffic that matches the transmission direction counted for the fifth connection based on the traffic of the business data packet through the DPI business processing node.

[0049] As a possible implementation manner, the fourth processing unit is also used to: when the service data packet is not the TCP connection establishment message, determine whether the service data packet is a TCP connection deletion message through the DPI service processing node; when the service data packet is the TCP connection deletion message, determine the sixth connection matching the first IP five-tuple from the second connection table through the DPI service processing node; determine whether the identification bit of the sixth connection indicates that the sixth connection has been service identified through the DPI service processing node; when the identification bit of the sixth connection indicates that the sixth connection has been service identified, delete the sixth connection in the second connection table through the DPI service processing node, and send a second message for deleting the connection to the TFT service processing node; wherein the second message is used for the TFT service processing node to delete the first connection in the first connection table; when the identification bit of the sixth connection indicates that the sixth connection has not been service identified, delete the sixth connection in the second connection table through the DPI service processing node, and discard the service data packet.

[0050] As a possible implementation manner, the fourth processing unit is also used for: when the service data packet is not the TCP connection deletion message, or when the protocol type is UDP, judging through the DPI service processing node whether there is a seventh connection matching the first IP five-tuple in the second connection table; when the seventh connection exists in the second connection table, performing protocol parsing on the service data packet according to the protocol type by the DPI service processing node to obtain a protocol parsing result; when the identification bit of the seventh connection indicates that the seventh connection has been service identified, judging through the DPI service processing node whether the service data packet is a UDP termination message according to the protocol parsing result; when the service data packet is a UDP termination message, deleting the seventh connection in the second connection table by the DPI service processing node; and sending a third message for deleting the connection to the TFT service processing node by the DPI service processing node; wherein the third message is used by the TFT service processing node to delete the first connection in the first connection table.

[0051] As a possible implementation, the UPF includes a TFT service processing node and a DPI service processing node; the device also includes: a fifth processing unit, configured to determine whether there is a target connection in the second connection table through the DPI service processing node; wherein the target connection is a connection established according to the second IP five-tuple; wherein the second connection table is a connection table maintained by the DPI service processing node; if the target connection exists in the second connection table, the DPI service processing node determines whether the identification bit of the target connection indicates that the target connection has been service identified; if the identification bit of the target connection indicates that the target connection has not been service identified, the DPI service processing node deletes the target connection in the second connection table; if the identification bit of the target connection indicates that the target connection has been service identified, the DPI service processing node deletes the target connection in the second connection table, and sends a fourth message for deleting the connection to the TFT service processing node; wherein the fourth message carries the second IP five-tuple and the target service identifier indicated by the target connection, and is used by the TFT service processing node to delete the eighth connection matching the second IP five-tuple in the first connection table.

[0052] As a possible implementation manner, the fifth processing unit is specifically used to: for any connection in the second connection table, obtain the reception time of the third encapsulation packet corresponding to the any connection through the DPI service processing node; wherein the third encapsulation packet is the most recently received encapsulation packet containing the IP five-tuple indicated by the any connection; determine through the DPI service processing node whether the time difference between the reception time of the third encapsulation packet corresponding to the any connection and the current time is less than a set duration; when the time difference corresponding to any connection is greater than or equal to the set duration, determine that there is a target connection in the second connection table, and use the any connection as the target connection; when the time differences corresponding to all connections in the second connection table are less than the set duration, determine that there is no target connection in the second connection table.

[0053] As a possible implementation manner, the sending unit is further configured to: when the first connection does not exist in the first connection table, send the service data packet to a device indicated by a destination address in the first IP quintuple.

[0054] According to another aspect of the present application, a processor-readable storage medium is provided, characterized in that the processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the service identification method described in the above embodiment.

[0055] According to another aspect of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the service identification method described in the above embodiment of the present application is implemented.

[0056] The service identification method, device, user plane function and medium provided in the embodiments of the present application obtain a service data packet and determine whether a first connection exists in the first connection table under the target PF; wherein the target PF is a PF that matches the first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service identified; if the first connection does not exist in the first connection table, service identification is performed on the service data packet to determine a first service identifier; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet; the first IP quintuple and the first service identifier are sent to the SMF so that the SMF establishes a target session for the target terminal, wherein the target session is used to perform QoS control and / or billing on data packets of the target terminal accessing the target application. Therefore, the first connection table records each connection that has been service identified. When the first IP quintuple in the service data packet does not match any connection in the first connection table, it indicates that the UPF has not performed service identification on the data packet containing the first IP quintuple, that is, the connection indicated by the first IP quintuple has not been service identified. At this time, service identification can be performed on the service data packet. When the first IP quintuple in the service data packet matches a connection in the first connection table, it indicates that the connection indicated by the first IP quintuple has been service identified. At this time, service identification is not required for the service data packet, which can reduce the processing burden of the UPF and improve the processing speed and performance of the UPF.

[0057] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present application.

[0059] Figure 1 A flowchart of a service identification method provided in an embodiment of the present application;

[0060] Figure 2 A flowchart of another service identification method provided in an embodiment of the present application;

[0061] Figure 3 A flowchart of another service identification method provided in an embodiment of the present application;

[0062] Figure 4 A flowchart of another service identification method provided in an embodiment of the present application;

[0063] Figure 5 A flowchart of another service identification method provided in an embodiment of the present application;

[0064] Figure 6 A schematic diagram of the structure of a UPF provided in an embodiment of the present application;

[0065] Figure 7 A schematic diagram of the structure of a service identification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] In the embodiments of the present application, the term "and / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0067] In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0068] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0069] In the related technology, UPF needs to perform in-depth analysis or service identification on each data packet to determine which application each data packet corresponds to, so as to perform targeted QoS control and billing on the data packets of each application.

[0070] However, the above method has at least the following disadvantages:

[0071] First, it greatly affects the performance of UPF. For example, the applicant tested UPF and found that if UPF performs deep parsing on all data packets, the performance will drop by 40%.

[0072] Second, in order to improve the performance of business identification, the corresponding hardware resources requirements are relatively high.

[0073] Third, data packets before service identification are not counted in the identified services, resulting in inaccurate billing.

[0074] Therefore, in order to solve at least one of the above-mentioned problems, the embodiments of the present application provide a service identification method, device, user plane function and medium, wherein the method and the device are based on the same application concept. Since the principles of solving the problems by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0075] The service identification method, device, user plane function and medium provided by the present application are described below with reference to the accompanying drawings. Before describing the embodiments of the present application in detail, for ease of understanding, common technical terms are first introduced:

[0076] The service data packets may include uplink data packets and downlink data packets, wherein the uplink data packets refer to data packets sent by the target terminal to the application server, and the downlink data packets refer to data packets sent by the application server to the target terminal.

[0077] Among them, the target terminal can be a terminal device that can access an application server or APP (Application) (referred to as the target application in this application), and the application server is a server (or called a server) corresponding to the target application.

[0078] The terminal device may be a device that provides voice and / or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. In different systems, the names of the terminal devices may also be different. For example, in a 5G system, the terminal device may be called a user equipment (UE). The wireless terminal device may communicate with one or more core networks (CN) via a radio access network (RAN). The wireless terminal device may be a mobile terminal device, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal device. For example, it may be a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device that exchanges language and / or data with a wireless access network. For example, personal communication service (PCS) phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDA) and other devices. The wireless terminal device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point, a remote terminal device, an access terminal device, a user terminal device, a user agent, and a user device, but is not limited in the embodiments of the present application.

[0079] The first IP quintuple refers to the IP quintuple contained in the service data packet, wherein the IP quintuple includes: source IP address, source port, destination IP address (referred to as destination address in this application), destination port and transport layer protocol.

[0080] For example, taking the IP quintuple "192.168.1.1 10000 TCP 121.14.88.76 80" as an exemplary illustration, the source IP address is "192.168.1.1", the source port is "10000", the transport layer protocol is "TCP", the destination IP address is "121.14.88.76", and the destination port is "80".

[0081] Among them, IP refers to the abbreviation of Internet Protocol, and TCP refers to the abbreviation of Transmission Control Protocol.

[0082] The first connection table refers to the connection table under the target PF (Packet Filter), wherein the first connection table may include at least one connection that has been service-identified, wherein the connection refers to a connection established according to an IP five-tuple. Still taking the above example as an example, the connection established according to the IP five-tuple is used to indicate the connection between the source IP address (192.168.1.1) and the destination IP address (121.14.88.76).

[0083] The first connection refers to the connection in the first connection table that matches the first IP quintuple. That is, the first connection is a connection established based on the first IP quintuple. Here, "matching" means that the first connection at least includes the source IP address and destination IP address in the first IP quintuple, and may also include the source port, destination port, and transport layer protocol.

[0084] Business identification refers to the UPF or DPI business processing node performing in-depth analysis of data packets, such as application layer analysis. According to the protocol type used by the data packet, the payload in the data packet is checked, and key information in the application layer protocol, such as URL (Uniform Resource Locator), file type, user agent, etc., is identified, as well as application-related information, such as application identification (application ID).

[0085] Among them, ID is the abbreviation of identity.

[0086] The first service identifier refers to a service identifier obtained by performing service identification on a service data packet through a DPI service processing node when the first connection does not exist in the first connection table.

[0087] Among them, the first service identifier (ServiceID) is used to indicate the target application accessed by the target terminal. For example, there is a mapping relationship or a corresponding relationship between the application identifier of the target application (such as the application ID) and the first service identifier. The above mapping relationship can be queried according to the first service identifier to determine the application identifier of the target application, and thus the target application accessed by the target terminal can be determined according to the application identifier of the target application.

[0088] The DPI (Deep Packet Inspection) parsing flag is used to indicate whether deep parsing or service identification is performed through a DPI service processing node. For example, the DPI parsing flag can have two values, one of which (such as 1) is used to indicate that deep parsing or service identification is performed through a DPI service processing node, and the other value (such as 0) is used to indicate that deep parsing or service identification is not performed through a DPI service processing node.

[0089] The second service identifier is used to indicate an application program (such as a mailbox, etc.) that adopts a general processing strategy, wherein the general processing strategy includes a general QoS control strategy and a general charging strategy.

[0090] Correspondingly, the first service identifier is used to indicate an application program (such as a short video application, an instant messaging application, etc.) that adopts a dedicated processing strategy.

[0091] The dedicated processing strategy (referred to as the first processing strategy in this application) includes a dedicated QoS control strategy and a dedicated charging strategy. The dedicated QoS control strategy is a dedicated QoS control strategy pre-set for the target application, and the dedicated charging strategy is a dedicated charging strategy pre-set for the target application.

[0092] The second connection table refers to a connection table maintained by the DPI service processing node. The second connection table includes at least one connection, and the connection in the second connection table can be a connection that has been service identified or a connection that has not been service identified, and this application does not limit this.

[0093] Among them, each connection in the second connection table may include an identification bit, and the identification bit is used to indicate whether the corresponding connection has been service identified. For example, when the identification bit is 1, it can be used to indicate that the corresponding connection has been service identified, and when the identification bit is 0, it can be used to indicate that the corresponding connection has not been service identified. Of course, the identification bit can also be 0 to indicate that the corresponding connection has been service identified, and the identification bit can be 1 to indicate that the corresponding connection has not been service identified, and this application does not limit this.

[0094] It should be noted that when a new connection is established, the identification bit (initial value) of the connection is used to indicate that the connection has not been service identified.

[0095] The second connection refers to a connection in the second connection table that matches the first IP quintuple when the first connection does not exist in the first connection table, wherein "match" means that the second connection contains at least the source IP address and the destination IP address in the first IP quintuple, and may also include the source port, the destination port and the transport layer protocol.

