Communication method, device and system, communication equipment and readable storage medium

Abstract

The invention relates to a communication method, device and system, communication equipment and a readable storage medium. The method comprises the steps that in the process that a target network element entity updates a configuration file to a network storage function entity, under the condition that the network storage function entity receives a configuration file updating request sent by the target network element entity, a to-be-updated field content list is acquired according to the configuration file updating request; obtaining a security reputation evaluation result of the security reputation evaluation device on the target network element entity; according to the security level requirement of each to-be-updated field content in the to-be-updated field content list, determining the security creditworthiness requirement of the updating action corresponding to each to-be-updated field content; according to the security reputation evaluation result and the security reputation requirement, judging whether to execute a configuration file updating action or not; and returning the execution result to the target network element entity. By adopting the method, the operation safety of the 5G core network can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to a communication method, apparatus, system, communication equipment and readable storage medium. Background Art

[0002] NF (Network Function) refers to various network functional entities in the 5G network, each of which is responsible for specific tasks and functions. NRF (Network Repository Function) refers to a key network function of 5G. Its main function is to serve as the registration and discovery center of network functional entities (NFs), responsible for providing service registration, discovery, authorization, and maintaining available NF instance information. During the NF registration process, the NF instance will provide its configuration file to NRF. If an NF is hacked, the configuration information of the NF may be maliciously modified, such as modifying the network slice-related identifier, so that the attacker can jump from one slice to another, obtain sensitive information or affect the services of other slices. Therefore, if the NF is hacked and controlled, the configuration file can be changed arbitrarily, which will bring serious risks to the safe operation of the 5G core network.

[0003] At present, in the 5G private network scenario, 5GC network elements may be deployed down to the customer's room. The risk of unauthorized access to 5GC due to physical control of the network elements is high. Therefore, the traditional communication methods pose serious risks to the safe operation of the 5G core network. Summary of the invention

[0004] Based on this, it is necessary to provide a communication method, apparatus, system, communication equipment, computer-readable storage medium and computer program product to address the above-mentioned technical problems, which can improve the security of 5G core network operation.

[0005] In a first aspect, the present application provides a communication method, which is applied to a network storage function entity NRF, including:

[0006] In the process of the target network element entity requesting the network storage function entity to update the configuration file, when the network storage function entity receives the configuration file update request sent by the target network element entity, the network storage function entity obtains the list of field contents to be updated according to the configuration file update request;

[0007] Obtaining a security reputation evaluation result of a target network element entity by a security reputation evaluation device;

[0008] Determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the field content list to be updated;

[0009] Determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement;

[0010] The execution result is returned to the target network element entity.

[0011] In one embodiment, judging whether to perform a configuration file update action according to a security reputation evaluation result and a security reputation requirement includes:

[0012] When the security reputation evaluation result is lower than the security reputation requirement, determining not to perform the configuration file update action;

[0013] When the security reputation evaluation result is not lower than the security reputation requirement, it is determined to execute the configuration file update action.

[0014] In one embodiment, the communication method further comprises:

[0015] Determining whether the configuration file update request belongs to a heartbeat maintenance operation according to a preset condition;

[0016] If yes, directly execute the configuration file update action;

[0017] If not, continue to execute the step of determining whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement corresponding to the content of the field to be updated.

[0018] In one embodiment, according to the security level requirement of each field content to be updated in the field content list to be updated, the security reputation requirement of the update action corresponding to each field content to be updated is determined, including:

[0019] Obtaining a preset mapping relationship, where the preset mapping relationship is used to characterize the corresponding relationship between the security level requirement and the security reputation requirement;

[0020] The preset mapping relationship is queried to obtain the security reputation requirement of each field content to be updated; the highest security reputation requirement of each field content to be updated is used as the security reputation requirement of the update action corresponding to each field content to be updated.

[0021] In one embodiment, the step of constructing the preset mapping relationship includes:

[0022] When receiving a registration request from the target network element entity, obtaining a configuration file of the target network element entity according to the registration request;

[0023] The security level of multiple field contents in the configuration file is divided into different levels to obtain the security level requirements corresponding to the multiple field contents;

[0024] A preset mapping relationship is constructed based on the correspondence between the security level requirements and the security reputation requirements corresponding to the contents of multiple fields.

[0025] In a second aspect, the present application further provides a communication device, applied to a network storage function entity NRF, comprising:

[0026] A first acquisition module is used to acquire a list of to-be-updated field contents according to the configuration file update request when the network storage function entity receives a configuration file update request sent by the target network element entity in a process of the target network element entity updating the configuration file to the network storage function entity;

[0027] A second acquisition module is used to obtain a security reputation evaluation result of a target network element entity by a security reputation evaluation device;

[0028] A first determination module, configured to determine the security reputation requirement of the update action corresponding to each to-be-updated field content according to the security level requirement of each to-be-updated field content in the to-be-updated field content list;

[0029] The second determination module is used to determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement; and return the execution result to the target network element entity.

[0030] In a third aspect, the present application provides a communication method, which is applied to a network element entity NF, including:

[0031] In the process of the network element entity requesting the network storage function entity to update the configuration file, a configuration file update request is sent to the network storage function entity to instruct the network storage function entity to obtain a list of field contents to be updated according to the configuration file update request and obtain a security reputation evaluation result of the network element entity by the security reputation evaluation device when the configuration file update request is received; the list of field contents to be updated and the security reputation evaluation result are used to instruct the network storage function entity to determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the list of field contents to be updated, and determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement; the execution result is used to return to the network element entity;

[0032] Receive the execution result returned by the network storage function entity request.

[0033] In a fourth aspect, the present application provides a communication device, applied to a network element entity NF, including:

[0034] A sending module, used for sending a configuration file update request to the network storage function entity in the process of the network element entity requesting the network storage function entity to update the configuration file, so as to instruct the network storage function entity to obtain a list of field contents to be updated according to the configuration file update request and obtain a security reputation evaluation result of the network element entity by the security reputation evaluation device when receiving the configuration file update request, wherein the list of field contents to be updated and the security reputation evaluation result are used to instruct the network storage function entity to determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the list of field contents to be updated, and to judge whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement; the execution result is used to return to the network element entity;

[0035] The receiving module is used to receive the execution result returned by the network storage function entity request.

