5G multi-level processing user data traceability association method based on strong verification

Abstract

The invention discloses a 5G multi-stage processing user data traceability association method based on strong verification. The method specifically comprises the following steps: a 5G original signaling enters a first-stage processing board card through a load balancing mode; the first-level board card purely analyzes the N11 and N16 signaling, and packages the analyzed data into a first-level semi-structured data packet; and after the second-level board card receives the first-level semi-structured data, updating the user table item. And the second-level board card packages the three-code information and the tunnel information into second-level structured data, and the second-level structured data is screened and sent to the third-level board card according to the learned UPF IP. The third-level board card analyzes and extracts three codes of the user, position information NCGI, uplink and downlink tunnel numbers and network element IPs allocated to the user and IP addresses allocated to the user for surfing the Internet, and the third-level board card analyzes an outer-layer tunnel number and an outer-layer IP address through 5G N3 interface service data. And performing user traceability association by using the outer IP of the N3 service data and the tunnel number. Strong verification is carried out by using an inner-layer IP, IMSIs associated with two-side tunnels and an IP associated with a base station, so that the accuracy of user traceability association is ensured.

Description

Technical Field

[0001] The present invention relates to the field of automated traffic collection and analysis, and in particular, mainly to a 5G multi-stage processing user data tracing and association method based on strong verification. Background Art

[0002] Mobile communications have evolved from 1G, 2G, 3G, and 4G in accordance with the law of development of one generation every ten years. Each generational leap and technological advancement has greatly promoted industrial upgrading and economic and social development. The rapid development of 4G networks has brought about an explosive growth of new services and new businesses. At the same time, it has put forward urgent needs and higher requirements for the next generation of communication technology - 5G.

[0003] At present, the deep integration of 5G with cloud computing, big data, artificial intelligence, big models and other technologies will accelerate the integrated application of 5G in all walks of life, promote business model innovation, promote the diffusion and penetration of 5G technology into various fields of economy and society, breed new information products and services, and expand new space for the development of digital economy. How to trace and associate 5G user data and do a good job in cyberspace security management is an important and difficult problem we are currently facing.

[0004] Through research, it is found that the existing 5G user data tracing technology does not verify the accuracy of user data, resulting in insufficient accuracy. In view of the shortcomings of the existing solutions, combined with the characteristics and requirements of specific applications, the present invention provides a method for performing strong verification on 5G user data in the field of 5G user data tracing, so as to achieve the purpose of improving the accuracy of user data tracing association. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the existing methods and, according to the requirements of specific applications and actual combat, provide a 5G multi-stage processing user data tracing association method based on strong verification, which is used to solve the problem of large 5G original signaling traffic and the number of users exceeding tens of millions. It innovatively uses multi-stage processing user tracing and adopts strong verification to solve problems such as inaccuracy and error-proneness.

[0006] According to one aspect of the present invention, a 5G multi-stage processing user data tracing and association method based on strong verification is proposed, comprising:

[0007] S1, 5G original signaling enters the first-level board through load balancing. The first-level board parses N11 and N16 signaling, encapsulates the parsed data into a first-level semi-structured data packet, and distributes the data packet to the second-level board in an imsi load balancing manner;

[0008] S2, the secondary board receives the primary semi-structured data packet, updates the user table entry, and encapsulates the user three codes and tunnel information into secondary structured data, uses UPF IP to learn and filter the secondary structured data, and sends the filtered data to the tertiary board;

[0009] S3, the third-level board parses the received secondary structured data, extracts the user three codes and location information NCGI, allocates uplink and downlink tunnel numbers and network element IPs to the user, and allocates an Internet access IP to the user;

[0010] S4, the third-level board receives the service data through the 5G N3 interface, and parses the uplink and downlink tunnel numbers, uplink and downlink network element IPs, inner source IP addresses, and inner destination IP addresses from the service data;

[0011] S5. Use the uplink and downlink tunnel numbers and the uplink and downlink network element IPs to perform user tracing association, and use the inner source IP address and inner destination IP address to perform strong verification with the IMSI associated with the uplink and downlink tunnel numbers and the IP associated with the base station.