[0096] The third service identifier refers to the service identifier indicated by the first connection when the first connection exists in the first connection table. That is, each connection in the first connection table is established based on the IP quintuple and the service identifier at the same time.

[0097] The second processing strategy is the same as the first processing strategy, and both are dedicated processing strategies pre-set for the target application, including a dedicated QoS control strategy and a dedicated charging strategy. The difference is that the first processing strategy is a processing strategy corresponding to the first service identifier, and the second processing strategy is a processing strategy corresponding to the third service identifier.

[0098] The fourth connection refers to a connection in the second connection table that matches the first IP quintuple when the first connection exists in the first connection table and the service data packet is a TCP connection establishment message.

[0099] The fifth connection refers to a connection established by the DPI service processing node according to the first IP quintuple when the first connection exists in the first connection table and the fourth connection does not exist in the second connection table.

[0100] The sixth connection refers to a connection in the second connection table that matches the first IP quintuple when the first connection exists in the first connection table and the service data packet is a TCP connection deletion message.

[0101] The seventh connection refers to a connection in the second connection table that matches the first IP quintuple when the first connection exists in the first connection table and the service data packet is not a TCP connection deletion message or the protocol type in the first IP quintuple is UDP.

[0102] Among them, UDP is the abbreviation of User Datagram Protocol.

[0103] The target connection refers to the aged connection in the second connection table, wherein "aging" means that the time difference between the time when the DPI service processing node last received the encapsulated packet containing the IP five-tuple indicated by the target connection and the current time is greater than the set duration.

[0104] The set duration is a preset duration threshold.

[0105] The second IP quintuple refers to the IP quintuple indicated by the target connection, that is, the target connection is established based on the second IP quintuple.

[0106] The eighth connection refers to a connection in the first connection table that matches the second IP quintuple.

[0107] The target service identifier is used to indicate the application accessed by the terminal device that sends or receives the data packet containing the second IP five-tuple.

[0108] Figure 1 A flowchart of a service identification method provided in an embodiment of the present application.

[0109] The service identification method of the embodiment of the present application can be executed by UPF.

[0110] like Figure 1 As shown, the service identification method may include the following steps:

[0111] Step S101, obtain the service data packet and determine whether there is a first connection in the first connection table under the target PF; wherein the target PF is the PF that matches the first IP quintuple in the service data packet, and the first connection is the connection that matches the first IP quintuple and has been service identified.

[0112] In an embodiment of the present application, when the transmission direction of the service data packet is uplink, that is, the service data packet is an uplink data packet, UPF can obtain the service data packet sent by the target terminal. When the transmission direction of the service data packet is downlink, that is, the service data packet is a downlink data packet, UPF can receive the service data packet sent by the application server.

[0113] It should be noted that the intermediate devices may be omitted in the description of the data sending / receiving process.

[0114] In an embodiment of the present application, after receiving a service data packet, the UPF can extract the IP quintuple (referred to as the first IP quintuple in the present application) in the service data packet and determine the target PF that matches the first IP quintuple (that is, the target PF includes the first IP quintuple). After that, it can be determined whether there is a first connection matching the first IP quintuple in the first connection table under the target PF. If the first connection exists in the first connection table, it indicates that the UPF has previously performed service identification on the data packet containing the first IP quintuple. At this time, in order to reduce the processing burden of the UPF, there is no need to perform service identification on each data packet containing the first IP quintuple again.

[0115] If the first connection does not exist in the first connection table, it means that the UPF has not previously performed service identification on the data packet containing the first IP quintuple. At this time, the subsequent steps can be executed.

[0116] Step S102, when there is no first connection in the first connection table, service identification is performed on the service data packet to determine a first service identifier; wherein the first service identifier is used to indicate a target application accessed by a target terminal sending or receiving the service data packet.

[0117] In an embodiment of the present application, when the first connection does not exist in the first connection table, it indicates that the UPF has not previously performed service identification on the data packet containing the first IP five-tuple. At this time, the UPF can perform the first service identification on the service data packet to determine the first service identifier.

[0118] When the service data packet is an uplink data packet, the first service identifier is used to indicate the target application accessed by the target terminal sending the service data packet. When the service data packet is a downlink data packet, the first service identifier is used to indicate the target application accessed by the target terminal receiving the service data packet.

[0119] Step S103: Send the first IP quintuple and the first service identifier to SMF (Session Management Function).

[0120] In an embodiment of the present application, UPF can send a first IP quintuple and a first service identifier to SMF. Accordingly, after receiving the first IP quintuple and the first service identifier, SMF can establish a target session for the target terminal based on the first IP quintuple and the first service identifier, wherein the target session is used to perform QoS control and / or billing on data packets of the target terminal accessing the target application.

[0121] As an example, UPF can perform QoS control on the data packets of the target terminal accessing the target application based on the target session, and / or UPF can perform traffic statistics on the data packets of the target terminal accessing the target application based on the target session, and send the counted traffic to CHF (Charging Function) through SMF, so that CHF can charge the data packets of the target terminal accessing the target application according to the counted traffic.

[0122] The service identification method of the embodiment of the present application obtains a service data packet and determines whether there is a first connection in the first connection table under the target PF; wherein the target PF is a PF that matches the first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service identified; if the first connection does not exist in the first connection table, service identification is performed on the service data packet to determine a first service identifier; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet; the first IP quintuple and the first service identifier are sent to the SMF so that the SMF establishes a target session for the target terminal, wherein the target session is used to perform QoS control and / or billing on data packets of the target terminal accessing the target application. Therefore, the first connection table records each connection that has been service identified. When the first IP quintuple in the service data packet does not match any connection in the first connection table, it indicates that the UPF has not performed service identification on the data packet containing the first IP quintuple, that is, the connection indicated by the first IP quintuple has not been service identified. At this time, service identification can be performed on the service data packet. When the first IP quintuple in the service data packet matches a connection in the first connection table, it indicates that the connection indicated by the first IP quintuple has been service identified. At this time, service identification is not required for the service data packet, which can reduce the processing burden of the UPF and improve the processing speed and performance of the UPF.

[0123] In order to clearly illustrate the above embodiment, the present application also proposes a service identification method.

[0124] Figure 2 A flowchart of another service identification method provided in an embodiment of the present application.

[0125] like Figure 2 As shown, the service identification method can be executed by UPF, wherein UPF includes a TFT (Traffic Flow Template) service processing node and a DPI service processing node, and the method may include the following steps:

[0126] Step S201: Acquire a service data packet through a TFT service processing node.

[0127] For the explanation of step S201, please refer to the relevant description in any embodiment of the present application, which will not be repeated here.

[0128] Step S202: query multiple candidate PFs according to the first IP quintuple through the TFT service processing node to determine a target PF matching the first IP quintuple from the multiple candidate PFs.

[0129] In an embodiment of the present application, after receiving a service data packet, the TFT service processing node can extract the first IP quintuple from the service data packet, and query multiple candidate PFs based on the first IP service group to determine a target PF that matches the first IP quintuple from the multiple candidate PFs, wherein the target PF includes the first IP quintuple.

[0130] Step S203: extracting the DPI resolution identifier from the target PF through the TFT service processing node.

[0131] In an embodiment of the present application, the TFT service processing node can extract a DPI resolution identifier from a target PF, wherein the DPI resolution identifier is used to indicate whether deep resolution or service identification is performed through the DPI service processing node.

[0132] Step S204, determining whether the DPI resolution identifier indicates that service identification is performed through the DPI service processing node, if so, executing step S205, if not, executing step S210.

[0133] It should be noted that step S205 and step S210 are two parallel implementation methods. In actual application, only one needs to be executed.

[0134] Step S205: Acquire the first connection table under the target PF through the TFT service processing node.

[0135] In an embodiment of the present application, when the DPI resolution identifier indicates that service identification is performed through the DPI service processing node, it indicates that the service data packet needs to be sent to the DPI service processing node for deep analysis and / or service identification. At this time, the first connection table under the target PF can be obtained through the TFT service processing node.

[0136] Step S206, determining whether the first connection exists in the first connection table, if yes, executing step S209, if no, executing steps S207 to S208.

[0137] The first connection is a connection that matches the first IP quintuple and has been service-identified.

[0138] It should be noted that step S209 and steps S207 to S208 are two parallel implementation methods. In actual application, only one needs to be executed.

[0139] Step S207: Perform service identification on the service data packet through the DPI service processing node to determine the first service identifier.

[0140] In an embodiment of the present application, when the first connection does not exist in the first connection table, the DPI service processing node can perform service identification on the service data packet to determine the first service identifier, wherein the first service identifier is used to indicate the target application accessed by the target terminal sending or receiving the service data packet.

[0141] Step S208: Send the first IP quintuple and the first service identifier to the SMF through the TFT service processing node.

[0142] Among them, the first IP quintuple and the first service identifier are used by SMF to establish a target session for the target terminal, and the target session is used to perform QoS control and / or billing on the data packets of the target terminal accessing the target application.

[0143] The explanation of steps S206 to S208 can be found in the relevant description in any embodiment of the present application and will not be repeated here.

[0144] Optionally, when the first connection does not exist in the first connection table, the service data packet may also be sent to the device indicated by the destination address (ie, the destination IP address) in the first IP quintuple through the TFT service processing node.

[0145] For example, when the service data packet is a downlink data packet, the device indicated by the target address is a target terminal, and the service data packet can be sent to the target terminal through the TFT service processing node.

[0146] For another example, when the service data packet is an uplink data packet, the device indicated by the target address is an application server, and the service data packet can be sent to the application server through the TFT service processing node.

[0147] Step S209: obtaining the third service identifier indicated by the first connection through the TFT service processing node, and performing QoS control and / or charging on the service data packet based on the second processing strategy corresponding to the third service identifier.

[0148] In an embodiment of the present application, when there is a first connection in the first connection table, at this time, the third service identifier indicated by the first connection can be obtained through the TFT service processing node (that is, the first connection is a connection established based on the first IP quintuple and the third service identifier), and based on the second processing strategy corresponding to the third service identifier, QoS control and / or billing are performed on the service data packet.

[0149] Step S210, determining whether the target PF contains the second service identifier, if so, executing step S211, if not, executing step S212.

[0150] The second service identifier is used to indicate an application program that adopts a universal processing strategy, and the universal processing strategy includes a universal service quality control strategy and / or a universal billing strategy.

[0151] In an embodiment of the present application, when the DPI resolution identifier indicates that service identification is not performed through the DPI service processing node, it is possible to further determine through the TFT service processing node whether the target PF contains a predefined second service identifier. If so, execute step S211; if not, execute step S212.

[0152] It should be noted that step S211 and step S212 are two parallel implementation methods. In actual application, only one needs to be executed.

[0153] Step S211: The TFT service processing node executes a general processing strategy on the service data packet based on the default session corresponding to the first IP quintuple.

[0154] In an embodiment of the present application, when the target PF includes a predefined second service identifier, the TFT service processing node can execute a general processing policy corresponding to the second service identifier on the service data packet based on the default session corresponding to the first IP quintuple. The general processing policy includes a general service quality control policy and / or a general billing policy.

[0155] As an application scenario, taking the protocol type of the business data packet as POP3 (Post Office Protocol-Version 3), the target application is a mailbox. Layer 3 and Layer 4 can directly parse the business type of the business data packet and determine the service identifier used to indicate the target application without the need for the DPI business processing node to perform deep analysis to determine the service identifier used to indicate the target application. At this time, the target PF can directly include a second service identifier used to indicate the mailbox. Therefore, a general processing strategy can be executed on the data packet accessing the mailbox based directly on the default session corresponding to the first IP quintuple.

