A GTP-U tunnel source authentication method and system

Abstract

The present invention discloses a source authentication method and system for a GTP-U tunnel, belonging to the technical field of wireless communication. A source authentication method for a GTP-U tunnel comprises the following steps: when a tunnel sending end encapsulates a user data packet into a GTP-U tunnel packet, tunnel origination information is added; after receiving the packet, a tunnel receiving end parses the packet header, and determines whether the packet is a GTP-U tunnel packet according to the transport layer protocol header; if the packet is a GTP-U tunnel packet and carries tunnel origination information, the receiving end performs source authentication, and compares the tunnel origination information part of the GTP-U tunnel packet with the tunnel source information recorded by the receiving end; if the packet is a non-GTP-U tunnel packet or a GTP-U tunnel packet that does not carry tunnel origination information, non-authentication forwarding is performed, authentication forwarding is performed after the GTP-U tunnel packet matches the authentication successfully, and subsequent processing is performed after the authentication passes.

Description

Technical Field

[0001] The present invention belongs to the technical field of wireless communications, and in particular relates to a source end authentication method and system for a GTP-U tunnel. Background Art

[0002] 5G (5th Generation) wireless networks adopt an architecture that separates control plane and data plane functions, and implements user data processing and forwarding at the edge of the network to improve the flexibility of transmission control. The User Plane Function (UPF) is a key component in the 5G core network. It is closely related to the transmission and management of data, and the GRPS Tunneling Protocol (General Packet Radio Service Tunneling Protocol, GTP) is an important protocol to support this purpose. The GTP protocol mainly includes two application objects, namely the GTP control plane part (GTPControl Plane, GTP-C) and the GTP user plane part (GTP User Plane, GTP-U).

[0003] According to the technical specifications of 3GPP, GTP-U is a tunnel protocol based on IP / UDP, which is specially used to transmit user data in mobile communication networks. Its main function is to carry user data streams and ensure that data can be transmitted efficiently and reliably. The management of GTP-U tunnels is mainly completed by the control plane. The source end of the GTP-U tunnel is the sender of the GTP-U packet, and the destination end of the tunnel is the receiver of the GTP-U packet. The authentication of the GTP-U source end is mainly completed in the control plane, and there is no source end authentication in the user plane.

[0004] When the GTP-U transmitter receives an IP packet that needs to be carried, it encapsulates it in a tunnel packet according to the technical standards. The structure of the GTP-U tunnel packet, starting from the outermost layer, is: external IP header, UDP header, GTP-U header and internal IP packet part. The function of the external IP header is used for routing between the GTP-U receiver and the GTP-U transmitter. The internal IP packet header is the basis for routing forwarding outside the 5G core network. The source port number of UDP in the GTP-U tunnel packet is statically or dynamically assigned by the sender, and the default value of the destination port number is generally 2152. An important field in the GTP-U header is the Tunnel Endpoint Identifier (TEID). TEID is assigned by the receiver and used by the sender. TEID is a unique identifier that distinguishes different GTP-U tunnels in the 5G network.

[0005] In a typical mobile application scenario, there are two cells, corresponding to cell A and cell B, and the cell center base station corresponds to base station A and base station B. The user terminal (UE) migrates from cell A to cell B, and the access and mobility management function (AMF) of the 5G core network controls the base station (the nextGeneration Node B, gNB), coordinates the session management function (SMF) to control the UPF, and jointly establishes a GTP-U tunnel. When the user leaves cell A and enters cell B and needs to switch, because the source gNB will change, in order to maintain the continuity of the connection, the GTP-U tunnel packet should not carry the sender TEID.

[0006] The above-mentioned TEID allocation mode has an abnormal phenomenon. After the interfering UE obtains the TEID allocated by the UPF, it can encapsulate the interfering data into a GTP-U tunnel packet and send it to the interfered UE. It can also establish a connection with the interfered UE in this way to obtain its data. It can be seen that the current allocation and use mode of TEID lacks the authentication of the source end of the GTP-U tunnel.