[0012] Furthermore, the step S1 specifically includes:

[0013] S1.1. parse the user three codes, location information NCGI and session ID from the Nsmf_PDUSession_CreateSMContext Request signaling, encapsulate the user three codes, location information NCGI and session ID into semi-structured data, recorded as semi_data_a, and load-balance to the secondary board through imis;

[0014] S1.2. Parse smContextRef from Nsmf_PDUSession_CreateSMContext Response signaling, encapsulate the smContextRef into semi-structured data using imis, record it as semi_data_b, and load balance it to the secondary board through imis;

[0015] S1.3. Parse the IMSI, smContextRef and tunnel information in the user three codes from the Namf_Communication_N1N2MessageTransfer signaling, and encapsulate them into semi-structured data, recorded as semi_data_c, and load balance the semi_data_c to the secondary board through imsi;

[0016] S1.4. Parse the smContextRef and tunnel information from the Nsmf_PDUSession_UpdateSMContext Request signaling, encapsulate them into semi-structured data, record them as semi_data_d, and send them to the secondary board via broadcast;

[0017] S1.5. Parse the smContextRef from the Nsmf_PDUSession_ReleaseSMContext Request signaling and mark the user offline, encapsulate it into semi-structured data recorded as semi_data_e, and send it to the secondary board via broadcast.

[0018] Furthermore, the specific processing steps for the secondary board to receive the primary semi-structured data packet and update the user table entry include:

[0019] S2.1. Receive the semi-structured data of semi_data_a, and establish an imis-associated imsiInfo table item, wherein the imsiInfo includes the user's three codes, location information NCGI, the uplink and downlink tunnel numbers allocated to the user, the network element IP, and the Internet access IP allocated to the user;

[0020] S2.2, receiving the semi-structured data of semi_data_b, and establishing a smContextRef->imis table entry;

[0021] S2.3, receiving the semi-structured data of semi_data_c, and updating the imsi->imsiInfo table item;

[0022] S2.4. Receive the semi-structured data of semi_data_d, search the smContextRef->imis table item, obtain imis, and search the imsi->imsiInfo table item through the imsi to update;

[0023] S2.5. Receive the semi-structured data of semi_data_e, search for the smContextRef->imis table item, obtain imis, search for the imsi->imsiInfo table item through the imsi, and delete the user offline.

[0024] After receiving the first-level semi-structured data, the second-level board updates the user table entries. Since the second-level board stores user table entries based on IMSI load balancing, multiple boards can be stacked to store more than 10 million users.

[0025] Each time the secondary board receives the semi-structured data processing operation, it encapsulates the user's three codes and tunnel information into secondary structured data, and sends it to the third-level associated board according to the learned UPF IP filter. By filtering the UPF IP destination, the third-level board does not need to store more than 10 million users, and only needs to store local related users.

[0026] Furthermore, the processing step S3 specifically includes:

[0027] S3.1. Establishing a user association table entry, including establishing an association table entry of the uplink and downlink tunnel numbers, user three codes, location information NCGI, and Internet access IP;

[0028] S3.2. Establish a base station IP association table entry, including extracting the gNB ID using the location information NCGI, and establishing the gNB ID associated with the base station IP.

[0029] Furthermore, the uplink and downlink tunnel numbers in step S4 plus the downlink network element IP are recorded as Teid_N3_Up+UPFIP and Teid_N3_Down+gNode IP, and the inner source IP address and the inner destination IP address are recorded as IPv4_Src_Inner, Ipv4_Dst_Innder, Ipv6_Src_Inner, and Ipv6_Dst_Innder.