[0156] Step S212: Send the service data packet to the device indicated by the destination address in the first IP quintuple through the TFT service processing node.

[0157] In an embodiment of the present application, when the target PF does not contain a predefined second service identifier, the service data packet can be sent to the device indicated by the destination address (ie, the destination IP address) in the first IP quintuple through the TFT service processing node.

[0158] As an application scenario, take the example of the target terminal using the enterprise intranet to access the target application. Since the enterprise intranet is not charged, at this time, the target PF does not need to include a service identifier for indicating the target application. The UPF can directly forward the service data packet to the device indicated by the destination address (i.e., the destination IP address) in the first IP quintuple.

[0159] The service identification method of the embodiment of the present application performs deep analysis and service identification on the service data packet through the DPI service processing node only when the DPI resolution identifier in the target PF indicates that service identification is performed through the DPI service processing node and the first connection table under the target PF does not contain a connection matching the first IP quintuple. This can further reduce the processing burden of UPF and improve the processing speed and performance of UPF.

[0160] In order to clearly explain how to perform service identification on a service data packet to determine a first service identifier in any embodiment of the present application, the present application also proposes a service identification method.

[0161] Figure 3 A flowchart of another service identification method provided in an embodiment of the present application.

[0162] like Figure 3 As shown, the service identification method can be executed by UPF, wherein the UPF includes a TFT service processing node and a DPI service processing node, and the method may include the following steps:

[0163] Step S301: Acquire a service data packet, and determine whether there is a first connection in the first connection table under the target PF.

[0164] The target PF is the PF that matches the first IP quintuple in the service data packet, and the first connection is the connection that matches the first IP quintuple and has been service identified.

[0165] For the explanation of step S301, please refer to the relevant description in any embodiment of the present application, and will not be repeated here.

[0166] Step S302: When the first connection does not exist in the first connection table, the service data packet is encapsulated by the TFT service processing node to obtain a first encapsulation packet, and the first encapsulation packet is sent to the DPI service processing node.

[0167] In an embodiment of the present application, when there is no first connection matching the first IP quintuple in the first connection table, the service data packet can be encapsulated by the TFT service processing node to obtain a first encapsulation packet.

[0168] As an example, the TFT service processing node may encapsulate the service data packet according to the transmission direction of the service data packet, identification information (such as an index) of the target PF, and address information of the TFT service processing node to obtain a first encapsulation packet.

[0169] In the embodiment of the present application, the first encapsulation packet can also be sent to the DPI service processing node through the TFT service processing node.

[0170] Step S303: decapsulate the first encapsulated packet through the DPI service processing node to obtain a service data packet, and parse the service data packet to obtain a first IP quintuple.

[0171] In an embodiment of the present application, after receiving the first encapsulation packet, the DPI service processing node may decapsulate the first encapsulation packet to obtain a service data packet, and parse the service data packet to obtain a first IP quintuple.

[0172] Step S304: Determine, by the DPI service processing node, whether there is a second connection in the second connection table.

[0173] The second connection refers to a connection in the second connection table that matches the first IP quintuple.

[0174] The second connection table is a connection table maintained by the DPI service processing node.

[0175] In an embodiment of the present application, after obtaining the first IP quintuple, the DPI service processing node can determine whether there is a second connection in the second connection table that matches the first IP quintuple based on the first IP quintuple. If so, execute subsequent steps; if not, create a new connection based on the first IP quintuple and add it to the second connection table.

[0176] Step S305, when there is a second connection in the second connection table and the identification bit of the second connection indicates that the second connection has not been service-identified, the service data packet is service-identified through the DPI service processing node to obtain the application identifier of the target application, and the first service identifier is determined based on the application identifier.

[0177] In an embodiment of the present application, when the identification bit of the second connection indicates that the second connection has not been service identified, the service data packet can be service identified by the DPI service processing node to obtain the application identifier of the target application, and based on the application identifier of the target application, the mapping relationship or correspondence between the application identifier (such as APP ID) and the service identifier (ServiceID) is queried to obtain a first service identifier that has a mapping relationship with the application identifier of the target application.

[0178] The first service identifier is used to indicate a target application accessed by a target terminal that sends or receives a service data packet.

[0179] In any embodiment of the present application, after the DPI service processing node identifies the first service identifier, the DPI service processing node may also update the identification bit of the second connection in the second connection table; wherein the updated identification bit of the second connection is used to indicate that the second connection has been service identified. Furthermore, after the DPI service processing node identifies the first service identifier, it may also discard the service data packet.

[0180] Step S306: Send the first IP quintuple and the first service identifier to the SMF through the TFT service processing node.

[0181] Among them, the first IP quintuple and the first service identifier are used by SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on the data packets of the target terminal accessing the target application.

[0182] For the explanation of step S306, please refer to the relevant description in any embodiment of the present application, which will not be repeated here.

[0183] In any embodiment of the present application, the process of establishing the target session is, for example:

[0184] 1. Send a first message (or called a connection creation message, connection establishment message) for establishing or creating a connection to the TFT service processing node through the DPI service processing node; wherein the first message includes a first service identifier, a first IP five-tuple, identification information of the target PF in the first encapsulation packet, and a first signaling traffic counted for the second connection that matches the transmission direction.

[0185] In an embodiment of the present application, after identifying the first service identifier, the DPI service processing node can send a first message for establishing or creating a connection to the TFT service processing node; wherein the first message includes the first service identifier, the first IP five-tuple, the identification information of the target PF in the first encapsulation packet, and the first signaling traffic matching the transmission direction counted for the second connection, wherein the transmission direction is the transmission direction of the service data packet included in the first encapsulation packet.

[0186] It should be noted that before performing service identification on the second connection in the second connection table, counting signaling traffic for the second connection can avoid missing traffic statistics of data packets before service identification, thereby improving the accuracy of traffic statistics and billing.

[0187] 2. Establish a third connection through the TFT service processing node according to the first service identifier and the first IP quintuple, and add the third connection to the first connection table under the target PF matching the identifier information.

[0188] In an embodiment of the present application, after receiving the first message, the TFT service processing node can establish a third connection based on the first service identifier and the first IP quintuple in the first message, and determine the target PF that matches the identification information from multiple candidate PFs based on the identification information in the first message, and add the third connection to the first connection table under the target PF.

[0189] 3. Send the first service identifier and the first IP quintuple to SMF through the TFT service processing node; wherein, the first service identifier and the first IP quintuple are used by SMF to establish a target session corresponding to the third connection.

[0190] The target session is used by the TFT service processing node to perform QoS control and / or billing on data packets of the target terminal accessing the target application based on the first processing strategy and the first signaling flow corresponding to the first service identifier.

[0191] In an embodiment of the present application, after receiving the first message, the TFT service processing node may also send the first service identifier and the first IP quintuple in the first message to the SMF, so that the SMF creates a target session corresponding to the third connection for the target terminal based on the first service identifier and the first IP quintuple. Thus, the TFT service processing node can perform QoS control on the data packets of the target terminal accessing the target application on the target session based on the QoS control policy in the first processing policy corresponding to the first service identifier, and / or, the TFT service processing node can perform traffic statistics on the data packets of the target terminal accessing the target application on the target session based on the first signaling traffic, and send the statistical traffic to the CHF through the SMF, so that the CHF can charge the data packets of the target terminal accessing the target application according to the billing policy and the statistical traffic in the first processing policy.

[0192] The service identification method of the embodiment of the present application performs deep analysis and service identification on the service data packet through the DPI service processing node only when there is no connection matching the first IP quintuple in the first connection table and the identification bit of the connection matching the first IP quintuple in the second connection table indicates that the connection has not been service identified. This can further reduce the processing burden of UPF and improve the processing speed and performance of UPF.

[0193] In order to clearly illustrate the above embodiment, the present application also proposes a service identification method.

[0194] Figure 4A flowchart of another service identification method provided in an embodiment of the present application.

[0195] The service identification method provided in the embodiment of the present application can be executed by UPF, wherein UPF includes a TFT service processing node and a DPI service processing node.

[0196] like Figure 4 As shown, based on any of the above embodiments, when there is a first connection in the first connection table, the service identification method may further include the following steps:

[0197] Step S401: encapsulate the service data packet through the TFT service processing node to obtain a second encapsulation packet, and send the second encapsulation packet to the DPI service processing node.

[0198] In an embodiment of the present application, when there is a first connection in the first connection table, the TFT service processing node can also encapsulate the service data packet to obtain a second encapsulation package, wherein the encapsulation method of the second encapsulation package is similar to the encapsulation method of the first encapsulation package, and will not be repeated here.

[0199] In an embodiment of the present application, the TFT service processing node may also send the second encapsulation packet to the DPI service processing node for protocol analysis.

[0200] Step S402: Decapsulate the second encapsulated packet through the DPI service processing node to obtain a service data packet, and parse the service data packet to obtain a first IP quintuple.

[0201] In an embodiment of the present application, after receiving the second encapsulation packet, the DPI service processing node may decapsulate the second encapsulation packet to obtain a service data packet, and parse the service data packet to obtain a first IP quintuple.

[0202] Step S403, determine whether the protocol type in the first IP quintuple is TCP, if so, execute step S404, if not, execute step S413.

[0203] In an embodiment of the present application, the DPI service processing node may determine whether the protocol type in the first IP quintuple is TCP, and if so, execute step S404, and if not, execute step S413.

[0204] It should be noted that step S404 and step S413 are two parallel implementation methods. In actual application, only one needs to be executed.

[0205] Step S404, determine whether the service data packet is a TCP connection establishment message, if so, execute step S405, if not, execute step S408.

[0206] In an embodiment of the present application, when the protocol type in the first IP quintuple is TCP, the DPI service processing node can further determine whether the service data packet is a TCP connection establishment message, if so, execute step S405, if not, execute step S408.

[0207] It should be noted that step S405 and step S408 are two parallel implementation methods. In actual application, only one needs to be executed.

[0208] Step S405, determining whether there is a fourth connection in the second connection table, if yes, executing step S406, if no, executing step S407.

[0209] The fourth connection is a connection in the second connection table that matches the first IP quintuple.

[0210] In an embodiment of the present application, when the service data packet is a TCP connection establishment message, the DPI service processing node can further determine whether there is a fourth connection in the second connection table that matches the first IP quintuple. If so, execute step S406; if not, execute step S407.

[0211] It should be noted that step S406 and step S407 are two parallel implementation methods. In actual application, only one needs to be executed.

[0212] Step S406: discard the service data packet through the DPI service processing node.

[0213] In the embodiment of the present application, when there is a fourth connection in the second connection table, the DPI service processing node may discard the service data packet.

[0214] Step S407: establish a fifth connection according to the first IP quintuple through the DPI service processing node, add the fifth connection to the second connection table, and determine the second signaling traffic matching the transmission direction counted for the fifth connection according to the traffic of the service data packet.

[0215] In an embodiment of the present application, when the fourth connection does not exist in the second connection table, the DPI service processing node can establish a fifth connection according to the first IP quintuple and add the fifth connection to the second connection table. The DPI service processing node can also determine the second signaling traffic that matches the transmission direction counted for the fifth connection according to the traffic of the service data packet, and store the second signaling traffic, the transmission direction and the fifth connection in correspondence.

[0216] Step S408, determining whether the service data packet is a TCP connection deletion message, if so, executing step S409, if not, executing step S413.

[0217] It should be noted that step S409 and step S413 are two parallel implementation methods. In actual application, only one needs to be executed.

[0218] Step S409: Determine a sixth connection from the second connection table through the DPI service processing node.

