Method and system for user identity association in 5G network

Abstract

The invention provides a user identity association method and system in a 5G network, and relates to the technical field of mobile Internet, and the method comprises the steps: deploying a network probe at a specified interface contained in a 5G core network, and obtaining the network flow corresponding to the specified interface through the network probe; analyzing the transmission signaling of the specified interface, and extracting a target field in the signaling transmission process; determining a target identifier representing the association relationship based on the association relationship of the target field; and taking the target identifier as a user identifier, and associating the network flow with the user identity. According to the invention, the association rate and reliability of user plane network traffic are improved, and user association in a scene without IMSI is realized.

Description

Technical Field

[0001] The present application relates to the field of mobile Internet technology, and in particular to a method and system for associating user identities in a 5G network. Background Art

[0002] With the rapid development of 5G networks, the need to associate data plane traffic with control plane traffic for sensing user behavior is also increasing accordingly. Traditional 4G networks generally associate the user plane with the data plane in network traffic based on the user's IMSI or IMEI. However, in the 5G core network, IMSI is no longer mandatory for transmission as a user identifier. Therefore, the current method makes it impossible to associate the data plane with the signaling plane in the 5G network, and in the scenario where there is no IMSI in the signaling plane data, the user identity cannot be associated without IMSI. Summary of the invention

[0003] The purpose of this application is to provide a method and system for associating user identities in a 5G network to alleviate the above-mentioned technical problems existing in the prior art.

[0004] In a first aspect, the present invention provides a method for associating user identities in a 5G network, the method comprising:

[0005] Deploy network probes on designated interfaces of the 5G core network and obtain network traffic corresponding to the designated interfaces through the network probes;

[0006] Parse the transmission signaling of the specified interface and extract the target field in the transmission signaling process;

[0007] Determine a target identifier representing the association relationship based on the association relationship of the target field;

[0008] The target identifier is used as the user identifier to associate network traffic with the user identity.

[0009] In an optional implementation manner, a network probe is deployed on a designated interface included in the 5G core network, and network traffic corresponding to the designated interface is obtained through the network probe, including:

[0010] Determine monitoring targets based on user identity association requirements; monitoring targets include network traffic;

[0011] Determine the deployment location according to the monitoring target, and the deployment location includes the designated interface, and the designated interface includes the N1 interface, the N2 interface, the N3 interface, and the N12 interface in the 5G core network;

[0012] Configure the working mode, filtering conditions, and traffic collection frequency of the network probe, and obtain the network traffic of the corresponding N1 interface, N2 interface, N3 interface, and N12 interface respectively according to the working mode, filtering conditions, and traffic collection frequency.

[0013] In an optional implementation manner, parsing the transmission signaling of the specified interface and extracting the target field in the transmission signaling process includes:

[0014] Parse the Registration signaling of the N12 interface and extract the first SUCI field in the signaling transmission process;

[0015] Parse the transmission signaling of the N1 interface and the N2 interface, extract the second SUCI field and the corresponding AMF-UE-NGAP-ID field and RAN-UE-NGAP-ID field, the first TEID field and the first IP field;

[0016] Parse the user plane data of the N3 interface and extract the second TEID field and the second IP field.

[0017] In an optional implementation manner, parsing the Registration signaling of the N12 interface and extracting the first SUCI field in the signaling transmission process includes:

[0018] Obtain the interface traffic captured by the N12 interface, search for the Registration Request message in the interface traffic, and parse the Registration Request message;

[0019] The SUCI field is located and decoded to obtain the first SUCI field in the signaling transmission process.

[0020] In an optional implementation, parsing the transmission signaling of the N1 interface and the N2 interface, extracting the second SUCI field and the corresponding AMF-UE-NGAP-ID field and RAN-UE-NGAP-ID field, the first TEID field and the first IP field, including:

[0021] Get the network traffic of N1 and N2 interfaces;

[0022] Filter out the signaling messages of the N1 interface and the N2 interface from the network traffic through the pre-selected filter;

[0023] Parsing the NAS message in the signaling message, and extracting the second SUCI field in the NAS message body;

[0024] Parse the NGAP message in the signaling message, extract the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field corresponding to the N1 interface and the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field corresponding to the N2 interface, as well as the first TEID field and the first IP field.

