Anti-positioning method for mobile communication network and satellite internet

Abstract

According to the mobile communication network and satellite internet anti-positioning method provided by the invention, on the premise of not changing the 3GPP standard protocol and flow and meeting the anti-positioning capability requirements of the mobile communication network and the satellite internet, an internal interface is converted into an equal external interface, and standard network management interfaces such as account opening, account cancellation and one-machine multi-number are directly multiplexed to realize IMSI / SUPI (International Mobile Subscriber Identity); according to the method, the dynamic replacement of the MSISDN / GPSI in a core network is realized, and the cloud negotiation of IMSI / SUPI and MSISDN / GPSI update control between a UDM / HSS network element and a terminal is realized by enhancing the ARPF / AuC logic function in the UDM / HSS, so that the customized support of the UDM / HSS network element for the anti-positioning function is realized at extremely low cost, and the landing implementation of high-security applications of a mobile communication network and a satellite internet can be better promoted.

Description

Technical Field

[0001] The present invention belongs to the field of communications, and specifically relates to a mobile communication network and satellite Internet anti-positioning mechanism, and in particular to a UDM / HSS ultra-light customization method and device for achieving the anti-positioning effect of the mobile communication network and satellite Internet. Background Art

[0002] With the vigorous development of mobile communication network technology, the technical system of satellite Internet is becoming clearer. At present, it basically refers to 5G (5th Generation Mobile Communication Technology, referred to as 5G). The two have many similarities in system architecture and protocol. At the same time, in the future 6G (6th Generation Mobile Communication Technology, referred to as 6G) era, the two will gradually merge. Since mobile communication network and satellite Internet will become the largest wide-area Internet infrastructure, there will be more and more strong industry application demand in the future, especially in many key industries with high security application requirements. However, due to the wide distribution of users, in order to facilitate the addressing and routing problems of mobile communication network and satellite Internet themselves, many network elements will maintain and manage identity and location identifiers at the same time, which makes it convenient for attackers to track and locate specific users.

[0003] The identity identifiers of mobile communication network and satellite Internet include GPSI (Generic Public Subscription Identifier) / MSISDN (Mobile Subscriber International ISDN number) (as telephone number), SUPI (Subscription Permanent Identifier) / IMSI (International Mobile Subscriber Identity) (as communication identifier), and the location identifiers include TAI (Tracking Area Identifier) ​​and Cell ID (Cell ID). In order to reduce the exposure of identity identifiers, 3GPP (3rd Generation Partnership Project) introduced asymmetric encryption to provide air interface protection for SUPI, which can prevent attackers from obtaining the identity information of mobile communication network and satellite Internet through the air interface. At present, there are some security enhancement solutions that can prevent attackers from obtaining the identity information of mobile communication network and satellite Internet through the core network visit domain by introducing the transformation of SUPI / IMSI, but there are difficulties such as high technical difficulty of mobile communication network element customization and high cost of engineering implementation.

[0004] Therefore, there is an urgent need to solve the problem of reducing the technical difficulty of customizing communication network elements and reducing the cost of engineering implementation without changing the 3GPP standard processes and protocols and meeting the anti-positioning capability requirements of mobile communication networks and satellite Internet, so as to provide support for high-security industry applications of mobile communication networks and satellite Internet. Summary of the invention

[0005] In view of the above defects, in order to solve the problems of high technical difficulty and high engineering cost of communication network element customization for security enhancement needs of mobile communication networks and satellite Internet, a UDM (User Data Management) / HSS (Home Subscriber Server) ultra-light customization method and device for realizing anti-positioning effect of mobile communication networks and satellite Internet are proposed.

[0006] In order to achieve the above-mentioned effects, the mobile communication network and satellite Internet anti-positioning method provided by the present invention includes overall steps and steps related to UDM / HSS customization in three stages: preparation stage, change stage, and recovery stage, wherein the overall steps include:

[0007] Step 1: The original ARPF / AuC logic function in the UDM / HSS network element is separated and deployed independently to form an enhanced ARPF / AuC unit. The internal function interface for the ARPF / AuC logic function in the UDM / HSS network element is converted into an equivalent external network communication interface for the enhanced ARPF / AuC unit to realize the function of providing the primary authentication vector;

[0008] Among them, ARPF specifically refers to Authentication credential Repository and Processing Function, AuC specifically refers to Authentication Center, UDM specifically refers to User Data Management, and HSS specifically refers to Home Subscriber Server, home user service function.

