Communication method and device, storage medium, communication equipment and chip

Abstract

The invention relates to a communication method and device, a storage medium, communication equipment and a chip. The method comprises: receiving an attach rejection message sent by a network device, the attach rejection message comprising a rejection reason value, and the rejection reason value being used for indicating reason information for rejecting establishment of PDN connection; in this case, if the rejection cause value is a specific target cause value, anti-attack processing may be performed based on the rejection cause value. According to the technical scheme, when the attachment rejection message carries the specific rejection reason value, effective anti-attack processing can be executed, the situation that the terminal cannot establish a bearer for a long time is reduced, the terminal can quickly recover the service capability to obtain the corresponding service, recovery is carried out without relying on manual intervention of a user, and the user experience is improved. The user experience can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a communication method, apparatus, storage medium, communication equipment and chip. Background Art

[0002] 4G communication technology is the fourth generation of mobile information system, which is a better improvement on 3G technology. Compared with 3G communication technology, its greater advantage is that it combines wireless local area network (WLAN) technology with 3G communication technology, making image transmission faster and making the quality of transmitted images and images look clearer. The application of 4G communication technology in terminals allows users to access the Internet faster, with speeds as high as 100Mbps.

[0003] When the terminal initiates the process of attaching (ATTACH) to the 4G network, if the terminal does not support bearerless attachment, the attach request message sent by the terminal to the network device must carry an Evolved Packet System (EPS) Session Management (ESM) Packet Data Network (PDN) connection request. Accordingly, the network device can choose to agree or refuse to establish a PDN connection. When choosing to refuse to establish a PDN connection, the attach rejection message can carry a message of refusing to establish a PDN connection, and can include a corresponding rejection reason value.

[0004] Currently, an attacker can carry a specific rejection reason value in an attach reject message, causing the terminal to be unable to establish a bearer and thus unable to obtain the corresponding service. Summary of the invention

[0005] The present disclosure provides a communication method, apparatus, storage medium, communication equipment and chip, the main purpose of which is to improve the current technical problem that attackers carry a specific rejection reason value in an attachment rejection message, causing the terminal to be unable to establish a bearer and thus unable to obtain the corresponding service.

[0006] According to a first aspect of an embodiment of the present disclosure, there is provided a communication method, including:

[0007] receiving an attach reject message sent by a network device, where the attach reject message includes a reject cause value, where the reject cause value is used to indicate reason information for rejecting establishment of a PDN connection;

[0008] If the rejection reason value is a target reason value, anti-attack processing is performed based on the rejection reason value.

[0009] In some embodiments of the present disclosure, the target cause value includes one of the following:

[0010] A first value, where the first value is used to indicate that an IPv4 type PDN connection request is allowed to be initiated;

[0011] A second value, where the second value is used to indicate that an IPv6 type PDN connection request is allowed to be initiated;

[0012] A third value, where the third value is used to indicate that an IPv4v6 type PDN connection request is allowed to be initiated;

[0013] a fourth value, where the fourth value is used to indicate that a non-Internet Protocol (non-IP) type PDN connection request is allowed to be initiated;

[0014] a fifth value, where the fifth value is used to indicate that an Ethernet type PDN connection request is allowed to be initiated;

[0015] A sixth value is used to indicate that the number of activated EPS bearers has reached the maximum number of bearers supported by the network.

[0016] In some embodiments of the present disclosure, the attach rejection message carries a message of rejecting the establishment of the PDN connection, and the message of rejecting the establishment of the PDN connection includes the rejection reason value;

[0017] Performing anti-attack processing based on the rejection reason value includes:

[0018] Ignore the rejection reason value; or,

[0019] discarding the attach reject message; or,

[0020] The message for refusing to establish the PDN connection is discarded.

[0021] In some embodiments of the present disclosure, performing anti-attack processing based on the rejection reason value includes:

[0022] Recording first information corresponding to the rejection reason value, and starting a timer for timing, wherein the first information includes a type of PDN connection allowed to be established or a maximum number of EPS bearers allowed to be established;

[0023] Determine that the timer reaches the timing duration, and clear the recorded first information.

[0024] In some embodiments of the present disclosure, the method further includes:

[0025] The execution times of the anti-attack processing are counted based on the target cause value received each time within a preset time period, and the execution of the anti-attack processing is canceled after the execution times reach a preset times threshold.

[0026] In some embodiments of the present disclosure, performing anti-attack processing based on the rejection reason value includes:

[0027] Recording second information corresponding to the rejection reason value, where the second information includes a type of PDN connection allowed to be established or a maximum number of EPS bearers allowed to be established;

[0028] Determine that the registration is successful on any network standard, and clear the recorded second information.

[0029] In some embodiments of the present disclosure, the method further includes:

[0030] By lowering the priority of the current resident cell, or prohibiting access to the current resident cell, or prohibiting access to the cell corresponding to the current tracking area identity (Tracing Area Identity, TAI), a change of resident cell is triggered.

[0031] According to a second aspect of an embodiment of the present disclosure, there is provided a communication device, including:

[0032] A receiving module, configured to receive an attach rejection message sent by a network device, wherein the attach rejection message includes a rejection reason value, and the rejection reason value is used to indicate reason information for rejecting establishment of a PDN connection;

[0033] The processing module is configured to perform anti-attack processing based on the rejection reason value if the rejection reason value is a target reason value.