[0007] In view of the fact that the current GTP-U protocol lacks a source authentication mechanism, a feasible way is to monitor GTP traffic. Specifically, it is necessary to check whether the GTP-U tunnel packet matches the tunnel, and whether the payload of the packet is also a GTP-U tunnel packet. However, continuous traffic monitoring has a negative impact on network performance, depends on specific network equipment and software, and has privacy issues. Therefore, a GTP-U authentication method with less impact on network performance and wider application is needed. Summary of the invention

[0008] In view of the deficiencies in the prior art, the purpose of the present invention is to provide a source authentication method and system for a GTP-U tunnel, which solves the problems in the prior art.

[0009] The purpose of the present invention can be achieved by the following technical solutions:

[0010] A method for authenticating a source end of a GTP-U tunnel comprises the following steps:

[0011] The tunnel sender adds the tunnel origination information when encapsulating the user data packet into the GTP-U tunnel packet;

[0012] After receiving the packet, the tunnel receiving end parses the packet header and determines whether the packet is a GTP-U tunnel packet based on the transport layer protocol header;

[0013] If the packet is a GTP-U tunnel packet and carries tunnel origination information, the receiving end performs source authentication and compares the tunnel origination information part of the GTP-U tunnel packet with the tunnel source information recorded by the receiving end; if the packet is a non-GTP-U tunnel packet or a GTP-U tunnel packet that does not carry tunnel origination information, it is forwarded without authentication. After the GTP-U tunnel packet matches the authentication successfully, it is forwarded with authentication, and subsequent processing is performed after the authentication passes.

[0014] Furthermore, the GTP-U tunnel packet structure after adding the tunnel origination information includes: tunnel destination information, tunnel origination information, tunnel inner layer address and net load.

[0015] Furthermore, the tunnel receiving end information includes: an external IP header of a GTP-U tunnel packet, a UDP header of a GTP-U tunnel packet, and a GTP-U header.

[0016] Furthermore, the tunnel originating end information is used by the receiving end to verify the tunnel source, including: the tunnel sending end IP header, the tunnel sending end UDP header, and the tunnel sending end obtained from the GTP-U packet header involved in the reverse reception.

[0017] Furthermore, the method for determining the GTP-U tunnel grouping is:

[0018] Parse the tunnel receiving end information of the received tunnel packet, obtain the protocol field of the external IP header, and determine whether the packet has a UDP header based on whether the protocol field is 17. If not, it means that the packet is a non-GTP-U tunnel packet.

[0019] Get the destination port number in the UDP header. If the port number is a pre-configured characteristic number, the packet is a GTP-U tunnel packet; otherwise, it is a non-GTP-U tunnel packet.

[0020] Furthermore, the receiving end performs source authentication steps as follows:

[0021] Step 1, the receiving end parses the tunnel origination information part in the GTP-U tunnel packet, and obtains the destination address of the IP header involved in the reverse reception and the TEID in the GTP-U header taken by the sending end;

[0022] Step 2: The receiving end compares the destination address obtained in step 1 with the recorded sending end IP address to determine whether it is the address of the sending end of the GTP-U tunnel. If not, the authentication fails and the subsequent steps are not performed.

[0023] In step 3, the receiving end compares the TEID obtained from the GTP-U header involved in the reverse reception with the TEID obtained from the recorded sending end to see if the TEID obtained in step 1 is the TEID allocated by the sending end of the GTP-U tunnel. If not, the authentication fails. If so, the authentication passes.

[0024] A source authentication system for a GTP-U tunnel, comprising:

[0025] Data packet module: The tunnel sender adds tunnel origination information when encapsulating user data packets into GTP-U tunnel packets;

[0026] Packet judgment module: After receiving the packet, the tunnel receiving end parses the packet header and judges whether the packet is a GTP-U tunnel packet according to the transport layer protocol header;

[0027] And, authentication module: if the packet is a GTP-U tunnel packet and carries tunnel origination information, the receiving end performs source authentication and compares the tunnel origination information part of the GTP-U tunnel packet with the tunnel source information recorded by the receiving end; if the packet is a non-GTP-U tunnel packet or a GTP-U tunnel packet that does not carry tunnel origination information, it is forwarded without authentication, and the GTP-U tunnel packet is forwarded with authentication after the authentication is successful. After the authentication is passed, subsequent processing is performed.

