Message interaction method and device, nonvolatile storage medium and communication system

Abstract

The invention discloses a message interaction method and device, a nonvolatile storage medium and a communication system. The method comprises the following steps: receiving a first message sent by a first network entity, and modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway to obtain a first target message; sending the first target message to a second network entity, and receiving a second message sent by the second network entity; modifying the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling interworking gateway, and modifying the destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity to obtain a second target message; and sending the second target message to the first network entity. According to the method and the device, the technical problems of network potential safety hazards and topological information exposure caused by direct connection between the private network entity and the core network entity are solved.

Description

Technical Field

[0001] The present application relates to the field of network technology and security, and specifically, to a message interaction method, device, non-volatile storage medium and communication system. Background Art

[0002] With the in-depth development of 5G (5th Generation Mobile Communication Technology) networks, the needs of industry customers are becoming more diverse. Most users in the private network field need customized access to core network element services to interact with the core network for more information. However, the 5G customized network elements deployed in the operator's computer room, which the enterprise has operation rights, belong to the network elements in the untrusted area. When the private network element is attacked, the core network element directly accessed by the network element will have security risks, thereby affecting the normal operation of other network services.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a message interaction method, device, non-volatile storage medium and communication system to at least solve the technical problems of network security risks and topology information exposure caused by the direct connection between a private network entity and a core network entity.

[0005] According to one aspect of an embodiment of the present application, a message interaction method is provided, including: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling intercommunication gateway, and obtaining a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, and the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data; sending the first target message to a second network entity, and receiving a second message sent by the second network entity, wherein the second message is a response message to the first target message; modifying the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling intercommunication gateway, and modifying the destination address carried in the second message from the first proxy address of the signaling intercommunication gateway to the address of the first network entity, and obtaining a second target message; and sending the second target message to the first network entity.

[0006] Optionally, before sending the first target message to the second network entity, the method further includes, based on the first message, determining the second network entity from a candidate network entity set: traversing and acquiring each candidate network entity in the candidate network entity set, and judging whether the candidate network entity matches the first network entity based on a mapping rule between the first network entity and the second network entity; if the judgment result is that the candidate network entity matches the first network entity, stopping the traversal and taking the network entity in the candidate network entity set that matches the first network entity as the second network entity; if the judgment result is that the candidate network entity does not match the first network entity, continuing to traverse the candidate network entity set to reacquire candidate network entities until a network entity that matches the first network entity is determined from the candidate network entity set, and taking the network entity that matches the first network entity as the second network entity.

[0007] Optionally, the mapping rule includes at least one of the following: a regular mapping rule, a number segment mapping rule, and judging whether the candidate network entity and the first network entity match according to the mapping rule between the first network entity and the second network entity includes: judging whether the candidate network entity satisfies the regular expression corresponding to the first network entity according to the regular expression recorded in the regular mapping rule, and determining that the candidate network entity and the first network entity match if the regular expression is satisfied; judging whether the number segment corresponding to the candidate network entity includes an identifier corresponding to the first network entity according to the number segment mapping relationship recorded in the number segment mapping rule, and determining that the candidate network entity and the first network entity match if the number segment corresponding to the candidate network entity includes an identifier corresponding to the first network entity.

[0008] Optionally, when all candidate network entities in the candidate network entity set do not match the first network entity, the method further includes: traversing and obtaining each candidate network entity in the candidate network entity set, and determining whether the candidate network entity supports processing a first message sent by any first network entity; when the determination result is that the candidate network entity supports processing a first message sent by any first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that supports processing a first message sent by any first network entity as the second network entity.

[0009] Optionally, the first message carries a notification information identifier, and the notification information identifier stores the address of the first network entity. After receiving the first message sent by the first network entity, the method also includes: encrypting the address of the first network entity stored in the notification information identifier; replacing sensitive fields in the first message, wherein the sensitive fields include at least one of the following: the sending port number of the first message, and the network entity identifier of the first network entity.

[0010] Optionally, the method also includes: receiving a third message sent by the second network entity, wherein the third message is used to notify the first network entity of billing management information; obtaining a notification information identifier carried in the third message, decrypting the address of the first network entity stored in the notification information identifier, and obtaining the address of the first network entity; and forwarding the third message to the first network entity based on the address of the first network entity.