[0030] Furthermore, using the uplink and downlink tunnel numbers and the uplink and downlink network element IPs to perform user tracing association specifically includes: using Teid_N3_Up+UPF IP as a key to search for the Teid+Ip->UserInfo table item to obtain the first user information, and at the same time using Teid_N3_Down+gNode IP as a key to search for the Teid+Ip->UserInfo table item to obtain the second user information.

[0031] The strong verification specifically includes:

[0032] S5.1. The user information queried using the Teid_N3_Up+UPF IP and Teid_N3_Down+gNode IP needs to be consistent;

[0033] S5.2. Use the user's Internet IP and inner IP for verification. If the inner IP is IPv4, IPv4_Src_Inner or Ipv4_Dst_Innder needs to be consistent with the UE IPv4 in the associated user information table item; if the inner IP is an IPv6 prefix, the prefix of Ipv6_Src_Inner or Ipv6_Dst_Innder is consistent with the UE IPv6 prefix in the associated user information table item, where the inner IP includes the inner source IP address and the inner destination IP address;

[0034] S5.3. The base station IP corresponding to the associated location information NCGI must be consistent with the base station IP of the N3 interface service data, including: using the base station ID extracted by the location information NCGI to search the gNB ID->gNB IP table entry, and obtaining the base station IP that is consistent with the gNB IP parsed by the N3 interface service data.

[0035] According to a second aspect of the present invention, a computer-readable storage medium is provided, on which one or more computer programs are stored. When the one or more computer programs are executed by a computer processor, the above method is implemented.

[0036] The above one or more technical solutions in the embodiments of the present application have at least one of the following technical effects:

[0037] The present invention provides a 5G multi-level processing user data tracing and association method based on strong verification, which solves the problem that the original 5G signaling traffic is large and the number of users exceeds 10 million. It innovatively uses multi-level processing user tracing and adopts a strong verification method to solve the problems of inaccuracy and error-proneness. The present invention is suitable for the scenario of parsing 5G traffic and tracing the user data. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and are used together with the description to explain the principles of the present invention. It will be easy to recognize other embodiments and many expected advantages of the embodiments because they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with each other. The same reference numerals refer to corresponding similar parts.

[0039] Figure 1 A schematic flow chart of a 5G multi-stage processing user data traceability association method based on strong verification according to an embodiment of the present invention is shown.

[0040] Figure 2 A schematic diagram of a user provenance association strong verification process according to an embodiment of the present invention is shown.

[0041] Figure 3It is a structural diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application. DETAILED DESCRIPTION

[0042] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0043] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0044] Figure 1 A schematic diagram of a 5G multi-stage processing user data traceability association method based on strong verification according to an embodiment of the present invention is shown. Figure 1 As shown:

[0045] S1, 5G original signaling enters the first-level board through load balancing. The first-level board parses N11 and N16 signaling, encapsulates the parsed data into a first-level semi-structured data packet, and distributes the data packet to the second-level board in an imsi load balancing manner;

[0046] S1.1. parse the user three codes, location information NCGI and session ID from the Nsmf_PDUSession_CreateSMContext Request signaling, encapsulate the user three codes, location information NCGI and session ID into semi-structured data, recorded as semi_data_a, and load-balance to the secondary board through imis;

[0047] S1.2. Parse smContextRef from Nsmf_PDUSession_CreateSMContext Response signaling, encapsulate the smContextRef into semi-structured data using imis, record it as semi_data_b, and load balance it to the secondary board through imis;

[0048] S1.3. Parse the IMSI, smContextRef and tunnel information in the user three codes from the Namf_Communication_N1N2MessageTransfer signaling, and encapsulate them into semi-structured data, recorded as semi_data_c, and load balance the semi_data_c to the secondary board through imsi;

[0049] S1.4. Parse the smContextRef and tunnel information from the Nsmf_PDUSession_UpdateSMContext Request signaling, encapsulate them into semi-structured data, record them as semi_data_d, and send them to the secondary board via broadcast;

[0050] S1.5. Parse the smContextRef from the Nsmf_PDUSession_ReleaseSMContext Request signaling and mark the user offline, encapsulate it into semi-structured data recorded as semi_data_e, and send it to the secondary board via broadcast.

