Message interaction method and device, nonvolatile storage medium and communication system

Abstract

The application discloses a message interaction method and device, a nonvolatile storage medium and a communication system. The method comprises the following steps: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway to obtain a first target message; sending the first target message to a second network entity, receiving a second message sent by the second network entity; modifying a source address carried in the second message from an address of the second network entity to a second proxy address of the signaling interworking gateway, modifying a destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity to obtain a second target message; and sending the second target message to the first network entity. The application solves the technical problems of network security risks and topology information exposure caused by the direct connection between a private network entity and a core network entity.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network technology and security, in particular to a message interaction method and device, a nonvolatile storage medium and a communication system. BACKGROUND

[0002] With the deep development of 5G (5th Generation Mobile Communication Technology) networks, the needs of industry customers are becoming more diverse. Most users in the private network field need to customize access to core network element services to interact with the core network for more information. However, 5G customized network elements deployed in the operation room of the operator have operation permissions, which belong to network elements in the untrusted area. When the private network element is attacked, the core network element directly accessed by the network element has a security risk, thereby affecting the normal operation of other network services.

[0003] At present, there is no effective solution to the above problems. SUMMARY

[0004] The embodiments of the present application provide a message interaction method and device, a nonvolatile storage medium and a communication system to at least solve the technical problems of network security risks and topology information exposure caused by direct connection between private network entities and core network entities.

[0005] According to an aspect of an embodiment of the present application, a message interaction method is provided, comprising: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway to obtain a first target message, wherein the first network entity is located in an untrusted area and is used to manage user sessions, the first message is used to request charging services from a second network entity, and the second network entity is located in a trusted area and is used to manage charging data; sending the first target message to the second network entity, receiving a second message sent by the second network entity, wherein the second message is a response message of the first target message; modifying a source address carried in the second message from an address of the second network entity to a second proxy address of the signaling interworking gateway, modifying a destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity to obtain a second target message; and sending the second target message to the first network entity.

[0006] Optionally, before sending the first target message to the second network entity, the method further comprises: determining the second network entity from the candidate network entity set according to the first message; traversing each candidate network entity in the candidate network entity set, and determining whether the candidate network entity matches the first network entity according to the mapping rule between the first network entity and the second network entity; in the case that the candidate network entity matches the first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that matches the first network entity as the second network entity; in the case that the candidate network entity does not match the first network entity, continuing to traverse the candidate network entity set to reacquire the candidate network entity until a network entity that matches the first network entity is determined from the candidate network entity set, and taking the network entity that matches the first network entity as the second network entity.

[0007] Optionally, the mapping rule comprises at least one of the following: a regular mapping rule, a number segment mapping rule, and determining whether the candidate network entity matches the first network entity according to the mapping rule between the first network entity and the second network entity comprises: determining whether the candidate network entity satisfies a regular expression corresponding to the first network entity according to a regular expression recorded in the regular mapping rule, and determining that the candidate network entity matches the first network entity in the case that the candidate network entity satisfies the regular expression; and determining whether an identifier corresponding to the first network entity is included in a number segment corresponding to the candidate network entity according to a number segment mapping relationship recorded in the number segment mapping rule, and determining that the candidate network entity matches the first network entity in the case that the identifier corresponding to the first network entity is included in the number segment corresponding to the candidate network entity.

[0008] Optionally, in the case that all candidate network entities in the candidate network entity set do not match the first network entity, the method further comprises: traversing each candidate network entity in the candidate network entity set, and determining whether the candidate network entity supports processing the first message sent by any first network entity; and in the case that the candidate network entity supports processing the first message sent by any first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that supports processing the first message sent by any first network entity as the second network entity.

[0009] Optionally, the first message carries a notification information identifier, and the notification information identifier stores the address of the first network entity; after receiving the first message sent by the first network entity, the method further comprises: encrypting the address of the first network entity stored in the notification information identifier; and replacing a sensitive field in the first message, wherein the sensitive field comprises at least one of the following: a sending port number of the first message, and a network entity identifier of the first network entity.

[0010] Optionally, the method further comprises: receiving a third packet sent by the second network entity, wherein the third packet is used to notify the first network entity of the charging management information; obtaining a notification information identifier carried in the third packet, decrypting an address of the first network entity stored in the notification information identifier, and obtaining the address of the first network entity; and forwarding the third packet to the first network entity according to the address of the first network entity.

[0011] Optionally, after receiving the second packet sent by the second network entity, the method further comprises: replacing a sensitive field in the second packet, wherein the sensitive field comprises at least one of the following: a sending port number of the second packet, and a network entity identifier of the second network entity.