[0036] In a fifth aspect, the present application also provides a communication system, the system comprising:

[0037] The target network element entity is connected to the network storage function entity and sends a configuration file update request to the network storage function entity;

[0038] A security reputation evaluation device, configured to respond to a security reputation evaluation request for a target network element entity initiated by a network storage function entity, perform a security reputation evaluation on the target network element entity, and obtain a security reputation evaluation result;

[0039] A network storage functional entity is used to obtain a list of field contents to be updated according to the configuration file update request upon receiving a configuration file update request sent by the target network element entity in the process of the target network element entity updating the configuration file to the network storage functional entity; obtain a security reputation assessment result of the target network element entity by a security reputation assessment device; determine the security reputation requirement of the update action corresponding to each field content to be updated according to the highest security level requirement of each field content to be updated in the list of field contents to be updated; determine whether to execute the configuration file update action according to the security reputation assessment result and the security reputation requirement; and return the execution result to the target network element entity.

[0040] In a sixth aspect, the present application further provides a communication device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0041] In the process of the target network element entity updating the configuration file to the network storage function entity, when the network storage function entity receives the configuration file update request sent by the target network element entity, the network storage function entity obtains the list of field contents to be updated according to the configuration file update request;

[0042] Obtaining a security reputation evaluation result of a target network element entity by a security reputation evaluation device;

[0043] Determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the field content list to be updated;

[0044] Determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement;

[0045] The execution result is returned to the target network element entity.

[0046] In a seventh aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0047] In the process of the target network element entity updating the configuration file to the network storage function entity, when the network storage function entity receives the configuration file update request sent by the target network element entity, the network storage function entity obtains the list of field contents to be updated according to the configuration file update request;

[0048] Obtaining a security reputation evaluation result of a target network element entity by a security reputation evaluation device;

[0049] Determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the field content list to be updated;

[0050] Determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement;

[0051] The execution result is returned to the target network element entity.

[0052] In an eighth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0053] In the process of the target network element entity updating the configuration file to the network storage function entity, when the network storage function entity receives the configuration file update request sent by the target network element entity, the network storage function entity obtains the list of field contents to be updated according to the configuration file update request;

[0054] Obtaining a security reputation evaluation result of a target network element entity by a security reputation evaluation device;

[0055] Determine the security reputation requirement of the update action corresponding to each field content to be updated according to the highest security level requirement of each field content to be updated in the field content list to be updated;

[0056] Determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement;

[0057] The execution result is returned to the target network element entity.

[0058] The above-mentioned communication method, apparatus, communication equipment, computer-readable storage medium and computer program product, when receiving a configuration file update request sent by the target network element entity, obtains a list of field contents to be updated according to the configuration file update request, and obtains the security reputation evaluation result of the target network element entity by the security reputation evaluation device. Since each field content to be updated in the list of field contents to be updated has a corresponding security reputation requirement, the security reputation requirement is used to characterize the security level requirement of the field content to be updated, therefore, by comparing the security reputation evaluation result with the security reputation requirement, it can be determined whether to execute the configuration file update action, and the execution result can be returned to the target network element entity so that the target network element entity can know the execution result in time; this method of performing security reputation judgment on the update action after the target network element entity initiates a configuration file update request ensures that the configuration file update action can only be executed when the security reputation of the target network element entity meets the security reputation requirement of the update action, which is conducive to reducing the security risk of maliciously changing the configuration file of the target network element entity, thereby facilitating the security of the operation of the 5G core network. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0060] Figure 1 An application environment diagram of a communication method in an embodiment;

[0061] Figure 2 is a flow chart of a communication method in one embodiment;

[0062] Figure 3 is a schematic diagram of a sub-flow chart of step 208 in one embodiment;

[0063] Figure 4 is a flow chart of a communication method in another embodiment;

[0064] Figure 5 is a schematic diagram of the overall flow of a communication method in an embodiment;

[0065] Figure 6is a structural block diagram of a communication device in one embodiment;

[0066] Figure 7 is a structural block diagram of a communication device in another embodiment;

[0067] Figure 8 FIG. 4 is a diagram showing the internal structure of a communication device in one embodiment. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0069] Figure 1 A schematic diagram of an application scenario of a communication method provided in an embodiment of the present application. Figure 1 As shown, in this scenario, there are a first user terminal 100, a second user terminal 200 and an access network device 300. The first user terminal 100 and the second user terminal 200 perform data transmission via a network, and the first user terminal 100 and the access network device 300 perform data transmission via a network.

[0070] Among them, the access network device 300 can be a base station (Base Transceiver Station, BTS) in Global System of Mobilecommunication (GSM) or Code Division Multiple Access (CDMA), or a base station (NodeB, NB) in Wideband Code Division Multiple Access (WCDMA), or an evolved base station (Evolutional Node B, eNB or eNodeB) in LTE, or a relay station or access point, or a base station in a 5G network, etc., which is not limited here.

[0071] The first user terminal 100 and the second terminal 200 may be wireless terminals, which may be devices that provide voice and / or other business data connectivity to users, or handheld devices with wireless connection functions, or other processing devices connected to wireless modems. The wireless terminal may communicate with one or more core networks via a radio access network (Radio Access Network, referred to as RAN). The wireless terminal may be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, for example, a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device, which exchanges language and / or data with the radio access network. The wireless terminal may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, an access terminal, a user terminal, a user agent, a user device or user equipment, which is not limited here.

[0072] In an exemplary embodiment, Figure 2 As shown, a communication method is provided, and the method is applied to a network storage function entity (NRF) as an example for description, including the following steps 202 to 208. Among them:

[0073] Step 202: In the process of the target network element entity updating the configuration file to the network storage function entity, when the network storage function entity receives the configuration file update request sent by the target network element entity, it obtains a list of field contents to be updated according to the configuration file update request.