[0025] In an optional implementation, parsing the user plane data of the N3 interface and extracting the second TEID field and the second IP field includes:

[0026] Obtain the network traffic of the N3 interface, filter the network traffic through the filter, and obtain the data packets of the GTP-U protocol;

[0027] Extract the second TEID field in the specified field of the data packet;

[0028] Parse the user plane data in the IP data packet and parse the IP header to extract the second IP field.

[0029] In an optional implementation manner, the designated interface further includes an N4 interface, and the method further includes:

[0030] Parse the session management data of the N4 interface and extract the third TEID field and the third IP field.

[0031] In an optional implementation, determining a target identifier representing the association relationship based on the association relationship of the target field includes:

[0032] Associating the third TEID field and the third IP field obtained by parsing the N4 interface with the second TEID field and the second IP field obtained by parsing the N3 interface to obtain first association information;

[0033] Associating the first TEID field and the first IP field obtained by parsing the first association information, the N2 interface, to obtain second association information;

[0034] Associating the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field obtained by parsing the N1 interface with the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field obtained by parsing the N2 interface to obtain third association information;

[0035] Based on the third association information, the second SUCI field obtained by parsing the N1 interface is associated with the first SUCI field obtained by parsing the N12 interface to determine a target identifier representing the association relationship; the target identifier is a SUCI identifier.

[0036] In an optional implementation manner, the target identifier is a SUCI identifier; using the target identifier as a user identifier and associating network traffic with the user identity includes:

[0037] Through NAS decryption processing, the mapping relationship between the SUCI identifier and the SUPI identifier is obtained;

[0038] A target SUPI identifier corresponding to the SUCI identifier is determined based on the mapping relationship, and network traffic is associated with a user identity based on the target SUPI identifier.

[0039] In a second aspect, the present invention provides a system for associating user identities in a 5G network, the system being used to implement the method of the aforementioned implementation mode, the system comprising:

[0040] The traffic acquisition module is used to deploy a network probe on a specified interface included in the 5G core network, and obtain the network traffic corresponding to the specified interface through the network probe;

[0041] A field extraction module is used to parse the transmission signaling of the specified interface and extract the target field in the transmission signaling process;

[0042] An association relationship determination module, used for associating the association relationship based on the target field to determine a target identifier representing the association relationship;

[0043] The association module is used to associate the network traffic with the user identity by using the target identifier as the user identifier.

[0044] The beneficial effects of the method and system for associating user identities in a 5G network provided by the present application are as follows:

[0045] In the 5G core network, the data plane network traffic is associated with specific users. By using SUPI as the unique user identifier, not only can the user plane data be associated with the signaling plane data, but also in the absence of IMSI transmission, the network traffic can be associated with the user by using SUPI as the user identifier, thus improving the association rate and reliability of the user plane network traffic and realizing user association in the scenario without IMSI. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1A flowchart of a method for associating user identities in a 5G network provided in an embodiment of the present application;

[0048] Figure 2 A field association diagram provided for an embodiment of the present application;

[0049] Figure 3 A flowchart of another association provided in an embodiment of the present application;

[0050] Figure 4 A structural diagram of a system for associating user identities in a 5G network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0052] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0053] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0054] The present application embodiment provides a method for associating user identities in a 5G network. Figure 1 As shown, the method mainly includes the following steps:

[0055] Step S110, deploy a network probe on the designated interface included in the 5G core network, and obtain the network traffic corresponding to the designated interface through the network probe.

[0056] The 5G network consists of multiple parts, including but not limited to the Radio Access Network (RAN), the Core Network (CN) and the User Equipment (UE). The 5G Core Network (5GC) is an important part of the 5G network architecture and is mainly responsible for handling the core functions of the network, such as connection management, mobility management, session management, policy control and billing.

[0057] The above-mentioned designated interfaces include N1 interface, N2 interface, N3 interface and N12 interface in the 5G core network. Optionally, in order to improve the accuracy of association, N4 interface may be further included.