[0011] Optionally, after receiving the second message sent by the second network entity, the method further includes replacing a sensitive field in the second message, wherein the sensitive field includes at least one of the following: a sending port number of the second message, and a network entity identifier of the second network entity.

[0012] According to another aspect of an embodiment of the present application, a message interaction device is also provided, including: a first interaction module, used to receive a first message sent by a first network entity, modify the source address carried in the first message from the address of the first network entity to the first proxy address of the signaling intercommunication gateway, and obtain a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, and the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data; a second interaction module, used to send the first target message to the second network entity, and receive a second message sent by the second network entity, wherein the second message is a response message to the first target message; a third interaction module, used to modify the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling intercommunication gateway, and modify the destination address carried in the second message from the first proxy address of the signaling intercommunication gateway to the address of the first network entity, and obtain a second target message; a fourth interaction module, used to send the second target message to the first network entity.

[0013] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, in which a program is stored, wherein when the program is running, a device where the non-volatile storage medium is located is controlled to execute a message interaction method.

[0014] According to another aspect of an embodiment of the present application, an electronic device is further provided, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the message interaction method is executed when the program is run.

[0015] According to another aspect of an embodiment of the present application, a communication system is also provided, including a signaling interworking gateway, a billing function network entity and a session management function network entity. When the signaling interworking gateway, the billing function network entity and the session management function network entity are executed by a processor, a message interaction method is implemented.

[0016] In an embodiment of the present application, a first message sent by a first network entity is received, and a source address carried in the first message is modified from the address of the first network entity to the first proxy address of the signaling intercommunication gateway to obtain a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, and the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data; the first target message is sent to the second network entity, and a second message sent by the second network entity is received, wherein the second message is a response message to the first target message; the source address carried in the second message is changed from the address of the second network entity to the first proxy address of the signaling intercommunication gateway; The address is modified to the second proxy address of the signaling intercommunication gateway, and the destination address carried in the second message is modified from the first proxy address of the signaling intercommunication gateway to the address of the first network entity, so as to obtain a second target message; the second target message is sent to the first network entity, and the purpose of security isolation and hiding the core network topology is achieved by setting a signaling intercommunication gateway between the billing function network entity and the session management function network entity to forward data, thereby realizing the technical effect of enhancing network security and protecting the communication system from attacks, and further solving the technical problems of network security risks and topology information exposure caused by the direct connection between the private network entity and the core network entity. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a schematic diagram of the structure of a communication system provided according to an embodiment of the present invention;

[0019] Figure 2 is a schematic diagram of a configuration relationship between network elements provided according to an embodiment of the present invention;

[0020] Figure 3 It is a structural schematic diagram of a computer terminal (mobile device) provided according to an embodiment of the present application;

[0021] Figure 4 It is a flowchart of a message interaction method provided according to an embodiment of the present application;

[0022] Figure 5 It is a schematic diagram of a specific process of interaction provided according to an embodiment of the present application;

[0023] Figure 6 is a schematic diagram of a CHF network element matching process provided according to an embodiment of the present application;

[0024] Figure 7is a schematic diagram of an interaction process of a third message provided according to an embodiment of the present application;

[0025] Figure 8 It is a structural schematic diagram of a message interaction device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0029] C-IWF (Customized-InterWorking Function, signaling interworking gateway): is a network element device that solves the multi-point interworking and data security between the operator network and the enterprise campus private network. This network element belongs to the network element in the 5G public network, which belongs to the trusted domain for the operator, and realizes the one-point access of the customized equipment of the private network customer.

[0030] 5GC (5G Core): consists of multiple network functions (NFs), each of which is responsible for specific tasks and functions.

[0031] CHF (Charging Function): A core network element device of a large network. It is the key functional body of 5G converged billing and supports three scenarios: online billing, offline billing and converged billing. It collects billing data from SMF, generates billing call records, and completes quota management.

[0032] SMF (Session Management Function): It is a network element device in the private network and is mainly responsible for user session management. In the billing system, it is responsible for billing data collection and connecting to the billing center.

[0033] N40 (5GC billing-related interface): A service-oriented interface between SMF and CHF, used for the interaction of billing messages to implement billing functions.

[0034] DMZ (Demilitarized Zone): A buffer zone between a non-secure system and a secure system.