[0219] The sixth connection is a connection in the second connection table that matches the first IP quintuple.

[0220] In an embodiment of the present application, when the service data packet is a TCP connection deletion message, the DPI service processing node can further determine whether there is a sixth connection in the second connection table that matches the first IP quintuple. If so, execute step S410; if not, establish a new connection based on the first IP quintuple and add the new connection to the second connection table, after which step S410 can be executed.

[0221] Step S410, determining whether the identification bit of the sixth connection indicates that the sixth connection has been service identified, if so, proceed to S411, if not, proceed to step S412.

[0222] It should be noted that step S411 and step S412 are two parallel implementation methods. In actual application, only one needs to be executed.

[0223] Step S411: Delete the sixth connection in the second connection table through the DPI service processing node, and send a second message for deleting the connection to the TFT service processing node.

[0224] The second message (or called a connection deletion message) is used by the TFT service processing node to delete the first connection in the first connection table.

[0225] In an embodiment of the present application, when the identification bit of the sixth connection indicates that the sixth connection has been service identified, the DPI service processing node can delete the sixth connection in the second connection table and send a second message for deleting the connection to the TFT service processing node, wherein the second message carries the first IP quintuple and the identification information of the target PF in the second encapsulation packet, so that the TFT service processing node determines the target PF from multiple candidate PFs based on the identification information of the target PF, and deletes the first connection in the first connection table hanging under the target PF that matches the first IP quintuple.

[0226] Step S412: Delete the sixth connection in the second connection table through the DPI service processing node, and discard the service data packet.

[0227] In the embodiment of the present application, when the identification bit of the sixth connection indicates that the sixth connection has not been service identified, the DPI service processing node can directly delete the sixth connection in the second connection table and discard the service data packet.

[0228] Step S413: Determine whether there is a seventh connection matching the first IP quintuple in the second connection table.

[0229] The seventh connection is a connection in the second connection table that matches the first IP quintuple.

[0230] In an embodiment of the present application, when the service data packet is not a TCP connection deletion message, or the protocol type in the first IP quintuple is UDP, the DPI service processing node can further determine whether there is a seventh connection in the second connection table that matches the first IP quintuple. If so, execute subsequent steps; if not, establish a new connection based on the first IP quintuple and add the new connection to the second connection table, after which subsequent steps can be executed.

[0231] Step S414: If the seventh connection exists in the second connection table, the DPI service processing node performs protocol parsing on the service data packet according to the protocol type to obtain a protocol parsing result.

[0232] In an embodiment of the present application, when there is a seventh connection in the second connection table that matches the first IP quintuple, the DPI service processing node can perform protocol parsing on the service data packet according to the protocol type in the first IP quintuple to obtain a protocol parsing result.

[0233] Step S415: When the identification bit of the seventh identification indicates that the seventh connection has been service identified, the DPI service processing node determines whether the service data packet is a UDP termination message according to the protocol analysis result.

[0234] In an embodiment of the present application, the DPI service processing node can determine whether the identification bit of the seventh connection indicates that the seventh connection has undergone service identification. If the identification bit of the seventh identification indicates that the seventh connection has undergone service identification, then based on the protocol parsing results, it is determined whether the service data packet is a UDP termination message.

[0235] If the identification bit of the seventh identifier indicates that the seventh connection has not undergone service identification, the DPI service processing node can perform service identification on the service data packet to obtain the service identifier, and send the first IP quintuple and service identifier to the TFT service processing node, so that the TFT service processing node sends the first IP quintuple and service identifier to the SMF, so that the SMF can establish a new session for the target terminal based on the first IP quintuple and service identifier, and the new session is used to perform QoS control and / or billing on the data packets of the target terminal accessing the target application.

[0236] Step S416: When the service data packet is a UDP termination message, the seventh connection in the second connection table is deleted through the DPI service processing node, and a third message for deleting the connection is sent to the TFT service processing node.

[0237] The third message (or called a connection deletion message) is used by the TFT service processing node to delete the first connection in the first connection table.

[0238] In an embodiment of the present application, when the service data packet is a UDP termination message, the DPI service processing node may delete the seventh connection in the second connection table, and send a third message for deleting the connection to the TFT service processing node, wherein the third message includes the first IP quintuple and the identification information of the target PF in the second encapsulation packet, so that the TFT service processing node determines, based on the identification information of the target PF, a target PF that matches the identification information from multiple candidate PFs, and deletes the first connection that matches the first IP quintuple in the first connection table under the target PF.

[0239] The service identification method of the embodiment of the present application, when there is a first connection in the first connection table, performs protocol parsing on the service data packet through the DPI service processing node, so as to realize dynamic maintenance and timely update of each connection in the connection table (including the first connection table and the second connection table).

[0240] In any embodiment of the present application, aging control can also be performed on the established connection to reduce the effective capacity of the connection. Figure 5 , the above process is explained in detail.

[0241] Figure 5 A flowchart of another service identification method provided in an embodiment of the present application.

[0242] The service identification method provided in the embodiment of the present application can be executed by UPF, wherein UPF includes a TFT service processing node and a DPI service processing node.

[0243] like Figure 5As shown, based on any of the above embodiments, the service identification method may further include the following steps:

[0244] Step S501: Determine, through the DPI service processing node, whether there is a target connection in the second connection table; wherein the target connection is a connection established according to the second IP quintuple.

[0245] The second connection table is a connection table maintained by the DPI service processing node.

[0246] In the embodiment of the present application, the DPI service processing node can also determine whether there is an aged target connection in the second connection table, wherein the target connection is established according to the second IP quintuple. If the target connection exists in the second connection table, step S502 is executed; if the target connection does not exist in the second connection table, no processing is performed.

[0247] In any embodiment of the present application, the target connection may be determined by, for example:

[0248] 1. The DPI service processing node may obtain, for any connection in the second connection table, a reception time of a third encapsulation packet corresponding to the connection, wherein the third encapsulation packet is a most recently received encapsulation packet containing an IP quintuple indicated by the connection.

[0249] 2. The DPI service processing node can determine whether the time difference between the reception time of the third encapsulation packet corresponding to the connection and the current time is less than the set duration. If so, the connection is not an aged target connection; if not, the connection is an aged target connection.

[0250] That is, when the time difference corresponding to the connection is greater than or equal to the set duration, it is determined that the target connection exists in the second connection table and the connection is used as the target connection; and when the time differences corresponding to all connections in the second connection table are less than the set duration, it is determined that the target connection does not exist in the second connection table.

[0251] Step S502, when the target connection exists in the second connection table, it is determined whether the identification bit of the target connection indicates that the target connection has been service identified, if so, step S504 is executed, if not, step S503 is executed.

[0252] In an embodiment of the present application, when there is a target connection in the second connection table, the DPI service processing node can further determine whether the identification bit of the target connection indicates that the target connection has been service identified. If so, execute step S504; if not, execute step S503.

[0253] It should be noted that step S503 and step S504 are two parallel implementation methods. In actual application, only one needs to be executed.

[0254] Step S503: Deleting the target connection in the second connection table through the DPI service processing node.

[0255] In the embodiment of the present application, when the identification bit of the target connection indicates that the target connection has not been service identified, the DPI service processing node can directly delete the target connection in the second connection table.

[0256] Step S504: Delete the target connection in the second connection table through the DPI service processing node, and send a fourth message for deleting the connection to the TFT service processing node.

[0257] The target connection is a connection established based on the second IP quintuple and the target service identifier, and the fourth message carries the second IP quintuple and the target service identifier indicated by the target connection.

[0258] In an embodiment of the present application, when the identification bit of the target connection indicates that the target connection has been service identified, the DPI service processing node can delete the target connection in the second connection table, and send a fourth message (or connection deletion message) for deleting the connection to the TFT service processing node, wherein the fourth message carries the second IP five-tuple and the target service identifier indicated by the target connection. Accordingly, after receiving the fourth message, the TFT service processing node can delete the eighth connection in the first connection table that matches the second IP five-tuple and the target service identifier according to the fourth message.

[0259] In any one of the embodiments of the present application, the deep analysis function of the data packet can be completed within the core network, and the UPF identifies the service identifier corresponding to the data packet and actively reports it to the SMF. The SMF creates a new session for the identified service identifier based on the reported information, and subsequent data packets perform QoS control and / or billing on the new session.

[0260] Specifically, UPF includes a TFT service processing node and a DPI service processing node. The processing flow of the TFT service processing node mainly includes the following steps:

[0261] Step 1. After receiving the data packet on the service plane (referred to as the service data packet in this application), the TFT service processing node performs TFT and PF search to determine the PF (referred to as the target PF in this application) that matches the first IP five-tuple in the service data packet from multiple PFs, and obtains the DPI resolution identifier in the target PF.

[0262] Step 2: Determine whether the DPI resolution flag of the target PF is set. If not, execute step 3; if yes, execute step 6.

[0263] Step 3. If the DPI resolution flag of the target PF is not set, there is no need to send the service data packet to the DPI service processing node for deep analysis. At this time, it can be determined whether the target PF contains a predefined service identifier (ServiceID, referred to as the second service identifier in this application). If so, execute step 4; if not, execute step 5.

[0264] Step 4: If the target PF contains a predefined service identifier, a general processing strategy corresponding to the service identifier is executed on the service data packet.

[0265] Step 5: If the target PF does not contain the predefined service identifier, the service data packet is forwarded to the device corresponding to the destination IP address according to the destination IP address in the first IP quintuple (referred to as the destination address in this application).

[0266] Step 6. If the DPI resolution flag of the target PF is set, match the connection table under the target PF (referred to as the first connection table in this application), and determine whether there is a first connection matching the first IP quintuple in the first connection table. If so, execute step 7; if not, execute step 8.

[0267] Step 7: If the first connection exists in the first connection table, a processing strategy corresponding to the service identifier indicated by the first connection is executed on the service data packet. Meanwhile, the service data packet is internally encapsulated and sent to the DPI service processing node for protocol parsing.

[0268] Step 8: If the first connection does not exist in the first connection table, the service data packet is forwarded to the device corresponding to the above-mentioned destination IP address. At the same time, the service data packet is internally encapsulated and sent to the DPI service processing node for service identification and protocol analysis.

[0269] Among them, the DPI business processing node mainly completes protocol parsing and business identification, including the second connection table, the protocol parsing table (used to parse the protocol) and the business identification table (used to identify the ServiceID, which is used to store the mapping relationship between the APP ID and the ServiceID). Among them, the connection table is a table dynamically generated inside the UP (User Plane), which maintains the connections of all data packets sent to the DPI business processing node and identifies the establishment and deletion of connections. The protocol rule table and the business identification table are both configured through the database. The DPI business processing node synchronizes the business identification part of the protocol parsing table and the business rule table (i.e., the business identification table).

[0270] The DPI service processing node can perform the following operations: service identification, sending a connection establishment message (recorded as the first message in this application) to the TFT service processing node; when the UDP service is terminated and the TCP connection is broken, sending a connection deletion message (recorded as the second message, the third message, and the fourth message in this application) to the TFT service processing node; in the case where there are multiple TCP connections for some services, maintaining the links of the TCP connections; performing aging control on the maintained connections (this can be achieved by starting a timer on the DPI service processing node, and the duration of the timer is recorded as the set duration in this application) to reduce the effective capacity of the TCP connection.

[0271] For the encapsulated packets sent to the DPI service processing node, only one service identification is required for each data packet corresponding to the connection, but each data packet must undergo protocol parsing. The connection after service identification is identified by an identification bit in the second connection table. After obtaining the ServiceID through service identification, the TFT service processing node needs to be notified. The TFT service processing node notifies the SMF through the N4 interface. The SMF creates a session and sends an update message to the UPF to add a flow. In the future, for the data packets corresponding to the connection, the TFT service processing node can directly execute the processing policy corresponding to the ServiceID on the session.