[0009] Step 2: The enhanced ARPF / AuC unit directly reuses the standard network management account opening interface and account cancellation interface supported by the UDM / HSS network element to achieve the effect of dynamic simultaneous change of IMSI / SUPI, MSISDN / GPSI;

[0010] Step 3: The enhanced ARPF / AuC unit directly reuses the standard network management card activation interface, one-number-multiple-machine configuration interface, and card cancellation interface supported by the UDM / HSS network element to achieve dynamic changes in IMSI / SUPI and keep the MSISDN / GPSI unchanged.

[0011] Preferably, the above step 1 is a unique customization element for the UDM / HSS network element.

[0012] Preferably, the above step 2 realizes the effect of dynamically changing IMSI / SUPI and MSISDN / GPSI at the same time. There is actually no customization requirement for UDM / HSS in the preparation stage, and specifically includes the following steps:

[0013] S201, triggering the enhanced ARPF / AuC unit to initiate anti-positioning security protection processing;

[0014] S202, the enhanced ARPF / AuC unit randomly selects IMSI / SUPI, MSISDN / GPSI from the free resource pool, opens an account locally, and binds the IMSI / SUPI, MSISDN / GPSI as a new user information;

[0015] S203. The enhanced ARPF / AuC unit controls the UDM / HSS network element to perform account opening processing through the standard network management interface account opening interface, and adds relevant subscription information of IMSI / SUPI and MSISDN / GPSI users.

[0016] Preferably, the above step 3 realizes the effect of dynamic change of IMSI / SUPI and unchanged MSISDN / GPSI. There is actually no customization requirement for UDM / HSS in the preparation stage, which specifically includes:

[0017] S301, triggering the enhanced ARPF / AuC unit to initiate anti-positioning security protection processing;

[0018] S302, the enhanced ARPF / AuC unit randomly selects an IMSI / SUPI from the free resource pool and activates the card locally without binding the MSISDN / GPSI number;

[0019] S303, the enhanced ARPF / AuC unit controls the UDM / HSS network element to perform card activation through the card activation interface of the standard network management interface, and adds IMSI / SUPI information;

[0020] S304. The enhanced ARPF / AuC unit controls the UDM / HSS network element through the one-number multi-machine configuration interface of the standard network management interface to bind the new IMSI / SUPI information with the IMSI / SUPI and MSISDN / GPSI of the users related to the anti-location processing to form new contract information of the new IMSI / SUPI, the original IMSI / SUPI and MSISDN / GPSI users.

[0021] Preferably, the above step 2 realizes the effect of dynamic change of IMSI / SUPI and MSISDN / GPSI at the same time and step 3 realizes the effect of dynamic change of IMSI / SUPI and unchanged MSISDN / GPSI. The UDM / HSS is ultra-lightly customized during the change stage, specifically including:

[0022] S1. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI control information through the UDM / HSS via the equivalent external network communication interface;

[0023] S2. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector;

[0024] S3: UE re-initiates the network attachment process using the new IMSI / SUPI;

[0025] S4. When the UE performs IMS domain network authentication, the UDM / HSS sends the MSISDN / GPSI number in the user's subscription information through a standard interface.

[0026] Preferably, the above step 2 realizes the effect of dynamic change of IMSI / SUPI, MSISDN / GPSI at the same time, and there is actually no customization requirement for UDM / HSS in the recovery stage, which specifically includes the following steps:

[0027] S21. UE completes network access authentication using the new IMSI / SUPI;

[0028] S22. The enhanced ARPF / AuC unit controls the UDM / HSS network element to perform account cancellation processing through the account cancellation interface of the standard network management interface, and recovers and releases the original IMSI / SUPI and the original MSISDN / GPSI number resources;

[0029] S23: The UE continues the subsequent network attachment process.

[0030] Preferably, the above step 3 realizes the effect of dynamic change of IMSI / SUPI and keeping MSISDN / GPSI unchanged. There is actually no customization requirement for UDM in the recovery stage, and specifically includes the following steps:

[0031] S31. UE completes network attachment using new IMSI / SUPI;

[0032] S32. The enhanced ARPF / AuC unit controls the UDM / HSS network element to perform card cancellation processing through the card cancellation interface of the standard network management interface. Under the premise of keeping the MSISDN / GPSI number unchanged, the original IMSI / SUPI information in the user's one-number-multiple-devices subscription information is stripped, and the original IMSI / SUPI number resources are recovered and released;

[0033] S33: The UE continues the subsequent network attachment process.