[0058] In one implementation, a network probe is deployed on a designated interface included in the 5G core network, and the network traffic corresponding to the designated interface is obtained through the network probe. The monitoring target can be determined according to the user identity association requirements. In this embodiment, the monitoring target can be network traffic. Then, the deployment location is determined according to the monitoring target, that is, the designated interface where the network probe needs to be deployed is determined according to the obtained network traffic. The working mode, filtering conditions and traffic collection frequency of the network probe are further configured, and the network traffic of the corresponding N1 interface, N2 interface, N3 interface and N12 interface is obtained respectively through the working mode, filtering conditions and traffic collection frequency.

[0059] Step S120, parsing the transmission signaling of the designated interface, and extracting the target field in the transmission signaling process.

[0060] In order to associate network traffic with user identity, in specific implementation, the transmission signaling of the specified interface is parsed and the target field in the transmission signaling process is extracted, which may include the following steps 1.1 to 1.3:

[0061] Step 1.1, parse the Registration signaling of the N12 interface, and extract the first SUCI field in the signaling transmission process. Specifically, it can further include steps 1.1.1 and 1.1.2:

[0062] Step 1.1.1, obtain the interface traffic captured by the N12 interface, search for the RegistrationRequest message in the interface traffic, and parse the RegistrationRequest message;

[0063] Step 1.1.2, locate the SUCI field and perform decoding processing to obtain the first SUCI field in the signaling transmission process.

[0064] In practical applications, more specifically, the following methods can be used:

[0065] 1) Capture N12 interface traffic:

[0066] Use a network capture tool (such as Wireshark) to capture the traffic on the N12 interface. Make sure you can identify the traffic on the N12 interface, which usually involves a specific IP address and port number.

[0067] 2) Filter Registration Request messages:

[0068] Look for Registration Request messages in the captured traffic. These messages are usually included in NAS messages, and you can use Wireshark's display filter (e.g. nas-s1ap.nas_msg_type == 65) to filter out Registration Request messages.

[0069] 3) Parsing NAS message:

[0070] The Registration Request message is a complex NAS message that contains multiple IEs (Information Elements). You need to parse the message to find the SUCI field. The SUCI is usually located in an IE called "5G-GUTI orSUCI".

[0071] 4) Locate the SUCI field:

[0072] After parsing the NAS message, look for the SUCI IE. According to the 3GPP standard, the SUCI IE may contain the following fields:

[0073] Routing Indicator: used for network routing.

[0074] Home Network Identifier (HNI): includes MCC and MNC.

[0075] Scheme Output: The transformed user identifier part.

[0076] 5) Decode the SUCI field:

[0077] Once the SUCI field is found, the SUCI can be decoded based on the protection scheme used by the operator. If the protection scheme is key-based encryption, the corresponding key is required to decrypt; if it is based on a hash function, reverse engineering may be required to infer the original IMSI.

[0078] Step 1.2, parse the transmission signaling of the N1 interface and the N2 interface, extract the second SUCI field and the corresponding AMF-UE-NGAP-ID field and RAN-UE-NGAP-ID field, the first TEID field and the first IP field. Specifically, the following steps 1.2.1 to 1.2.4 may be further included:

[0079] Step 1.2.1, obtain the network traffic of N1 interface and N2 interface;

[0080] Step 1.2.2, filtering out the signaling messages of the N1 interface and the N2 interface from the network traffic through the pre-selected filter;

[0081] Step 1.2.3, parsing the NAS message in the signaling message, and extracting the second SUCI field in the NAS message body;

[0082] Step 1.2.4, parse the NGAP message in the signaling message, extract the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field corresponding to the N1 interface and the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field corresponding to the N2 interface, as well as the first TEID field and the first IP field.

[0083] In practical applications, the above analysis steps can also be specifically performed by the following means:

[0084] 1. Capture signaling messages: Use a network packet capture tool (such as Wireshark) to capture signaling messages on the N1 and N2 interfaces.

[0085] 2. Filter messages: Use appropriate filters (such as nas-s1ap or ngap) in Wireshark to filter out signaling messages on the N1 and N2 interfaces.