[0272] Specifically, the processing flow of the DPI service processing node mainly includes the following steps:

[0273] Step A: The DPI service processing node receives the encapsulated packet from the TFT service processing node, decapsulates it internally, obtains the first IP quintuple of the service data packet, and determines the protocol type (TCP / UDP) in the first IP quintuple. If the protocol type is UDP, go to step E; if the protocol type is TCP, go to step B.

[0274] Step B: parse the service data packet to determine whether the service data packet is a TCP connection establishment message.

[0275] If the service data packet is a TCP connection establishment message, check whether there is an established connection matching the first IP quintuple in the second connection table. If not, create a new connection matching the first IP quintuple in the second connection table, and count the signaling traffic established by the connection based on the traffic of the service data packet, and then discard the service data packet; if it exists, skip this step and directly discard the service data packet.

[0276] If the service data packet is not a TCP connection establishment message, go to step C.

[0277] Step C: determine whether the service data packet is a TCP connection deletion message.

[0278] If the service data packet is a TCP connection deletion message, determine whether there is a connection matching the first IP five-tuple in the second connection table. If so, delete the connection. If the identification bit of the connection indicates that the connection has been service identified, notify the TFT service processing node to delete the connection matching the first IP five-tuple in the first connection table. If the identification bit of the connection indicates that the connection has not been service identified, there is no need to notify the TFT service processing node. At this time, the service data packet can be directly discarded.

[0279] If the service data packet is not a TCP connection deletion message, go to step D.

[0280] Step D: Match the second connection table according to the first IP quintuple, check whether there is a connection matching the first IP quintuple in the second connection table, if not, add the connection matching the first IP quintuple in the second connection table; if yes, skip this step. Then continue to step E.

[0281] Step E: According to the protocol type (TCP / UDP) of the service data packet, use different seven-layer protocol parsing tables to perform seven-layer protocol parsing, record the protocol parsing results, and then continue to execute step F.

[0282] Step F: According to the identification bit of the connection matching the first IP quintuple in the second connection table, determine whether the connection has been service identified. If so, go to step I; otherwise, go to step G.

[0283] It should be noted that service identification generally requires about 10 data packets. Before the service identification, the traffic of the data packet is first placed in the second connection table maintained by the DPI service processing node. After the service identification obtains the APP ID, the DPI service processing node sends a connection creation message to the TFT service processing node, and the recorded traffic is sent to the TFT service processing node at the same time through the configuration message, which can improve the accuracy of traffic statistics.

[0284] Step G: Perform business identification on the business data packet to obtain the APP ID. According to the APP ID obtained by business identification, query the business rule table (i.e., the business identification table, which is used to record the mapping relationship or correspondence between the APP ID and the ServiceID) to determine whether there is a ServiceID matching the APP ID in the business rule table. If so, go to step H; if not, it indicates that the connection matching the first IP quintuple in the second connection table does not belong to any predefined ServiceID, and the identification bit of the connection matching the first IP quintuple in the second connection table is updated, that is, it is marked that the connection has been business identified, and then the business data packet is discarded.

[0285] Step H: Update the connection matching the first IP quintuple in the second connection table according to the ServiceID, and notify the TFT service processing node to add the connection matching the ServiceID and the first IP quintuple in the first connection table. Then, continue to execute step I.

[0286] Step I: Analyze the protocol parsing result. If the protocol parsing result indicates that the service data packet is a UDP termination message, the DPI service processing node sends a connection deletion message to the TFT service processing node.

[0287] In summary, the service identification method provided by this application has at least the following advantages:

[0288] 1. After analyzing only the first 10 or so data packets of a service, the service can be identified (i.e., the ServiceID can be identified). There is no need to analyze and identify each data packet of the service, which reduces the number of data packets to be parsed and greatly improves the efficiency of identification.

[0289] 2. The DPI service processing node maintains an internal connection table and periodically performs aging control on the connection table to reduce the effective capacity of the connection.

[0290] 3. Before the data packet is identified for service, the traffic is first counted. After the service is identified, the counted traffic is added to the identified service, making the traffic statistics more accurate.

[0291] The technical solution provided in the embodiment of the present application can be applicable to a variety of systems, especially 5G systems. For example, the applicable system can be a global system of mobile communication (Global System of Mobile communication, referred to as GSM) system, code division multiple access (Code Division Multiple Access, referred to as CDMA) system, wideband code division multiple access (Wideband Code Division Multiple Access, referred to as WCDMA) general packet radio service (General Packet Radio Service, referred to as GPRS) system, long term evolution (long term evolution, referred to as LTE) system, LTE frequency division duplex (Frequency Division Duplex, referred to as FDD) system, LTE time division duplex (time division duplex, referred to as TDD) system, advanced long term evolution (Long Term Evolution Advanced, referred to as LTE-A) system, Universal Mobile Telecommunication System (Universal Mobile Telecommunication System, referred to as UMTS), Worldwide interoperability for Microwave Access (Worldwide interoperability for Microwave Access, referred to as WiMAX) system, 5G new air interface (NewRadio, referred to as NR) system, etc. These various systems include terminals and network equipment. The system may also include a core network part, such as an evolved packet system (EPS), a 5G system (5GS), etc.

[0292] In order to implement the above embodiments, the present application also proposes a UPF.

[0293] Figure 6 A schematic diagram of the structure of a UPF provided in an embodiment of the present application.

[0294] like Figure 6 As shown, the UPF may include: a transceiver 600 , a processor 610 , and a memory 620 .

[0295] The memory 620 is used to store computer programs; the transceiver 600 is used to send and receive data under the control of the processor 610; the processor 610 is used to read the computer program in the memory 620 and perform the following operations: obtaining a service data packet, and determining whether there is a first connection in the first connection table under the target packet filter PF; wherein the target PF is a PF that matches the first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service-identified; if the first connection does not exist in the first connection table, performing service identification on the service data packet to determine a first service identifier; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet; sending the first IP quintuple and the first service identifier to a session management function SMF; wherein the first IP quintuple and the first service identifier are used by the SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on data packets of the target terminal accessing the target application.

[0296] The transceiver 600 is used to receive and send data under the control of the processor 610 .

[0297] Among them, Figure 6 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically linking together various circuits of one or more processors represented by processor 610 and memory represented by memory 620. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 600 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, which transmission medium may include a wireless channel, a wired channel, an optical cable, and the like. The processor 610 is responsible for managing the bus architecture and general processing, and the memory 620 may store data used by the processor 610 when performing operations.

[0298] The processor 610 may be a CPU, an ASIC, an FPGA or a CPLD, and the processor 610 may also adopt a multi-core architecture.

[0299] In a possible implementation form of the present application, the UPF includes a flow template TFT business processing node and a deep packet inspection DPI business processing node; the processor 610 executes a judgment on whether there is a first connection in the first connection table hanging under the target packet filter PF, specifically: querying multiple candidate PFs according to the first IP quintuple through the TFT business processing node to determine the target PF matching the first IP quintuple from the multiple candidate PFs; extracting a DPI resolution identifier from the target PF through the TFT business processing node; wherein the DPI resolution identifier is used to indicate whether business identification is performed through the DPI business processing node; when the DPI resolution identifier indicates that business identification is performed through the DPI business processing node, obtaining the first connection table hanging under the target PF through the TFT business processing node; and judging whether there is a first connection matching the first IP quintuple in the first connection table through the TFT business processing node.

[0300] In a possible implementation form of the present application, after the processor 610 extracts the DPI resolution identifier from the target PF, it is also used to perform the following operations: when the DPI resolution identifier indicates that service identification is not performed through the DPI service processing node, determine whether the target PF contains a second service identifier through the TFT service processing node; wherein the second service identifier is used to indicate an application that adopts a general processing policy, and the general processing policy includes a general service quality control policy and / or a general billing policy; when the target PF contains the second service identifier, the default session corresponding to the first IP five-tuple is adopted by the TFT service processing node to execute the general processing policy on the service data packet; when the target PF does not contain the second service identifier, the service data packet is sent to the device indicated by the destination address in the first IP five-tuple through the TFT service processing node.

[0301] In a possible implementation form of the present application, the UPF includes a TFT service processing node and a DPI service processing node; the processor 610 performs service identification on the service data packet to determine the first service identifier when the first connection does not exist in the first connection table, specifically: when the first connection does not exist in the first connection table, the service data packet is encapsulated by the TFT service processing node to obtain a first encapsulation packet, and the first encapsulation packet is sent to the DPI service processing node; the first encapsulation packet is decapsulated by the DPI service processing node to obtain the service data packet, and the service data packet is parsed to obtain the first IP five-tuple; the DPI service processing node determines whether there is a second connection matching the first IP five-tuple in the second connection table; wherein the second connection table is a connection table maintained by the DPI service processing node; when the second connection exists in the second connection table and the identification bit of the second connection indicates that the second connection has not been service identified, the service data packet is service identified by the DPI service processing node to obtain the application identifier of the target application, and the first service identifier is determined according to the application identifier.

[0302] In a possible implementation form of the present application, the processor 610 is also used to perform the following operations: updating the identification bit of the second connection through the DPI service processing node; wherein the updated identification bit of the second connection is used to indicate that the second connection has been service identified; and discarding the service data packet through the DPI service processing node.

[0303] In a possible implementation form of the present application, the first encapsulation package also includes the identification information of the target PF and the transmission direction of the service data packet, and the processor 610 executes sending the first IP quintuple and the first service identifier to the session management function SMF, specifically: sending a first message for establishing a connection to the TFT service processing node through the DPI service processing node; wherein the first message includes the first service identifier, the first IP quintuple, the identification information and the first signaling traffic matching the transmission direction counted for the second connection; establishing a third connection through the TFT service processing node according to the first service identifier and the first IP quintuple, and adding the third connection to the first connection table under the target PF matching the identification information; sending the first service identifier and the first IP quintuple to the SMF through the TFT service processing node; wherein the first service identifier and the first IP quintuple are used by the SMF to establish a target session corresponding to the third connection; wherein the target session is used by the TFT service processing node to perform service quality control and / or billing on the data packet of the target terminal accessing the target application based on the first processing policy corresponding to the first service identifier and the first signaling traffic.

[0304] In a possible implementation form of the present application, after the processor 610 executes the determination whether there is a first connection in the first connection table under the target packet filter PF, it is also used to perform the following operations: if the first connection exists in the first connection table, obtain the third service identifier indicated by the first connection; based on the second processing strategy corresponding to the third service identifier, perform service quality control and / or billing on the business data packet.

[0305] In a possible implementation form of the present application, the UPF includes a TFT service processing node and a DPI service processing node; when the first connection exists in the first connection table, the processor 610 is further used to perform the following operations: encapsulate the service data packet through the TFT service processing node to obtain a second encapsulation packet, and send the second encapsulation packet to the DPI service processing node; decapsulate the second encapsulation packet through the DPI service processing node to obtain the service data packet, and parse the service data packet to obtain the first IP five-tuple; when the protocol type in the first IP five-tuple is TCP, determine whether the service data packet is a TCP connection establishment message through the DPI service processing node; when the service data packet is the TCP connection establishment message, determine whether there is a fourth connection matching the first IP five-tuple in the second connection table through the DPI service processing node; wherein the second connection table is a connection table maintained by the DPI service processing node; when the fourth connection exists in the second connection table, discard the service data packet through the DPI service processing node.