[0034] The present invention provides a device for realizing the anti-positioning method of the mobile communication network and the satellite Internet as described above, characterized in that the device comprises an external network management system, an enhanced ARPF / AuC unit formed by independent deployment and additional transformation based on the standard ARPF / AuC logic function in the UDM / HSS network element, and an internal function interface for the ARPF / AuC logic function in the UDM / HSS network element is converted into an equivalent external network communication interface for the enhanced ARPF / AuC unit; the enhanced ARPF / AuC unit supports a standard master authentication function and a control function for dynamic replacement of IMSI / SUPI, MSISDN / GPSI based on standard network management interfaces such as account opening, account cancellation, and one number for multiple machines.

[0035] The present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above method is implemented.

[0036] Compared with the prior art, the present invention adopts an internal interface to convert to an equivalent external interface without changing the 3GPP standard protocol and process and under the premise of meeting the anti-positioning capability requirements of the mobile communication network and the satellite Internet, and directly reuses standard network management interfaces such as account opening, account cancellation, and one machine with multiple numbers to realize dynamic replacement of IMSI / SUPI and MSISDN / GPSI in the core network. By enhancing the ARPF / AuC logical function in the UDM / HSS to form an enhanced ARPF (Authentication credential Repository and Processing Function) / AuC (Authentication Center) unit, cloud-based negotiation of IMSI / SUPI, MSISDN / GPSI update control between the UDM / HSS network element and the terminal is realized, thereby realizing customized support for the anti-positioning function of the UDM / HSS network element at a very low cost, and can better promote the implementation of high-security applications of mobile communication networks and satellite Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the following briefly introduces the drawings required for use in the embodiment of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 A schematic diagram of an embodiment of a mobile communication network and satellite Internet anti-positioning method of the present invention is shown;

[0039] Figure 2 The schematic diagram of the device related to the UDM / HSS ultra-light customization method for anti-positioning effect of mobile communication network and satellite Internet of the present invention is shown;

[0040] Figure 3 A schematic diagram of an embodiment of the anti-positioning method based on the mobile communication network and satellite Internet of the present invention in a 4G mobile communication network is shown;

[0041] Figure 4 A schematic diagram of another embodiment of the anti-positioning method of the mobile communication network and the satellite Internet based on the present invention in a 4G mobile communication network is shown;

[0042] Figure 5 A schematic diagram of an embodiment of the anti-positioning method based on the mobile communication network and satellite Internet of the present invention in a 5G mobile communication network is shown;

[0043] Figure 6 A schematic diagram of another embodiment of the anti-positioning method of the mobile communication network and the satellite Internet based on the present invention in a 5G mobile communication network is shown;

[0044] Figure 7 A schematic diagram of an embodiment of the anti-positioning method of the mobile communication network and the satellite Internet based on the satellite Internet of the present invention is shown;

[0045] Figure 8 A schematic diagram of another embodiment of the anti-positioning method of the mobile communication network and satellite Internet based on the satellite Internet of the present invention is shown. DETAILED DESCRIPTION

[0046] The features and exemplary embodiments of various aspects of the present invention will be described in detail below. In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and Examples. It should be understood that the specific embodiments described herein are only configured to explain the present invention and are not configured to limit the present invention. For those skilled in the art, the present invention can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present invention by illustrating examples of the present invention.

[0047] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0048] The present invention provides an embodiment of a mobile communication network and satellite Internet anti-positioning method, such as Figure 1 As shown, the UDM / HSS ultra-light customization method for realizing the anti-positioning effect of mobile communication network and satellite Internet includes: an overall description of the UDM / HSS ultra-light customization method for realizing the anti-positioning effect, and a description of methods related to UDM / HSS customization in three stages: preparation stage, change stage, and recovery stage.

[0049] Among them, the overall description of the UDM / HSS ultra-light customization method to achieve anti-positioning effect is:

[0050] Step 1: Separate the original ARPF / AuC logic function in the UDM / HSS network element and deploy it independently to form an enhanced ARPF / AuC unit. Convert the internal function interface for the ARPF / AuC logic function in the UDM / HSS network element into an equivalent external network communication interface for the enhanced ARPF / AuC unit to realize the function of providing the primary authentication vector. This is also the only customized element for the UDM / HSS network element.