[0051] IMIS stands for Management Information System; IMSI load balancing refers to the use of load balancing technology to distribute IMSI requests to multiple processing units in a mobile communication network to reduce the load of a single processing unit and improve the processing capacity and response speed of the overall system. This technology can prevent any server from being overloaded, thereby improving the flexibility and availability of the network.

[0052] smContextRef represents a session management context reference, an identifier used to uniquely identify a session management context in the 5G core network. smContextRef is used as a key to associate with relevant information in the imis system.

[0053] In the 5G core network, N11 is the interface between AMF and SMF, and has functions such as PDU session creation and modification management. N3 is the interface between the base station gNobe and UPF, and is used to carry user plane data.

[0054] The AMF IP and SMF IP corresponding to the N11 signaling generated by the same user when surfing the Internet may not remain unchanged. They will switch and change as the user moves, so it is not appropriate to lock the user network element IP. At the same time, facing the number of users exceeding 10 million, a single board card cannot meet the storage requirements. Therefore, a multi-level processing method is used to achieve a solution with large traffic and 10 million users.

[0055] In some embodiments, the parsed information is packaged into a semi-structured data format, and the information can be packaged into highly readable semi-structured data using a format such as JSON or XML.

[0056] IMSI load balancing is achieved through IMSI hashing algorithm or IMSI range division.

[0057] S2, the secondary board receives the primary semi-structured data packet, updates the user table entry, and encapsulates the user three codes and tunnel information into secondary structured data, uses UPF IP to learn and filter the secondary structured data, and sends the filtered data to the tertiary board;

[0058] The specific processing steps of the secondary board receiving the primary semi-structured data packet and updating the user table entry include:

[0059] S2.1. Receive the semi-structured data of semi_data_a, and establish an imis-associated imsiInfo table item, wherein the imsiInfo includes the user's three codes, location information NCGI, the uplink and downlink tunnel numbers allocated to the user, the network element IP, and the Internet access IP allocated to the user;

[0060] S2.2, receiving the semi-structured data of semi_data_b, and establishing a smContextRef->imis table entry;

[0061] S2.3, receiving the semi-structured data of semi_data_c, and updating the imsi->imsiInfo table item;

[0062] S2.4. Receive the semi-structured data of semi_data_d, search the smContextRef->imis table item, obtain imis, and search the imsi->imsiInfo table item through the imsi to update;

[0063] S2.5. Receive the semi-structured data of semi_data_e, search for the smContextRef->imis table item, obtain imis, search for the imsi->imsiInfo table item through the imsi, and delete the user offline.

[0064] The three user codes are IMSI, IMEI, and MSISDN, wherein IMSI represents the International Mobile Subscriber Identity, IMEI represents the International Mobile Equipment Identity, and MSISDN represents the user's mobile phone number.

[0065] After receiving the first-level semi-structured data, the second-level board updates the user table entries. Since the second-level board stores user table entries based on IMSI load balancing, multiple boards can be stacked to store more than 10 million users.

[0066] Each time the secondary board receives the semi-structured data processing operation, it encapsulates the user's three codes and tunnel information into secondary structured data, and sends it to the third-level associated board according to the learned UPF IP filter. By filtering the UPF IP destination, the third-level board does not need to store more than 10 million users, and only needs to store local related users.

[0067] S3, the third-level board parses the received secondary structured data, extracts the user three codes and location information NCGI, allocates uplink and downlink tunnel numbers and network element IPs to the user, and allocates an Internet access IP to the user;

[0068] After receiving the secondary structured data, the third-level board parses and extracts the user's three codes (IMSI, IMEI, MSISDN) location information NCGI, the uplink and downlink tunnel numbers and network element IPs assigned to the user (recorded as: Teid_up, UPF IP, Teid_down, gNodeIp respectively), and the IP address assigned to the user for Internet access, which is recorded as UE IP, where UE IP includes UE IPv4 and UE IPv6 prefixes.