[0028] A computer storage medium stores a readable program, which can execute the above-mentioned source authentication method of a GTP-U tunnel when the program is running.

[0029] An electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus;

[0030] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the above-mentioned source authentication method of a GTP-U tunnel.

[0031] A computer program product includes computer instructions, wherein the computer instructions instruct a computing device to perform operations corresponding to the above-mentioned source authentication method of a GTP-U tunnel.

[0032] Beneficial effects of the present invention:

[0033] 1. In the source authentication method of the GTP-U tunnel proposed in the present invention, the tunnel sending end only needs to add the tunnel sending end information part when encapsulating the GTP-U tunnel packet, and its structure is the same as the tunnel receiving end information; for the tunnel receiving end, the source end authentication process will not affect the process of the receiving end processing non-GTP-U tunnel packets; the tunnel sending end information and the source end authentication process are only used in the GTP-U tunnel, and there is no need to change the subsequent processing process of the receiving end for the GTP-U tunnel packet.

[0034] 2. The method proposed in the present invention also retains and is compatible with the existing TEID allocation and usage mode, and the UE does not need to rebuild the GTP-U tunnel when performing cell switching. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 It is a mobile application scenario diagram of the authentication method proposed in the present invention;

[0037] Figure 2 It is a GTP-U tunnel packet protocol structure diagram in the present invention;

[0038] Figure 3 It is a general flow chart of the source end authentication method of the GTP-U tunnel grouping of the present invention;

[0039] Figure 4 is a flow chart of grouping type determination of the present invention;

[0040] Figure 5 It is the source authentication sub-flow chart;

[0041] Figure 6 This is a specific application scenario diagram in Example 2 of the present invention;

[0042] Figure 7 is the comparison scene diagram in Embodiment 2 of the present invention;

[0043] Figure 8 This is a scene diagram of source authentication in Example 2 of the present invention.

[0044] In the figure, 101: UE1 before migrating from cell A to cell B, 102: gNB corresponding to cell A, 103: UE2 after migrating from cell A to cell B, 104: gNB corresponding to cell B, 105: UPF in the 5G core network, 106: external data network DN in the 5G network architecture, 107: AMF in the 5G core network, 108: SMF in the 5G core network, 109: gNB coverage of cell A, 110: gNB coverage of cell B.

[0045] 201: Outer IP header of GTP-U tunnel packet, 202: UDP header of GTP-U tunnel packet, 203: GTP-U header, 204: Tunnel sender IP header, 205: Tunnel sender UDP header, 206: Tunnel sender is taken from the GTP-U packet header involved in reverse reception, 207: Inner IP header, 208: User data part.

[0046] 601: gNB-A encapsulates the uplink GTP-U tunnel packet using the method proposed in the present invention; 602: gNB-B encapsulates the uplink GTP-U tunnel packet using the method proposed in the present invention.

[0047] 701: the interfering party, 702: the gNB to which the interfering party belongs, 703: the uplink GTP-U tunnel packet encapsulated by the method proposed in the present invention not adopted by gNB-A, 704: the uplink GTP-U tunnel packet encapsulated by the method proposed in the present invention not adopted by gNB-C.