[0051] Step 2: The enhanced ARPF / AuC unit directly reuses the standard network management account opening interface and account cancellation interface supported by the UDM / HSS network element to achieve the effect of dynamic simultaneous change of IMSI / SUPI, MSISDN / GPSI;

[0052] Step 3: The enhanced ARPF / AuC unit directly reuses the standard network management card activation interface, one-number-multiple-machine configuration interface, and card cancellation interface supported by the UDM / HSS network element to achieve the dynamic change of IMSI / SUPI and keep the MSISDN / GPSI unchanged.

[0053] To achieve the effect of dynamic change of IMSI / SUPI, MSISDN / GPSI at the same time, there is no customization requirement for UDM / HSS in the preparation stage. The relevant methods are as follows:

[0054] S1. The management system triggers the enhanced ARPF / AuC unit to initiate anti-positioning security protection processing;

[0055] S2. The enhanced ARPF / AuC unit randomly selects IMSI / SUPI, MSISDN / GPSI from the free resource pool, opens an account locally, and binds IMSI / SUPI, MSISDN / GPSI as a new user information;

[0056] S3. The enhanced ARPF / AuC unit controls the UDM / HSS network element to perform account opening processing through the standard network management interface account opening interface, and adds relevant contract information of IMSI / SUPI and MSISDN / GPSI users.

[0057] To achieve the effect of dynamic change of IMSI / SUPI and unchanged MSISDN / GPSI, there is no customization requirement for UDM / HSS in the preparation stage. The relevant methods are as follows:

[0058] S1. The management system triggers the enhanced ARPF / AuC unit to initiate anti-positioning security protection processing;

[0059] S2. The enhanced ARPF / AuC unit randomly selects an IMSI / SUPI from the free resource pool and activates the card locally without binding the MSISDN / GPSI number.

[0060] S3, the enhanced ARPF / AuC unit controls the UDM / HSS network element to perform card activation through the card activation interface of the standard network management interface, and adds IMSI / SUPI information;

[0061] S4. The enhanced ARPF / AuC unit controls the UDM / HSS network element through the one-number multi-machine configuration interface of the standard network management interface to bind the new IMSI / SUPI information with the IMSI / SUPI and MSISDN / GPSI of users related to anti-location processing to form new contract information of the new IMSI / SUPI, the original IMSI / SUPI, and the MSISDN / GPSI users.

[0062] Whether it is to achieve the effect of dynamic change of IMSI / SUPI, MSISDN / GPSI at the same time, or to achieve the effect of dynamic change of IMSI / SUPI and unchanged MSISDN / GPSI, only very light customization of UDM / HSS is required during the change phase. The relevant methods are as follows:

[0063] S1. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI control information through the UDM / HSS via the equivalent external network communication interface;

[0064] S2. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector;

[0065] S3: UE re-initiates the network attachment process using the new IMSI / SUPI;

[0066] S4. When the UE performs IMS domain network authentication, the UDM / HSS sends the MSISDN / GPSI number in the user's subscription information through a standard interface.

[0067] To achieve the effect of dynamic change of IMSI / SUPI, MSISDN / GPSI at the same time, there is no customization requirement for UDM / HSS in the recovery phase. The relevant methods are as follows:

[0068] S1. UE completes network authentication using new IMSI / SUPI;

[0069] S2. The enhanced ARPF / AuC unit controls the UDM / HSS network element to cancel the account through the cancellation interface of the standard network management interface, and recovers and releases the original IMSI / SUPI and the original MSISDN / GPSI number resources;

[0070] S3. The UE continues the subsequent network attachment process.

[0071] To achieve the effect of dynamic change of IMSI / SUPI and unchanged MSISDN / GPSI, there is actually no customization requirement for UDM in the recovery phase. The relevant methods are as follows:

[0072] S1. UE uses the new IMSI / SUPI to complete network attachment;

[0073] S2. The enhanced ARPF / AuC unit controls the UDM / HSS network element to cancel the card through the card cancellation interface of the standard network management interface. Under the premise of keeping the MSISDN / GPSI number unchanged, the original IMSI / SUPI information in the user's one-number-multiple-devices subscription information is stripped, and the original IMSI / SUPI number resources are recovered and released;

[0074] S3. The UE continues the subsequent network attachment process.