[0034] According to a third aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method described in the first aspect is implemented.

[0035] According to the fourth aspect of an embodiment of the present disclosure, a communication device is provided, comprising: a transceiver; a memory; and a processor, which is connected to the transceiver and the memory respectively, and is configured to control the wireless signal reception and transmission of the transceiver by executing computer executable instructions on the memory, and can implement the method described in the first aspect.

[0036] According to a fifth aspect of an embodiment of the present disclosure, there is provided a computer program product on which a computer program is stored. When the computer program is executed by a processor, the method described in the first aspect is implemented.

[0037] According to the sixth aspect of an embodiment of the present disclosure, a chip is provided, comprising at least one processor and a communication interface; the communication interface is used to receive a signal input into the chip or a signal output from the chip, the processor communicates with the communication interface and implements the method described in the first aspect through a logic circuit or by executing code instructions.

[0038] By means of the above technical scheme, the present disclosure provides a communication method, apparatus, storage medium, communication equipment and chip. Specifically, the terminal may receive an attachment rejection message sent by a network device, the attachment rejection message including a rejection reason value, and the rejection reason value is used to indicate the reason information for refusing to establish a PDN connection; in this case, if the rejection reason value is a specific target reason value, anti-attack processing may be performed based on the rejection reason value. Compared with the current related technologies, the present disclosure can perform effective anti-attack processing when carrying a specific rejection reason value in an attachment rejection message, thereby reducing the situation where the terminal cannot establish a bearer for a long time, and enabling the terminal to quickly restore business capabilities to obtain corresponding services, without relying on manual user intervention for recovery, thereby improving the user experience.

[0039] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0041] Figure 1 A schematic diagram of an example process provided by an embodiment of the present disclosure is shown;

[0042] Figure 2 A schematic diagram of an example process provided by an embodiment of the present disclosure is shown;

[0043] Figure 3 A flow chart of a communication method provided by an embodiment of the present disclosure is shown;

[0044] Figure 4 A schematic diagram of a process flow of an example application scenario provided by an embodiment of the present disclosure is shown;

[0045] Figure 5 A schematic diagram of an example process provided by an embodiment of the present disclosure is shown;

[0046] Figure 6 A schematic diagram of an example process provided by an embodiment of the present disclosure is shown;

[0047] Figure 7 A schematic diagram of an example process provided by an embodiment of the present disclosure is shown;

[0048] Figure 8 A schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure is shown;

[0049] Fig. 9 A schematic diagram of the structure of a communication device provided by an embodiment of the present disclosure is shown;

[0050] Fig.10 A schematic structural diagram of a chip provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0051] Some embodiments of the present disclosure will be described in detail here, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. Various changes, modifications and equivalents of the methods, devices and / or systems described herein will become apparent after understanding the present disclosure. For example, the order of operations described herein is merely an example and is not limited to those orders set forth herein, but can be changed as becomes apparent after understanding the present disclosure, except for operations that must be performed in a specific order. In addition, in order to enhance clarity and conciseness, descriptions of features known in the art may be omitted. It should be noted that, in the absence of conflict, the embodiments in the present disclosure and the features in the embodiments may be combined with each other.

[0052] To facilitate understanding, the terms involved in the embodiments of the present disclosure are first introduced.

[0053] 1. ATTACH

[0054] Attach is a key process in mobile communication systems, which is used to register a terminal to the network and establish an initial connection. Through the attach process, the terminal can obtain network services such as voice calls and data transmission.

[0055] When security is not activated, if the terminal receives an ATTACH REJECT air interface message during the attachment process and does not carry the rejection reason value #25, the terminal needs to process it (because it is a plain text message and has not been fully secured, the terminal does not know whether the message is sent by the real network or by an attacker through a fake base station).

[0056] Bearerless attach refers to allowing the terminal to complete the attach process without establishing a dedicated data bearer.

[0057] 2. Packet Data Network (PDN)

[0058] PDN refers to a network based on packet switching technology, which is mainly used to transmit data packets. In mobile communication systems, PDN usually refers to the logical connection between a terminal and an external data network (such as the Internet) through a mobile network.

[0059] When the terminal does not support bearerless attachment, the ATTACH REQUEST message must carry an ESM PDN connection request (CONNECTIVITY REQUEST) message. The network can carry an ESM PDN connection reject (CONNECTIVITY REJECT) message in the ATTACH REJECT message to inform the terminal that the PDN connection is refused to be established, which may carry the corresponding ESM rejection reason value.