[0012] According to another aspect of the embodiments of the present application, a packet interaction apparatus is further provided, which comprises: a first interaction module, configured to receive a first packet sent by a first network entity, modify a source address carried in the first packet from an address of the first network entity to a first proxy address of a signaling interworking gateway, and obtain a first target packet, wherein the first network entity is located in an untrusted area, is used to manage a user session, and the first packet is used to request a charging service from a second network entity; a second interaction module, configured to send the first target packet to the second network entity, and receive a second packet sent by the second network entity, wherein the second packet is a response packet of the first target packet; a third interaction module, configured to modify a source address carried in the second packet from an address of the second network entity to a second proxy address of the signaling interworking gateway, and modify a destination address carried in the second packet from the first proxy address of the signaling interworking gateway to the address of the first network entity, and obtain a second target packet; and a fourth interaction module, configured to send the second target packet to the first network entity.

[0013] According to another aspect of the embodiments of the present application, a nonvolatile storage medium is further provided, which stores a program, wherein the program, when running, controls a device where the nonvolatile storage medium is located to perform a packet interaction method.

[0014] According to another aspect of the embodiments of the present application, an electronic device is further provided, which comprises a memory and a processor, and the processor is used to run a program stored in the memory, wherein the program, when running, performs a packet interaction method.

[0015] According to another aspect of the embodiments of the present application, a communication system is further provided, which comprises a signaling interworking gateway, a charging function network entity, and a session management function network entity, and the signaling interworking gateway, the charging function network entity, and the session management function network entity, when executed by a processor, implement a packet interaction method.

[0016] In the embodiment of the present application, the first message sent by the first network entity is received, the source address carried in the first message is modified from the address of the first network entity to the first proxy address of the signaling interworking gateway to obtain a first target message, wherein the first network entity is located in an untrusted area and is used for managing a user session, the first message is used for requesting a charging service from a second network entity, the second network entity is located in a trusted area and is used for managing charging data; the first target message is sent to the second network entity, and a second message sent by the second network entity is received, wherein the second message is a response message of the first target message; the source address carried in the second message is modified from the address of the second network entity to the second proxy address of the signaling interworking gateway, and the destination address carried in the second message is modified from the first proxy address of the signaling interworking gateway to the address of the first network entity to obtain a second target message; and the second target message is sent to the first network entity, so that the signaling interworking gateway is arranged between the charging function network entity and the session management function network entity to forward data, the purpose of security isolation and hiding of a core network topology is achieved, the technical effect of enhancing network security and protecting a communication system from attacks is achieved, and the technical problems of network security risks and exposure of topology information caused by direct connection of a private network entity and a core network entity are solved. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are included to provide a further understanding of the present application and are incorporated in and constitute a part of this application, illustrate embodiments of the present application and serve to explain the present application. In the drawings:

[0018] Figure 1 FIG. 1 is a structural schematic diagram of a communication system according to an embodiment of the present application;

[0019] Figure 2 FIG. 2 is a schematic diagram of a configuration relationship between various network elements according to an embodiment of the present application;

[0020] Figure 3 FIG. 3 is a structural schematic diagram of a computer terminal (mobile device) according to an embodiment of the present application;

[0021] Figure 4 FIG. 4 is a flow schematic diagram of a message interaction method according to an embodiment of the present application;

[0022] Figure 5 FIG. 5 is a schematic diagram of a specific flow of interaction according to an embodiment of the present application;

[0023] Figure 6 FIG. 6 is a schematic diagram of a CHF network element matching process according to an embodiment of the present application;

[0024] Figure 7is a third message interaction process schematic diagram provided according to an embodiment of the application;

[0025] Figure 8 is a structural schematic diagram of a message interaction device provided according to an embodiment of the application. DETAILED DESCRIPTION

[0026] In order for those skilled in the art to better understand the scheme of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0029] C-IWF (Customized-InterWorking Function, signaling interworking gateway): a network element device that solves the multi-point interworking and data security between the operator network and the enterprise park private network. The network element belongs to the network element in the 5G public network, and belongs to the trusted domain for the operator, realizing one-point access of the private network customer customized device.

[0030] 5GC (5G Core, 5G core network): composed of multiple network functions (NF), each function is responsible for a specific task and function.

[0031] CHF (Charging Function, charging function): a large network core network element device, is a key function body of 5G converged charging, supports online charging, offline charging and converged charging three scenarios. Collect charging data from SMF, generate charging bill, complete quota management.

[0032] SMF (Session Management Function, session management function): a sink private network element device, mainly responsible for user session management. In the charging system, it is responsible for charging data collection and connection to the charging center.

[0033] N40 (5GC charging related interface): a service interface between SMF and CHF, used for charging message interaction and charging function implementation.

[0034] DMZ (Demilitarized Zone, demilitarized zone): a buffer zone between a non-secure system and a secure system.