[0086] 3. Parsing NAS message:

[0087] o Find the Registration Request message and check the SUCI field in the NAS message body.

[0088] o Look at the Initial Context Setup Request message and extract the AMF-UE-NGAP-ID and RAN-UE-NGAP-ID fields.

[0089] 4. Parsing NGAP message:

[0090] o Find the Initial UE Message and extract the AMF-UE-NGAP-ID and RAN-UE-NGAP-ID fields.

[0091] oView the PDU Session Establish Accept message and extract the TEID field.

[0092] View the PDU Session Resource Setup Request message and extract the IP address.

[0093] Step 1.3, parse the user plane data of the N3 interface, and extract the second TEID field and the second IP field. In the specific implementation, the following steps 1.3.1 to 1.3.3 may be further included:

[0094] Step 1.3.1, obtain the network traffic of the N3 interface, filter the network traffic through the filter, and obtain the data packets of the GTP-U protocol;

[0095] Step 1.3.2, extracting the second TEID field in the designated field of the data packet;

[0096] Step 1.3.3, parse the user plane data in the IP data packet, parse the IP header and extract the second IP field.

[0097] In practical applications, extracting TEID and IP address can be performed by the following specific means:

[0098] 1. Use Wireshark to capture and parse data packets: Capture data packets: Use Wireshark or other network packet capture tools to capture data packets on the N3 interface; save the captured file for subsequent analysis.

[0099] 2. Load the captured file: Open Wireshark and load the captured file.

[0100] 3. Filter GTP-U packets: Use the filter gtp or gtpu to filter out GTP-U protocol packets.

[0101] 4. Find TEID: In the GTP-U header, the TEID field is located from the 8th to the 11th bytes (32 bits); in Wireshark, the TEID field is usually displayed as "Tunnel ID".

[0102] 5. Find IP address: User plane data is usually encapsulated in IP packets, and the source IP and destination IP addresses can be extracted by parsing the IP header. For example, in Wireshark, the IP address is usually displayed in the "Internet Protocol Version 4" or "Internet Protocol Version 6" section.

[0103] Optionally, when the specified interface also includes the N4 interface, the following steps 1.4 may be further included during the parsing:

[0104] Step 1.4, parse the session management data of the N4 interface, and extract the third TEID field and the third IP field.

[0105] Step S130: determining a target identifier representing the association relationship based on the association relationship of the target field.

[0106] In one implementation, the association relationship of the above-mentioned target field is also an association relationship between the third TEID field and the third IP field, the second TEID field and the second IP field, the first TEID field and the first IP field, the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field, the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field, the second SUCI field, and the first SUCI field.

[0107] In the specific implementation, for ease of understanding, see Figure 2 The field association diagram shown may include the following steps 2.1 to 2.4:

[0108] Step 2.1, associating the third TEID field and the third IP field obtained by parsing the N4 interface with the second TEID field and the second IP field obtained by parsing the N3 interface to obtain first association information;

[0109] Step 2.2, the first association information, the first TEID field obtained by parsing the N2 interface, and the first IP field are associated to obtain second association information;

[0110] Step 2.3, the second association information, the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field obtained by parsing the N1 interface, and the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field obtained by parsing the N2 interface are associated to obtain third association information;

[0111] Step 2.4, the third association information, the second SUCI field obtained by parsing the N1 interface, and the first SUCI field obtained by parsing the N12 interface are associated to determine a target identifier representing the association relationship; the target identifier is a SUCI identifier.

[0112] Step S140: Use the target identifier as the user identifier and associate the network traffic with the user identity.

[0113] The target identifier is a SUCI identifier. In practical applications, the following steps 3.1 to 3.2 may be included:

[0114] Step 3.1, obtain the mapping relationship between the SUCI identifier and the SUPI identifier through NAS decryption processing;

[0115] Step 3.2: determining a target SUPI identifier corresponding to the SUCI identifier based on the mapping relationship, and associating the network traffic with the user identity based on the target SUPI identifier.

[0116] The above method extracts these identifiers by parsing the signaling and data of the N12 interface, N1 interface, N2 interface, N3 interface, and N4 interface, and obtains the user's unique identifier SUPI identifier by associating them, and uses the SUPI identifier as the user identifier to associate the network traffic with the user, thereby improving the association rate and reliability of the user plane network traffic, and realizing user association in a scenario without IMSI.