[0060] When the PDN CONNECTIVITY REJECT message carries any of the following rejection cause values ​​a to e, for the corresponding APN, the terminal only initiates a PDN connection establishment request of the type indicated by the rejection cause value. This constraint is also effective on 2G / 3G / 5G networks, and the message may indicate whether the constraint is effective under all public land mobile networks (PLMNs) in the peer public land mobile network list (EPLMN LIST), and the constraint can only be cleared when the phone is turned off, the card is removed, or the effective PLMN is removed;

[0061] a)#50 "PDN type IPv4only allowed", the corresponding access point name (APN) can only initiate the PDN connection establishment process of type IPv4;

[0062] b)#51 "PDN type IPv6only allowed", the corresponding APN can only initiate the PDN connection establishment process of type IPv6;

[0063] c) #57 "PDN type IPv4v6only allowed", the corresponding APN can only initiate the PDN connection establishment process of type IPv4v6;

[0064] d) #58 "PDN type non-IP only allowed", the corresponding APN can only initiate the PDN connection establishment process of type non-IP;

[0065] e)#61 "PDN type Ethernet only allowed", the corresponding APN can only initiate the PDN connection establishment process of type Ethernet;

[0066] In addition, when the rejection reason value carried in the PDN CONNECTIVITY REJECT message is #65 "maximum number of EPS bearers reached", the terminal needs to record the number of currently activated bearers as the maximum number of bearers supported by the network. When the number of established bearers has reached this limit, the PDN connection establishment request cannot be initiated on the 4G network. This limit can only be cleared when the phone is turned off or the card is removed.

[0067] Some embodiments of the present disclosure are introduced below. It should be noted that the embodiments described in some embodiments of the present disclosure below do not represent all embodiments consistent with the present disclosure. Instead, they are only examples of devices and methods consistent with some aspects of the present disclosure as detailed in the attached claims.

[0068] Currently, attackers can send an ATTACH REJECT message through a fake base station, which carries PDN CONNECTIVITY REJECT (where the rejection reason value carried is any one of #50, #51, #57, #58, and #61), which will limit the terminal to only establish the bearer type indicated by the attacker. When the terminal or the real network does not support the type indicated by the attacker, the terminal on the corresponding APN will not be able to establish the bearer to obtain the corresponding service.

[0069] For example, taking the terminal as a user equipment (UE), Figure 1As shown in the figure, the UE only supports initiating the IPv4v6 type PDN connection establishment process. After the UE successfully attaches to the real 4G network, the attacker attracts the UE to reside on the fake base station by means of signal amplification, and the Tracking Area Indicator (TAI) configured in the fake base station cell is different from that in the real network, triggering the UE to initiate the location update process. The UE sends a tracking area update request (TRACKING AREA UPDATE REQUEST) to the fake base station, and the fake base station sends a tracking area update rejection message (TRACKING AREA UPDATE REJECT) to the UE, and can carry the reason value #9 / #10, etc. At this time, the UE needs to re-initiate an attachment request (ATTACH REQUEST) according to the protocol, and because the UE does not support bearerless attachment, it needs to carry a PDN CONNECTIVITY REQUEST, which requests to establish an IPv4v6 type PDN connection. The attacker sends an ATTACH REJECT message (carrying PDN CONNECTIVITY REJECT, in which the ESM rejection reason value is #58 "PDNtype non-IP only allowed") to the UE through the fake base station. At this time, the UE needs to process the rejection message according to the protocol, and record that the corresponding APN only allows non-IP type PDN connection establishment requests to be initiated. In this way, when the UE resides on the real 4G network again, since the UE only supports initiating IPv4v6 type PDN connection establishment procedures, and the current recorded network only allows initiating non-IP type PDN connection establishment requests, and the terminal does not support bearerless attachment, the UE will not be able to initiate the attachment procedure.

[0070] For another example, taking the terminal as a UE, Figure 2As shown in the figure, after the UE successfully attaches to the real 4G network, the attacker attracts the UE to reside on the fake base station by means of signal amplification, and the TAI configured in the fake base station cell is different from that in the real network, triggering the UE to initiate the location update process. The UE sends a TRACKING AREA UPDATE REQUEST to the fake base station, and the fake base station sends a TRACKING AREA UPDATE REJECT to the UE, and can carry the reason value #9 / #10, etc. At this time, the UE needs to re-initiate an attachment request (ATTACH REQUEST) according to the protocol, and because the UE does not support bearerless attachment, it needs to carry PDNCONNECTIVITY REQUEST. The attacker sends an ATTACH REJECT message to the UE through the fake base station (carrying PDNCONNECTIVITY REJECT, in which the ESM rejection reason value is #65 "maximum number of EPS bearersreached"). At this time, the UE needs to process the rejection message according to the protocol and record that the network allows a maximum of 0 EPS bearers to be established. In this way, when the UE resides on the real 4G network again, the UE will not be able to initiate the attachment process because the recorded network allows a maximum of 0 EPS bearers to be established and the terminal does not support bearerless attachment.

[0071] based on Figure 1 and Figure 2 The example shown is to improve the current technical problem that the attacker carries a specific rejection reason value (such as any one of #50, #51, #57, #58, #61, and #65) in the ATTACHREJECT message, causing the terminal to be unable to establish a bearer and thus unable to obtain the corresponding service. The embodiment of the present disclosure provides a communication method, such as Figure 3 As shown, Figure 3 It is a flowchart of a communication method according to some embodiments of the present disclosure, which includes the following steps.

[0072] Step 101: Receive an attachment rejection message sent by a network device.

[0073] The execution subject of this embodiment may be a communication device or a communication equipment, such as an electronic device or a chip, etc., which may be configured on the terminal side.