[0035] In the charging business scenario, the private network SMF network element is located in the untrusted domain, and submits charging data information to the core network CHF network element through the N40 interface. The direct connection link between the private network SMF network element and the core network CHF network element directly exposes the network environment of the core network. Moreover, all messages of the charging system are online message interaction, and the operators need to perform roaming settlement between provinces and the number of charging system manufacturers is large. Therefore, the direct exposure of the core network CHF network element will bring great security risks to the charging system.

[0036] In order to solve the above problems, the related solutions are provided in the embodiments of the present application, which are described in detail below.

[0037] According to the embodiments of the present application, a system embodiment of a communication system is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] The communication system provided by the embodiments of the present application is shown in Figure 1 As shown, the communication system includes an SMF network element of a government-enterprise private network, a core network CHF network element, and a signaling interworking gateway C-IWF network element. The functions and connection relationships of the devices are as follows:

[0039] 1. SMF network element: located in the untrusted area, responsible for PDU session management, charging data collection and connection to the charging center.

[0040] 2. C-IWF network element: located in the DMZ area, responsible for signaling proxy forwarding and isolation.

[0041] 3. CHF network element: located in the trusted area, responsible for collecting charging data, generating charging tickets, and completing quota management.

[0042] 4. SMF and C-IWF interact charging data through N40 interface carrying charging signaling.

[0043] 5. C-IWF and CHF carry billing signaling through the N40 interface to transmit billing data to the billing system.

[0044] The configuration relationship between each network element in the communication system is as follows: Figure 2 As shown, one private network N40 agent and one large network N40 agent can be configured on the signaling interconnection gateway. The private network N40 agent connects to multiple edge private network SMFs, and the large network N40 agent can connect to multiple core network CHFs.

[0045] According to an embodiment of the present application, a method embodiment of a message interaction method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0046] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 3 FIG1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a data storage method. Figure 3 As shown, the computer terminal 30 (or mobile device 30) may include one or more (illustrated as 302a, 302b, ..., 302n in the figure) processors 302 (the processor 302 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 304 for storing data, and a transmission device 306 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 3 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 3 More or fewer components than shown, or with Figure 3 Different configurations shown.

[0047] It should be noted that the one or more processors 302 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 30 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0048] The memory 304 can be used to store software programs of application software and modules, such as program instructions / data storage apparatus corresponding to the data storage method in the embodiments of the present application. The processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 304, that is, implements the vulnerability detection method of the application program described above. The memory 304 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 304 can further include a memory remotely arranged with respect to the processor 302, which can be connected to the computer terminal 30 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0049] The transmission device 306 is used to receive or send data via a network. The specific examples of the above-mentioned network can include a wireless network provided by a communication provider of the computer terminal 30. In one example, the transmission device 306 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 306 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.

[0050] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable a user to interact with the user interface of the computer terminal 30 (or mobile device).

[0051] Under the above operating environment, the embodiments of the present application provide a message interaction method, as shown in Figure 4 The method includes the following steps:

[0052] In step S402, a first message sent by a first network entity is received, and a source address carried in the first message is modified from an address of the first network entity to a first proxy address of a signaling interworking gateway, to obtain a first target message, wherein the first network entity is located in an untrusted area and is used to manage a user session, the first message is used to request a charging service from a second network entity, the second network entity is located in a trusted area and is used to manage charging data;

[0053] Optionally, the untrusted area refers to an area with lower security or unknown security in the network, usually including external networks, Internet access points, user terminal devices (such as mobile phones, IoT devices), and enterprise private networks adjacent to the operator network boundary, etc. These areas may be vulnerable to attacks, unauthorized access or data leakage, and therefore, additional security measures such as data encryption, identity verification and access control, etc. are required when communicating with the untrusted area. In the 5G network, edge networks or enterprise private networks, etc. are often considered as untrusted areas. Network entities in these areas (such as private network SMF) may need to communicate with the operator core network, but their location or security status may be unstable, thus posing a potential security threat.

[0054] Optionally, the trusted area refers to an area with higher security in the network, usually including the operator core network, data center, internal management network, etc. Network entities and resources in these areas are considered to be fully protected and can normally process data and communicate without additional security verification. Network function entities (such as CHF) in the trusted area can interact with other trusted entities without excessive concern about data security or network attacks. In the 5G network, the core network part of the operator, including CHF, etc. is usually located in the trusted area. These core network functions have high security and stability when designed, and can effectively manage and protect the communication within the network.

[0055] Optionally, before receiving the first message sent by the first network entity, the signaling interworking gateway is further configured with network information of the core network CHF (i.e. the first network entity) and the private network SMF (i.e. the second network entity), such as their IP address information: in the configuration file or database of C-IWF, an entry is established for each CHF and SMF network element communicating with it, recording their respective network address information, so that C-IWF can identify and communicate with these network elements. Through the above processing process, it can be ensured that C-IWF knows how to communicate with CHF and SMF, which is the basis for realizing the proxy forwarding of messages.