[0035] In the billing business scenario, the private network SMF network element is located in the untrusted domain and submits billing data information to the core network CHF network element through the N40 interface. Its direct link with the core network CHF directly exposes the core network environment. In addition, all messages in the billing system are exchanged online. Operators need roaming settlement between provinces across the country, and there are many billing manufacturers across the country. Therefore, the direct exposure of the core network CHF network element will bring greater security risks to the billing system.

[0036] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0037] According to an embodiment of the present application, a system embodiment of a communication system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] The communication system provided in the embodiment of the present application is as follows: Figure 1 As shown, it includes the SMF network element of the government and enterprise private network, the CHF network element of the core network, and the C-IWF network element of the signaling interworking gateway. The functions and connection relationships of each device are as follows:

[0039] 1. SMF network element: located in the untrusted area, responsible for PDU session management, billing data collection and connection to the billing center.

[0040] 2. C-IWF network element: located in the DMZ area, responsible for signaling proxy forwarding and isolation.

[0041] 3. CHF network element: located in the trusted area, responsible for collecting billing data, generating billing call records, and completing quota management.

[0042] 4. SMF and C-IWF carry billing signaling to exchange billing data through the N40 interface.

[0043] 5. C-IWF and CHF carry billing signaling through the N40 interface to transmit billing data to the billing system.

[0044] The configuration relationship between each network element in the communication system is as follows: Figure 2 As shown, one private network N40 agent and one large network N40 agent can be configured on the signaling interconnection gateway. The private network N40 agent connects to multiple edge private network SMFs, and the large network N40 agent can connect to multiple core network CHFs.

[0045] According to an embodiment of the present application, a method embodiment of a message interaction method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0046] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 3 The hardware structure block diagram of a computer terminal (or mobile device) for implementing the data storage method is shown. Figure 3 As shown, the computer terminal 30 (or mobile device 30) may include one or more (302a, 302b, ..., 302n are used to illustrate) processors 302 (the processor 302 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 304 for storing data, and a transmission device 306 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 3 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 3 More or fewer components as shown, or with Figure 3 Different configurations are shown.

[0047] It should be noted that the one or more processors 302 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 30 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0048] The memory 304 can be used to store software programs and modules of application software, such as program instructions / data storage devices corresponding to the data storage method in the embodiment of the present application. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 304, that is, realizing the vulnerability detection method of the above-mentioned application. The memory 304 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 304 may further include a memory remotely arranged relative to the processor 302, and these remote memories may be connected to the computer terminal 30 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0049] The transmission device 306 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 30. In one example, the transmission device 306 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 306 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0050] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 30 (or mobile device).

[0051] In the above operating environment, the present application embodiment provides a message interaction method, such as Figure 4 As shown, the method comprises the following steps:

[0052] Step S402, receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling intercommunication gateway, and obtaining a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data;

[0053] Optionally, untrusted areas refer to areas in the network with low security or unknown security, which usually include external networks, Internet access points, user terminal devices (such as mobile phones, IoT devices), and enterprise private networks adjacent to the operator's network boundary. These areas may be vulnerable to attacks, unauthorized access or data leakage. Therefore, additional security measures such as data encryption, authentication and access control need to be implemented when communicating with untrusted areas. In 5G networks, networks that are not directly controlled by operators, such as edge networks or enterprise private networks, are often regarded as untrusted areas. The network entities therein (such as private network SMF) may need to communicate with the operator's core network, but their location or security status may be unstable, posing a potential security threat.

[0054] Optionally, the trusted zone refers to a higher security area in the network, which usually includes the operator's core network, data center, internal management network, etc. The network entities and resources in these areas are considered to be fully protected and can process data and communicate normally without additional security verification. Network function entities (such as CHF) in the trusted zone can interact with other trusted entities without undue concern about data security or network attacks. In the 5G network, the core network part of the operator, including CHF, etc., is usually located in the trusted zone. These core network functions are designed with high security and stability, and can effectively manage and protect communications within the network.

[0055] Optionally, before receiving the first message sent by the first network entity, the signaling intercommunication gateway is also configured with network information of the core network CHF (i.e., the first network entity) and the private network SMF (i.e., the second network entity), such as the IP address information of both: in the configuration file or database of the C-IWF, an entry is established for each CHF and SMF network element that communicates with it, and their respective network address information is recorded so that the C-IWF can identify and communicate with these network elements. Through the above processing, it can be ensured that the C-IWF knows how to communicate with the CHF and SMF, which is the basis for realizing message proxy forwarding.