[0069] S3.1. Establishing a user association table entry, including establishing an association table entry of the uplink and downlink tunnel numbers, user three codes, location information NCGI, and Internet access IP;

[0070] In this embodiment, the specific association table items are as follows:

[0071]

[0072] S3.2. Establish a base station IP association table entry, including extracting the gNB ID using the location information NCGI, and establishing the gNB ID associated with the base station IP.

[0073] The 5G NR Cell Global Identity (NCGI) is composed of the Public Land Mobile Network Identity (PLMN ID) to which the cell belongs and the NR Cell Identity (NCI), and its specific composition is as follows:

[0074] NCGI=PLMN ID+NCI(gNB ID+Cell ID)

[0075] The gNB ID is extracted using the location information NCGI parsed by N11, and the gNB ID is associated with the base station IP. In this embodiment, the specific association table entries are as follows:

[0076]

[0077]

[0078] S4, the third-level board receives the service data through the 5G N3 interface, and parses the uplink and downlink tunnel numbers, uplink and downlink network element IPs, inner source IP addresses, and inner destination IP addresses from the service data;

[0079] The upstream and downstream tunnel numbers plus the downstream network element IP are recorded as Teid_N3_Up+UPF IP and Teid_N3_Down+gNodeIP, and the inner source IP address and inner destination IP address are recorded as IPv4_Src_Inner, Ipv4_Dst_Innder, Ipv6_Src_Inner, and Ipv6_Dst_Innder.

[0080] The N3 interface is an interface used to carry user plane data in the 5G core network. It connects the user plane function (UPF) in the 5G core network and the data network. The uplink and downlink network element IP, uplink and downlink tunnel number, and inner IP of a flow are extracted through the N3 interface service data.

[0081] In this embodiment, IPv4_Src_Inner represents the source IP address of the inner IPv4 message in the tunnel technology, and Ipv4_Dst_Innder represents the destination address of the inner IPv4 message in the tunnel technology. Similarly, Ipv6_Src_Inner represents the source address of the inner IPv6 message in the tunnel technology, and Ipv6_Dst_Innder represents the destination address of the inner IPv6 message in the tunnel technology.

[0082] S5. Use the uplink and downlink tunnel numbers and the uplink and downlink network element IPs to perform user tracing association, and use the inner source IP address and inner destination IP address to perform strong verification with the IMSI associated with the uplink and downlink tunnel numbers and the IP associated with the base station.

[0083] Using the uplink and downlink tunnel numbers and the uplink and downlink network element IPs to perform user tracing association specifically includes: using Teid_N3_Up+UPF IP as a key to search for the Teid+Ip->UserInfo table item to obtain the first user information, and at the same time using Teid_N3_Down+gNode IP as a key to search for the Teid+Ip->UserInfo table item to obtain the second user information.

[0084] The strong verification specifically includes:

[0085] S5.1. The user information queried using the Teid_N3_Up+UPF IP and Teid_N3_Down+gNode IP needs to be consistent;

[0086] S5.2. Use the user's Internet IP and inner IP for verification. If the inner IP is IPv4, IPv4_Src_Inner or Ipv4_Dst_Innder needs to be consistent with the UE IPv4 in the associated user information table item; if the inner IP is an IPv6 prefix, the prefix of Ipv6_Src_Inner or Ipv6_Dst_Innder is consistent with the UE IPv6 prefix in the associated user information table item, where the inner IP includes the inner source IP address and the inner destination IP address;

[0087] S5.3. The base station IP corresponding to the associated location information NCGI must be consistent with the base station IP of the N3 interface service data, including: using the base station ID extracted by the location information NCGI to search the gNB ID->gNB IP table entry, and obtaining the base station IP that is consistent with the gNB IP parsed by the N3 interface service data.