[0117] Figure 3 Another way of association is shown, which mainly includes the following steps:

[0118] Step S1, parsing the Registration signaling of the N12 interface, and extracting the SUCI field in the signaling transmission process.

[0119] SUCI is the abbreviation of Subscriber Concealed Identifier, which is an identifier used to protect user privacy. It is generated by AMF (Access and Mobility Management Function) and sent to AUSF (Authentication Server Function) and UDM (Unified Data Management) for authentication during the registration process. SUCI is encrypted by SUPI (Subscriber Permanent Identifier) ​​and HN (Home Network) Public Key. SUPI is the unique identifier of the user in the 5G core network, which is converted from IMSI (International Mobile Subscriber Identity) or 5G-GUTI (5G Globally Unique Temporary Identifier). HN Public Key is a public key generated by HN and distributed to AMF and AUSF.

[0120] Step S2, parse the Registration signaling of the N1 interface, extract the SUCI field corresponding to the AMF-UE-NGAP-ID and RAN-UE-NGAP-ID fields.

[0121] The above AMF-UE-NGAP-ID and RAN-UE-NGAP-ID are two identifiers used to identify UE (User Equipment). The former is generated by AMF and sent to AUSF and UDM for authentication during the registration process; the latter is generated by gNB (Next Generation NodeB) and sent to AMF for authentication during the registration process.

[0122] Step S3, parse the signaling of the N2 interface, and extract the AMF-UE-NGAP-ID, RAN-UE-NGAP-ID, TEID, and IP.

[0123] TEID is the abbreviation of Tunnel Endpoint Identifier, which is used to identify the terminal point of a data tunnel. IP is the abbreviation of Internet Protocol, which is used to identify the location of a device on the network.

[0124] Step S4, parse the user plane data of the N3 interface and extract the TEID and IP.

[0125] Step S5: Associating the user identity SUCI through TEID+IP, AMF-UE-NGAP-ID+RAN-UE-NGAP-ID.

[0126] Step S6: Decrypt and restore SUPI from SUCI through NAS decryption as the unique identifier of the user in the 5G core network.

[0127] In summary, the present application can extract these identifiers by parsing the signaling and data of the N12, N1, N2 and N3 interfaces, and associate them to obtain the user's unique identifier SUPI.

[0128] Based on the above method embodiment, the present application embodiment also provides a system for associating user identities in a 5G network, which is used to implement the method of the above implementation method, see Figure 4 As shown, the system includes the following parts:

[0129] The traffic acquisition module 410 is used to deploy a network probe on a designated interface included in the 5G core network, and acquire the network traffic corresponding to the designated interface through the network probe;

[0130] The field extraction module 420 is used to parse the transmission signaling of the specified interface and extract the target field in the transmission signaling process;

[0131] An association relationship determination module 430 is used to determine a target identifier representing the association relationship by associating the association relationship based on the target field;

[0132] The association module 440 is used to associate the network traffic with the user identity by using the target identifier as the user identifier.

[0133] In a feasible implementation manner, the traffic acquisition module 410 is further used to:

[0134] Determine monitoring targets based on user identity association requirements; monitoring targets include network traffic;

[0135] Determine the deployment location according to the monitoring target, and the deployment location includes the designated interface, and the designated interface includes the N1 interface, the N2 interface, the N3 interface, and the N12 interface in the 5G core network;

[0136] Configure the working mode, filtering conditions, and traffic collection frequency of the network probe, and obtain the network traffic of the corresponding N1 interface, N2 interface, N3 interface, and N12 interface respectively according to the working mode, filtering conditions, and traffic collection frequency.

[0137] In a feasible implementation manner, the field extraction module 420 is further used to:

[0138] Parse the Registration signaling of the N12 interface and extract the first SUCI field in the signaling transmission process;

[0139] Parse the transmission signaling of the N1 interface and the N2 interface, extract the second SUCI field and the corresponding AMF-UE-NGAP-ID field and RAN-UE-NGAP-ID field, the first TEID field and the first IP field;

[0140] Parse the user plane data of the N3 interface and extract the second TEID field and the second IP field.