[0306] In a possible implementation form of the present application, the second encapsulation packet also includes the transmission direction of the service data packet. After the processor 610 executes the determination through the DPI service processing node whether there is a fourth connection matching the first IP quintuple in the second connection table, it is also used to perform the following operations: if the fourth connection does not exist in the second connection table, establish a fifth connection according to the first IP quintuple through the DPI service processing node; add the fifth connection to the second connection table through the DPI service processing node; and determine, through the DPI service processing node, the second signaling traffic matching the transmission direction counted for the fifth connection based on the traffic of the service data packet.

[0307] In a possible implementation form of the present application, after the processor 610 executes the determination through the DPI service processing node whether the service data packet is a TCP connection establishment message, it is further used to perform the following operations: when the service data packet is not the TCP connection establishment message, determine through the DPI service processing node whether the service data packet is a TCP connection deletion message; when the service data packet is the TCP connection deletion message, determine through the DPI service processing node a sixth connection matching the first IP five-tuple from the second connection table; determine through the DPI service processing node whether the identification bit of the sixth connection indicates that the sixth connection has been service identified; when the identification bit of the sixth connection indicates that the sixth connection has been service identified, delete the sixth connection in the second connection table through the DPI service processing node, and send a second message for deleting the connection to the TFT service processing node; wherein the second message is used by the TFT service processing node to delete the first connection in the first connection table; when the identification bit of the sixth connection indicates that the sixth connection has not been service identified, delete the sixth connection in the second connection table through the DPI service processing node, and discard the service data packet.

[0308] In a possible implementation form of the present application, the processor 610 is further used to perform the following operations: when the service data packet is not the TCP connection deletion message, or when the protocol type is UDP, determine, through the DPI service processing node, whether there is a seventh connection matching the first IP five-tuple in the second connection table; when the seventh connection exists in the second connection table, perform protocol parsing on the service data packet according to the protocol type through the DPI service processing node to obtain a protocol parsing result; when the identification bit of the seventh connection indicates that the seventh connection has been service identified, determine, through the DPI service processing node, whether the service data packet is a UDP termination message according to the protocol parsing result; when the service data packet is a UDP termination message, delete the seventh connection in the second connection table through the DPI service processing node; and send a third message for deleting the connection to the TFT service processing node through the DPI service processing node; wherein the third message is used by the TFT service processing node to delete the first connection in the first connection table.

[0309] In a possible implementation form of the present application, the UPF includes a TFT service processing node and a DPI service processing node; the processor 610 is further used to perform the following operations: determining, by the DPI service processing node, whether there is a target connection in the second connection table; wherein the target connection is a connection established according to the second IP five-tuple; wherein the second connection table is a connection table maintained by the DPI service processing node; if the target connection exists in the second connection table, determining, by the DPI service processing node, whether the identification bit of the target connection indicates that the target connection has been service identified; if the identification bit of the target connection indicates that the target connection has not been service identified, deleting the target connection in the second connection table by the DPI service processing node; if the identification bit of the target connection indicates that the target connection has been service identified, deleting the target connection in the second connection table by the DPI service processing node, and sending a fourth message for deleting the connection to the TFT service processing node; wherein the fourth message carries the second IP five-tuple and the target service identifier indicated by the target connection, and is used by the TFT service processing node to delete the eighth connection matching the second IP five-tuple in the first connection table.

[0310] In a possible implementation form of the present application, the processor 610 executes the determination of whether there is a target connection in the second connection table through the DPI service processing node, specifically: for any connection in the second connection table, obtaining the reception time of the third encapsulation packet corresponding to the any connection through the DPI service processing node; wherein the third encapsulation packet is the most recently received encapsulation packet containing the IP five-tuple indicated by the any connection; determining through the DPI service processing node whether the time difference between the reception time of the third encapsulation packet corresponding to the any connection and the current time is less than a set duration; when the time difference corresponding to any connection is greater than or equal to the set duration, determining that there is a target connection in the second connection table, and using any connection as the target connection; when the time differences corresponding to all connections in the second connection table are less than the set duration, determining that there is no target connection in the second connection table.

[0311] In a possible implementation form of the present application, when the first connection does not exist in the first connection table, the processor 610 is further configured to perform the following operations: sending the service data packet to a device indicated by a destination address in the first IP quintuple.

[0312] It should be noted that the UPF provided in the embodiment of the present application can achieve the above Figures 1 to 5All the method steps implemented in the method embodiment can achieve the same technical effect, and the parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0313] With the above Figures 1 to 5 Corresponding to the service identification method provided in the embodiment, the present application also provides a service identification device. Figures 1 to 5 The business identification method provided in the embodiment corresponds to the embodiment, so the implementation method of the business identification method is also applicable to the business identification device provided in the embodiment of the present application, and will not be described in detail in the embodiment of the present application.

[0314] Figure 7 A schematic diagram of the structure of a service identification device provided in an embodiment of the present application.

[0315] like Figure 7 As shown, the service identification device 700 is applied to UPF and may include: an acquisition unit 710, a judgment unit 720, an identification unit 730 and a sending unit 740.

[0316] The acquisition unit 710 is used to acquire a service data packet.

[0317] The judgment unit 720 is used to judge whether there is a first connection in the first connection table hanging under the target packet filter PF; wherein the target PF is the PF that matches the first IP quintuple in the business data packet, and the first connection is the connection that matches the first IP quintuple and has been business identified.

[0318] The identification unit 730 is used to perform service identification on the service data packet to determine a first service identifier when the first connection does not exist in the first connection table; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet.

[0319] The sending unit 740 is used to send the first IP quintuple and the first service identifier to the session management function SMF.

[0320] Among them, the first IP quintuple and the first service identifier are used by the SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on the data packets of the target terminal accessing the target application.

[0321] Furthermore, in a possible implementation form of the present application, the UPF includes a flow template TFT service processing node and a deep packet inspection DPI service processing node; the judgment unit 720 is specifically used to: query multiple candidate PFs according to the first IP quintuple through the TFT service processing node to determine the target PF that matches the first IP quintuple from the multiple candidate PFs; extract the DPI resolution identifier from the target PF through the TFT service processing node; wherein the DPI resolution identifier is used to indicate whether service identification is performed through the DPI service processing node; when the DPI resolution identifier indicates that service identification is performed through the DPI service processing node, obtain the first connection table hanging under the target PF through the TFT service processing node; and judge through the TFT service processing node whether there is a first connection matching the first IP quintuple in the first connection table.

[0322] Furthermore, in another possible implementation form of the present application, the service identification device 700 may also include:

[0323] A first processing unit is configured to: when the DPI resolution identifier indicates that service identification is not performed through the DPI service processing node, determine through the TFT service processing node whether the target PF contains a second service identifier; wherein the second service identifier is used to indicate an application program that adopts a general processing policy, and the general processing policy includes a general service quality control policy and / or a general billing policy; when the target PF contains the second service identifier, use the TFT service processing node to adopt the default session corresponding to the first IP quintuple to execute the general processing policy on the service data packet; when the target PF does not contain the second service identifier, send the service data packet to the device indicated by the destination address in the first IP quintuple through the TFT service processing node.

[0324] Further, in another possible implementation form of the present application, the UPF includes a TFT service processing node and a DPI service processing node; the identification unit 730 is specifically used to: when the first connection does not exist in the first connection table, encapsulate the service data packet through the TFT service processing node to obtain a first encapsulation packet, and send the first encapsulation packet to the DPI service processing node; decapsulate the first encapsulation packet through the DPI service processing node to obtain the service data packet, and parse the service data packet to obtain the first IP five-tuple; determine through the DPI service processing node whether there is a second connection matching the first IP five-tuple in the second connection table; wherein the second connection table is a connection table maintained by the DPI service processing node; when the second connection exists in the second connection table and the identification bit of the second connection indicates that the second connection has not been service identified, the service data packet is service identified through the DPI service processing node to obtain the application identifier of the target application, and the first service identifier is determined according to the application identifier.

[0325] Furthermore, in another possible implementation form of the present application, the service identification device 700 may also include:

[0326] The second processing unit is used to: update the identification bit of the second connection through the DPI service processing node; wherein the updated identification bit of the second connection is used to indicate that the second connection has been service identified; and discard the service data packet through the DPI service processing node.

[0327] Further, in another possible implementation form of the present application, the first encapsulation package also includes the identification information of the target PF and the transmission direction of the service data packet, and the sending unit 740 is specifically used to: send a first message for establishing a connection to the TFT service processing node through the DPI service processing node; wherein the first message includes the first service identifier, the first IP quintuple, the identification information and the first signaling traffic matching the transmission direction counted for the second connection; establish a third connection through the TFT service processing node according to the first service identifier and the first IP quintuple, and add the third connection to the first connection table under the target PF matching the identification information; send the first service identifier and the first IP quintuple to the SMF through the TFT service processing node; wherein the first service identifier and the first IP quintuple are used by the SMF to establish a target session corresponding to the third connection; wherein the target session is used by the TFT service processing node to perform service quality control and / or billing on the data packet of the target terminal accessing the target application based on the first processing policy corresponding to the first service identifier and the first signaling traffic.

[0328] Furthermore, in another possible implementation form of the present application, the service identification device 700 may also include:

[0329] The third processing unit is used to: when the first connection exists in the first connection table, obtain a third service identifier indicated by the first connection; and perform service quality control and / or billing on the business data packet based on a second processing strategy corresponding to the third service identifier.

[0330] Further, in another possible implementation form of the present application, the UPF includes a TFT service processing node and a DPI service processing node; the service identification device 700 may also include:

[0331] a fourth processing unit, configured to: when the first connection exists in the first connection table, encapsulate the service data packet through the TFT service processing node to obtain a second encapsulation packet, and send the second encapsulation packet to the DPI service processing node; decapsulate the second encapsulation packet through the DPI service processing node to obtain the service data packet, and parse the service data packet to obtain the first IP five-tuple; when the protocol type in the first IP five-tuple is TCP, determine whether the service data packet is a TCP connection establishment message through the DPI service processing node; when the service data packet is the TCP connection establishment message, determine whether there is a fourth connection matching the first IP five-tuple in the second connection table through the DPI service processing node; wherein the second connection table is a connection table maintained by the DPI service processing node; and when the fourth connection exists in the second connection table, discard the service data packet through the DPI service processing node.

[0332] Furthermore, in another possible implementation form of the present application, the second encapsulation package also includes the transmission direction of the service data packet, and the fourth processing unit is also used to: when the fourth connection does not exist in the second connection table, establish a fifth connection according to the first IP quintuple through the DPI service processing node; add the fifth connection to the second connection table through the DPI service processing node; determine, through the DPI service processing node, the second signaling traffic that matches the transmission direction counted for the fifth connection based on the traffic of the service data packet.

[0333] Further, in another possible implementation form of the present application, the fourth processing unit is also used to: when the service data packet is not the TCP connection establishment message, determine whether the service data packet is a TCP connection deletion message through the DPI service processing node; when the service data packet is the TCP connection deletion message, determine the sixth connection matching the first IP five-tuple from the second connection table through the DPI service processing node; determine whether the identification bit of the sixth connection indicates that the sixth connection has been service identified through the DPI service processing node; when the identification bit of the sixth connection indicates that the sixth connection has been service identified, delete the sixth connection in the second connection table through the DPI service processing node, and send a second message for deleting the connection to the TFT service processing node; wherein the second message is used by the TFT service processing node to delete the first connection in the first connection table; when the identification bit of the sixth connection indicates that the sixth connection has not been service identified, delete the sixth connection in the second connection table through the DPI service processing node, and discard the service data packet.