[0056] Optionally, before receiving the first message sent by the first network entity, the signaling interworking gateway is further configured with a mapping relationship between the core network CHF and the private network SMF, for example, user number segment information establishes a logical association between the CHF and the SMF, so that the C-IWF can determine which specific CHF network element to forward the message to according to the user information or service type and other characteristics carried in the message. For example, different user number segments (which can be prefixes of telephone numbers or specific IMSI number segments) correspond to different service levels or charging policies, so the C-IWF needs to be configured with rules to forward the message to a specific CHF that processes the charging request of the user number segment when receiving a request sent by the SMF within a certain user number segment. This mapping relationship includes regular expression matching, number range matching and other technologies to ensure that the message can be accurately routed to the correct destination according to network policies and user characteristics.

[0057] In the technical solution provided in step S402, the first message carries a notification information identifier, and the notification information identifier stores the address of the first network entity. After receiving the first message sent by the first network entity, the method further includes: encrypting the address of the first network entity stored in the notification information identifier; and replacing a sensitive field in the first message, wherein the sensitive field includes at least one of the following: a sending port number of the first message, a network entity identifier of the first network entity.

[0058] Optionally, after receiving the first message sent by the first network entity, the C-IWF parses the first message and identifies the sensitive fields (such as the sending port number and the network entity identifier) therein. The C-IWF replaces the original information stored in the sensitive fields in the first message with the information of the C-IWF (usually the IP address and port number of the C-IWF), that is, fills the IP address of the C-IWF into the network entity identifier field of the first message and fills the port number of the C-IWF into the sending port number field of the first message.

[0059] Step S404, sending the first target message to the second network entity and receiving a second message sent by the second network entity, wherein the second message is a response message of the first target message;

[0060] Optionally, Figure 5 A specific flow of interaction is shown as follows: Figure 5 As shown in the figure, the message interaction includes the following flow:

[0061] 1. Configure the network information of the core network CHF and the private network SMF, such as IP information, on the C-IWF network element.

[0062] 2. Configure the mapping relationship between the core network CHF and the private network SMF, such as user number segment information, on the C-IWF network element.

[0063] 3. SMF sends N40 message to C-IWF's private network N40 agent through HTTP / 2 protocol.

[0064] 4. C-IWF acquires the message, hides the private network SMF related information and modifies the source address to the public network agent address.

[0065] 5. The modified message is forwarded to CHF through the public network N40 agent.

[0066] 6. CHF replies to the response message to the public network N40 agent of C-IWF.

[0067] 7. C-IWF acquires the message, replaces the source address to the private network agent address and the destination address to the SMF address, and forwards the message to SMF.

[0068] 8. SMF receives the N40 response message delivered through HTTP / 2 protocol.

[0069] In the technical solution provided in step S404, before the first target message is sent to the second network entity, the method further includes: determining the second network entity from the candidate network entity set according to the first message: traversing each candidate network entity in the candidate network entity set, judging whether the candidate network entity and the first network entity match according to the mapping rule between the first network entity and the second network entity; in the case that the judgment result is that the candidate network entity and the first network entity match, stopping the traversal, and taking the network entity in the candidate network entity set that matches the first network entity as the second network entity; in the case that the judgment result is that the candidate network entity and the first network entity do not match, continuing to traverse the candidate network entity set to reacquire the candidate network entity, until the network entity that matches the first network entity is determined from the candidate network entity set, and taking the network entity that matches the first network entity as the second network entity.

[0070] Optionally, the first message includes a Create service message, an Update service message and a Release service message. The Create message is used to initialize a charging session. When a user equipment connects to a network and initiates a service, the SMF informs the CHF of user information and expected services through the Create message, and the CHF starts a charging process accordingly. The Update message is responsible for updating charging parameters of the CHF in real time when the SMF detects a change in charging conditions during a session, such as an increase in user data usage or a change in service type, to ensure the accuracy and dynamics of charging. The Release message is used to instruct the CHF to stop charging through the Release message when the session ends or charging is no longer needed, to complete the charging period.

[0071] Specifically, the charging parameter is used to describe the charging condition during the user session, including but not limited to: user data usage: the amount of data consumed by the user in the session, used to calculate the traffic fee; service type: the network service type currently accessed by the user, different service types correspond to different charging strategies; charging timestamp: records the time point of changing the charging parameter, ensures the accuracy of charging; charging features: such as data rate, traffic type (uplink / downlink), etc., these features determine the detailed rules of charging.

[0072] Figure 6 A matching process of a CHF network element (i.e., a second network entity) is shown, as Figure 6 shown, the flow includes the following steps:

[0073] 1. After receiving the Create, Update, and Release service operations triggered by the SMF, the C-IWF obtains all CHF network element information and performs CHF matching in combination with the received request message.