[0074] The target network element entity refers to a network element entity that has been registered in the network storage functional entity. The configuration file refers to a file containing configuration information related to the target network element entity. Usually, the configuration file is provided by the target network element entity to the network storage functional entity during the registration process. Configuration information includes but is not limited to NF instance ID, NF type, PLMN (Public Land Mobile Network) ID, network slice related identifiers (such as S-NSSAI, NSI ID), NF's FQDN (Fully Qualified Domain Name) or IP address, NF capacity information, NF priority information, NF specific service authorization information, supported service names, endpoint addresses of each instance supporting services, identification of stored data / information, other service parameters (such as DNN, Data Network Name, Access Point Name), notification endpoints for each notification type of interest to the NF service), location information of the NF instance, Tracking Area Identity (TAI), Routing Indicator (for UDM (Unified Data Management) and AUSF (Authentication Server Function)), one or more GUAMI (Globally Unique AMF Identifier) ​​(for AMF, Access and Mobility Management Function), SMF (Session Management Function) regional identity (for UPF, User Plane Function, user plane function), UDM group ID, SUPI (Subscription Permanent Identifier, subscription permanent identifier) ​​range, GPSI (Global Positioning System IMSI, which is a combination of the global positioning system GPS and the international mobile subscriber identity code IMSI) range, external group identifier range and other information. The communication method proposed in the embodiment of the present application is mainly used for the process of updating the configuration file from the target network element entity to the network storage function entity. A configuration file update request refers to a request to change the configuration information in the configuration file, or to replace the configuration file. In some embodiments, it can be determined according to the update identifier in the configuration file update request to change part of the configuration information, or to replace the entire configuration file.For example, if the configuration file update request indicates that the network slice related identifier is to be modified, the content of the field to be updated is the network slice related identifier in the configuration file.

[0075] When receiving a configuration file update request sent by the target network element entity, the network storage function entity determines a corresponding list of field contents to be updated according to the content indicated by the configuration file update request. The list of field contents to be updated includes at least one field content to be updated, and the field content to be updated is the configuration information that needs to be updated in the configuration file.

[0076] Step 204: Obtain the security reputation evaluation result of the target network element entity by the security reputation evaluation device.

[0077] The security reputation evaluation device refers to a device that performs security reputation evaluation on a network element entity. In some embodiments, the security reputation evaluation device may include NWDAF (Network Data Analytics Function, 5G network data analysis function) or other third-party security detection and analysis systems.

[0078] The security reputation evaluation result is used to characterize the security reputation of the target network element entity. For example, the security reputation evaluation result may include multiple security reputation levels.

[0079] In some embodiments, upon receiving a configuration file update request sent by a target network element entity, the network storage function entity may initiate a security reputation evaluation request for the target network element entity to the security reputation evaluation device, and obtain a security reputation evaluation result returned by the security reputation evaluation device.

[0080] In some other embodiments, the network storage function entity subscribes to the security reputation evaluation device for the target network element entity, so that the security reputation evaluation result for the target network element entity sent by the security reputation evaluation device can be obtained according to the subscription period. The security reputation evaluation result for the target network element entity that the network storage function entity can obtain when receiving a configuration file update request sent by the target network element entity is the latest security reputation evaluation result obtained from the security reputation evaluation device.

[0081] In some other embodiments, after the network storage functional entity subscribes to the security reputation assessment result for the target network element entity to the security reputation assessment device, the security reputation assessment device, in addition to periodically returning the security reputation assessment result, can also send the changed security reputation assessment result to the network storage functional entity when the security reputation assessment result for the target network element entity changes.

[0082] Step 206 , determining the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the field content to be updated list.

[0083] The security level requirement refers to a preset security level for each field content to be updated in the field content to be updated list, for example, including high, medium, low, etc.

[0084] Update actions refer to the actions involved in changing the contents of the fields to be updated. A single update action can be used to change one or more contents to be updated.

[0085] Different security levels require different security reputations. For example, the security level requirements include 3 levels, and the security reputation requirements include 3 security reputation levels. The security reputation level required for a low security level requirement may be level 1, the security reputation level required for a medium security level requirement may be level 2, and the security reputation level required for a high security level requirement may be level 3. The security reputations required for the security levels may also have other corresponding relationships, and can be flexibly set according to requirements.

[0086] Step 208: Determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement corresponding to the content of the field to be updated; and return the execution result to the target network element entity.

[0087] Among them, in the traditional communication method, the network storage function entity can determine and execute the configuration file update action according to the configuration file update request, thereby updating the configuration file. For example, the content of the field to be updated is the network slice related identifier in the configuration file. After the configuration file is updated, another slice is added according to the modified network slice related identifier to obtain the information of another slice or affect the service of the slice. However, if the target network element entity is subject to a security attack, this method of directly updating the configuration file may bring greater security risks to the 5G core network.

[0088] In some embodiments, after the target network element entity is maliciously controlled, it will generally send some detection packets to collect data. This behavior deviates from the usual behavior of the target network element entity, and the security reputation evaluation device will reduce the security reputation level of the target network element entity accordingly. However, the security reputation evaluation result of the target network element entity at this time is not enough for the network storage function entity to prohibit it from providing services, and the configuration file can still be updated to proceed to the next attack step. The configuration file update action is an update action to update the content of the field to be updated. The embodiment of the present application proposes to perform security verification based on the security reputation evaluation result and the security reputation requirement of the update action before updating the configuration file, so as to ensure that the update action involved in the configuration file update request meets the security level requirement, and then execute the configuration file update action, which solves the disadvantages of static authorization of the network storage function entity. If the security level or security reputation of the target network element entity still allows it to provide services, but the security level of its action to update the configuration file has exceeded its own security level or reputation, it is impossible to control this malicious behavior.

[0089] The execution result is used to indicate whether the configuration file update action is executed successfully. The execution result is sent to the target network element entity so that the target network element entity can timely learn whether the sent configuration file update request is accepted.