[0048] 801: gNB-C encapsulates the uplink GTP-U tunnel group using the method proposed in the present invention. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] Example 1

[0051] An application scenario of a source authentication method for a GTP-U tunnel is as follows: Figure 1 As shown in FIG. 1 , two cells and their corresponding base stations are depicted, and the UE migrates from the coverage of cell A to the coverage of cell B. The scenario includes the following parts:

[0052] UE1 101 before migrating from cell A to cell B;

[0053] gNB 102 corresponding to cell A, which is connected to UE 1101 before migration from cell A to cell B through a wireless interface;

[0054] UE2 103 after migration from cell A to cell B;

[0055] gNB 104 corresponding to cell B, which is connected to UE2103 after migration from cell A to cell B through a wireless interface;

[0056] The UPF 105 in the 5G core network transmits user data with the gNB 102 corresponding to the A cell and the gNB 104 corresponding to the B cell through the N3 interface;

[0057] The external data network DN 106 in the 5G network architecture transmits user data with the UPF 105 in the 5G core network via the N6 interface;

[0058] The AMF 107 in the 5G core network transmits signaling with the UE1 101 before migration from the A cell to the B cell or the UE2 103 after migration from the A cell to the B cell through the logical interface N1, and transmits signaling with the gNB 102 corresponding to the A cell and the gNB 104 corresponding to the B cell through the N2 interface;

[0059] The SMF 108 in the 5G core network transmits signaling with the UPF 105 in the 5G core network via the N4 interface;

[0060] The gNB coverage of cell A is 109 and the gNB coverage of cell B is 110; Figure 1 Circled in ellipse.

[0061] The present invention is a GTP-U tunnel source authentication method, which is divided into two aspects: 1) the sending end completes the tunnel encapsulation, and 2) the receiving end completes the source verification; the details are as follows:

[0062] In the first aspect, when a tunnel sender transmits a user data packet via a GTP-U tunnel, the user data packet is encapsulated into a GTP-U tunnel packet. The method proposed in the present invention stipulates that the tunnel sender needs to add tunnel origination information in the GTP-U tunnel packet, and its structure is the same as the tunnel receiving end information, and the entire GTP-U tunnel packet is divided into four parts, namely, tunnel receiving end information, tunnel origination information, tunnel inner layer address and net load; the GTP-U tunnel packet structure is as follows Figure 2 shown.

[0063] Tunnel end information contains the following three components:

[0064] The destination address of the outer IP header (Out IP Header, OIP-H) 201 of the GTP-U tunnel packet is the tunnel receiving end address.

[0065] The default value of the destination port number of the UDP header (UDP-H) 202 of the GTP-U tunnel packet is 2152.

[0066] GTP-U Header (GTP-U Header, GTPU-H) 203, whose TEID is allocated by the tunnel receiving end.

[0067] The tunnel source information is used by the receiving end to verify the tunnel source. Its structure is similar to that of the tunnel receiving end information, including:

[0068] The tunnel sender IP header (Source IP Header, SIP-H) 204, whose destination address is the IP address of the tunnel sender.

[0069] The tunnel sender UDP header (Source UDP Header, SUDP-H) is 205, and its destination port number is 2152.

[0070] The tunnel sending end is taken from the GTP-U packet header (Source GTP-U Header, SGTPU-H) 206 involved in the reverse reception, and its TEID is allocated by the tunnel sending end.

[0071] The tunnel inner IP Header (IIP-H) includes: an inner IP header 207, which includes the IP information of the UE.

[0072] The payload (Payload, PL) includes: a user data portion 208 .

[0073] The sender follows Figure 2 The protocol structure shown encapsulates the data packet. After the encapsulated GTP-U tunnel packet is transmitted through the tunnel, it is received and parsed by the tunnel receiving end.

[0074] Secondly, when the tunnel receiving end receives a packet, it first determines whether the packet is a GTP-U tunnel packet based on the transport layer protocol header, and then performs source authentication on the GTP-U tunnel packet carrying the tunnel origination information. After successful authentication, authentication forwarding is performed, and non-authentication forwarding is performed directly for non-GTP-U tunnel packets or GTP-U tunnel packets that do not carry tunnel origination information.