[0141] In a feasible implementation manner, the field extraction module 420 is further used to:

[0142] Obtain the interface traffic captured by the N12 interface, search for the Registration Request message in the interface traffic, and parse the Registration Request message;

[0143] The SUCI field is located and decoded to obtain the first SUCI field in the signaling transmission process.

[0144] In a feasible implementation manner, the field extraction module 420 is further used to:

[0145] Get the network traffic of N1 and N2 interfaces;

[0146] Filter out the signaling messages of the N1 interface and the N2 interface from the network traffic through the pre-selected filter;

[0147] Parsing the NAS message in the signaling message, and extracting the second SUCI field in the NAS message body;

[0148] Parse the NGAP message in the signaling message, extract the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field corresponding to the N1 interface and the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field corresponding to the N2 interface, as well as the first TEID field and the first IP field.

[0149] In a feasible implementation manner, the field extraction module 420 is further used to:

[0150] Obtain the network traffic of the N3 interface, filter the network traffic through the filter, and obtain the data packets of the GTP-U protocol;

[0151] Extract the second TEID field in the specified field of the data packet;

[0152] Parse the user plane data in the IP data packet and parse the IP header to extract the second IP field.

[0153] In a feasible implementation manner, the designated interface further includes an N4 interface, a parsing module, which is used to:

[0154] Parse the session management data of the N4 interface and extract the third TEID field and the third IP field.

[0155] In a feasible implementation manner, the above association relationship determination module 430 is further used to:

[0156] Associating the third TEID field and the third IP field obtained by parsing the N4 interface with the second TEID field and the second IP field obtained by parsing the N3 interface to obtain first association information;

[0157] Associating the first TEID field and the first IP field obtained by parsing the first association information, the N2 interface, to obtain second association information;

[0158] Associating the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field obtained by parsing the N1 interface with the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field obtained by parsing the N2 interface to obtain third association information;

[0159] Based on the third association information, the second SUCI field obtained by parsing the N1 interface is associated with the first SUCI field obtained by parsing the N12 interface to determine a target identifier representing the association relationship; the target identifier is a SUCI identifier.

[0160] In a feasible implementation manner, the target identifier is a SUCI identifier; the association module 440 is configured to:

[0161] Through NAS decryption processing, the mapping relationship between the SUCI identifier and the SUPI identifier is obtained;

[0162] A target SUPI identifier corresponding to the SUCI identifier is determined based on the mapping relationship, and network traffic is associated with a user identity based on the target SUPI identifier.

[0163] The system for associating user identities in a 5G network provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for parts not mentioned in the embodiment of the system for associating user identities in a 5G network, reference may be made to the corresponding contents in the aforementioned method embodiment for associating user identities in a 5G network.

[0164] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present application.

[0165] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0166] In the description of the present application, it should be noted that the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0167] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for associating user identities in a 5G network, characterized in that: The method comprises: Deploy a network probe on a designated interface included in the 5G core network, and obtain network traffic corresponding to the designated interface through the network probe; Parsing the transmission signaling of the designated interface and extracting the target field in the transmission signaling process; Determine a target identifier representing the association relationship based on the association relationship of the target field; The target identifier is used as a user identifier, and the network traffic is associated with the user identity.

2. The method for associating user identities in a 5G network according to claim 1, characterized in that: Deploy a network probe on a designated interface included in the 5G core network, and obtain network traffic corresponding to the designated interface through the network probe, including: Determine monitoring targets according to user identity association requirements; the monitoring targets include network traffic; Determine a deployment location according to the monitoring target, where the deployment location includes the designated interface, and the designated interface includes an N1 interface, an N2 interface, an N3 interface, and an N12 interface in the 5G core network; Configure the working mode, filtering conditions and flow collection frequency of the network probe, and obtain the corresponding network flow of the N1 interface, N2 interface, N3 interface and N12 interface respectively through the working mode, the filtering conditions and the flow collection frequency.