[0090] In the above communication method, when a configuration file update request is received from a target network element entity, a list of field contents to be updated is obtained according to the configuration file update request, and a security reputation evaluation result of the target network element entity by a security reputation evaluation device is obtained. Since each field content to be updated in the list of field contents to be updated has a corresponding security reputation requirement, and the security reputation requirement is used to characterize the security level requirement of the field content to be updated, the security reputation evaluation result is compared with the security reputation requirement to determine whether to execute the configuration file update action, and the execution result can be returned to the target network element entity so that the target network element entity can know the execution result in time. This method of performing security reputation judgment on the update action after the target network element entity initiates a configuration file update request ensures that the configuration file update action can only be executed when the security reputation of the target network element entity meets the security reputation requirement of the update action, which is beneficial to reducing the security risk of maliciously changing the configuration file of the target network element entity, thereby facilitating improving the security of the operation of the 5G core network.

[0091] In an exemplary embodiment, Figure 3 As shown, according to the security reputation evaluation result and the security reputation requirement, it is determined whether to perform the configuration file update action, including:

[0092] Step 302, when the security reputation evaluation result is lower than the security reputation requirement, determining not to perform the configuration file update action;

[0093] Step 304: If the security reputation evaluation result is not lower than the security reputation requirement, determine to execute the configuration file update action.

[0094] Among them, the security reputation assessment result includes the security reputation level. The security reputation assessment result is lower than the security reputation requirement, indicating that the actual security reputation of the target network element entity is low and cannot meet the security reputation required by the update action. Therefore, the network storage function entity can reject the configuration file update request and determine not to perform the configuration file update action.

[0095] The security reputation evaluation result is not lower than the security reputation requirement, indicating that the actual security reputation of the target network element entity is high and can meet the security reputation required by the update action. Therefore, the network storage function entity can accept the configuration file update request and determine to execute the configuration file update action.

[0096] In this embodiment, by comparing the security reputation assessment result with the security reputation requirement, it is determined whether to execute the configuration file update action to ensure that the configuration file update request is accepted when the actual security reputation of the target network element entity meets the security reputation required by the update action, which is beneficial to improving the security of the 5G core network operation.

[0097] In an exemplary embodiment, the communication method further includes: determining whether the configuration file update request belongs to a heartbeat maintenance operation according to preset conditions; if so, directly executing the configuration file update action; if not, continuing to execute the step of determining whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement corresponding to the content of the field to be updated.

[0098] Among them, if the configuration file update request belongs to the heartbeat maintenance operation, it does not belong to the request for maliciously changing the configuration file. Therefore, the configuration file update operation can be executed directly. If the configuration file update request does not belong to the heartbeat maintenance operation, it is necessary to further execute the steps of determining whether to execute the configuration file update action based on the security reputation assessment results and the security reputation requirements to reduce the security risk of maliciously changing the configuration file.

[0099] For example, if the network storage function entity receives a Patch request (i.e., a configuration file update request) sent by the target network element entity for partially updating a configuration file, it first checks whether PatchData is only performing a "replace" operation on the attribute "nfStatus". If so, it is considered to be a heartbeat maintenance operation, and no subsequent security assessment action is required, and the PatchData command is directly executed. If not, the subsequent security assessment action is performed.

[0100] In this embodiment, it is determined whether the configuration file update request belongs to the heartbeat maintenance operation, so that when the configuration file update request belongs to the heartbeat maintenance operation, the configuration file is directly updated, effectively avoiding the security verification overhead caused by periodically processing heartbeat information.

[0101] In an exemplary embodiment, based on the security level requirements of each field content to be updated in the list of field contents to be updated, the security credibility requirements of the update actions corresponding to each field content to be updated are determined, including: obtaining a preset mapping relationship, the preset mapping relationship is used to characterize the correspondence between the security level requirements and the security credibility requirements; querying the preset mapping relationship to obtain the security credibility requirements of each field content to be updated; and using the highest security credibility requirement of each field content to be updated as the security credibility requirement of the update action corresponding to each field content to be updated.

[0102] The preset mapping relationship is a pre-built correspondence relationship between security level requirements and security reputation requirements. When querying the preset mapping relationship, the security reputation requirement corresponding to the security level requirement of the field content to be updated can be used as the security reputation requirement of the corresponding field content to be updated.

[0103] The configuration file update request may indicate more than one modification of the content, so the to-be-updated field content in the to-be-updated field content list includes at least one field content. For example, multiple to-be-updated field contents are used for description.

[0104] When there are multiple fields to be updated, the security reputation requirements of the multiple fields to be updated may be different. In this case, in order to ensure that the update action meets the security level requirements of the fields to be updated, the highest security reputation requirement of the multiple fields to be updated can be used as the security reputation requirement of the update action corresponding to the fields to be updated. In this way, when the security reputation evaluation result of the target network element entity is lower than the highest security reputation requirement, it is determined not to execute the configuration file update action; when the security reputation evaluation result of the target network element entity is not lower than the highest security reputation requirement, it is determined to execute the configuration file update action.

[0105] In this embodiment, by pre-building a mapping relationship, the steps for determining the security reputation requirements corresponding to the field content to be updated are simplified, thereby improving the system data processing efficiency; at the same time, since the modification of some configuration information in the configuration file has little impact on the safe operation of the 5G core network, the field content with the highest security level requirement is screened, and the configuration file update action can only be performed when the security reputation assessment result of the target network element entity is not lower than the highest security reputation requirement, thereby reducing the security risk of maliciously changing the configuration file.

[0106] In an exemplary embodiment, the steps of constructing a preset mapping relationship include: upon receiving a registration request from a target network element entity, obtaining a configuration file of the target network element entity according to the registration request; classifying the contents of multiple fields in the configuration file into security levels to obtain security level requirements corresponding to each of the contents of the multiple fields; and constructing a preset mapping relationship based on the correspondence between the security level requirements corresponding to each of the contents of the multiple fields and the security credibility requirements.

[0107] The registration request refers to a request initiated by the target network element entity for registering with the network storage function entity. In some embodiments, the registration request carries a configuration file of the target network element entity.

[0108] The multiple field contents in the configuration file refer to the configuration information in the configuration file. Security level division refers to a method of dividing multiple field contents into multiple different security levels according to the security requirements of different field contents. The security level of some field contents is low, and the security level of some field contents is high. For example, the security level of network slice related identifiers is high.

[0109] Different security level requirements correspond to different security reputation requirements, and a preset mapping relationship is constructed by the correspondence between the security level requirements and the security reputation requirements corresponding to the contents of multiple fields.