[0075] To further illustrate the innovative features of the present invention, the present invention also provides an embodiment, such as Figure 3 As shown, a UDM / HSS ultra-light customization method and device for realizing the simultaneous dynamic change effect of IMSI / SUPI, MSISDN / GPSI in a 4G mobile communication network, and related functional entities include a 4G mobile terminal UE (User Equipment), a 4G base station eNB (EvolvedNode B), a 4G core network EPC (Evolved Packet Core), HSS, and an enhanced ARPF / AuC unit.

[0076] The specific steps include:

[0077] S1, the external network management system triggers anti-location security protection processing;

[0078] S2. The enhanced ARPF / AuC unit randomly selects IMSI / SUPI, MSISDN / GPSI from the free resource pool, opens an account locally, and binds IMSI / SUPI, MSISDN / GPSI as a new user information;

[0079] S3. The enhanced ARPF / AuC unit controls the HSS network element to perform account opening processing through the standard network management interface account opening interface, and adds relevant contract information of IMSI / SUPI and MSISDN / GPSI users.

[0080] S4. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI change control information through the HSS network element via the equivalent external network communication interface;

[0081] S5. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector;

[0082] S6. The UE uses the new IMSI / SUPI to re-initiate the packet domain network access authentication process;

[0083] S7. The UE uses the new IMSI / SUPI to re-initiate the IMS domain network access authentication process and obtain a new MSISDN / GPSI.

[0084] S8. The enhanced ARPF / AuC unit controls the HSS network element to cancel the account through the standard network management interface cancellation interface, and recovers and releases the original IMSI / SUPI and the original MSISDN / GPSI number resources;

[0085] S9. Complete the dynamic change of IMSI / SUPI, MSISDN / GPSI and continue the subsequent network attachment process.

[0086] like Figure 4 As shown, the present invention provides a UDM / HSS ultra-light customization method and device that realizes dynamic change of IMSI / SUPI but keeps MSISDN / GPSI unchanged in a 4G mobile communication network, and the relevant functional entities include a 4G mobile terminal UE, a 4G base station eNB, a 4G core network EPC, HSS, and an enhanced ARPF / AuC unit.

[0087] The specific steps include:

[0088] S1, the external network management system triggers anti-location security protection processing;

[0089] S2. The enhanced ARPF / AuC unit randomly selects an IMSI / SUPI from the free resource pool and opens an account locally without binding the MSISDN / GPSI.

[0090] S3. The enhanced ARPF / AuC unit controls the HSS network element to perform account opening processing through the standard network management interface card opening interface and adds new IMSI / SUPI information.

[0091] S4. The enhanced ARPF / AuC unit controls the HSS network element to bind the new IMSI / SUPI to the original IMSI / SUPI, MSISDN / GPSI user through the standard network management interface one-number multi-machine configuration interface;

[0092] S5. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI change control information through the HSS network element via the equivalent external network communication interface;

[0093] S6. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector;

[0094] S7: UE uses the new IMSI / SUPI to re-initiate the packet domain network access authentication process;

[0095] S8. The UE re-initiates the IMS domain access authentication process using the new IMSI / SUPI and still obtains the original MSISDN / GPSI.

[0096] S9, the enhanced ARPF / AuC unit controls the HSS network element to cancel the card through the standard network management interface cancellation interface, and strips, recycles and releases the original IMSI / SUPI information resources from the current user's one-number-multiple-device subscription information;

[0097] S10. Complete the dynamic change of IMSI / SUPI, MSISDN / GPSI and continue the subsequent network attachment process.

[0098] To further illustrate the innovative features of the present invention, the present invention also provides an embodiment, such as Figure 5 As shown, a UDM / HSS ultra-light customization method and device for realizing the simultaneous dynamic change effect of IMSI / SUPI, MSISDN / GPSI in a 5G mobile communication network, and related functional entities include a 5G mobile terminal UE, a 5G base station gNB, a 5G core network 5GC, a UDM, and an enhanced ARPF / AuC unit.

[0099] The specific steps include:

[0100] S1, the external network management system triggers anti-location security protection processing;

[0101] S2. The enhanced ARPF / AuC unit randomly selects IMSI / SUPI, MSISDN / GPSI from the free resource pool, opens an account locally, and binds IMSI / SUPI, MSISDN / GPSI as a new user information;

[0102] S3. The enhanced ARPF / AuC unit controls the UDM network element to perform account opening processing through the standard network management interface account opening interface, and adds relevant contract information of IMSI / SUPI and MSISDN / GPSI users.