3. The method for associating user identities in a 5G network according to claim 2, characterized in that: Parsing the transmission signaling of the specified interface and extracting the target field in the transmission signaling process, including: Parsing the Registration signaling of the N12 interface, and extracting the first SUCI field in the signaling transmission process; Parse the transmission signaling of the N1 interface and the N2 interface, extract the second SUCI field and the corresponding AMF-UE-NGAP-ID field and RAN-UE-NGAP-ID field, the first TEID field and the first IP field; Parse the user plane data of the N3 interface and extract the second TEID field and the second IP field.

4. The method for associating user identities in a 5G network according to claim 3, characterized in that: Parsing the Registration signaling of the N12 interface and extracting the first SUCI field in the signaling transmission process, including: Obtain interface traffic captured by the N12 interface, search for a Registration Request message in the interface traffic, and parse the Registration Request message; The SUCI field is located and decoded to obtain the first SUCI field in the signaling transmission process.

5. The method for associating user identities in a 5G network according to claim 3, characterized in that: Parsing the transmission signaling of the N1 interface and the N2 interface, extracting the second SUCI field and the corresponding AMF-UE-NGAP-ID field and RAN-UE-NGAP-ID field, the first TEID field and the first IP field, including: Obtaining network traffic of the N1 interface and the N2 interface; Filter out the signaling messages of the N1 interface and the N2 interface from the network traffic by using a pre-selected filter; Parsing a NAS message in the signaling message, and extracting a second SUCI field in the NAS message body; Parse the NGAP message in the signaling message, extract the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field corresponding to the N1 interface and the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field corresponding to the N2 interface, as well as the first TEID field and the first IP field.

6. The method for associating user identities in a 5G network according to claim 5, characterized in that: Parsing the user plane data of the N3 interface and extracting the second TEID field and the second IP field include: Obtain network traffic of the N3 interface, filter the network traffic through a filter, and obtain a data packet of the GTP-U protocol; Extracting the second TEID field in the designated field of the data packet; Parse the user plane data in the IP data packet, and parse the IP header to extract the second IP field.

7. The method for associating user identities in a 5G network according to claim 6, characterized in that: The designated interface further includes an N4 interface, and the method further includes: Parse the session management data of the N4 interface and extract the third TEID field and the third IP field.

8. The method for associating user identities in a 5G network according to claim 7, characterized in that: Determining a target identifier representing the association relationship based on the association relationship of the target field includes: Associating the third TEID field and the third IP field obtained by parsing the N4 interface with the second TEID field and the second IP field obtained by parsing the N3 interface to obtain first association information; Associating the first association information, the first TEID field obtained by parsing the N2 interface, and the first IP field to obtain second association information; Associating the first AMF-UE-NGAP-ID field and the first RAN-UE-NGAP-ID field obtained by parsing the N1 interface with the second AMF-UE-NGAP-ID field and the second RAN-UE-NGAP-ID field obtained by parsing the N2 interface to obtain third association information; Based on the third association information, the second SUCI field obtained by parsing the N1 interface and the first SUCI field obtained by parsing the N12 interface, an association is performed to determine a target identifier representing the association relationship; the target identifier is a SUCI identifier.

9. The method for associating user identities in a 5G network according to claim 1, characterized in that: The target identifier is a SUCI identifier; Using the target identifier as a user identifier and associating the network traffic with the user identity includes: Obtaining a mapping relationship between the SUCI identifier and the SUPI identifier through NAS decryption processing; A target SUPI identifier corresponding to the SUCI identifier is determined based on the mapping relationship, and the network traffic is associated with a user identity based on the target SUPI identifier.

10. A system for associating user identities in a 5G network, characterized in that: The system is used to implement the method according to claim 1, and the system comprises: A traffic acquisition module, used to deploy a network probe on a designated interface included in the 5G core network, and acquire the network traffic corresponding to the designated interface through the network probe; A field extraction module, used to parse the transmission signaling of the specified interface and extract the target field in the transmission signaling process; An association relationship determination module, used for associating the association relationship based on the target field to determine a target identifier representing the association relationship; The association module is used to use the target identifier as a user identifier to associate the network traffic with the user identity.

Images