[0334] Further, in another possible implementation form of the present application, the fourth processing unit is also used for: when the service data packet is not the TCP connection deletion message, or when the protocol type is UDP, judging through the DPI service processing node whether there is a seventh connection matching the first IP five-tuple in the second connection table; when the seventh connection exists in the second connection table, performing protocol parsing on the service data packet according to the protocol type through the DPI service processing node to obtain a protocol parsing result; when the identification bit of the seventh connection indicates that the seventh connection has been service identified, judging through the DPI service processing node whether the service data packet is a UDP termination message according to the protocol parsing result; when the service data packet is a UDP termination message, deleting the seventh connection in the second connection table through the DPI service processing node; sending a third message for deleting the connection to the TFT service processing node through the DPI service processing node; wherein the third message is used by the TFT service processing node to delete the first connection in the first connection table.

[0335] Further, in another possible implementation form of the present application, the UPF includes a TFT service processing node and a DPI service processing node; the service identification device 700 may also include:

[0336] a fifth processing unit, configured to: determine, through the DPI service processing node, whether there is a target connection in the second connection table; wherein the target connection is a connection established according to the second IP five-tuple; wherein the second connection table is a connection table maintained by the DPI service processing node; if the target connection exists in the second connection table, determine, through the DPI service processing node, whether the identification bit of the target connection indicates that the target connection has been service identified; if the identification bit of the target connection indicates that the target connection has not been service identified, delete the target connection in the second connection table through the DPI service processing node; if the identification bit of the target connection indicates that the target connection has been service identified, delete the target connection in the second connection table through the DPI service processing node, and send a fourth message for deleting the connection to the TFT service processing node; wherein the fourth message carries the second IP five-tuple and the target service identifier indicated by the target connection, and is used by the TFT service processing node to delete the eighth connection matching the second IP five-tuple in the first connection table.

[0337] Further, in another possible implementation form of the present application, the fifth processing unit is specifically used to: for any connection in the second connection table, obtain the reception time of the third encapsulation packet corresponding to the any connection through the DPI service processing node; wherein the third encapsulation packet is the most recently received encapsulation packet containing the IP five-tuple indicated by the any connection; determine through the DPI service processing node whether the time difference between the reception time of the third encapsulation packet corresponding to the any connection and the current time is less than a set duration; when the time difference corresponding to the any connection is greater than or equal to the set duration, determine that there is a target connection in the second connection table, and use the any connection as the target connection; when the time differences corresponding to all connections in the second connection table are less than the set duration, determine that there is no target connection in the second connection table.

[0338] Furthermore, in another possible implementation form of the present application, the sending unit 740 is also used to: when the first connection does not exist in the first connection table, send the service data packet to the device indicated by the destination address in the first IP quintuple.

[0339] It should be noted that the above-mentioned service identification device provided in the embodiment of the present application can achieve the above-mentioned Figures 1 to 5 All the method steps implemented in the method embodiment can achieve the same technical effect, and the parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0340] It should be noted that each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0341] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store program code.

[0342] In order to implement the above embodiments, the present application also proposes a processor-readable storage medium.

[0343] The processor-readable storage medium stores a computer program for causing the processor to execute the present application. Figures 1 to 5 The service identification method of any embodiment.

[0344] Among them, the processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0345] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0346] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0347] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0348] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0349] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A service identification method, characterized in that: Applied to the user plane function UPF, including: Acquire a service data packet, and determine whether there is a first connection in the first connection table under the target packet filter PF; wherein the target PF is a PF that matches the first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service identified; If the first connection does not exist in the first connection table, performing service identification on the service data packet to determine a first service identifier; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet; Sending the first IP quintuple and the first service identifier to a session management function SMF; Among them, the first IP quintuple and the first service identifier are used by the SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on the data packets of the target terminal accessing the target application.

2. The method according to claim 1, characterized in that The UPF includes a flow template TFT service processing node and a deep packet inspection DPI service processing node; The step of determining whether there is a first connection in the first connection table under the target packet filter PF comprises: Querying a plurality of candidate PFs according to the first IP quintuple through the TFT service processing node to determine a target PF matching the first IP quintuple from the plurality of candidate PFs; Extracting a DPI resolution identifier from the target PF through the TFT service processing node; wherein the DPI resolution identifier is used to indicate whether service identification is performed through the DPI service processing node; When the DPI resolution identifier indicates that service identification is performed through the DPI service processing node, obtaining a first connection table under the target PF through the TFT service processing node; The TFT service processing node determines whether there is a first connection matching the first IP quintuple in the first connection table.

3. The method according to claim 2, characterized in that After extracting the DPI resolution identifier from the target PF, the method further includes: In the case where the DPI resolution identifier indicates that service identification is not performed through the DPI service processing node, determining whether the target PF includes a second service identifier through the TFT service processing node; wherein the second service identifier is used to indicate an application program that adopts a general processing strategy, and the general processing strategy includes a general service quality control strategy and / or a general billing strategy; When the target PF includes the second service identifier, the general processing strategy is executed on the service data packet by using the default session corresponding to the first IP quintuple through the TFT service processing node; When the target PF does not contain the second service identifier, the service data packet is sent to the device indicated by the destination address in the first IP quintuple through the TFT service processing node.

4. The method according to claim 1, characterized in that: The UPF includes a TFT service processing node and a DPI service processing node; When the first connection does not exist in the first connection table, performing service identification on the service data packet to determine the first service identifier includes: If the first connection does not exist in the first connection table, encapsulate the service data packet by the TFT service processing node to obtain a first encapsulation packet, and send the first encapsulation packet to the DPI service processing node; Decapsulating the first encapsulated packet through the DPI service processing node to obtain the service data packet, and parsing the service data packet to obtain the first IP quintuple; Determine, by the DPI service processing node, whether there is a second connection in the second connection table that matches the first IP quintuple; wherein the second connection table is a connection table maintained by the DPI service processing node; When the second connection exists in the second connection table and the identification bit of the second connection indicates that the second connection has not been service-identified, the service data packet is service-identified by the DPI service processing node to obtain the application identifier of the target application, and the first service identifier is determined based on the application identifier.

5. The method according to claim 4, characterized in that The method further comprises: The identification bit of the second connection is updated by the DPI service processing node; wherein the updated identification bit of the second connection is used to indicate that the second connection has been service identified; The service data packet is discarded by the DPI service processing node.

6. The method according to claim 4, characterized in that The first encapsulation packet also includes the identification information of the target PF and the transmission direction of the service data packet. The sending the first IP quintuple and the first service identifier to the session management function SMF includes: Sending a first message for establishing a connection to the TFT service processing node through the DPI service processing node; wherein the first message includes the first service identifier, the first IP quintuple, the identifier information, and a first signaling flow that matches the transmission direction and is counted for the second connection; Establishing, by the TFT service processing node, a third connection according to the first service identifier and the first IP quintuple, and adding the third connection to a first connection table under the target PF matching the identifier information; Send the first service identifier and the first IP quintuple to the SMF through the TFT service processing node; wherein the first service identifier and the first IP quintuple are used by the SMF to establish a target session corresponding to the third connection; The target session is used by the TFT service processing node to perform service quality control and / or billing on the data packets of the target terminal accessing the target application based on the first processing strategy corresponding to the first service identifier and the first signaling traffic.

7. The method according to claim 1, characterized in that After determining whether there is a first connection in the first connection table under the target packet filter PF, the method further includes: If the first connection exists in the first connection table, obtaining a third service identifier indicated by the first connection; Based on the second processing strategy corresponding to the third service identifier, service quality control and / or charging are performed on the service data packet.

8. The method according to claim 7, characterized in that The UPF includes a TFT service processing node and a DPI service processing node; When the first connection exists in the first connection table, the method further includes: Encapsulating the service data packet through the TFT service processing node to obtain a second encapsulation packet, and sending the second encapsulation packet to the DPI service processing node; Decapsulating the second encapsulated packet through the DPI service processing node to obtain the service data packet, and parsing the service data packet to obtain the first IP quintuple; When the protocol type in the first IP quintuple is TCP, determining, by the DPI service processing node, whether the service data packet is a TCP connection establishment message; In the case where the service data packet is the TCP connection establishment message, determining, by the DPI service processing node, whether there is a fourth connection matching the first IP quintuple in the second connection table; wherein the second connection table is a connection table maintained by the DPI service processing node; In a case where the fourth connection exists in the second connection table, the service data packet is discarded by the DPI service processing node.

9. The method according to claim 8, characterized in that The second encapsulation packet also includes the transmission direction of the service data packet. After determining, by the DPI service processing node, whether there is a fourth connection in the second connection table that matches the first IP quintuple, the method further includes: If the fourth connection does not exist in the second connection table, establishing a fifth connection according to the first IP quintuple through the DPI service processing node; adding the fifth connection to the second connection table by the DPI service processing node; The DPI service processing node determines, according to the traffic of the service data packet, a second signaling traffic that matches the transmission direction and is counted for the fifth connection.

10. The method according to claim 8, characterized in that After determining by the DPI service processing node whether the service data packet is a TCP connection establishment message, the method further includes: In the case where the service data packet is not the TCP connection establishment message, determining, by the DPI service processing node, whether the service data packet is a TCP connection deletion message; In a case where the service data packet is the TCP connection deletion message, determining, by the DPI service processing node, from the second connection table a sixth connection matching the first IP quintuple; Determining, by the DPI service processing node, whether the identification bit of the sixth connection indicates that the sixth connection has undergone service identification; When the identification bit of the sixth connection indicates that the sixth connection has been service identified, the sixth connection in the second connection table is deleted by the DPI service processing node, and a second message for deleting the connection is sent to the TFT service processing node; wherein the second message is used by the TFT service processing node to delete the first connection in the first connection table; When the identification bit of the sixth connection indicates that the sixth connection has not been service identified, the sixth connection in the second connection table is deleted by the DPI service processing node, and the service data packet is discarded.

11. The method according to claim 10, characterized in that The method further comprises: When the service data packet is not the TCP connection deletion message, or when the protocol type is UDP, determining, by the DPI service processing node, whether there is a seventh connection matching the first IP quintuple in the second connection table; When the seventh connection exists in the second connection table, performing protocol parsing on the service data packet according to the protocol type by the DPI service processing node to obtain a protocol parsing result; In a case where the identification bit of the seventh connection indicates that the seventh connection has been service identified, judging, by the DPI service processing node according to the protocol parsing result, whether the service data packet is a UDP termination message; In the case where the service data packet is a UDP termination message, deleting the seventh connection in the second connection table through the DPI service processing node; A third message for deleting a connection is sent to the TFT service processing node through the DPI service processing node; wherein the third message is used by the TFT service processing node to delete the first connection in the first connection table.

12. The method according to any one of claims 1 to 11, characterized in that The UPF includes a TFT service processing node and a DPI service processing node; The method further comprises: Determine, by the DPI service processing node, whether there is a target connection in the second connection table; wherein the target connection is a connection established according to the second IP quintuple; wherein the second connection table is a connection table maintained by the DPI service processing node; When the target connection exists in the second connection table, determining, by the DPI service processing node, whether the identification bit of the target connection indicates that the target connection has been service identified; When the identification bit of the target connection indicates that the target connection has not been service identified, deleting the target connection in the second connection table through the DPI service processing node; When the identification bit of the target connection indicates that the target connection has been service-identified, the target connection in the second connection table is deleted by the DPI service processing node, and a fourth message for deleting the connection is sent to the TFT service processing node; wherein the fourth message carries the second IP quintuple and the target service identifier indicated by the target connection, and is used by the TFT service processing node to delete the eighth connection in the first connection table that matches the second IP quintuple.