[0103] S4. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI change control information through the UDM network element via the equivalent external network communication interface;

[0104] S5. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector;

[0105] S6. The UE uses the new IMSI / SUPI to re-initiate the packet domain network access authentication process;

[0106] S7. The UE uses the new IMSI / SUPI to re-initiate the IMS domain network access authentication process and obtain the new MSISDN / GPSI.

[0107] S8. The enhanced ARPF / AuC unit controls the UDM network element to cancel the account through the standard network management interface cancellation interface, and recovers and releases the original IMSI / SUPI and the original MSISDN / GPSI number resources;

[0108] S9. Complete the dynamic change of IMSI / SUPI, MSISDN / GPSI and continue the subsequent network attachment process.

[0109] like Figure 6 As shown, the present invention provides a UDM / HSS ultra-light customization method and device for realizing dynamic change of IMSI / SUPI but keeping MSISDN / GPSI unchanged in a 5G mobile communication network, and the relevant functional entities include a 5G mobile terminal UE, a 5G base station gNB, a 5G core network 5GC, a UDM, and an enhanced ARPF / AuC unit.

[0110] The specific steps include:

[0111] S1, the external network management system triggers anti-location security protection processing;

[0112] S2. The enhanced ARPF / AuC unit randomly selects an IMSI / SUPI from the free resource pool and opens an account locally without binding the MSISDN / GPSI.

[0113] S3. The enhanced ARPF / AuC unit controls the UDM network element to perform account opening processing through the standard network management interface card opening interface and adds new IMSI / SUPI information.

[0114] S4. The enhanced ARPF / AuC unit controls the UDM network element to bind the new IMSI / SUPI to the original IMSI / SUPI, MSISDN / GPSI user through the standard network management interface one-number multi-machine configuration interface;

[0115] S5. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI change control information through the UDM network element via the equivalent external network communication interface;

[0116] S6. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector;

[0117] S7: UE uses the new IMSI / SUPI to re-initiate the packet domain network access authentication process;

[0118] S8. The UE re-initiates the IMS domain access authentication process using the new IMSI / SUPI and still obtains the original MSISDN / GPSI.

[0119] S9. The enhanced ARPF / AuC unit controls the UDM network element to cancel the card through the standard network management interface cancellation interface, and strips, recycles and releases the original IMSI / SUPI information resources from the current user's one-number-multiple-device subscription information;

[0120] S10. Complete the dynamic change of IMSI / SUPI, MSISDN / GPSI and continue the subsequent network attachment process.

[0121] To further illustrate the innovative features of the present invention, the present invention also provides an embodiment, such as Figure 7 As shown, a UDM / HSS ultra-light customization method and device for realizing the simultaneous dynamic change effect of IMSI / SUPI, MSISDN / GPSI in satellite Internet, and related functional entities include satellite mobile terminal UE, satellite, information observation station, core network 5GC, UDM, and enhanced ARPF / AuC unit.

[0122] The specific steps include:

[0123] S1, the external network management system triggers anti-location security protection processing;

[0124] S2. The enhanced ARPF / AuC unit randomly selects IMSI / SUPI, MSISDN / GPSI from the free resource pool, opens an account locally, and binds IMSI / SUPI, MSISDN / GPSI as a new user information;

[0125] S3. The enhanced ARPF / AuC unit controls the UDM network element to perform account opening processing through the standard network management interface account opening interface, and adds relevant contract information of IMSI / SUPI and MSISDN / GPSI users.

[0126] S4. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI change control information through the UDM network element via the equivalent external network communication interface;

[0127] S5. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector;

[0128] S6. The UE uses the new IMSI / SUPI to re-initiate the packet domain network access authentication process;

[0129] S7. The UE uses the new IMSI / SUPI to re-initiate the IMS domain network access authentication process and obtain the new MSISDN / GPSI.

[0130] S8. The enhanced ARPF / AuC unit controls the UDM network element to cancel the account through the standard network management interface cancellation interface, and recovers and releases the original IMSI / SUPI and the original MSISDN / GPSI number resources;

[0131] S9. Complete the dynamic change of IMSI / SUPI, MSISDN / GPSI and continue the subsequent network attachment process.