[0074] In some examples, the terminal may be referred to as a terminal device (terminal), user equipment (UE), mobile station (MS), mobile terminal (MT), etc. The terminal may also be a car with communication function, a smart car, a mobile phone, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) device, an augmented reality (AR) device, a wireless terminal device in industrial control (industrial control), a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid (smart grid), a wireless terminal device in transportation safety (transportation safety), a wireless terminal device in smart city (smart city), a wireless terminal device in smart home (smart home), etc. This embodiment does not limit the specific technology and specific device form adopted by the terminal.

[0075] In some examples, the network device may be a base station, a satellite or other device, which is not specifically limited in this embodiment. The network device may be an entity on the network side for transmitting or receiving signals. For example, the network device may be a communication satellite, an evolved NodeB (eNB), a transmission reception point (TRP), a next generation NodeB (gNB) in an NR system, a base station in other future mobile communication systems, or an access node in a wireless fidelity (WiFi) system. The embodiments of the present disclosure do not limit the specific technology and specific device form adopted by the network device. The network device provided in this embodiment may be composed of a centralized unit (CU) and a distributed unit (DU), wherein the CU may also be referred to as a control unit. The CU-DU structure may be used to split the protocol layer of the network device, such as the base station, and the functions of some protocol layers are placed in the CU for centralized control, and the functions of the remaining part or all of the protocol layers are distributed in the DU, and the DU is centrally controlled by the CU.

[0076] In some examples, the terminal does not support bearerless attachment. In some embodiments, during the process of the terminal initiating an attachment (ATTACH) to the 4G network, the network device may receive an attachment request sent by the terminal, and if the terminal does not support bearerless attachment, the attachment request message sent by the terminal to the network device must carry an ESM PDN CONNECTIVITYREQUEST. The network device may receive the attachment request message, and may choose to agree or refuse to establish a PDN connection. When choosing to refuse to establish a PDN connection, the PDN CONNECTIVITY REJECT may be carried in the attachment rejection (ATTACH REJECT) message, and may include a corresponding rejection reason value. Accordingly, the terminal may receive an attachment rejection message sent by the network device, and the attachment rejection message includes a rejection reason value, and the rejection reason value may be used to indicate the reason information for refusing to establish a PDN connection, such as the attachment rejection message carries a message (PDN CONNECTIVITY REJECT) for refusing to establish a PDN connection, and the message for refusing to establish a PDN connection includes a rejection reason value.

[0077] Step 102: If the rejection reason value included in the attach rejection message is a target reason value, then perform anti-attack processing based on the rejection reason value.

[0078] In some examples, the target cause value may be some specific cause values, which may very likely cause the terminal to be unable to establish a bearer for a long time and thus be unable to obtain the corresponding service for a long time.

[0079] In some embodiments of the present disclosure, the target cause value may include one of the following A to F:

[0080] A. The first value is used to indicate that an IPv4 type PDN connection request is allowed; such as #50 "PDN typeIPv4only allowed", the corresponding APN can only initiate a PDN connection establishment process of type IPv4.

[0081] B. The second value is used to indicate that an IPv6 type PDN connection request is allowed; such as #51 "PDN typeIPv6only allowed", the corresponding APN can only initiate a PDN connection establishment process of type IPv6.

[0082] C. The third value is used to indicate that it is allowed to initiate a PDN connection request of type IPv4v6; such as #57 "PDNtype IPv4v6only allowed", the corresponding APN can only initiate a PDN connection establishment process of type IPv4v6.

[0083] D. The fourth value is used to indicate that non-IP type PDN connection requests are allowed; such as #58 "PDNtype non-IP only allowed", the corresponding APN can only initiate a non-IP type PDN connection establishment process.

[0084] E. The fifth value is used to indicate that an Ethernet type PDN connection request is allowed; such as #61 "PDNtype Ethernet only allowed", the corresponding APN can only initiate a PDN connection establishment process of Ethernet type.

[0085] F. The sixth value is used to indicate that the number of activated EPS bearers has reached the maximum number of bearers supported by the network; such as #65 "maximum number of EPS bearers reached".

[0086] For example, Figure 4 As shown, taking the terminal as UE as an example, the UE initiates an attachment process on the 4G network, and the UE does not support bearerless attachment. The network sends a plaintext ATTACH REJECT message to the UE, which carries a PDN CONNECTIVITY REJECT message. When the ESM rejection reason value carried in the PDN CONNECTIVITY REJECT is one of #50, #51, #57, #58, #61, and #65, the UE performs anti-attack processing based on the rejection reason value, thereby quickly restoring service capabilities.

[0087] Compared with the current related technologies, the disclosed embodiments can perform effective anti-attack processing when a specific rejection reason value is carried in the attachment rejection message, reduce the situation where the terminal cannot establish a bearer for a long time, and enable the terminal to quickly restore business capabilities to obtain corresponding services. For example, it can effectively solve the problem that the attacker sends a plain text ATTACH REJECT carrying PDN CONNECTIVITY REJECT and carrying the ESM rejection reason value #50 / #51 / #57 / #58 / #61 / #65, causing the terminal to be unable to establish the required type of bearer for a long time and can only rely on manual intervention by the user to recover, thereby improving the user experience.