[0088] In this embodiment, strong verification is performed through three conditions:

[0089] 1) When using N3 service data, the IMSI associated with different tunnel numbers and network element IPs for the same upstream and downstream flows must be consistent.

[0090] 2)N3 service data inner IP:

[0091] If it is IPv4, the inner IPv4 (source or destination IP) of the N3 interface service data needs to be consistent with the associated user UE IPv4;

[0092] If it is IPv6, the inner IPv6 prefix (source or destination IP) of the N3 interface service data needs to be consistent with the associated user UE IPv6 prefix.

[0093] 3) Use the associated table entry NCGI to extract the base station ID, look up the table entry Key (gNode ID) -> Value (gNodeIP), and compare the gNode IP with the outer IP (source or destination IP) of the current parsed N3 interface service data, which must be consistent.

[0094] In some optional embodiments, such as Figure 2 As shown, a schematic diagram of a user provenance association strong verification process according to an embodiment of the present invention is shown.

[0095] Use N11 interface signaling to parse and extract the user's three codes (IMSI, IMEI, MSISDN), location information NCGI, UE IP, and uplink and downlink tunnel numbers, and establish Key (Teid+IP) Value (IMSI, IMEI, MSISDN, NCGI, UE IPv4, UE IPv6 prefix) table items and Key (gNode ID) -> Value (gNode IP) table items.

[0096] The outer IP and tunnel number of N3 service data are used to perform user traceability association.

[0097] Strong verification is performed using the inner IP, IMSI associated with both tunnels, and IP associated with the base station to ensure the accuracy of user traceability association.

[0098] In summary, the present invention describes an architecture design for 5G core network signaling processing, aiming to solve the signaling processing and resource management problems when large-scale users access. Through a hierarchical processing mechanism, the following main problems can be effectively solved:

[0099] 1) Large-scale user processing: By distributing and storing user table information on multiple boards, distributed storage of user table information is achieved, thus supporting tens of millions of users. Including: primary board: preliminary analysis of original signaling and encapsulation into semi-structured data packets; secondary board: load balancing based on IMSI (International Mobile Subscriber Identity), distributing semi-structured data packets to different secondary boards, each board only processes a part of user data, thus avoiding the bottleneck caused by a single board storing too much user table information.

[0100] 2) Load balancing: The primary processing board receives 5G original signaling through load balancing to ensure that the processing load of each board is uniform; IMSI load balancing: Load balancing is performed between the secondary boards based on IMSI, so that multiple secondary boards can process user table updates in parallel, improving the overall system throughput.

[0101] 3) User Table Information Bottleneck The bottleneck problem of storing user table information on a single board is solved by distributing the user table information on multiple secondary boards, thereby supporting larger-scale user access.

[0102] 4) UPF IP filtering: The third-level board sends the learned UPF IP filtering to the third-level associated board, which can reduce the storage pressure of the third-level board so that it only needs to store user data related to the local area instead of all data of all users.

[0103] 5) Efficient management of user information: The third-level board further processes the secondary structured data, extracts the user's key information (such as IMSI, IMEI, MSISDN, NCGI, etc.), and allocates tunnel number and network element IP information to the user, so as to realize efficient management and update of user information.

[0104] 6) Business data analysis: The third-level board analyzes the business data of the N3 interface, extracts the outer and inner tunnel numbers and IP information, and can effectively manage and route the user's business data.

[0105] This architecture solves the signaling processing and resource management issues when large-scale users access the network. Specifically, it includes: 1) Distributed storage: User table information is stored in a distributed manner through multi-level boards to support large-scale user access. 2) Load balancing: Through load balancing between multi-level boards, the processing load of each board is ensured to be uniform, thereby improving the overall throughput of the system. 3) Efficient management: Through step-by-step processing and screening, efficient management and updating of user information is achieved to ensure the efficiency of system operation. 4) Resource optimization: Through the reasonable allocation of resources such as user information and tunnel numbers, the utilization efficiency of system resources is optimized. This architectural design enables the system to cope with the challenges brought by large-scale user access while ensuring the stability and efficiency of the system.