[0110] In this embodiment, upon receiving a registration request from a target network element entity, a plurality of field contents are divided into security levels, and security credibility requirements required for different security levels are defined, thereby constructing a preset mapping relationship. This method of constructing a preset mapping relationship during the registration of the target network element entity is beneficial for quickly determining the security credibility requirements corresponding to the update action during the security verification process of the target network element unit.

[0111] In an exemplary embodiment, Figure 4 As shown, a communication method is provided, and the method is applied to a network element entity (NF) as an example for explanation, including the following steps 402 to 404. Among them:

[0112] Step 402: In the process of the network element entity requesting the network storage function entity to update the configuration file, a configuration file update request is sent to the network storage function entity to instruct the network storage function entity to obtain a list of field contents to be updated according to the configuration file update request and obtain a security reputation evaluation result of the network element entity by the security reputation evaluation device when receiving the configuration file update request; the list of field contents to be updated and the security reputation evaluation result are used to instruct the network storage function entity to determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the list of field contents to be updated, and determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement; the execution result is used to return to the network element entity;

[0113] Step 404: Receive the execution result returned by the network storage function entity request.

[0114] Among them, the network element entity refers to a network element entity that has been registered in the network storage functional entity. The configuration file refers to a file containing configuration information related to the network element entity. Normally, the configuration file is provided by the network element entity to the network storage functional entity during the registration process. The communication method proposed in the embodiment of the present application is mainly used in the process of the network element entity requesting the network storage functional entity to update the configuration file. A configuration file update request refers to a request to change the configuration information in the configuration file, or to replace the configuration file. In some embodiments, it can be determined based on the update identifier in the configuration file update request whether to change part of the configuration information or to replace the entire configuration file. For example, if the configuration file update request indicates that the network slice related identifier is modified, the content of the field to be updated is the network slice related identifier in the configuration file.

[0115] The network element entity sends a configuration file update request to the network storage function entity to instruct the network storage function entity to determine the corresponding list of field contents to be updated according to the content indicated by the configuration file update request when receiving the configuration file update request. The list of field contents to be updated includes at least one field content to be updated, and the field content to be updated is the configuration information that needs to be updated in the configuration file.

[0116] The security reputation evaluation device refers to a device that performs security reputation evaluation on a network element entity. In some embodiments, the security reputation evaluation device may include NWDAF (Network Data Analytics Function, 5G network data analysis function) or other third-party security detection and analysis systems.

[0117] The security reputation evaluation result is used to characterize the security reputation of the network element entity. For example, the security reputation evaluation result may include multiple security reputation levels.

[0118] In some embodiments, upon receiving a configuration file update request sent by a network element entity, the network storage function entity may initiate a security reputation evaluation request for the network element entity to the security reputation evaluation device, and obtain a security reputation evaluation result returned by the security reputation evaluation device.

[0119] In some other embodiments, the network storage function entity subscribes to the security reputation evaluation device for the security reputation evaluation result for the network element entity, so that the security reputation evaluation result for the network element entity sent by the security reputation evaluation device can be obtained according to the subscription period. The security reputation evaluation result for the network element entity that the network storage function entity can obtain when receiving the configuration file update request sent by the network element entity is the latest security reputation evaluation result obtained from the security reputation evaluation device.

[0120] In some other embodiments, after the network storage functional entity subscribes to the security reputation assessment result for the network element entity to the security reputation assessment device, the security reputation assessment device, in addition to periodically returning the security reputation assessment result, can also send the changed security reputation assessment result to the network storage functional entity when the security reputation assessment result for the network element entity changes.

[0121] The security level requirement refers to the preset security level for each field content to be updated in the field content to be updated list, for example, including high, medium, low, etc.

[0122] Update actions refer to the actions involved in changing the contents of the fields to be updated. A single update action can be used to change one or more contents to be updated.

[0123] Different security levels require different security reputations. For example, the security level requirements include 3 levels, and the security reputation requirements include 3 security reputation levels. The security reputation level required for a low security level requirement may be level 1, the security reputation level required for a medium security level requirement may be level 2, and the security reputation level required for a high security level requirement may be level 3. The security reputations required for the security levels may also have other corresponding relationships, and can be flexibly set according to requirements.

[0124] Among them, in the traditional communication method, the network storage function entity can determine and execute the configuration file update action according to the configuration file update request, thereby updating the configuration file. For example, the content of the field to be updated is the network slice related identifier in the configuration file. After the configuration file is updated, another slice is added according to the modified network slice related identifier to obtain the information of another slice or affect the service of the slice. However, if the network element entity is subject to a security attack, this method of directly updating the configuration file may bring greater security risks to the 5G core network.

[0125] In some embodiments, after a network element entity is maliciously controlled, it will generally send some detection packets to collect data. This behavior deviates from the usual behavior of this network element entity, and the security reputation evaluation device will reduce the security reputation level of the network element entity accordingly. However, the security reputation evaluation result of the network element entity at this time is not enough for the network storage function entity to prohibit it from providing services, and it can still update the configuration file and proceed to the next attack step. The configuration file update action is an update action to update the content of the field to be updated. The embodiment of the present application proposes to perform security verification based on the security reputation evaluation result and the security reputation requirement of the update action before updating the configuration file, so as to ensure that the update action involved in the configuration file update request meets the security level requirement, and then execute the configuration file update action, which solves the drawbacks of static authorization of the network storage function entity. If the security level or security reputation of the network element entity still allows it to provide services, but the security level of its action to update the configuration file has exceeded its own security level or reputation, it is impossible to control this malicious behavior.

[0126] The execution result is used to indicate whether the configuration file update action is executed successfully. The execution result is sent to the network element entity so that the network element entity can timely learn whether the sent configuration file update request is accepted.