[0088] Furthermore, there may be multiple optional methods for performing anti-attack processing based on the rejection reason value. As an optional method, performing anti-attack processing based on the rejection reason value may specifically include: ignoring the rejection reason value; or, discarding the attachment rejection message; or, discarding the message that refuses to establish a PDN connection.

[0089] For example, based on Figure 1 and Figure 2 In the example in Figure 1, the attacker attracts the UE to stay on the fake base station by means of signal amplification, and the TAI configured in the fake base station cell is different from that in the real network, triggering the UE to initiate the location update process. The UE sends a TRACKING AREA UPDATE REQUEST to the fake base station, and the fake base station sends a TRACKING AREA UPDATE REJECT to the UE, which may carry a reason value of #9 / #10, etc. At this time, the UE needs to re-initiate an ATTACH REQUEST according to the protocol, such as Figure 5 As shown, since the UE does not support bearerless attachment, it is necessary to carry PDN CONNECTIVITY REQUEST. The attacker sends an ATTACH REJECT message (carrying PDN CONNECTIVITY REJECT, which carries one of the ESM rejection reason values ​​#50, #51, #57, #58, #61, and #65) to the UE through a fake base station. At this time, the UE, according to the method of this embodiment, believes that it may be attacked based on the ESM rejection reason value, and may ignore the ESM rejection reason value, or discard the ATTACH REJECT message, or discard the PDN CONNECTIVITY REJECT message, so that the UE does not execute the record of the type of PDN connection allowed to be established or the maximum number of EPS bearers allowed to be established based on the ESM rejection reason value. In this way, when the UE resides on the real 4G network again, it will not be unable to initiate the attachment process due to the recorded information, and the terminal can quickly restore the service capability to obtain the corresponding service, without relying on manual intervention by the user for recovery, which can improve the user experience.

[0090] Based on Figure 5 As shown in the examples, in some examples, after receiving the ATTACH REJECT message, the UE can trigger a change of cell residence by lowering the priority of the current cell, or prohibiting access to the current cell, or prohibiting access to the cell corresponding to the current tracking area identifier (TAI), so as to reduce the possibility of staying on a fake base station, protect user safety, and improve the quality of communication services.

[0091] Based on Figure 5 As shown in the example, in some examples, the UE can also count the number of executions of the anti-attack processing based on the target reason value (such as one of #50, #51, #57, #58, #61, and #65) received each time within a preset time period, and cancel the execution of the anti-attack processing after the number of executions reaches a preset threshold.

[0092] For example, the UE can choose to set a duration (i.e., a preset duration) and a maximum number of times (i.e., a preset number threshold). Within the duration, when the target scenario (such as the UE receives an ATTACH REJECT message (carrying PDN CONNECTIVITY REJECT, which carries one of the ESM rejection reason values ​​#50, #51, #57, #58, #61, and #65), the UE ignores the rejection reason value, or discards the attachment rejection message, or discards the message that refuses to establish a PDN connection, etc.) occurs for the maximum number of times, in order to avoid communication processing that may affect normal business, it can be processed according to the protocol specification and the execution of this anti-attack processing can be canceled.

[0093] As another optional method, anti-attack processing is performed based on the rejection reason value, which may specifically include: while recording the first information corresponding to the rejection reason value, starting a timer for timing, the first information includes the type of PDN connection allowed to be established or the maximum number of EPS bearers allowed to be established; when the timer reaches the timing duration, clearing the recorded first information.

[0094] For example, based on Figure 1 and Figure 2 In the example in Figure 1, the attacker attracts the UE to stay on the fake base station by means of signal amplification, and the TAI configured in the fake base station cell is different from that in the real network, triggering the UE to initiate the location update process. The UE sends a TRACKING AREA UPDATE REQUEST to the fake base station, and the fake base station sends a TRACKING AREA UPDATE REJECT to the UE, which may carry a reason value of #9 / #10, etc. At this time, the UE needs to re-initiate an ATTACH REQUEST according to the protocol, such as Figure 6 As shown, since the UE does not support bearerless attachment, it is necessary to carry PDN CONNECTIVITY REQUEST. The attacker sends an ATTACH REJECT message to the UE through a fake base station (carrying PDN CONNECTIVITY REJECT, where the ESM rejection reason value is one of #50, #51, #57, #58, #61, and #65). At this time, the UE records the type of PDN connection that the current APN allows to initiate or the maximum number of EPS bearers allowed to be established on the 4G network in accordance with the protocol, and starts a timer according to the method of this embodiment. If the timer times out, the recorded type of PDN connection that the current APN allows to initiate or the maximum number of EPS bearers allowed to be established on the 4G network is cleared. In this way, the UE will not be unable to initiate the attachment process for a long time due to the recorded information, and will not rely on manual intervention by the user for recovery, which can improve the user experience.

[0095] Based on Figure 6 As shown in the examples, in some examples, after receiving the ATTACH REJECT message, the UE can trigger a change of cell residence by lowering the priority of the current cell, or prohibiting access to the current cell, or prohibiting access to the cell corresponding to the current tracking area identifier (TAI), so as to reduce the possibility of staying on a fake base station, protect user safety, and improve the quality of communication services.