[0074] 2. Whether the traversal of all CHF information is completed. If not, go to step 3; if yes, go to step 6.

[0075] 3. Match the CHF according to the Patten information in the configured mapping relationship. If the matching fails, go to step 4; if the matching succeeds, go to step 5.

[0076] 4. Match the CHF according to the Start / End information in the configured mapping relationship. If the matching fails, go to step 2; if the matching succeeds, go to step 5.

[0077] 5. The CHF matching succeeds, and the message routing succeeds.

[0078] 6. The first round of traversal fails, and no matching CHF network element is found to process the N40 message.

[0079] 7. Attempt the second round of traversal, whether the traversal of all CHF information is completed. If not, go to step 8; if yes, go to step 9.

[0080] 8. Determine whether there is a CHF network element that supports processing all Create, Update, and Release service operations; if yes, go to step 5; if no, go to step 7.

[0081] 9. The CHF matching fails, and the message routing fails.

[0082] In the technical solution provided in step S404, the mapping rule includes at least one of the following: a regular mapping rule, a number segment mapping rule, and determining whether the candidate network entity and the first network entity match according to the mapping rule between the first network entity and the second network entity includes: determining whether the candidate network entity satisfies the regular expression corresponding to the first network entity according to the regular expression recorded in the regular mapping rule, and determining that the candidate network entity and the first network entity match in the case of satisfying the regular expression; determining whether the identifier corresponding to the first network entity is included in the number segment corresponding to the candidate network entity according to the number segment mapping relationship recorded in the number segment mapping rule, and determining that the candidate network entity and the first network entity match in the case of including the identifier corresponding to the first network entity in the number segment corresponding to the candidate network entity.

[0083] Optionally, according to the Patten information in the configured mapping relationship, the CHF is matched, when the C-IWF receives the service request sent by the SMF, the user identifier (such as IMSI or telephone number) information in the request is checked, and the information is compared with the Patten information in the mapping relationship. The Patten here configures a regular expression for matching a specific user identifier mode. For example, if the "Patten" field is configured to match all users whose IMSI number segment starts from M, the C-IWF will match the received IMSI with the regular expression. If the matching is successful, the C-IWF will determine that the request should be processed by the CHF mapped with the number segment. In this way, the C-IWF can dynamically select the most suitable CHF according to the attributes of the user identifier, not only enhancing the flexibility and accuracy of message routing, but also ensuring the security and efficiency of the network, so that the 5G core network can better adapt to the changing business needs and security environment.

[0084] Optionally, according to the matching of the Start / End information in the configured mapping relationship, after receiving the request message sent by the session management function (SMF), the C-IWF parses the user identification information carried in the message, such as the IMSI (international mobile subscriber identity) or the telephone number segment. Then, the C-IWF compares the identification information with the preset Start / End configuration, which defines different user number segment ranges managed by different CHFs. For example, if the configuration indicates that the users with IMSI number segments from 46000 to 46099 should be processed by CHF-A, and the users with IMSI number segments from 46100 to 46199 should be processed by CHF-B, then the C-IWF checks the user IMSI in each request to determine whether it falls within the above number segment range, and then decides whether to forward the request to CHF-A or CHF-B. Through this matching mechanism based on the number segment configuration, the C-IWF can effectively realize the intelligent distribution of the message, ensure that each user request can be correctly processed by the CHF, and at the same time, hide the direct network location of the CHF, thereby improving the overall security of the system and the management flexibility of the operator network.

[0085] In the technical solution provided in step S404, in the case that all candidate network entities in the candidate network entity set do not match the first network entity, the method further comprises: traversing each candidate network entity in the candidate network entity set, judging whether the candidate network entity supports processing the first message sent by any first network entity; in the case that the judgment result is that the candidate network entity supports processing the first message sent by any first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that supports processing the first message sent by any first network entity as the second network entity.

[0086] Step S406, modifying the source address carried in the second message from the address of the second network entity to the second proxy address of the signaling interworking gateway, modifying the destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity, to obtain a second target message;

[0087] Step S408, sending the second target message to the first network entity.

[0088] Optionally, the first message carries a notification information identifier, and the notification information identifier stores the address of the first network entity. After receiving the first message sent by the first network entity, the method further comprises: encrypting the address of the first network entity stored in the notification information identifier; and replacing the sensitive field in the first message, wherein the sensitive field includes at least one of the following: the sending port number of the first message, and the network entity identifier of the first network entity.

[0089] Optionally, the method further comprises receiving a third message sent by the second network entity, wherein the third message is used to notify the first network entity of the charging management information; obtaining a notification information identifier carried in the third message, decrypting an address of the first network entity stored in the notification information identifier, and obtaining the address of the first network entity; and forwarding the third message to the first network entity according to the address of the first network entity.