[0106] Reference below Figure 3 , which shows a schematic diagram of the structure of a computer system 300 suitable for implementing an electronic device of an embodiment of the present application. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0107] like Figure 3 As shown, the computer system 300 includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage part 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the system 300 are also stored. The CPU 301, the ROM 302, and the RAM 303 are connected to each other through a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0108] The following components are connected to the I / O interface 305: an input section 306 including a keyboard, a mouse, etc.; an output section 307 including a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN card, a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as needed. A removable medium 311, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 310 as needed, so that a computer program read therefrom is installed into the storage section 308 as needed.

[0109] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 309, and / or installed from the removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, the above functions defined in the method of the present application are executed. It should be noted that the computer-readable storage medium of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.

[0110] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0111] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] The modules involved in the embodiments of the present application may be implemented by software or by hardware.

[0113] As another aspect, the present application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or it may exist alone and not be assembled into the electronic device. The above computer-readable storage medium carries one or more programs. When the above one or more programs are executed by the electronic device, the electronic device: 5G original signaling enters the first-level processing board through load balancing. The first-level board purely parses N11 and N16 signaling, and encapsulates the parsed data into a first-level semi-structured data packet. After receiving the first-level semi-structured data, the second-level board updates the user table. The second-level board encapsulates the three-code information and tunnel information into secondary structured data, and sends it to the third-level board according to the learned UPF IP screening. The third-level board parses and extracts the user's three codes, location information NCGI, the uplink and downlink tunnel numbers and network element IPs assigned to the user, and the IP addresses assigned to the user's Internet access. The third-level board parses the outer tunnel number and outer IP address through the 5G N3 interface service data. The outer IP and tunnel number of the N3 service data are used to perform user traceability association. Strong verification is performed using the inner IP, IMSI associated with both tunnels, and IP associated with the base station to ensure the accuracy of user traceability association.

[0114] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A 5G multi-stage processing user data tracing and association method based on strong verification, characterized in that: The following steps are involved: S1, 5G original signaling enters the first-level board through load balancing. The first-level board parses N11 and N16 signaling, encapsulates the parsed data into a first-level semi-structured data packet, and distributes the data packet to the second-level board in an imsi load balancing manner; S2, the secondary board receives the primary semi-structured data packet, updates the user table entry, and encapsulates the user three codes and tunnel information into secondary structured data, uses UPF IP to learn and filter the secondary structured data, and sends the filtered data to the tertiary board; S3, the third-level board parses the received secondary structured data, extracts the user three codes and location information NCGI, allocates uplink and downlink tunnel numbers and network element IPs to the user, and allocates an Internet access IP to the user; S4, the third-level board receives the service data through the 5G N3 interface, and parses the uplink and downlink tunnel numbers, uplink and downlink network element IPs, inner source IP addresses, and inner destination IP addresses from the service data; S5. Use the uplink and downlink tunnel numbers and the uplink and downlink network element IPs to perform user tracing association, and use the inner source IP address and inner destination IP address to perform strong verification with the IMSI associated with the uplink and downlink tunnel numbers and the IP associated with the base station.

2. The user data traceability and association method according to claim 1, characterized in that: The specific steps of step S1 also include: S1.

1. parse the user three codes, location information NCGI and session ID from the Nsmf_PDUSession_CreateSMContext Request signaling, encapsulate the user three codes, location information NCGI and session ID into semi-structured data, recorded as semi_data_a, and load-balance to the secondary board through imis; S1.

2. Parse smContextRef from Nsmf_PDUSession_CreateSMContext Response signaling, encapsulate the smContextRef into semi-structured data using imis, record it as semi_data_b, and load balance it to the secondary board through imis; S1.

3. Parse the IMSI, smContextRef and tunnel information in the user three codes from the Namf_Communication_N1N2MessageTransfer signaling, and encapsulate them into semi-structured data, recorded as semi_data_c, and load balance the semi_data_c to the secondary board through imsi; S1.