[0096] Based on Figure 6 As shown in the example, in some examples, the UE can also count the number of executions of the anti-attack processing based on the target reason value (such as one of #50, #51, #57, #58, #61, and #65) received each time within a preset time period, and cancel the execution of the anti-attack processing after the number of executions reaches a preset threshold.

[0097] For example, the UE can choose to set a duration (i.e., a preset duration) and a maximum number of times (i.e., a preset number threshold). Within the duration, when the target scenario (such as the UE receives an ATTACH REJECT message (carrying PDN CONNECTIVITY REJECT, which carries one of the ESM rejection reason values ​​#50, #51, #57, #58, #61, and #65), the UE starts a timer and clears the record of the type of PDN connection allowed to be initiated by the current APN or the maximum number of EPS bearers allowed to be established on the 4G network after the timer expires) occurs to the set maximum number of times, in order to avoid communication processing that may affect normal business, the timer is no longer started and the execution of this anti-attack processing is canceled.

[0098] As another optional method, anti-attack processing is performed based on the rejection reason value, which may specifically include: recording second information corresponding to the rejection reason value, the second information including the type of PDN connection allowed to be established or the maximum number of EPS bearers allowed to be established; when registration is successful on any network standard, clearing the recorded second information.

[0099] For example, based on Figure 1 and Figure 2 In the example in Figure 1, the attacker attracts the UE to stay on the fake base station by means of signal amplification, and the TAI configured in the fake base station cell is different from that in the real network, triggering the UE to initiate the location update process. The UE sends a TRACKING AREA UPDATE REQUEST to the fake base station, and the fake base station sends a TRACKING AREA UPDATE REJECT to the UE, which may carry a reason value of #9 / #10, etc. At this time, the UE needs to re-initiate an ATTACH REQUEST according to the protocol, such as Figure 7As shown, since the UE does not support bearerless attachment, it is necessary to carry PDN CONNECTIVITY REQUEST. The attacker sends an ATTACH REJECT message to the UE through a fake base station (carrying PDN CONNECTIVITY REJECT, in which the ESM rejection reason value is one of #50, #51, #57, #58, #61, and #65). At this time, the UE records the type of PDN connection that the current APN allows to initiate or the maximum number of EPS bearers allowed to be established on the 4G network in accordance with the protocol, and according to the method of this embodiment, when the UE successfully registers on any network standard (such as the UE successfully attaches to the 4G network using other APNs or specified PDN types, or successfully registers on other 2G, 3G, 5G and other network standards), it is considered to have registered on the real network, and then the recorded type of PDN connection that the current APN allows to initiate or the maximum number of EPS bearers allowed to be established on the 4G network can be cleared. This prevents the UE from being affected by the recorded information when it needs to initiate the attachment process again in the future, and does not rely on manual intervention by the user for recovery, which can improve the user experience.

[0100] Based on Figure 7 As shown in the examples, in some examples, after receiving the ATTACH REJECT message, the UE can trigger a change of cell residence by lowering the priority of the current cell, or prohibiting access to the current cell, or prohibiting access to the cell corresponding to the current tracking area identifier (TAI), so as to reduce the possibility of staying on a fake base station, protect user safety, and improve the quality of communication services.

[0101] Figure 8 is a block diagram of a communication device according to some embodiments of the present disclosure. Figure 8 The device includes: a receiving module 21 and a processing module 22.

[0102] The receiving module 21 is configured to receive an attach rejection message sent by a network device, wherein the attach rejection message includes a rejection reason value, and the rejection reason value is used to indicate reason information for rejecting establishment of a PDN connection;

[0103] The processing module 22 is configured to perform anti-attack processing based on the rejection reason value if the rejection reason value is a target reason value.

[0104] In some embodiments, the target cause value includes one of the following:

[0105] A first value, where the first value is used to indicate that an IPv4 type PDN connection request is allowed to be initiated;

[0106] A second value, where the second value is used to indicate that an IPv6 type PDN connection request is allowed to be initiated;

[0107] A third value, where the third value is used to indicate that an IPv4v6 type PDN connection request is allowed to be initiated;

[0108] A fourth value, where the fourth value is used to indicate that a non-IP type PDN connection request is allowed to be initiated;

[0109] a fifth value, where the fifth value is used to indicate that an Ethernet type PDN connection request is allowed to be initiated;

[0110] A sixth value is used to indicate that the number of activated EPS bearers has reached the maximum number of bearers supported by the network.

[0111] In some embodiments, the attach rejection message carries a message of rejecting to establish a PDN connection, and the message of rejecting to establish a PDN connection includes the rejection reason value.

[0112] In some embodiments, the processing module 22 is specifically configured to ignore the rejection reason value; or discard the attachment rejection message; or discard the message for refusing to establish a PDN connection.

[0113] In some embodiments, the processing module 22 is specifically configured to start a timer for timing while recording the first information corresponding to the rejection reason value, wherein the first information includes the type of PDN connection allowed to be established or the maximum number of EPS bearers allowed to be established; when the timer reaches the timing duration, the recorded first information is cleared.