[0075] like Figure 3 As shown, the source authentication steps of the GTP-U tunnel packet are as follows:

[0076] S301, the process starts;

[0077] S302, the receiving end receives the packet and parses the packet header field;

[0078] S303 has two inputs; if the tunnel receiving end information is successfully parsed, the external IP header is processed to obtain the value of the transport layer protocol field; the UDP header is parsed to obtain the destination port number;

[0079] S304, enter the packet type determination sub-process, and determine whether the received packet is a GTP-U tunnel packet according to the protocol field value of OIP-H and the destination port number of UDP-H;

[0080] S305, according to the result of packet type judgment, if the packet is a GTP-U tunnel packet and carries tunnel origination information, jump to S306; otherwise jump to S308;

[0081] S306, entering the source authentication sub-process, performing source authentication on the GTP-U tunnel packet carrying the tunnel origination information;

[0082] S307, according to the result of the source end authentication, if the source end authentication passes, jump to S309; ​​if not, jump to S310;

[0083] S308 performs non-authentication forwarding for the non-GTP-U tunnel packet, and forwards the non-GTP-U tunnel packet according to the original forwarding process of the tunnel receiving end;

[0084] S309, authenticate and forward the GTP-U tunnel packet that has passed the authentication of the source end, and forward it according to the original forwarding process of the GTP-U tunnel packet at the tunnel receiving end;

[0085] S310, the process ends.

[0086] The packet type is determined by first parsing the tunnel receiving end information of the received tunnel packet, and then judging it based on the protocol field in the external IP header and the destination port number in the UDP header. Non-GTP-U tunnel packets do not undergo source authentication. The process of determining whether a packet is a GTP-U tunnel packet is as follows: Figure 4 As shown, the following steps are included:

[0087] S401, the group type determination sub-process starts;

[0088] S402, if the protocol field value of OIP-H is equal to 17 and the destination port number of UDP-H is 2152, jump to S403; otherwise, jump to S404;

[0089] S403, the received packet is a GTP-U tunnel packet;

[0090] S404, the received packet is a non-GTP-U tunnel packet;

[0091] S405, the group type determination sub-process ends.

[0092] Source authentication requires parsing the tunnel origination information part in the GTP-U tunnel packet, obtaining the destination address of the IP header involved in the reverse reception and the TEID in the GTP-U header from the sender, and comparing them with the recorded sender IP address and TEID. Figure 5 The flowchart of the GTP-U tunnel group authentication for the tunnel source end is as follows:

[0093] S501, the source authentication sub-process starts;

[0094] S502, parsing the tunnel origination information of the GTP-U tunnel group;

[0095] S503, there are two inputs. After parsing the header field, the destination address in SIP-H and the TEID in SGTPU-H are obtained;

[0096] S504, there are two inputs, obtaining the IP address of the tunnel sender recorded by the receiving end and the TEID involved in the reverse reception (i.e., assigned by the sending end);

[0097] S505, if the destination address in SIP-H is equal to the IP address of the tunnel sender recorded by the receiving end and the TEID in SGTPU-H is equal to the TEID assigned by the sender recorded by the receiving end, jump to S506. Otherwise, jump to S507;

[0098] S506, source authentication passed;

[0099] S507, source authentication failed;

[0100] S508, the source authentication sub-process ends.

[0101] Example 2

[0102] like Figure 6 As shown, in this embodiment, an example of a specific application scenario is introduced. The example describes a scenario in which a UE switches from a cell A to a cell B. The specific scenario includes the following:

[0103] UE1 101 before migrating from cell A to cell B;

[0104] gNB 102 corresponding to cell A, the IP address of the base station is 192.168.1.1, and the allocated TEID is 21;

[0105] After UE2 103 migrates from cell A to cell B:

[0106] gNB 104 corresponding to cell B, the IP address of this base station is 192.168.1.2, and the allocated TEID is 22;

[0107] UPF 105 in the 5G core network has an IP address of 192.163.1.3 and an assigned TEID of 23;

[0108] gNB-A encapsulates an uplink GTP-U tunnel packet 601 using the method proposed in the present invention, wherein the IP destination address and TEID of the tunnel receiving end information are 192.168.1.3 and 23 respectively, and the IP destination address and TEID of the tunnel sending end information are 192.168.1.1 and 21 respectively;

[0109] gNB-B uses the uplink GTP-U tunnel packet 602 encapsulated by the method proposed in the present invention; the IP destination address and TEID of the tunnel receiving end information are 192.168.1.3 and 23 respectively, and the IP destination address and TEID of the tunnel sending end information are 192.168.1.2 and 22 respectively.