[0090] Specifically, Figure 7 An interaction flow of a third message is shown, the third message including a Notify message route, and being used to send an N40 message to a specified SMF to notify and change charging management information according to NotifyUri information provided by the SMF when a Create service is performed, as shown in Figure 7 The flow includes the following steps:

[0091] 1. After receiving a Create or Update service operation triggered by an SMF, the C-IWF obtains NotifyURI information.

[0092] 2. The SMF address information of the NotifyURI in the current message is hidden using an encryption method.

[0093] 3. The C-IWF receives a Notify service operation triggered by a CHF.

[0094] 4. The Notify service request URI is decrypted to obtain address information of a destination SMF.

[0095] Optionally, after receiving the second message sent by the second network entity, the method further comprises replacing a sensitive field in the second message, wherein the sensitive field includes at least one of the following: a sending port number of the second message and a network entity identifier of the second network entity.

[0096] Through the above steps, a signaling interworking gateway C-IWF can be introduced between a sunk SMF and a large network CHF, N40 messages between the SMF and the CHF are proxy forwarded, the large network is ensured to be invisible to the special network, address information of the CHF of the large network is hidden, a security isolation problem of the core network and the special network SMF is solved, a network topology is simplified, deployment difficulty is reduced, a function of the signaling interworking gateway is enhanced, and an operator core network does not need to be customized and developed, thereby adapting to development requirements of a 5G special network of the operator. Specifically, the embodiments of the present application have the following advantages:

[0097] Advantage 1: With the development of 5G technology, the charging system architecture is also evolving, in order to be able to support 5G charging technology more quickly, part of the 4G charging network element still plays a role in the 5G charging architecture. The N40 proxy method provided in the application is not limited to the type of core network element connected by the SMF when transferring N40 messages, including but not limited to CHF network elements, and is more adaptable to changing customized environments.

[0098] Advantage 2: By introducing a C-IWF network element into the existing charging system to solve the security isolation problem of private networks and large networks, and based on C-IWF, an N40 message proxy forwarding method is introduced to hide the topology of the large network CHF, further improving the security of the system, avoiding the problem of signaling impact caused by core network element exposure, and abnormal message attacks.

[0099] The embodiment of the application provides a message interaction device, Figure 8 is a structural schematic diagram of the device, as Figure 8 shown, the device comprises: a first interaction module 80, configured to receive a first message sent by a first network entity, modify a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway, and obtain a first target message, wherein the first network entity is located in an untrusted area and is used for managing a user session, the first message is used for requesting a charging service from a second network entity, and the second network entity is located in a trusted area and is used for managing charging data; a second interaction module 82, configured to send the first target message to the second network entity and receive a second message sent by the second network entity, wherein the second message is a response message of the first target message; a third interaction module 84, configured to modify a source address carried in the second message from an address of the second network entity to a second proxy address of the signaling interworking gateway, and modify a destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity, and obtain a second target message; and a fourth interaction module 86, configured to send the second target message to the first network entity.

[0100] In some embodiments of the present application, before sending the first target message to the second network entity, the method further comprises: determining the second network entity from the candidate network entity set according to the first message: traversing each candidate network entity in the candidate network entity set, and determining whether the candidate network entity matches the first network entity according to the mapping rule between the first network entity and the second network entity; in the case that the result of the determination is that the candidate network entity matches the first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that matches the first network entity as the second network entity; in the case that the result of the determination is that the candidate network entity does not match the first network entity, continuing to traverse the candidate network entity set to reacquire the candidate network entity until a network entity that matches the first network entity is determined from the candidate network entity set, and taking the network entity that matches the first network entity as the second network entity.

[0101] In some embodiments of the present application, the mapping rule comprises at least one of the following: a regular mapping rule, a number segment mapping rule, and determining whether the candidate network entity matches the first network entity according to the mapping rule between the first network entity and the second network entity comprises: determining whether the candidate network entity satisfies the regular expression corresponding to the first network entity according to the regular expression recorded in the regular mapping rule, and determining that the candidate network entity matches the first network entity in the case that the candidate network entity satisfies the regular expression; and determining whether the identifier corresponding to the first network entity is included in the number segment corresponding to the candidate network entity according to the number segment mapping relationship recorded in the number segment mapping rule, and determining that the candidate network entity matches the first network entity in the case that the identifier corresponding to the first network entity is included in the number segment corresponding to the candidate network entity.

[0102] In some embodiments of the present application, in the case that all candidate network entities in the candidate network entity set do not match the first network entity, the method further comprises: traversing each candidate network entity in the candidate network entity set, and determining whether the candidate network entity supports processing the first message sent by any first network entity; and in the case that the result of the determination is that the candidate network entity supports processing the first message sent by any first network entity, stopping the traversal, and taking the network entity in the candidate network entity set that supports processing the first message sent by any first network entity as the second network entity.