[0114] In some embodiments, the processing module 22 is further configured to count the number of executions of the anti-attack processing based on the target cause value received each time within a preset time period, and cancel the execution of the anti-attack processing after the number of executions reaches a preset threshold.

[0115] In some embodiments, the processing module 22 is specifically configured to record second information corresponding to the rejection reason value, wherein the second information includes the type of PDN connection allowed to be established or the maximum number of EPS bearers allowed to be established; when registration is successful on any network standard, the recorded second information is cleared.

[0116] In some embodiments, the processing module 22 is further configured to trigger a change of the cell to be camped on by lowering the priority of the current camped cell, or prohibiting access to the current camped cell, or prohibiting access to the cell corresponding to the current tracking area identifier TAI.

[0117] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0118] Fig. 9 1 is a schematic diagram of the structure of a communication device 1800 provided in this embodiment. The communication device 1800 may be a terminal device, a network device, a chip, a chip system, or a processor that supports the network device to implement the above method, or a chip, a chip system, or a processor that supports the user equipment to implement the above method. The device may be used to implement the method described in the above method embodiment, and the details may refer to the description in the above method embodiment.

[0119] The communication device 1800 includes: a transceiver; a memory; and a processor, which is connected to the transceiver and the memory respectively, and is configured to control the wireless signal reception and transmission of the transceiver by executing computer executable instructions on the memory, and can implement the functions of any of the above method embodiments.

[0120] The communication device 1800 may include one or more processors 1801. The processor 1801 may be a general-purpose processor or a dedicated processor, etc. For example, it may be a baseband processor or a central processing unit. The baseband processor may be used to process the communication protocol and communication data, and the central processing unit may be used to control the communication device (such as a base station, a baseband chip, a terminal device, a terminal device chip, a DU or a CU, etc.), execute a computer program, and process the data of the computer program.

[0121] Optionally, the communication device 1800 may further include one or more memories 1802, on which a computer program 1804 may be stored, and the processor 1801 executes the computer program 1804, so that the communication device 1800 performs the method described in the above method embodiment. Optionally, data may also be stored in the memory 1802. The communication device 1800 and the memory 1802 may be provided separately or integrated together.

[0122] Optionally, the communication device 1800 may further include a transceiver 1805 and an antenna 1806. The transceiver 1805 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, etc., and is used to implement a transceiver function. The transceiver 1805 may include a receiver and a transmitter, the receiver may be referred to as a receiver or a receiving circuit, etc., and is used to implement a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, etc., and is used to implement a transmitting function.

[0123] Optionally, the communication device 1800 may further include one or more interface circuits 1807. The interface circuit 1807 is used to receive code instructions and transmit them to the processor 1801. The processor 1801 executes the code instructions to enable the communication device 1800 to execute the method described in the above method embodiment.

[0124] In one implementation, the processor 1801 may include a transceiver for implementing the receiving and sending functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing the receiving and sending functions may be separate or integrated. The above-mentioned transceiver circuit, interface, or interface circuit may be used for reading and writing code / data, or the above-mentioned transceiver circuit, interface, or interface circuit may be used for transmitting or delivering signals.

[0125] In one implementation, the processor 1801 may store a computer program 1803, which runs on the processor 1801 and enables the communication device 1800 to perform the method described in the above method embodiment. The computer program 1803 may be fixed in the processor 1801, in which case the processor 1801 may be implemented by hardware.

[0126] In one implementation, the communication device 1800 may include a circuit that can implement the functions of sending or receiving or communicating in the aforementioned method embodiments. The processor and transceiver described in the present disclosure may be implemented in an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc. The processor and transceiver may also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (nMetal-oxide-semiconductor, NMOS), P-type metal oxide semiconductor (positive channelmetal oxide semiconductor, PMOS), bipolar junction transistor (bipolar junction transistor, BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

[0127] The communication device described in the above embodiments may be a network device or a user device, but the scope of the communication device described in the present disclosure is not limited thereto, and the structure of the communication device may not be limited thereto. Fig. 9 The communication device may be an independent device or may be part of a larger device. For example, the communication device may be:

[0128] (1) Independent integrated circuit IC, or chip, or chip system or subsystem;

[0129] (2) having a set of one or more ICs, and optionally, the IC set may also include a storage component for storing data and computer programs;

[0130] (3) ASIC, such as modem;

[0131] (4) Modules that can be embedded in other devices;

[0132] (5) Receivers, terminal devices, intelligent terminal devices, cellular phones, wireless devices, handheld devices, mobile units, vehicle-mounted devices, network devices, cloud devices, artificial intelligence devices, etc.;

[0133] (6)Others

[0134] Based on the above embodiments, this embodiment also provides a chip, including at least one processor and a communication interface; the communication interface is used to receive signals input into the chip or signals output from the chip, and the processor communicates with the communication interface and implements the method shown above through logic circuits or executing code instructions.

[0135] Fig.10 FIG. 1 is a schematic diagram of the structure of a chip 1000 for implementing the above communication method provided in this embodiment. Fig.10 The chip 1000 includes at least one communication interface 1001 and a processor 1002. The communication interface 1001 is used to receive signals input into the chip 1000 or signals output from the above chip 1000. The processor 1002 communicates with the communication interface 1001 and implements the communication method described in the above embodiments of the present disclosure through logic circuits or executing code instructions.