[0110] After the UE switches to the B cell, the gNB to which the B cell belongs can still use the same tunnel identifier when encapsulating the GTP-U tunnel packet. In the uplink GTP-U tunnel packet 601 encapsulated by the method proposed by the present invention by gNB-A and the uplink GTP-U tunnel packet 602 encapsulated by the method proposed by the present invention by gNB-B, the TEID in the tunnel receiving end information is 23, so there is no need to recreate a new tunnel when switching cells. Compared with the GTP-U tunnel source authentication method not using the present invention, only the tunnel originating end information needs to be added, that is, the tunnel originating end information in the uplink GTP-U tunnel packet 601 encapsulated by the method proposed by the present invention by gNB-A and the uplink GTP-U tunnel packet 602 encapsulated by the method proposed by the present invention by gNB-B, and the IP destination address in the tunnel originating end information is the address of the gNB, and the TEID is allocated by the gNB, so the original technical method of cell switching is retained.

[0111] In addition, in order to illustrate that the GTP-U tunnel source authentication method proposed in the present invention has the following characteristics: it can identify other users sending interference data to the UE via the GTP-U protocol. Figure 7 The example of the comparative application scenario shown is used for illustration. The example describes a scenario in which the UE is interfered by the interference party without using the method proposed in the present invention. The specific scenarios include the following:

[0112] UE1 101 before migrating from cell A to cell B;

[0113] gNB 102 corresponding to cell A;

[0114] UPF 105 in the 5G core network has an IP address of 192.163.1.3 and an assigned TEID of 23;

[0115] The interfering party 701 interferes with the UE by taking advantage of the lack of source authentication mechanism in the GTP protocol;

[0116] The gNB 702 to which the interferer belongs has an IP address of 10.0.0.1 and an assigned TEID of 31.

[0117] gNB-A does not use the uplink GTP-U tunnel packet 703 encapsulated by the method proposed in the present invention. The IP destination address in the GTP-U tunnel packet header is 192.168.1.3, and the carried TEID is 23.

[0118] The gNB-C does not encapsulate the uplink GTP-U tunnel packet 704 using the method proposed in the present invention. The IP destination address in the GTP-U tunnel packet header is 192.168.1.3, and the carried TEID is 23.

[0119] Without using the GTP-U tunnel source authentication method, the interfering party can encapsulate the interference data packet into a GTP-U tunnel packet through the gNB. Figure 7 The gNB-C does not encapsulate the uplink GTP-U tunnel packet 704 using the method proposed in the present invention and sends it to the UPF. The IP destination address in the GTP-U tunnel packet from the interfering party is the IP address of the UPF, and the carried TEID is also allocated by the UPF, and Figure 7 The gNB-A shown does not use the same tunnel identification information of the uplink GTP-U tunnel packet 703 encapsulated by the method proposed in the present invention. Therefore, the UPF as the receiving end will treat it as a tunnel packet from the UE and process it, resulting in the interference data being sent to the UE in the end.

[0120] Figure 8 An example of an application scenario of source authentication is given. The example describes a scenario in which the UE is interfered by an interfering party using the method proposed in the present invention. The specific scenarios include the following:

[0121] UE1 101 before migrating from cell A to cell B;

[0122] gNB 102 corresponding to cell A; the IP address of this base station is 192.168.1.1, and the assigned TEID is 21;

[0123] UPF 105 in the 5G core network has an IP address of 192.163.1.3 and an assigned TEID of 23;

[0124] The interfering party 701 interferes with the UE by taking advantage of the lack of source authentication mechanism in the GTP protocol;

[0125] The gNB 702 to which the interferer belongs has an IP address of 10.0.0.1 and an assigned TEID of 31.