[0056] Optionally, before receiving the first message sent by the first network entity, the signaling intercommunication gateway is also configured with a mapping relationship between the core network CHF and the private network SMF, such as the user segment information to establish a logical association between the CHF and the SMF, so that the C-IWF can decide to forward the message to a specific CHF network element based on the user information or service type carried in the message. For example, different user segments (which can be the prefix of the telephone number or a specific IMSI segment) correspond to different service levels or billing policies. Therefore, the C-IWF needs to configure rules. When receiving a request sent by an SMF within a certain user segment range, the message is forwarded to a specific CHF that processes the billing request of the user in the segment. This mapping relationship includes regular expression matching, digital range matching and other technologies to ensure that the message can be accurately routed to the correct destination according to network policies and user characteristics.

[0057] In the technical solution provided in step S402, the first message carries a notification information identifier, and the notification information identifier stores the address of the first network entity. After receiving the first message sent by the first network entity, the method also includes: encrypting the address of the first network entity stored in the notification information identifier; replacing sensitive fields in the first message, wherein the sensitive fields include at least one of the following: the sending port number of the first message, and the network entity identifier of the first network entity.

[0058] Optionally, after receiving the first message sent by the first network entity, the C-IWF parses the first message and identifies sensitive fields therein (such as a sending port number and a network entity identifier). The C-IWF uses the information of the C-IWF (usually the IP address and port number of the C-IWF) to replace the original information stored in the sensitive fields in the first message, that is, the IP address of the C-IWF is filled into the network entity identifier field of the first message, and the port number of the C-IWF is filled into the sending port number field of the first message.

[0059] Step S404: sending the first target message to the second network entity, and receiving a second message sent by the second network entity, wherein the second message is a response message to the first target message;

[0060] Optionally, Figure 5 A specific process of interaction is shown, such as Figure 5 As shown in the figure, the message interaction includes the following processes:

[0061] 1. Configure the network information of the core network CHF and private network SMF, such as IP information, on the C-IWF network element.

[0062] 2. Configure the mapping relationship between the core network CHF and the private network SMF on the C-IWF network element, such as user number segment information.

[0063] 3. SMF sends N40 message to C-IWF’s private network N40 agent via HTTP / 2 protocol.

[0064] 4. C-IWF obtains the message, hides the private network SMF related information and changes the source address to the big network proxy address.

[0065] 5. Forward the modified message to CHF via the N40 agent of the big network.

[0066] 6. CHF replies with a response message to the large network N40 agent of C-IWF.

[0067] 7. C-IWF obtains the message, replaces the source address with the private network proxy address, the destination address with the SMF address, and forwards the message to SMF.

[0068] 8. SMF receives the N40 response message delivered via the HTTP / 2 protocol.

[0069] In the technical solution provided in step S404, before sending the first target message to the second network entity, the method further includes: determining the second network entity from a candidate network entity set according to the first message: traversing and acquiring each candidate network entity in the candidate network entity set, and judging whether the candidate network entity matches the first network entity according to a mapping rule between the first network entity and the second network entity; if the judgment result is that the candidate network entity matches the first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that matches the first network entity as the second network entity; if the judgment result is that the candidate network entity does not match the first network entity, continuing to traverse the candidate network entity set to reacquire the candidate network entity until a network entity that matches the first network entity is determined from the candidate network entity set, and taking the network entity that matches the first network entity as the second network entity.

[0070] Optionally, the first message includes a Create service message, an Update service message, and a Release service message. The Create message is used to initialize a billing session. When the user equipment connects to the network and initiates a service, the SMF informs the CHF of the user information and expected service through the Create message, and the CHF starts the billing process accordingly. The Update message is responsible for updating the billing parameters of the CHF in real time through the Update message when the SMF detects changes in billing conditions during the session, such as an increase in user data usage or a change in service type, to ensure the accuracy and dynamism of billing. The Release message is used when the session ends or billing is no longer required. The SMF instructs the CHF to stop billing through the Release message to complete the billing cycle.

[0071] Specifically, the billing parameters are used to describe the billing conditions during a user session, including but not limited to: user data usage: the amount of data consumed by the user in the session, which is used to calculate the traffic fee; service type: the type of network service currently accessed by the user, and different service types correspond to different billing policies; billing timestamp: records the time point when the billing parameters are changed to ensure the accuracy of billing; billing characteristics: such as data rate, traffic type (uplink / downlink), etc. These characteristics determine the detailed rules of billing.