[0132] like Figure 8 As shown, the present invention provides a UDM / HSS ultra-light customization method and device in satellite Internet that realizes dynamic change of IMSI / SUPI but keeps MSISDN / GPSI unchanged, and the relevant functional entities include satellite mobile terminal UE, satellite, information observation station, core network 5GC, UDM, and enhanced ARPF / AuC unit.

[0133] The specific steps include:

[0134] S1, the external network management system triggers anti-location security protection processing;

[0135] S2. The enhanced ARPF / AuC unit randomly selects an IMSI / SUPI from the free resource pool and opens an account locally without binding the MSISDN / GPSI.

[0136] S3. The enhanced ARPF / AuC unit controls the UDM network element to perform account opening processing through the standard network management interface card opening interface and adds new IMSI / SUPI information.

[0137] S4. The enhanced ARPF / AuC unit controls the UDM network element to bind the new IMSI / SUPI to the original IMSI / SUPI, MSISDN / GPSI user through the standard network management interface one-number multi-machine configuration interface;

[0138] S5. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI change control information through the UDM network element via the equivalent external network communication interface;

[0139] S6. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector;

[0140] S7: UE uses the new IMSI / SUPI to re-initiate the packet domain network access authentication process;

[0141] S8. The UE re-initiates the IMS domain access authentication process using the new IMSI / SUPI and still obtains the original MSISDN / GPSI.

[0142] S9. The enhanced ARPF / AuC unit controls the UDM network element to cancel the card through the standard network management interface cancellation interface, and strips, recycles and releases the original IMSI / SUPI information resources from the current user's one-number-multiple-device subscription information;

[0143] S10. Complete the dynamic change of IMSI / SUPI, MSISDN / GPSI and continue the subsequent network attachment process.

[0144] Compared with the prior art, the present invention adopts an internal interface to convert to an equivalent external interface without changing the 3GPP standard protocol and process and under the premise of meeting the anti-positioning capability requirements of the mobile communication network and the satellite Internet, and directly reuses standard network management interfaces such as account opening, account cancellation, and one machine with multiple numbers to realize dynamic replacement of IMSI / SUPI and MSISDN / GPSI in the core network. By enhancing the ARPF / AuC logical function in the UDM / HSS to form an enhanced ARPF / AuC unit, cloud-based negotiation of IMSI / SUPI, MSISDN / GPSI update control between the UDM / HSS network element and the terminal is realized, thereby realizing customized support for the anti-positioning function of the UDM / HSS network element at a very low cost, and can better promote the implementation of high-security applications in mobile communication networks and satellite Internet.

[0145] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0146] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0147] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0148] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0149] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0152] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0153] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0154] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0155] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0156] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A mobile communication network and satellite Internet anti-positioning method, characterized in that The method includes overall steps and steps related to UDM / HSS customization in three stages: preparation stage, change stage, and recycling stage, wherein the overall steps include: Step 1: The original ARPF / AuC logic function in the UDM / HSS network element is separated and deployed independently to form an enhanced ARPF / AuC unit. The internal function interface for the ARPF / AuC logic function in the UDM / HSS network element is converted into an equivalent external network communication interface for the enhanced ARPF / AuC unit to realize the function of providing the primary authentication vector; Step 2: The enhanced ARPF / AuC unit directly reuses the standard network management account opening interface and account cancellation interface supported by the UDM / HSS network element to achieve the effect of dynamic simultaneous change of IMSI / SUPI, MSISDN / GPSI; Step 3: The enhanced ARPF / AuC unit directly reuses the standard network management card activation interface, one-number-multiple-machine configuration interface, and card cancellation interface supported by the UDM / HSS network element to achieve dynamic changes in IMSI / SUPI and keep the MSISDN / GPSI unchanged.

2. The mobile communication network and satellite Internet anti-positioning method according to claim 1, characterized in that The step one is a unique customization element for UDM / HSS network elements.

3. The mobile communication network and satellite Internet anti-positioning method according to claim 1 is characterized in that The step 2 realizes the effect of dynamic change of IMSI / SUPI, MSISDN / GPSI at the same time. There is actually no customization requirement for UDM / HSS in the preparation stage, and specifically includes the following steps: S201, triggering the enhanced ARPF / AuC unit to initiate anti-positioning security protection processing; S202, the enhanced ARPF / AuC unit randomly selects IMSI / SUPI, MSISDN / GPSI from the free resource pool, opens an account locally, and binds the IMSI / SUPI, MSISDN / GPSI as a new user information; S203. The enhanced ARPF / AuC unit controls the UDM / HSS network element to perform account opening processing through the standard network management interface account opening interface, and adds relevant subscription information of IMSI / SUPI and MSISDN / GPSI users.