[0103] In some embodiments of the present application, the first message carries a notification information identifier, and the notification information identifier stores the address of the first network entity; after receiving the first message sent by the first network entity, the method further comprises: encrypting the address of the first network entity stored in the notification information identifier; and replacing the sensitive field in the first message, wherein the sensitive field comprises at least one of the following: the sending port number of the first message, and the network entity identifier of the first network entity.

[0104] In some embodiments of the present application, the method further comprises: receiving a third message sent by the second network entity, wherein the third message is used to inform the first network entity of the charging management information; obtaining a notification information identifier carried in the third message, decrypting an address of the first network entity stored in the notification information identifier, and obtaining the address of the first network entity; and forwarding the third message to the first network entity according to the address of the first network entity.

[0105] In some embodiments of the present application, after receiving the second message sent by the second network entity, the method further comprises: replacing a sensitive field in the second message, wherein the sensitive field comprises at least one of the following: a sending port number of the second message, and a network entity identifier of the second network entity.

[0106] It should be noted that each module in the message interaction apparatus described above can be a program module (for example, a program instruction set for implementing a certain specific function) or a hardware module. For the latter, it can be in the following form, but is not limited to this: the form of each module described above is a processor, or the functions of each module described above are implemented by a processor.

[0107] The embodiments of the present application provide a non-volatile storage medium, and the non-volatile storage medium stores a program, wherein when the program is running, the non-volatile storage medium controls a device in which the non-volatile storage medium is located to perform the following message interaction method: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway, to obtain a first target message, wherein the first network entity is located in an untrusted area and is used to manage a user session, the first message is used to request a charging service from a second network entity, the second network entity is located in a trusted area and is used to manage charging data; sending the first target message to the second network entity, receiving a second message sent by the second network entity, wherein the second message is a response message of the first target message; modifying a source address carried in the second message from an address of the second network entity to a second proxy address of the signaling interworking gateway, and modifying a destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity, to obtain a second target message; and sending the second target message to the first network entity.

[0108] An electronic device is provided in an embodiment of the present application, comprising a memory and a processor, the processor being configured to run a program stored in the memory, wherein the program performs the following message interaction method when running: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway to obtain a first target message, wherein the first network entity is located in an untrusted area and is configured to manage a user session, the first message is configured to request a charging service from a second network entity, and the second network entity is located in a trusted area and is configured to manage charging data; sending the first target message to the second network entity, receiving a second message sent by the second network entity, wherein the second message is a response message of the first target message; modifying a source address carried in the second message from an address of the second network entity to a second proxy address of the signaling interworking gateway, and modifying a destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity to obtain a second target message; and sending the second target message to the first network entity.

[0109] A communication system is provided in an embodiment of the present application, comprising a signaling interworking gateway, a charging function network entity, and a session management function network entity, the signaling interworking gateway, the charging function network entity, and the session management function network entity implement the following message interaction method when executed by a processor: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway to obtain a first target message, wherein the first network entity is located in an untrusted area and is configured to manage a user session, the first message is configured to request a charging service from a second network entity, and the second network entity is located in a trusted area and is configured to manage charging data; sending the first target message to the second network entity, receiving a second message sent by the second network entity, wherein the second message is a response message of the first target message; modifying a source address carried in the second message from an address of the second network entity to a second proxy address of the signaling interworking gateway, and modifying a destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity to obtain a second target message; and sending the second target message to the first network entity.

[0110] In the above-described embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0111] In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other means. Among them, the above-mentioned device embodiments are only schematic, for example, the division of the units can be a logical function division, and actual implementation can have another division mode, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between units or modules, which can be electrical or other forms.

[0112] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0113] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0114] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the related art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and various program codes that can be stored in the medium.

[0115] The above is only the preferred embodiment of the present application, and it should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A message interaction method, characterized by, The method comprises the following steps: receiving a first message sent by a first network entity, modifying a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway, and obtaining a first target message, wherein the first message carries a notification information identifier, the notification information identifier stores the address of the first network entity, the first network entity is located in an untrusted area and is used for managing a user session, the first message is used for requesting a charging service from a second network entity, and the second network entity is located in a trusted area and is used for managing charging data; encrypting the address of the first network entity stored in the notification information identifier, and replacing information stored in a sensitive field in the first message with information of the signaling interworking gateway, wherein the sensitive field comprises at least one of a sending port number of the first message and a network entity identifier of the first network entity, and the information of the signaling interworking gateway comprises at least one of an address of the signaling interworking gateway and a sending port number of the signaling interworking gateway; sending the first target message to the second network entity, and receiving a second message sent by the second network entity, wherein the second message is a response message of the first target message; replacing information stored in a sensitive field in the second message with information of the signaling interworking gateway, wherein the sensitive field comprises at least one of a sending port number of the second message and a network entity identifier of the second network entity, and the information of the signaling interworking gateway comprises at least one of an address of the signaling interworking gateway and a sending port number of the signaling interworking gateway; modifying a source address carried in the second message from an address of the second network entity to a second proxy address of the signaling interworking gateway, and modifying a destination address carried in the second message from the first proxy address of the signaling interworking gateway to the address of the first network entity, to obtain a second target message; sending the second target message to the first network entity.