[0072] Figure 6 A matching process of a CHF network element (ie, the second network entity) is shown, such as Figure 6 As shown, the process includes the following steps:

[0073] 1. After receiving the Create, Update, and Release service operations triggered by SMF, C-IWF obtains all CHF network element information and performs CHF matching in combination with the received request message.

[0074] 2. Have you completed the traversal of all CHF information? If not, jump to step 3; if yes, jump to step 6.

[0075] 3. Match CHF according to the Patten information in the configured mapping relationship. If the match fails, jump to step 4; if the match succeeds, jump to step 5.

[0076] 4. Match CHF according to the Start / End information in the configured mapping relationship. If the match fails, jump to step 2; if the match succeeds, jump to step 5.

[0077] 5. CHF is matched successfully and the message is routed successfully.

[0078] 6. The first round of traversal failed, and no matching CHF network element was found to process the N40 message.

[0079] 7. Try the second round of traversal to see if all CHF information is traversed. If not, jump to step 8; if yes, jump to step 9.

[0080] 8. Determine whether there is a CHF network element that supports processing all Create, Update, and Release service operations; if so, jump to step 5; if not, jump to step 7.

[0081] 9. CHF matching failed and message routing failed.

[0082] In the technical solution provided in step S404, the mapping rules include at least one of the following: regular mapping rules, number segment mapping rules, and judging whether the candidate network entity and the first network entity match according to the mapping rules between the first network entity and the second network entity includes: judging whether the candidate network entity satisfies the regular expression corresponding to the first network entity according to the regular expression recorded in the regular mapping rule, and determining that the candidate network entity and the first network entity match if the regular expression is satisfied; judging whether the number segment corresponding to the candidate network entity includes an identifier corresponding to the first network entity according to the number segment mapping relationship recorded in the number segment mapping rule, and determining that the candidate network entity and the first network entity match if the number segment corresponding to the candidate network entity includes an identifier corresponding to the first network entity.

[0083] Optionally, the CHF is matched according to the Patten information in the configured mapping relationship. When the C-IWF receives the service request sent by the SMF, it checks the user identification (such as IMSI or phone number) information in the request and compares this information with the Patten information in the mapping relationship. The Patten here is configured with a regular expression to match a specific user identification pattern. For example, if the "Patten" field is configured to match all users whose user IMSI number segment starts with M, the C-IWF will match the received IMSI with the regular expression. If the match is successful, the C-IWF will determine that the request should be processed by the CHF mapped to the number segment. In this way, the C-IWF can dynamically select the most suitable CHF based on the attributes of the user identity, which not only enhances the flexibility and accuracy of message routing, but also ensures the security and efficiency of the network, enabling the 5G core network to better adapt to changing business needs and security environments.

[0084] Optionally, the CHF is matched according to the Start / End information in the configured mapping relationship. After receiving the request message sent by the session management function (SMF), the C-IWF will parse the user identification information carried in the message, such as IMSI (International Mobile Subscriber Identity) or telephone number segment. Subsequently, the C-IWF compares this identification information with the preset Start / End configuration, which defines the different user number segment ranges that different CHFs are responsible for. For example, if the configuration indicates that users with IMSI number segments from 46000 to 46099 should be handled by CHF-A, and users from 46100 to 46199 should be handled by CHF-B, then the C-IWF will check the user IMSI in each request to determine whether it falls within the above number segment range, and then decide whether to forward the request to CHF-A or CHF-B. Through this matching mechanism based on number segment configuration, C-IWF can effectively realize intelligent distribution of messages, ensuring that each user request can be processed by the correct CHF, while hiding the direct network location of the CHF, improving the overall security of the system and the management flexibility of the operator network.

[0085] In the technical solution provided in step S404, when all candidate network entities in the candidate network entity set do not match the first network entity, the method further includes: traversing and obtaining each candidate network entity in the candidate network entity set, and determining whether the candidate network entity supports processing a first message sent by any first network entity; when the determination result is that the candidate network entity supports processing a first message sent by any first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that supports processing a first message sent by any first network entity as the second network entity.

[0086] Step S406, modifying the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling interworking gateway, and modifying the destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity, to obtain a second target message;

[0087] Step S408: Send the second target message to the first network entity.