[0127] In the above communication method, the network element entity sends a configuration file update request to the network storage function entity to instruct the network storage function entity to obtain a list of field contents to be updated according to the configuration file update request when receiving the configuration file update request, and obtain the security reputation evaluation result of the network element entity by the security reputation evaluation device. Since each field content to be updated in the list of field contents to be updated has a corresponding security reputation requirement, the security reputation requirement is used to characterize the security level requirement of the field content to be updated, therefore, by comparing the security reputation evaluation result with the security reputation requirement, it can be determined whether to execute the configuration file update action, and the execution result can be returned to the network element entity so that the network element entity can know the execution result in time; this method of performing security reputation judgment on the update action after the network element entity initiates the configuration file update request ensures that the configuration file update action can only be executed when the security reputation of the network element entity meets the security reputation requirement of the update action, which is beneficial to reducing the security risk of maliciously changing the network element entity configuration file, thereby facilitating improving the security of 5G core network operation.

[0128] The communication method provided in the embodiment of the present application can be applied to a communication system, which includes a target network element entity (NF), a security reputation evaluation device and a network storage function entity (NRF). The target network element entity is connected to the network storage function entity and sends a configuration file update request to the network storage function entity; the security reputation evaluation device is used to respond to the security reputation evaluation request initiated by the network storage function entity for the target network element entity, perform a security reputation evaluation on the target network element entity, and obtain a security reputation evaluation result; the network storage function entity is used to interact with the network element entity and the security reputation evaluation device to implement the above communication method. When the network storage functional entity receives a configuration file update request sent by the target network element entity during the process of the target network element entity updating the configuration file to the network storage functional entity, the network storage functional entity obtains a list of field contents to be updated according to the configuration file update request; obtains the security reputation assessment result of the target network element entity by the security reputation assessment device; determines the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the list of field contents to be updated; determines whether to execute the configuration file update action according to the security reputation assessment result and the security reputation requirement; and returns the execution result to the target network element entity.

[0129] To explain the communication method and effect in this solution in detail, a most detailed embodiment is described below:

[0130] In the 5G private network scenario, the 5GC network element may be deployed in the customer's room as an example. The communication system includes a target network element entity, a security reputation evaluation device and a network storage function entity. The network storage function entity implements the communication method by exchanging information with the target network element entity and the security reputation evaluation device. Figure 5 The figure is a schematic diagram of the overall flow of a communication method in one embodiment.

[0131] 1. In the process of NF registering with NRF, NRF divides the security level of the fields involved in the configuration file registered by NF according to the preset template. The security level of some fields is low, and the security level of some fields is high. For example, the security level of network slice related identifiers is high. And define the security reputation required for different security levels.

[0132] 2. NRF subscribes to the security reputation assessment results of registered NFs from NWDAF or other third-party security detection and analysis systems.

[0133] 3. NWDAF or other third-party security detection and analysis systems return the security reputation evaluation results of this NF to NRF. Once the security reputation evaluation results of this NF change, the results will be automatically sent to NRF.

[0134] 4. When NRF receives the configuration file update request from NF, it identifies the specific fields to be updated and confirms the fields with the highest security level requirements. Compare the security reputation requirements corresponding to the fields with the highest security level requirements with the current security reputation results of this NF. If the security reputation evaluation result of NF at this time does not meet the requirements of the security level of the fields with the highest security level requirements, it returns a failure message, does not update the configuration file, and reports the failure message; if it meets the requirements, it will be updated normally, return a success message, and proceed with the subsequent standard process.

[0135] 5. If NRF receives a Patch request from NF for partially updating a configuration file (i.e., a configuration file update request), it first checks whether PatchData is only performing a "replace" operation on the attribute "nfStatus". If so, it is considered to be a heartbeat maintenance message, and no subsequent security assessment action is required, and the command of PatchData is directly executed. If not, the subsequent security assessment action is executed.

[0136] The above-mentioned communication method, when receiving a configuration file update request sent by the target network element entity, obtains a list of field contents to be updated according to the configuration file update request, and obtains the security reputation evaluation result of the target network element entity by the security reputation evaluation device. Since each field content to be updated in the list of field contents to be updated has a corresponding security reputation requirement, the security reputation requirement is used to characterize the security level requirement of the field content to be updated, therefore, by comparing the security reputation evaluation result with the security reputation requirement, it can be determined whether to execute the configuration file update action, and the execution result can be returned to the target network element entity so that the target network element entity can know the execution result in time; this method of performing security reputation judgment on the update action after the target network element entity initiates a configuration file update request ensures that the configuration file update action can only be executed when the security reputation of the target network element entity meets the security reputation requirement of the update action, which is beneficial to reducing the security risk of maliciously changing the configuration file of the target network element entity, thereby facilitating improving the security of 5G core network operation. In addition, the network storage functional entity classifies the update actions involving the configuration files of the target network element entity into security categories according to the possible threat impact, and links them to the security reputation assessment results of the target network element entity. Dynamic authorization control is performed based on the security reputation assessment results of the target network element entity, and the configuration file update action can only be executed when the security reputation meets the security level requirements of the update action, thereby reducing the security risk of maliciously changing the configuration files of the target network element entity.

[0137] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0138] Based on the same inventive concept, the embodiment of the present application also provides a communication device for implementing the communication method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more communication device embodiments provided below can refer to the limitations on the communication method above, and will not be repeated here.

[0139] In an exemplary embodiment, Figure 6As shown, a communication device 600 is provided, which is applied to a network storage function entity, including: a first acquisition module 620, a second acquisition module 640, a first determination module 660 and a second determination module 680, wherein:

[0140] The first acquisition module 620 is used to obtain a list of to-be-updated field contents according to the configuration file update request when the network storage function entity receives a configuration file update request sent by the target network element entity in the process of the target network element entity updating the configuration file to the network storage function entity;

[0141] The second acquisition module 640 is used to obtain the security reputation evaluation result of the target network element entity by the security reputation evaluation device;

[0142] A first determination module 660 is used to determine the security reputation requirement of the update action corresponding to each to-be-updated field content according to the security level requirement of each to-be-updated field content in the to-be-updated field content list;

[0143] The second determination module 680 is used to determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement; and return the execution result to the target network element entity.