[0126] gNB-A encapsulates an uplink GTP-U tunnel packet 601 using the method proposed in the present invention, wherein the IP destination address and TEID of the tunnel receiving end information are 192.168.1.3 and 23 respectively, and the IP destination address and TEID of the tunnel sending end information are 192.168.1.1 and 21 respectively;

[0127] The gNB-C uses the uplink GTP-U tunnel packet 801 encapsulated by the method proposed in the present invention, wherein the IP destination address and TEID of the tunnel receiving end information are 192.168.1.3 and 23 respectively, and the IP destination address and TEID of the tunnel sending end information are 10.0.0.1 and 31 respectively.

[0128] After adopting the GTP-U tunnel source authentication method, UPF receives the GTP-U tunnel packet from the interfering party such as Figure 8 The gNB-C shown uses the uplink GTP-U tunnel packet 801 encapsulated by the method of the present invention to parse the tunnel originating information of the packet. The sender IP address and TEID parsed from the uplink GTP-U tunnel packet 801 encapsulated by the gNB-C using the method of the present invention are 10.0.0.1 and 31, which are compared with the peer tunnel identification information recorded by the UPF, that is, the sender IP address is 192.168.1.1 and the TEID is 21. If the match fails, it can be determined that it is not a GTP-U tunnel packet from the UE. Based on this identification, the UPF can not perform forwarding processing, avoiding the UE from receiving interference data from the interfering party.

[0129] Example 3

[0130] Based on a GTP-U tunnel source authentication method in Embodiment 1, this embodiment proposes a GTP-U tunnel source authentication system, which specifically includes:

[0131] Data packet module: The tunnel sender adds tunnel origination information when encapsulating user data packets into GTP-U tunnel packets;

[0132] Packet judgment module: After receiving the packet, the tunnel receiving end parses the packet header and judges whether the packet is a GTP-U tunnel packet according to the transport layer protocol header;

[0133] And, authentication module: if the packet is a GTP-U tunnel packet and carries tunnel origination information, the receiving end performs source authentication and compares the tunnel origination information part of the GTP-U tunnel packet with the tunnel source information recorded by the receiving end; if the packet is a non-GTP-U tunnel packet or a GTP-U tunnel packet that does not carry tunnel origination information, it is forwarded without authentication, and the GTP-U tunnel packet is forwarded with authentication after the authentication is successful. After the authentication is passed, subsequent processing is performed.

[0134] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0135] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements all fall within the scope of the present invention to be protected.

Claims

1. A method for authenticating the source of a GTP-U tunnel, characterized in that: The following steps are involved: The tunnel sender adds the tunnel origination information when encapsulating the user data packet into the GTP-U tunnel packet; After receiving the packet, the tunnel receiving end parses the packet header and determines whether the packet is a GTP-U tunnel packet based on the transport layer protocol header; If the packet is a GTP-U tunnel packet and carries tunnel origination information, the tunnel receiving end performs source authentication and compares the tunnel origination information portion of the GTP-U tunnel packet with the tunnel source information recorded by the tunnel receiving end; If the packet is not a GTP-U tunnel packet or a GTP-U tunnel packet that does not carry tunnel origination information, it is forwarded without authentication. If the GTP-U tunnel packet matches the authentication successfully, it is forwarded with authentication. After the authentication is passed, subsequent processing is performed. The method for determining the GTP-U tunnel grouping is: Parse the tunnel receiving end information of the received tunnel packet, obtain the protocol field of the external IP header, and determine whether the packet has a UDP header of a GTP-U tunnel packet according to whether the protocol field is 17. If not, it indicates that the packet is a non-GTP-U tunnel packet. Obtain the destination port number in the UDP header of the GTP-U tunnel packet. If the port number is a pre-configured characteristic number, the packet is a GTP-U tunnel packet; otherwise, it is a non-GTP-U tunnel packet. The steps for the tunnel receiving end to perform source authentication are: Step 1, the receiving end parses the tunnel origination information part in the GTP-U tunnel packet, and obtains the destination address of the IP header involved in the reverse reception and the TEID in the GTP-U header taken by the sending end; Step 2: The receiving end compares the destination address obtained in step 1 with the recorded sending end IP address to determine whether it is the address of the sending end of the GTP-U tunnel. If not, the authentication fails and the subsequent steps are not performed. In step 3, the receiving end compares the TEID obtained from the GTP-U header involved in the reverse reception with the TEID obtained from the recorded sending end to see if the TEID obtained in step 1 is the TEID allocated by the sending end of the GTP-U tunnel. If not, the authentication fails. If so, the authentication passes.