[0088] Optionally, the first message carries a notification information identifier, and the notification information identifier stores the address of the first network entity. After receiving the first message sent by the first network entity, the method also includes: encrypting the address of the first network entity stored in the notification information identifier; replacing sensitive fields in the first message, wherein the sensitive fields include at least one of the following: the sending port number of the first message, and the network entity identifier of the first network entity.

[0089] Optionally, the method also includes receiving a third message sent by the second network entity, wherein the third message is used to notify the first network entity of billing management information; obtaining a notification information identifier carried in the third message, decrypting the address of the first network entity stored in the notification information identifier, and obtaining the address of the first network entity; and forwarding the third message to the first network entity based on the address of the first network entity.

[0090] Specifically, Figure 7 The interactive process of a third message is shown. The third message includes a Notify message route, which is used to send an N40 message to a specified SMF for billing management information notification and change according to the NotifyUri information provided by the SMF when creating a service. Figure 7 As shown, the process includes the following steps:

[0091] 1. After receiving the Create and Update service operations triggered by SMF, C-IWF obtains the NotifyURI information.

[0092] 2. Use encryption to hide the SMF address information of the NotifyURI in the current message.

[0093] 3. C-IWF receives the Notify service operation triggered by CHF.

[0094] 4. Decrypt the Notify service request URI and obtain the address information of the destination SMF.

[0095] Optionally, after receiving the second message sent by the second network entity, the method further includes replacing a sensitive field in the second message, wherein the sensitive field includes at least one of the following: a sending port number of the second message, and a network entity identifier of the second network entity.

[0096] Through the above steps, it is possible to introduce the signaling intercommunication gateway C-IWF between the sinking SMF and the large network CHF, proxy forward the N40 message between the SMF and the CHF, ensure that the large network is invisible to the private network, thereby hiding the address information of the large network network element CHF, solving the security isolation problem between the core network and the private network SMF, simplifying the network topology to reduce the deployment difficulty, enhancing the function of the signaling intercommunication gateway, and the operator's core network does not need to be customized and developed, adapting to the development requirements of the operator's 5G private network. Specifically, the embodiment of the present application has the following advantages:

[0097] Advantage 1: With the development of 5G technology, the billing system architecture is also evolving. In order to support 5G billing technology more quickly, some 4G billing network elements still play a role in the 5G billing architecture. The N40 proxy method provided in this application is not limited to the type of core network element connected when SMF transmits N40 messages, including but not limited to CHF network elements, and can better adapt to changing customized environments.

[0098] Advantage 2: By introducing C-IWF network elements into the existing billing system, the security isolation problem between the private network and the large network is solved, and based on C-IWF, an N40 message proxy forwarding method is introduced to hide the topology of the large network CHF, further improving the security of the system and avoiding signaling shocks caused by exposure of core network elements and abnormal message attacks.

[0099] The present application embodiment provides a message interaction device, Figure 8 is a schematic diagram of the structure of the device, such as Figure 8 As shown, the device includes: a first interaction module 80, which is used to receive a first message sent by a first network entity, and modify the source address carried in the first message from the address of the first network entity to the first proxy address of the signaling intercommunication gateway to obtain a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, and the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data; a second interaction module 82, which is used to send the first target message to the second network entity, and receive a second message sent by the second network entity, wherein the second message is a response message to the first target message; a third interaction module 84, which modifies the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling intercommunication gateway, and modifies the destination address carried in the second message from the first proxy address of the signaling intercommunication gateway to the address of the first network entity, to obtain a second target message; a fourth interaction module 86, which is used to send the second target message to the first network entity.

[0100] In some embodiments of the present application, before sending the first target message to the second network entity, the method also includes, based on the first message, determining the second network entity from a candidate network entity set: traversing and acquiring each candidate network entity in the candidate network entity set, and judging whether the candidate network entity matches the first network entity based on a mapping rule between the first network entity and the second network entity; if the judgment result is that the candidate network entity matches the first network entity, stopping the traversal and taking the network entity in the candidate network entity set that matches the first network entity as the second network entity; if the judgment result is that the candidate network entity does not match the first network entity, continuing to traverse the candidate network entity set to reacquire candidate network entities until a network entity that matches the first network entity is determined from the candidate network entity set, and taking the network entity that matches the first network entity as the second network entity.