13. The method according to claim 12, characterized in that The determining, by the DPI service processing node, whether there is a target connection in the second connection table includes: For any connection in the second connection table, obtaining, through the DPI service processing node, a reception time of a third encapsulation packet corresponding to any connection; wherein the third encapsulation packet is a most recently received encapsulation packet containing an IP five-tuple indicated by any connection; Determine, by the DPI service processing node, whether a time difference between a receiving time of a third encapsulation packet corresponding to any one of the connections and a current time is less than a set duration; When the time difference corresponding to any one of the connections is greater than or equal to the set duration, determining that a target connection exists in the second connection table, and using any one of the connections as the target connection; When the time differences corresponding to all the connections in the second connection table are less than the set duration, it is determined that there is no target connection in the second connection table.

14. The method according to any one of claims 1 to 11, characterized in that When the first connection does not exist in the first connection table, the method further includes: The service data packet is sent to the device indicated by the destination address in the first IP quintuple.

15. A UPF, characterized in that: Including memory, transceiver, processor; A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: Acquire a service data packet, and determine whether there is a first connection in the first connection table under the target packet filter PF; wherein the target PF is a PF that matches the first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service identified; If the first connection does not exist in the first connection table, performing service identification on the service data packet to determine a first service identifier; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet; Sending the first IP quintuple and the first service identifier to a session management function SMF; Among them, the first IP quintuple and the first service identifier are used by the SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on the data packets of the target terminal accessing the target application.

16. The UPF according to claim 15, characterized in that The UPF includes a flow template TFT service processing node and a deep packet inspection DPI service processing node; The processor performs the following steps to determine whether there is a first connection in the first connection table under the target packet filter PF: Querying a plurality of candidate PFs according to the first IP quintuple through the TFT service processing node to determine a target PF matching the first IP quintuple from the plurality of candidate PFs; Extracting a DPI resolution identifier from the target PF through the TFT service processing node; wherein the DPI resolution identifier is used to indicate whether service identification is performed through the DPI service processing node; When the DPI resolution identifier indicates that service identification is performed through the DPI service processing node, obtaining a first connection table under the target PF through the TFT service processing node; The TFT service processing node determines whether there is a first connection matching the first IP quintuple in the first connection table.

17. The UPF according to claim 16, characterized in that After the processor extracts the DPI resolution identifier from the target PF, the processor is further configured to perform the following operations: In the case where the DPI resolution identifier indicates that service identification is not performed through the DPI service processing node, determining whether the target PF includes a second service identifier through the TFT service processing node; wherein the second service identifier is used to indicate an application program that adopts a general processing strategy, and the general processing strategy includes a general service quality control strategy and / or a general billing strategy; When the target PF includes the second service identifier, the general processing strategy is executed on the service data packet by using the default session corresponding to the first IP quintuple through the TFT service processing node; When the target PF does not contain the second service identifier, the service data packet is sent to the device indicated by the destination address in the first IP quintuple through the TFT service processing node.

18. The UPF according to claim 15, characterized in that The UPF includes a TFT service processing node and a DPI service processing node; The processor performs, when the first connection does not exist in the first connection table, service identification on the service data packet to determine the first service identifier, specifically: If the first connection does not exist in the first connection table, encapsulate the service data packet by the TFT service processing node to obtain a first encapsulation packet, and send the first encapsulation packet to the DPI service processing node; Decapsulating the first encapsulated packet through the DPI service processing node to obtain the service data packet, and parsing the service data packet to obtain the first IP quintuple; Determine, by the DPI service processing node, whether there is a second connection in the second connection table that matches the first IP quintuple; wherein the second connection table is a connection table maintained by the DPI service processing node; When the second connection exists in the second connection table and the identification bit of the second connection indicates that the second connection has not been service-identified, the service data packet is service-identified by the DPI service processing node to obtain the application identifier of the target application, and the first service identifier is determined based on the application identifier.

19. The UPF according to claim 18, characterized in that The processor is further configured to perform the following operations: The identification bit of the second connection is updated by the DPI service processing node; wherein the updated identification bit of the second connection is used to indicate that the second connection has been service identified; The service data packet is discarded by the DPI service processing node.

20. The UPF of claim 18, wherein: The first encapsulation packet also includes the identification information of the target PF and the transmission direction of the service data packet. The processor executes sending the first IP quintuple and the first service identifier to the session management function SMF, specifically: Sending a first message for establishing a connection to the TFT service processing node through the DPI service processing node; wherein the first message includes the first service identifier, the first IP quintuple, the identifier information, and a first signaling flow that matches the transmission direction and is counted for the second connection; Establishing, by the TFT service processing node, a third connection according to the first service identifier and the first IP quintuple, and adding the third connection to a first connection table under the target PF matching the identifier information; Send the first service identifier and the first IP quintuple to the SMF through the TFT service processing node; wherein the first service identifier and the first IP quintuple are used by the SMF to establish a target session corresponding to the third connection; The target session is used by the TFT service processing node to perform service quality control and / or billing on the data packets of the target terminal accessing the target application based on the first processing strategy corresponding to the first service identifier and the first signaling traffic.

21. The UPF of claim 15, wherein: After the processor determines whether there is a first connection in the first connection table under the target packet filter PF, the processor is further configured to perform the following operations: If the first connection exists in the first connection table, obtaining a third service identifier indicated by the first connection; Based on the second processing strategy corresponding to the third service identifier, service quality control and / or charging are performed on the service data packet.

22. The UPF according to claim 21, characterized in that The UPF includes a TFT service processing node and a DPI service processing node; When the first connection exists in the first connection table, the processor is further configured to perform the following operations: Encapsulating the service data packet through the TFT service processing node to obtain a second encapsulation packet, and sending the second encapsulation packet to the DPI service processing node; Decapsulating the second encapsulated packet through the DPI service processing node to obtain the service data packet, and parsing the service data packet to obtain the first IP quintuple; When the protocol type in the first IP quintuple is TCP, determining, by the DPI service processing node, whether the service data packet is a TCP connection establishment message; In the case where the service data packet is the TCP connection establishment message, determining, by the DPI service processing node, whether there is a fourth connection matching the first IP quintuple in the second connection table; wherein the second connection table is a connection table maintained by the DPI service processing node; In a case where the fourth connection exists in the second connection table, the service data packet is discarded by the DPI service processing node.

23. The UPF according to claim 22, characterized in that The second encapsulation packet also includes the transmission direction of the service data packet. After the processor executes the determination, through the DPI service processing node, whether there is a fourth connection in the second connection table that matches the first IP quintuple, the processor is further configured to perform the following operations: If the fourth connection does not exist in the second connection table, establishing a fifth connection according to the first IP quintuple through the DPI service processing node; adding the fifth connection to the second connection table by the DPI service processing node; The DPI service processing node determines, according to the traffic of the service data packet, a second signaling traffic that matches the transmission direction and is counted for the fifth connection.

24. The UPF of claim 22, wherein: After the processor determines whether the service data packet is a TCP connection establishment message through the DPI service processing node, it is further configured to perform the following operations: In the case where the service data packet is not the TCP connection establishment message, determining, by the DPI service processing node, whether the service data packet is a TCP connection deletion message; In a case where the service data packet is the TCP connection deletion message, determining, by the DPI service processing node, from the second connection table a sixth connection matching the first IP quintuple; Determining, by the DPI service processing node, whether the identification bit of the sixth connection indicates that the sixth connection has undergone service identification; In a case where the identification bit of the sixth connection indicates that the sixth connection has been service identified, deleting the sixth connection in the second connection table through the DPI service processing node, and sending a second message for deleting the connection to the TFT service processing node; wherein the second message is used by the TFT service processing node to delete the first connection in the first connection table; When the identification bit of the sixth connection indicates that the sixth connection has not been service identified, the sixth connection in the second connection table is deleted by the DPI service processing node, and the service data packet is discarded.

25. The UPF according to claim 24, characterized in that The processor is further configured to perform the following operations: When the service data packet is not the TCP connection deletion message, or when the protocol type is UDP, determining, by the DPI service processing node, whether there is a seventh connection matching the first IP quintuple in the second connection table; When the seventh connection exists in the second connection table, performing protocol parsing on the service data packet according to the protocol type by the DPI service processing node to obtain a protocol parsing result; In a case where the identification bit of the seventh connection indicates that the seventh connection has been service identified, judging, by the DPI service processing node according to the protocol parsing result, whether the service data packet is a UDP termination message; In the case where the service data packet is a UDP termination message, deleting the seventh connection in the second connection table through the DPI service processing node; A third message for deleting a connection is sent to the TFT service processing node through the DPI service processing node; wherein the third message is used by the TFT service processing node to delete the first connection in the first connection table.

26. The UPF according to any one of claims 15 to 25, characterized in that The UPF includes a TFT service processing node and a DPI service processing node; the processor is also used to perform the following operations: Determine, by the DPI service processing node, whether there is a target connection in the second connection table; wherein the target connection is a connection established according to the second IP quintuple; wherein the second connection table is a connection table maintained by the DPI service processing node; When the target connection exists in the second connection table, determining, by the DPI service processing node, whether the identification bit of the target connection indicates that the target connection has been service identified; When the identification bit of the target connection indicates that the target connection has not been service identified, deleting the target connection in the second connection table through the DPI service processing node; When the identification bit of the target connection indicates that the target connection has been service-identified, the target connection in the second connection table is deleted by the DPI service processing node, and a fourth message for deleting the connection is sent to the TFT service processing node; wherein the fourth message carries the second IP quintuple and the target service identifier indicated by the target connection, and is used by the TFT service processing node to delete the eighth connection in the first connection table that matches the second IP quintuple.

27. The UPF according to claim 26, characterized in that The processor executes, through the DPI service processing node, determining whether there is a target connection in the second connection table, specifically: For any connection in the second connection table, obtaining, through the DPI service processing node, a reception time of a third encapsulation packet corresponding to any connection; wherein the third encapsulation packet is a most recently received encapsulation packet containing an IP five-tuple indicated by any connection; Determine, by the DPI service processing node, whether a time difference between a receiving time of a third encapsulation packet corresponding to any one of the connections and a current time is less than a set duration; When the time difference corresponding to any one of the connections is greater than or equal to the set duration, determining that a target connection exists in the second connection table, and using any one of the connections as the target connection; When the time differences corresponding to all the connections in the second connection table are less than the set duration, it is determined that there is no target connection in the second connection table.

28. The UPF according to any one of claims 15 to 25, characterized in that When the first connection does not exist in the first connection table, the processor is further configured to perform the following operations: The service data packet is sent to the device indicated by the destination address in the first IP quintuple.

29. A service identification device, characterized in that: Applications in UPF include: An acquisition unit, used for acquiring a service data packet; A judging unit, used to judge whether there is a first connection in the first connection table under the target packet filter PF; wherein the target PF is a PF that matches the first IP quintuple in the service data packet, and the first connection is a connection that matches the first IP quintuple and has been service identified; an identification unit, configured to perform service identification on the service data packet to determine a first service identifier when the first connection does not exist in the first connection table; wherein the first service identifier is used to indicate a target application accessed by a target terminal that sends or receives the service data packet; A sending unit, configured to send the first IP quintuple and the first service identifier to a session management function SMF; Among them, the first IP quintuple and the first service identifier are used by the SMF to establish a target session for the target terminal, and the target session is used to perform service quality control and / or billing on the data packets of the target terminal accessing the target application.

30. A processor-readable storage medium, characterized in that: The processor-readable storage medium stores a computer program, and the computer program is used to enable the processor to execute the method according to any one of claims 1 to 14.

Images