2. A method for authenticating the source of a GTP-U tunnel according to claim 1, characterized in that: The GTP-U tunnel packet structure after adding the tunnel origination information includes: tunnel destination information, the tunnel origination information, the tunnel inner layer address and the net load.

3. A method for authenticating the source of a GTP-U tunnel according to claim 2, characterized in that: The tunnel receiving end information includes: an external IP header of a GTP-U tunnel packet, a UDP header of a GTP-U tunnel packet, and a GTP-U header.

4. A method for authenticating the source of a GTP-U tunnel according to claim 2, characterized in that: The tunnel source information is used by the receiving end to verify the tunnel source, including: the tunnel sender IP header, the tunnel sender UDP header, and the tunnel sender's GTP-U packet header involved in the reverse reception.

5. A source authentication system for a GTP-U tunnel, characterized in that: include: Data packet module: The tunnel sender adds tunnel origination information when encapsulating user data packets into GTP-U tunnel packets; Packet judgment module: After receiving the packet, the tunnel receiving end parses the packet header and judges whether the packet is a GTP-U tunnel packet according to the transport layer protocol header; And, authentication module: if the packet is a GTP-U tunnel packet and carries tunnel origination information, the receiving end performs source authentication and compares the tunnel origination information part of the GTP-U tunnel packet with the tunnel source information recorded by the receiving end; If the packet is not a GTP-U tunnel packet or a GTP-U tunnel packet that does not carry tunnel origination information, it is forwarded without authentication. If the GTP-U tunnel packet matches the authentication successfully, it is forwarded with authentication. After the authentication is passed, subsequent processing is performed. The method for determining the GTP-U tunnel grouping is: Parse the tunnel receiving end information of the received tunnel packet, obtain the protocol field of the external IP header, and determine whether the packet has a UDP header of a GTP-U tunnel packet according to whether the protocol field is 17. If not, it indicates that the packet is a non-GTP-U tunnel packet. Obtain the destination port number in the UDP header of the GTP-U tunnel packet. If the port number is a pre-configured characteristic number, the packet is a GTP-U tunnel packet; otherwise, it is a non-GTP-U tunnel packet. The steps for the tunnel receiving end to perform source authentication are: Step 1, the receiving end parses the tunnel origination information part in the GTP-U tunnel packet, and obtains the destination address of the IP header involved in the reverse reception and the TEID in the GTP-U header taken by the sending end; Step 2: The receiving end compares the destination address obtained in step 1 with the recorded sending end IP address to determine whether it is the address of the sending end of the GTP-U tunnel. If not, the authentication fails and the subsequent steps are not performed. In step 3, the receiving end compares the TEID obtained from the GTP-U header involved in the reverse reception with the TEID obtained from the recorded sending end to see if the TEID obtained in step 1 is the TEID allocated by the sending end of the GTP-U tunnel. If not, the authentication fails. If so, the authentication passes.

6. A computer storage medium storing a readable program, characterized in that: When the program is running, it can execute the source authentication method of a GTP-U tunnel described in any one of claims 1 to 4.

7. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to a source authentication method of a GTP-U tunnel as described in any one of claims 1-4.

8. A computer program product comprising computer instructions, characterized in that: The computer instructions instruct the computing device to perform operations corresponding to the source authentication method of a GTP-U tunnel as described in any one of claims 1-4.

Images