[0144] The above-mentioned communication device, when receiving a configuration file update request sent by the target network element entity, obtains the content of the field to be updated according to the configuration file update request, and obtains the security reputation evaluation result of the target network element entity by the security reputation evaluation device. Since each field content to be updated has a corresponding security reputation requirement, the security reputation requirement is used to characterize the security level requirement of the field content to be updated. Therefore, by comparing the security reputation evaluation result with the security reputation requirement corresponding to the field content to be updated, it can be determined whether to execute the configuration file update action, and the execution result can be returned to the target network element entity so that the target network element entity can know the execution result in time. This method of performing security reputation judgment on the field content to be updated after the target network element entity initiates a configuration file update request ensures that the configuration file update action can only be executed when the security reputation of the target network element entity meets the security reputation requirement of the field content to be updated, which is beneficial to reducing the security risk of maliciously changing the configuration file of the target network element entity, thereby facilitating improving the security of 5G core network operation.

[0145] In one embodiment, whether to execute the configuration file update action is determined based on the security reputation evaluation result and the security reputation requirement. The second determination module 680 is also used to: determine not to execute the configuration file update action when the security reputation evaluation result is lower than the security reputation requirement; determine to execute the configuration file update action when the security reputation evaluation result is not lower than the security reputation requirement.

[0146] In one embodiment, the communication device 600 also includes a third determination module, which is used to: determine whether the configuration file update request belongs to a heartbeat maintenance operation according to preset conditions; if so, directly execute the configuration file update action; if not, continue to execute the steps of determining whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement corresponding to the content of the field to be updated.

[0147] In one embodiment, the security reputation requirement of the update action corresponding to each field content to be updated is determined based on the security level requirement of each field content to be updated in the field content list to be updated, and the first determination module 660 is also used to: obtain a preset mapping relationship, the preset mapping relationship is used to characterize the correspondence between the security level requirement and the security reputation requirement; query the preset mapping relationship to obtain the security reputation requirement of each field content to be updated; and use the highest security reputation requirement of each field content to be updated as the security reputation requirement of the update action corresponding to each field content to be updated.

[0148] In one embodiment, in terms of constructing a preset mapping relationship, the first determination module 660 is also used to: upon receiving a registration request from a target network element entity, obtain a configuration file of the target network element entity according to the registration request; classify the contents of multiple fields in the configuration file into security levels to obtain security level requirements corresponding to each of the multiple field contents; and construct a preset mapping relationship based on the correspondence between the security level requirements and security credibility requirements corresponding to each of the multiple field contents.

[0149] In an exemplary embodiment, Figure 7 As shown, a communication device 700 is provided, which is applied to a network element entity, including: a sending module 720 and a receiving module 740, wherein:

[0150] The sending module 720 is used to send a configuration file update request to the network storage function entity in the process of the network element entity requesting the network storage function entity to update the configuration file, so as to instruct the network storage function entity to obtain a list of field contents to be updated according to the configuration file update request and obtain a security reputation evaluation result of the target network element entity by the security reputation evaluation device when receiving the configuration file update request. The list of field contents to be updated and the security reputation evaluation result are used to instruct the network storage function entity to determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the list of field contents to be updated, and determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement; the execution result is used to return to the target network element entity;

[0151] The receiving module 740 is used to receive the execution result returned by the network storage function entity request.

[0152] In the above-mentioned communication device, the network element entity sends a configuration file update request to the network storage function entity to instruct the network storage function entity to obtain a list of field contents to be updated according to the configuration file update request when receiving the configuration file update request, and obtain the security reputation evaluation result of the network element entity by the security reputation evaluation device. Since each field content to be updated in the list of field contents to be updated has a corresponding security reputation requirement, the security reputation requirement is used to characterize the security level requirement of the field content to be updated, therefore, by comparing the security reputation evaluation result with the security reputation requirement, it can be determined whether to execute the configuration file update action, and the execution result can be returned to the network element entity so that the network element entity can know the execution result in time; this method of performing security reputation judgment on the update action after the network element entity initiates a configuration file update request ensures that the configuration file update action can only be executed when the security reputation of the network element entity meets the security reputation requirement of the update action, which is beneficial to reducing the security risk of maliciously changing the network element entity configuration file, thereby facilitating improving the security of 5G core network operation.

[0153] Each module in the above communication device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in the communication device in the form of hardware, or can be stored in a memory in the communication device in the form of software, so that the processor can call and execute operations corresponding to each module above.

[0154] In an exemplary embodiment, Figure 8 A schematic diagram of the structure of an access network device provided in an embodiment of the present application. The access network device may include a receiver 31, a memory 32, a processor 33, at least one communication bus 34 and a transmitter 35. The communication bus 34 is used to realize the communication connection between the components. The memory 32 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory. Various programs may be stored in the memory 32 to complete various processing functions and implement the method steps of this embodiment. In this embodiment, the transmitter 35 may be a radio frequency processing module or a baseband processing module in the access network device, and the receiver 31 may also be a radio frequency processing module or a baseband processing module in the access network device. The transmitter 35 and the receiver 31 can be integrated together to realize a transceiver. The transmitter 35 and the receiver 31 can both be coupled to the processor 33, and they can realize the receiving or transmitting action under the instruction or control of the processor 33.

[0155] In this embodiment, the receiver 31 is used to receive a configuration file update request sent by the target network element entity and receive a security reputation evaluation result of the target network element entity sent by the security reputation evaluation device in the process of the target network element entity updating the configuration file to the network storage function entity;

[0156] Processor 33 is used to obtain a list of field contents to be updated according to the configuration file update request when a configuration file update request is received from the target network element entity in the process of the target network element entity updating the configuration file to the network storage function entity; obtain the security reputation evaluation result of the target network element entity by the security reputation evaluation device; determine the security reputation requirement of the update action corresponding to each field content to be updated according to the highest security level requirement of each field content to be updated in the list of field contents to be updated; and determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement.

[0157] The transmitter 35 is used to send the execution result to the target network element entity.

[0158] In one embodiment, the processor 33 is further configured to determine not to perform a configuration file update action when the security reputation evaluation result is lower than the security reputation requirement; and to determine to perform a configuration file update action when the security reputation evaluation result is not lower than the security reputation requirement.

[0159] In one embodiment, the processor 33 is also used to determine whether the configuration file update request belongs to a heartbeat maintenance operation according to preset conditions; if so, directly execute the configuration file update action; if not, continue to execute the step of determining whether to execute the configuration file update action based on the security reputation evaluation result and the security reputation requirement corresponding to the content of the field to be updated.