4. Parse the smContextRef and tunnel information from the Nsmf_PDUSession_UpdateSMContext Request signaling, encapsulate them into semi-structured data, record them as semi_data_d, and send them to the secondary board via broadcast; S1.

5. Parse the smContextRef from the Nsmf_PDUSession_ReleaseSMContext Request signaling and mark the user offline, encapsulate it into semi-structured data recorded as semi_data_e, and send it to the secondary board via broadcast.

3. The user data traceability association method according to claim 1 or 2, characterized in that: The specific processing steps of the secondary board receiving the primary semi-structured data packet and updating the user table entry include: S2.

1. Receive the semi-structured data of semi_data_a, and establish an imis-associated imsiInfo table item, wherein the imsiInfo includes the user's three codes, location information NCGI, the uplink and downlink tunnel numbers allocated to the user, the network element IP, and the Internet access IP allocated to the user; S2.2, receiving the semi-structured data of semi_data_b, and establishing a smContextRef->imis table entry; S2.3, receiving the semi-structured data of semi_data_c, and updating the imsi->imsiInfo table item; S2.

4. Receive the semi-structured data of semi_data_d, search the smContextRef->imis table item, obtain imis, and search the imsi->imsiInfo table item through the imsi to update; S2.

5. Receive the semi-structured data of semi_data_e, search for the smContextRef->imis table item, obtain imis, search for the imsi->imsiInfo table item through the imsi, and delete the user offline.

4. The user data tracing and associating method according to claim 1, characterized in that: The step S3 processing step specifically includes: S3.

1. Establishing a user association table entry, including establishing an association table entry of the uplink and downlink tunnel numbers, user three codes, location information NCGI, and Internet access IP; S3.

2. Establish a base station IP association table entry, including extracting the gNB ID using the location information NCGI, and establishing the gNB ID associated with the base station IP.

5. The user data tracing and associating method according to claim 1, characterized in that: The uplink and downlink tunnel numbers in step S4 plus the downlink network element IP are recorded as Teid_N3_Up+UPF IP and Teid_N3_Down+gNode IP, and the inner source IP address and the inner destination IP address are recorded as IPv4_Src_Inner, Ipv4_Dst_Innder, Ipv6_Src_Inner, and Ipv6_Dst_Innder.

6. The user data traceability association method according to claim 1 or 5, characterized in that: Using the uplink and downlink tunnel numbers and the uplink and downlink network element IPs to perform user tracing association specifically includes: using Teid_N3_Up+UPF IP as a key to search for the Teid+Ip->UserInfo table item to obtain the first user information, and at the same time using Teid_N3_Down+gNode IP as a key to search for the Teid+Ip->UserInfo table item to obtain the second user information.

7. The user data traceability association method according to claim 1 or 5, characterized in that: The strong verification specifically includes: S5.

1. The user information queried using the Teid_N3_Up+UPF IP and Teid_N3_Down+gNode IP needs to be consistent; S5.

2. Use the user's Internet IP and inner IP for verification. If the inner IP is IPv4, IPv4_Src_Inner or Ipv4_Dst_Innder needs to be consistent with the UE IPv4 in the associated user information table item; if the inner IP is an IPv6 prefix, the prefix of Ipv6_Src_Inner or Ipv6_Dst_Innder is consistent with the UE IPv6 prefix in the associated user information table item, where the inner IP includes the inner source IP address and the inner destination IP address; S5.

3. The base station IP corresponding to the associated location information NCGI must be consistent with the base station IP of the N3 interface service data, including: using the base station ID extracted by the location information NCGI to search the gNB ID->gNB IP table entry, and obtaining the base station IP that is consistent with the gNB IP parsed by the N3 interface service data.

8. A computer program product, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

9. A computing system, characterized in that: The method comprises a processor and a memory, wherein the processor is configured to execute the method according to any one of claims 1 to 7.

Images