[0101] In some embodiments of the present application, the mapping rules include at least one of the following: regular mapping rules, number segment mapping rules, and judging whether the candidate network entity and the first network entity match according to the mapping rules between the first network entity and the second network entity includes: judging whether the candidate network entity satisfies the regular expression corresponding to the first network entity according to the regular expression recorded in the regular mapping rule, and determining that the candidate network entity and the first network entity match if the regular expression is satisfied; judging whether the number segment corresponding to the candidate network entity includes an identifier corresponding to the first network entity according to the number segment mapping relationship recorded in the number segment mapping rule, and determining that the candidate network entity and the first network entity match if the number segment corresponding to the candidate network entity includes an identifier corresponding to the first network entity.

[0102] In some embodiments of the present application, when all candidate network entities in the candidate network entity set do not match the first network entity, the method further includes: traversing and obtaining each candidate network entity in the candidate network entity set, and determining whether the candidate network entity supports processing a first message sent by any first network entity; when the determination result is that the candidate network entity supports processing a first message sent by any first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that supports processing a first message sent by any first network entity as the second network entity.

[0103] In some embodiments of the present application, the first message carries a notification information identifier, and the notification information identifier stores the address of the first network entity. After receiving the first message sent by the first network entity, the method also includes: encrypting the address of the first network entity stored in the notification information identifier; replacing sensitive fields in the first message, wherein the sensitive fields include at least one of the following: the sending port number of the first message, and the network entity identifier of the first network entity.

[0104] In some embodiments of the present application, the method also includes: receiving a third message sent by the second network entity, wherein the third message is used to notify the first network entity of billing management information; obtaining a notification information identifier carried in the third message, decrypting the address of the first network entity stored in the notification information identifier, and obtaining the address of the first network entity; and forwarding the third message to the first network entity based on the address of the first network entity.

[0105] In some embodiments of the present application, after receiving a second message sent by a second network entity, the method further includes replacing a sensitive field in the second message, wherein the sensitive field includes at least one of the following: a sending port number of the second message and a network entity identifier of the second network entity.

[0106] It should be noted that the various modules in the above-mentioned message interaction device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0107] An embodiment of the present application provides a non-volatile storage medium, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the following message interaction method: receiving a first message sent by a first network entity, modifying the source address carried in the first message from the address of the first network entity to the first proxy address of a signaling intercommunication gateway, and obtaining a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, and the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data; sending the first target message to the second network entity, receiving a second message sent by the second network entity, wherein the second message is a response message to the first target message; modifying the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling intercommunication gateway, and modifying the destination address carried in the second message from the first proxy address of the signaling intercommunication gateway to the address of the first network entity, and obtaining a second target message; and sending the second target message to the first network entity.

[0108] An embodiment of the present application provides an electronic device, comprising: a memory and a processor, the processor being used to run a program stored in the memory, wherein the following message interaction method is executed when the program is run: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling intercommunication gateway, and obtaining a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, and the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data; sending the first target message to the second network entity, receiving a second message sent by the second network entity, wherein the second message is a response message to the first target message; modifying a source address carried in the second message from the address of the second network entity to a second proxy address of the signaling intercommunication gateway, and modifying a destination address carried in the second message from the first proxy address of the signaling intercommunication gateway to the address of the first network entity, and obtaining a second target message; and sending the second target message to the first network entity.

[0109] An embodiment of the present application provides a communication system, including a signaling interworking gateway, a charging function network entity, and a session management function network entity. When the signaling interworking gateway, the charging function network entity, and the session management function network entity are executed by a processor, the following message interaction method is implemented: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of the signaling interworking gateway, and obtaining a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, and the first message is used to request a charging service from a second network entity, and the second network entity is located in a trusted area and is used to manage charging data; sending the first target message to the second network entity, receiving a second message sent by the second network entity, wherein the second message is a response message to the first target message; modifying the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling interworking gateway, and modifying the destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity, and obtaining a second target message; and sending the second target message to the first network entity.

[0110] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0112] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0113] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0114] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0115] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A message interaction method, characterized in that: include: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway, and obtaining a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data; Sending the first target message to the second network entity, and receiving a second message sent by the second network entity, wherein the second message is a response message to the first target message; Modify the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling interworking gateway, and modify the destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity, to obtain a second target message; Send the second target message to the first network entity.