4. The mobile communication network and satellite Internet anti-positioning method according to claim 1, characterized in that Step 3 implements the effect of dynamic change of IMSI / SUPI and unchanged MSISDN / GPSI. In the preparation stage, there is actually no customization requirement for UDM / HSS, which specifically includes: S301, triggering the enhanced ARPF / AuC unit to initiate anti-positioning security protection processing; S302, the enhanced ARPF / AuC unit randomly selects an IMSI / SUPI from the free resource pool and activates the card locally without binding the MSISDN / GPSI number; S303, the enhanced ARPF / AuC unit controls the UDM / HSS network element to perform card activation through the card activation interface of the standard network management interface, and adds IMSI / SUPI information; S304. The enhanced ARPF / AuC unit controls the UDM / HSS network element through the one-number multi-machine configuration interface of the standard network management interface to bind the new IMSI / SUPI information with the IMSI / SUPI and MSISDN / GPSI of the users related to the anti-location processing to form new contract information of the new IMSI / SUPI, the original IMSI / SUPI and MSISDN / GPSI users.

5. The mobile communication network and satellite Internet anti-positioning method according to claim 1, characterized in that: The step 2 implements the effect of dynamic change of IMSI / SUPI and MSISDN / GPSI at the same time and the step 3 implements the effect of dynamic change of IMSI / SUPI and unchanged MSISDN / GPSI. The UDM / HSS is ultra-lightly customized during the change phase, specifically including: S1. When the UE performs packet domain network access authentication, the enhanced ARPF / AuC unit sends an authentication vector carrying IMSI / SUPI control information through the UDM / HSS via the equivalent external network communication interface; S2. The UE completes the dynamic change of IMSI / SUPI according to the control information in the authentication vector; S3: UE re-initiates the network attachment process using the new IMSI / SUPI; S4. When the UE performs IMS domain network authentication, the UDM / HSS sends the MSISDN / GPSI number in the user's subscription information through a standard interface.

6. The mobile communication network and satellite Internet anti-positioning method according to claim 1, characterized in that The step 2 realizes the effect of dynamic change of IMSI / SUPI, MSISDN / GPSI at the same time. There is actually no customization requirement for UDM / HSS in the recovery stage, and specifically includes the following steps: S21. UE completes network access authentication using the new IMSI / SUPI; S22. The enhanced ARPF / AuC unit controls the UDM / HSS network element to perform account cancellation processing through the account cancellation interface of the standard network management interface, and recovers and releases the original IMSI / SUPI and the original MSISDN / GPSI number resources; S23: The UE continues the subsequent network attachment process.

7. The mobile communication network and satellite Internet anti-positioning method according to claim 1, characterized in that The step 3 achieves the effect of dynamic change of IMSI / SUPI and unchanged MSISDN / GPSI. There is actually no customization requirement for UDM in the recovery stage, and specifically includes the following steps: S31. UE completes network attachment using new IMSI / SUPI; S32. The enhanced ARPF / AuC unit controls the UDM / HSS network element to perform card cancellation processing through the card cancellation interface of the standard network management interface. Under the premise of keeping the MSISDN / GPSI number unchanged, the original IMSI / SUPI information in the user's one-number-multiple-devices subscription information is stripped, and the original IMSI / SUPI number resources are recovered and released; S33: The UE continues the subsequent network attachment process.

8. A device for implementing the mobile communication network and satellite Internet anti-positioning method as described in any one of claims 1 to 7, characterized in that The device includes an external network management system, an enhanced ARPF / AuC unit formed by independent deployment and additional transformation of standard ARPF / AuC logic functions in UDM / HSS network elements, and an internal function interface for ARPF / AuC logic functions in UDM / HSS network elements converted into an equivalent external network communication interface for the enhanced ARPF / AuC unit; the enhanced ARPF / AuC unit supports standard master authentication functions and control functions for dynamic replacement of IMSI / SUPI, MSISDN / GPSI based on standard network management interfaces such as account opening, account cancellation, and one number for multiple machines.

9. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method according to any one of claims 1 to 8.

Images