[0160] In one embodiment, the processor 33 is also used to obtain a preset mapping relationship, which is used to characterize the correspondence between the security level requirement and the security credibility requirement; query the preset mapping relationship to obtain the security credibility requirement of each field content to be updated; and use the highest security credibility requirement of each field content to be updated as the security credibility requirement of the update action corresponding to each field content to be updated.

[0161] In one embodiment, the processor 33 is also used to, upon receiving a registration request from the target network element entity, obtain a configuration file of the target network element entity according to the registration request; classify the contents of multiple fields in the configuration file into security levels to obtain security level requirements corresponding to each of the multiple field contents; and construct a preset mapping relationship based on the correspondence between the security level requirements and security credibility requirements corresponding to each of the multiple field contents.

[0162] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the communication device to which the scheme of the present application is applied. The specific communication device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0163] In an exemplary embodiment, a communication device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0164] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0165] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0166] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0167] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0168] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0169] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A communication method, characterized in that: Applied to a network storage function entity, the method comprises: In the process of the target network element entity requesting the network storage function entity to update the configuration file, when the network storage function entity receives the configuration file update request sent by the target network element entity, the list of field contents to be updated is obtained according to the configuration file update request; Obtaining a security reputation evaluation result of the target network element entity by a security reputation evaluation device; Determining the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the field content list to be updated; Determining whether to execute a configuration file update action according to the security reputation evaluation result and the security reputation requirement; The execution result is returned to the target network element entity.

2. The method according to claim 1, characterized in that The determining whether to execute a configuration file update action according to the security reputation evaluation result and the security reputation requirement includes: In a case where the security reputation evaluation result is lower than the security reputation requirement, determining not to perform a configuration file update action; In a case where the security reputation evaluation result is not lower than the security reputation requirement, determining to execute a configuration file update action.

3. The method according to claim 1, characterized in that The method further comprises: Determining whether the configuration file update request belongs to a heartbeat maintenance operation according to a preset condition; If yes, the configuration file update action is directly executed; If not, continue to execute the step of determining whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement.

4. The method according to claim 1, characterized in that: Determining the security reputation requirement of the update action corresponding to each to-be-updated field content according to the security level requirement of each to-be-updated field content in the to-be-updated field content list includes: Obtaining a preset mapping relationship, where the preset mapping relationship is used to characterize the corresponding relationship between the security level requirement and the security reputation requirement; Query the preset mapping relationship to obtain the security reputation requirement of each field content to be updated; The highest security reputation requirement of each to-be-updated field content is used as the security reputation requirement of the update action corresponding to each to-be-updated field content.

5. The method according to claim 4, characterized in that The step of constructing the preset mapping relationship includes: When receiving a registration request from the target network element entity, obtaining a configuration file of the target network element entity according to the registration request; Classifying the security levels of the contents of multiple fields in the configuration file to obtain the security level requirements corresponding to the contents of the multiple fields; A preset mapping relationship is constructed based on the correspondence between the security level requirements and the security reputation requirements corresponding to the contents of multiple fields.

6. A communication method, characterized in that: Applied to a network element entity, the method comprises: In the process of the network element entity requesting the network storage function entity to update the configuration file, a configuration file update request is sent to the network storage function entity to instruct the network storage function entity to obtain a list of field contents to be updated according to the configuration file update request and obtain a security reputation evaluation result of the network element entity by a security reputation evaluation device when the configuration file update request is received; the list of field contents to be updated and the security reputation evaluation result are used to instruct the network storage function entity to determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the list of field contents to be updated, and to determine whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement; the execution result is used to return to the network element entity; Receive the execution result returned by the network storage function entity request.

7. A communication device, characterized in that: Applied to a network storage function entity, the device comprises: A first acquisition module is used for, in a process in which a target network element entity requests a network storage function entity to update a configuration file, when the network storage function entity receives a configuration file update request sent by the target network element entity, acquiring a list of field contents to be updated according to the configuration file update request; A second acquisition module is used to obtain a security reputation evaluation result of the target network element entity by a security reputation evaluation device; A first determination module, configured to determine the security reputation requirement of the update action corresponding to each to-be-updated field content according to the security level requirement of each to-be-updated field content in the to-be-updated field content list; The second determination module is used to determine whether to execute a configuration file update action according to the security reputation evaluation result and the security reputation requirement; and return the execution result to the target network element entity.

8. A communication device, characterized in that: Applied to a network element entity, the device comprises: A sending module, used for sending a configuration file update request to the network storage function entity in the process of the network element entity requesting the network storage function entity to update the configuration file, so as to instruct the network storage function entity to obtain a list of field contents to be updated according to the configuration file update request and obtain a security reputation evaluation result of the network element entity by a security reputation evaluation device when receiving the configuration file update request, wherein the list of field contents to be updated and the security reputation evaluation result are used to instruct the network storage function entity to determine the security reputation requirement of the update action corresponding to each field content to be updated according to the security level requirement of each field content to be updated in the list of field contents to be updated, and to judge whether to execute the configuration file update action according to the security reputation evaluation result and the security reputation requirement; the execution result is used to return to the network element entity; The receiving module is used to receive the execution result returned by the network storage function entity request.

9. A communication system, characterized in that: The system comprises: The target network element entity is connected to the network storage function entity and sends a configuration file update request to the network storage function entity; A security reputation evaluation device, configured to respond to a security reputation evaluation request initiated by the network storage function entity for the target network element entity, perform a security reputation evaluation on the target network element entity, and obtain a security reputation evaluation result; A network storage functional entity is used to obtain a list of field contents to be updated according to the configuration file update request when the network storage functional entity receives a configuration file update request sent by the target network element entity during the process of the target network element entity updating the configuration file to the network storage functional entity; obtain a security reputation assessment result of the target network element entity by the security reputation assessment device; determine the security reputation requirement of the update action corresponding to each field content to be updated according to the highest security level requirement of each field content to be updated in the list of field contents to be updated; determine whether to execute the configuration file update action according to the security reputation assessment result and the security reputation requirement; and return the execution result to the target network element entity.

10. A communication device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images