[0136] Those skilled in the art may also understand that the various illustrative logical blocks and steps listed in the embodiments of the present disclosure may be implemented by electronic hardware, computer software, or a combination of the two. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the functions described for each specific application, but such implementation should not be understood as exceeding the scope of protection of the embodiments of the present disclosure.

[0137] The present disclosure also provides a computer-readable storage medium having a computer program stored thereon, which implements the functions of any of the above method embodiments when executed by a processor of a computer.

[0138] The present disclosure also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer. If a computer program is stored thereon, the computer program product implements the functions of any of the above method embodiments when executed by a processor of a computer.

[0139] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, the process or function according to the embodiment of the present disclosure is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. Available media may be magnetic media (eg, floppy disks, hard disks, tapes), optical media (eg, high-density digital video discs (DVD)), or semiconductor media (eg, solid state disks (SSD)).

[0140] Those skilled in the art can understand that the various numerical numbers such as first and second involved in the present disclosure are only used for distinction for convenience of description and are not used to limit the scope of the embodiments of the present disclosure, and also indicate the order of precedence.

[0141] At least one in the present disclosure may also be described as one or more, and a plurality may be two, three, four or more, which is not limited in the present disclosure. In the embodiments of the present disclosure, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", etc., and there is no order of precedence or size between the technical features described by the "first", "second", "third", "A", "B", "C" and "D".

[0142] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0143] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0144] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

[0145] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present disclosure can be achieved, and this document is not limited here.

[0146] In addition, it should be understood that the various embodiments described in the present disclosure may be implemented separately or in combination with other embodiments when the scheme permits.

[0147] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments applied herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0148] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0149] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A communication method, characterized in that: include: Receiving an attach reject message sent by a network device, wherein the attach reject message includes a reject reason value, and the reject reason value is used to indicate reason information for rejecting establishment of a packet data network PDN connection; If the rejection reason value is a target reason value, anti-attack processing is performed based on the rejection reason value.

2. The method according to claim 1, characterized in that The target reason value includes one of the following: A first value, where the first value is used to indicate that an IPv4 type PDN connection request is allowed to be initiated; A second value, where the second value is used to indicate that an IPv6 type PDN connection request is allowed to be initiated; A third value, where the third value is used to indicate that an IPv4v6 type PDN connection request is allowed to be initiated; A fourth value, where the fourth value is used to indicate that a non-Internet Protocol (non-IP) type PDN connection request is allowed to be initiated; A fifth value, where the fifth value is used to indicate that an Ethernet type PDN connection request is allowed to be initiated; A sixth value is used to indicate that the number of activated evolved packet system EPS bearers has reached the maximum number of bearers supported by the network.

3. The method according to claim 1, characterized in that The attach rejection message carries a message of rejecting the establishment of the PDN connection, and the message of rejecting the establishment of the PDN connection includes the rejection reason value; Performing anti-attack processing based on the rejection reason value includes: Ignore the rejection reason value; or, discarding the attach reject message; or, The message for refusing to establish the PDN connection is discarded.

4. The method according to claim 1, characterized in that: Performing anti-attack processing based on the rejection reason value includes: Recording first information corresponding to the rejection reason value, and starting a timer for timing, wherein the first information includes a type of PDN connection allowed to be established or a maximum number of EPS bearers allowed to be established; Determine that the timer reaches the timing duration, and clear the recorded first information.

5. The method according to claim 3 or 4, characterized in that: The method further comprises: The execution times of the anti-attack processing are counted based on the target cause value received each time within a preset time period, and the execution of the anti-attack processing is canceled after the execution times reach a preset times threshold.

6. The method according to claim 1, characterized in that Performing anti-attack processing based on the rejection reason value includes: Recording second information corresponding to the rejection reason value, where the second information includes a type of PDN connection allowed to be established or a maximum number of EPS bearers allowed to be established; Determine that the registration is successful on any network standard, and clear the recorded second information.

7. The method according to claim 1, characterized in that The method further comprises: By lowering the priority of the current resident cell, or prohibiting access to the current resident cell, or prohibiting access to the cell corresponding to the current tracking area identifier TAI, a change of resident cell is triggered.

8. A communication device, characterized in that: include: A receiving module, configured to receive an attachment rejection message sent by a network device, wherein the attachment rejection message includes a rejection reason value, and the rejection reason value is used to indicate reason information for rejecting establishment of a packet data network PDN connection; The processing module is configured to perform anti-attack processing based on the rejection reason value if the rejection reason value is a target reason value.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A communication device, wherein: include: Transceiver; Memory; A processor is connected to the transceiver and the memory, respectively, and is configured to control the wireless signal reception and transmission of the transceiver by executing computer executable instructions on the memory, and can implement any one of the methods of claims 1 to 7.

11. A chip, characterized in that: It includes at least one processor and a communication interface; the communication interface is used to receive a signal input to the chip or a signal output from the chip, and the processor communicates with the communication interface and implements the method as described in any one of claims 1 to 7 through a logic circuit or executing code instructions.

Images