2. The message interaction method according to claim 1, characterized in that: Before sending the first target message to the second network entity, the method further includes: Determine, according to the first message, the second network entity from a set of candidate network entities: Traversing and acquiring each candidate network entity in the candidate network entity set, and judging whether the candidate network entity matches the first network entity according to a mapping rule between the first network entity and the second network entity; If the result of the determination is that the candidate network entity matches the first network entity, stop traversal and use the network entity in the candidate network entity set that matches the first network entity as the second network entity; When the judgment result is that the candidate network entity and the first network entity do not match, continue to traverse the candidate network entity set to re-acquire the candidate network entity until a network entity matching the first network entity is determined from the candidate network entity set, and the network entity matching the first network entity is used as the second network entity.

3. The message interaction method according to claim 2, characterized in that: The mapping rule includes at least one of the following: a regular mapping rule and a number segment mapping rule, and judging whether the candidate network entity matches the first network entity according to the mapping rule between the first network entity and the second network entity includes: According to the regular expression recorded in the regular mapping rule, judging whether the candidate network entity satisfies the regular expression corresponding to the first network entity, and determining that the candidate network entity matches the first network entity if the regular expression is satisfied; Based on the number segment mapping relationship recorded in the number segment mapping rule, determine whether the number segment corresponding to the candidate network entity includes the identifier corresponding to the first network entity. If the number segment corresponding to the candidate network entity includes the identifier corresponding to the first network entity, determine that the candidate network entity matches the first network entity.

4. The message interaction method according to claim 2, characterized in that: In a case where all the candidate network entities in the candidate network entity set do not match the first network entity, the method further includes: Traversing and acquiring each of the candidate network entities in the candidate network entity set, and determining whether the candidate network entity supports processing the first message sent by any of the first network entities; When the judgment result is that the candidate network entity supports processing the first message sent by any of the first network entities, the traversal is stopped, and the network entity in the candidate network entity set that supports processing the first message sent by any of the first network entities is taken as the second network entity.

5. The message interaction method according to claim 1, characterized in that: The first message carries a notification information identifier, and the notification information identifier stores the first network entity address. After receiving the first message sent by the first network entity, the method further includes: encrypting the address of the first network entity stored in the notification information identifier; Replace the information stored in the sensitive field in the first message with the information of the signaling intercommunication gateway, wherein the sensitive field includes at least one of the following: the sending port number of the first message and the network entity identifier of the first network entity, and the information of the signaling intercommunication gateway includes at least one of the following: the address of the signaling intercommunication gateway and the sending port number of the signaling intercommunication gateway.

6. The message interaction method according to claim 5, characterized in that: The method further comprises: receiving a third message sent by the second network entity, wherein the third message is used to notify the first network entity of charging management information; obtaining the notification information identifier carried in the third message, decrypting the address of the first network entity stored in the notification information identifier, and obtaining the address of the first network entity; Forward the third message to the first network entity according to the address of the first network entity.

7. The message interaction method according to claim 1, characterized in that: After receiving the second message sent by the second network entity, the method also includes replacing the information stored in the sensitive field in the second message with the information of the signaling intercommunication gateway, wherein the sensitive field includes at least one of the following: the sending port number of the second message, the network entity identifier of the second network entity, and the information of the signaling intercommunication gateway includes at least one of the following: the address of the signaling intercommunication gateway, the sending port number of the signaling intercommunication gateway.

8. A message interaction device, characterized in that: include: a first interaction module, configured to receive a first message sent by a first network entity, modify a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling intercommunication gateway, and obtain a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, the first message is used to request a billing service from a second network entity, and the second network entity is located in a trusted area and is used to manage billing data; A second interaction module, configured to send the first target message to the second network entity, and receive a second message sent by the second network entity, wherein the second message is a response message to the first target message; a third interaction module, which modifies the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling intercommunication gateway, and modifies the destination address carried in the second message from the first proxy address of the signaling intercommunication gateway to the address of the first network entity, to obtain a second target message; A fourth interaction module is used to send the second target message to the first network entity.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the message interaction method described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the message interaction method described in any one of claims 1 to 7 when running.

11. A communication system, comprising a signaling interworking gateway, a charging function network entity and a session management function network entity, characterized in that: The communication system, when executed by a processor, implements the steps of the message interaction method described in any one of claims 1 to 7.

Images