2. The message interaction method of claim 1, wherein, Before the first target message is sent to the second network entity, the method further comprises the following steps: determining the second network entity from a candidate network entity set according to the first message: iterating each candidate network entity in the candidate network entity set, and determining whether the candidate network entity and the first network entity match according to a mapping rule between the first network entity and the second network entity; in a case where the determination result is that the candidate network entity and the first network entity match, stopping iteration, and taking a network entity in the candidate network entity set that matches the first network entity as the second network entity; in a case where the determination result is that the candidate network entity and the first network entity do not match, continuing to iterate the candidate network entity set to reacquire the candidate network entity, until a network entity that matches the first network entity is determined from the candidate network entity set, and taking the network entity that matches the first network entity as the second network entity.

3. The message interaction method of claim 2, wherein, The mapping rule comprises at least one of the following: a regular mapping rule, a number segment mapping rule, and determining whether the candidate network entity and the first network entity match comprises: According to the regular expression recorded in the regular mapping rule, it is determined whether the candidate network entity satisfies the regular expression corresponding to the first network entity. In the case of satisfying the regular expression, it is determined that the candidate network entity and the first network entity match. According to the number segment mapping relationship recorded in the number segment mapping rule, it is determined whether the identifier corresponding to the first network entity is included in the number segment corresponding to the candidate network entity. In the case that the identifier corresponding to the first network entity is included in the number segment corresponding to the candidate network entity, it is determined that the candidate network entity and the first network entity match.

4. The message interaction method of claim 2, wherein, In the case that all the candidate network entities in the candidate network entity set do not match the first network entity, the method further comprises: Traverse each candidate network entity in the candidate network entity set, and determine whether the candidate network entity supports processing the first message sent by any first network entity; In the case that the result of the determination is that the candidate network entity supports processing the first message sent by any first network entity, stop traversing, and take the network entity in the candidate network entity set that supports processing the first message sent by any first network entity as the second network entity.

5. The message interaction method of claim 1, wherein, The method further comprises: Receiving a third message sent by the second network entity, wherein the third message is used to notify the first network entity of charging management information; Obtaining the notification information identifier carried in the third message, decrypting the address of the first network entity stored in the notification information identifier, and obtaining the address of the first network entity; According to the address of the first network entity, forwarding the third message to the first network entity.

6. A message interaction apparatus, characterized by Comprise: A first interaction module is configured to receive a first message sent by a first network entity, modify a source address carried in the first message from an address of the first network entity to a first proxy address of a signaling interworking gateway, and obtain a first target message, wherein the first message carries a notification information identifier, the notification information identifier stores the address of the first network entity, the first network entity is located in an untrusted area and is used to manage user sessions, the first message is used to request charging services from a second network entity, and the second network entity is located in a trusted area and is used to manage charging data. Encrypt the address of the first network entity stored in the notification information identifier, and replace information stored in a sensitive field in the first message with information of the signaling interworking gateway, wherein the sensitive field comprises at least one of the following: a sending port number of the first message, a network entity identifier of the first network entity, and the information of the signaling interworking gateway comprises at least one of the following: an address of the signaling interworking gateway and a sending port number of the signaling interworking gateway. The second interaction module is configured to send the first target message to the second network entity and receive a second message sent by the second network entity, wherein the second message is a response message of the first target message. The information stored in the sensitive field in the second message is replaced by information of the signaling interworking gateway, wherein the sensitive field includes at least one of a sending port number of the second message and a network entity identifier of the second network entity, and the information of the signaling interworking gateway includes at least one of an address of the signaling interworking gateway and a sending port number of the signaling interworking gateway. The third interaction module is configured to modify a source address carried in the second message from an address of the second network entity to a second proxy address of the signaling interworking gateway, and modify a destination address carried in the second message from a first proxy address of the signaling interworking gateway to an address of the first network entity, to obtain a second target message. The fourth interaction module is configured to send the second target message to the first network entity.

7. A non-volatile storage medium, characterized by The non-volatile storage medium stores a program, and when the program runs, controls a device in which the non-volatile storage medium is arranged to perform the message interaction method in any one of claims 1 to 5.

8. An electronic device, comprising: The program is run by the processor. The communication system is executed by the processor to implement the steps of the message interaction method in any one of claims 1 to 5.

9. A communication system comprising a signaling interworking gateway, a charging function network entity and a session management function network entity, characterized in that, The communication system is executed by the processor to implement the steps of the message interaction method in any one of claims 1 to 5.

Images