Signaling abstract generation method based on N11 and N16 interfaces of 5G core network

Abstract

The invention discloses a signaling digest generation method based on N11 and N16 interfaces of a 5G core network, and belongs to the technical field of signaling digest generation, the synthesis of a signaling digest is efficiently completed based on a synthesis algorithm by analyzing N11 and N16 interface signaling of the 5G core network, and the method specifically comprises three parts of SBI signaling preprocessing, N11 / N16 interface core signaling analysis and signaling digest synthesis; according to the method, N11 and N16 interface signaling of the 5G core network is analyzed, synthesis of the signaling abstract is efficiently completed based on a synthesis algorithm, and the method specifically comprises three parts of SBI signaling preprocessing, N11 / N16 interface core signaling analysis and signaling abstract synthesis; the invention provides a method for realizing the internal association of the N11 interface, the internal association of the N16 interface and the association between the N11 interface and the N16 interface based on the N11 interface and the N16 interface of the 5G core network, so that the efficient and accurate generation of the signaling abstract is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of signaling summary generation, and in particular to a signaling summary generation method based on 5G core network N11 and N16 interfaces. Background Art

[0002] Signaling summary is a form of recording the results of signaling analysis, similar to the industry's XDR (eXtensible Data Record) log, with more streamlined fields and more flexible formats. With the gradual improvement of 5G mobile communication networks, how to ensure the security of 5G networks is an urgent problem to be solved. 5G signaling summary can provide traceability information for 5G network security systems, effectively handle network attacks and data leaks, and thus protect the security of 5G systems such as Internet of Vehicles and edge MEC. 5G signaling data volume is huge and there are many interfaces. How to efficiently synthesize signaling summaries to support 5G network security systems is a research direction in the industry.

[0003] At present, for the 5G core network signaling summary generation method, the engineering approach is to parse the full signaling interface or parse the N2, N4 interface combination or the N2, N11 interface combination, and integrate the parsing results to generate a signaling summary.

[0004] Due to the huge amount of 5G data, the 5G network security system has extremely high requirements for the complexity and accuracy of signaling summary generation. It needs to use the least signaling interface and cover all scenarios. The traditional generation method can no longer meet the requirements. Although the signaling summary information can be generated based on the N2, N4 interface or the N2, N11 interface, it is not the optimal technical solution for the complexity and accuracy of generating signaling summary information. Specifically, it is manifested as follows: 1) Complex protocols. N2 and N4 interfaces need to parse two protocols: NGAP and PFCP; N2 and N11 interfaces need to parse two protocols: NGAP and HTTP2, both involving the parsing and association of different protocols; 2) The association relationship is complex. For example, the association within the N2 interface involves many indexes such as imsi, ran_n3u_ip_teid, upf_n3u_ip_teid, guti_5g, ran_ip_ran_ngap_id, etc., and also involves the association with the N11 interface or N4 interface, and the association logic is complex; 3) It cannot cover all scenarios. For some special scenarios (such as overseas roaming, roaming on different networks, etc., which generate N16 interface scenarios), the existing technology has insufficient adaptation in generating signaling summaries; 4) Some existing technologies use smContextRef association within the N11 interface, which may result in association errors, causing accuracy issues in some signaling summary information. Summary of the invention

[0005] In order to solve the problems in the prior art of excessive complexity, questionable accuracy and insufficient adaptation to special scenarios in generating signaling summary information, the present invention provides a method for realizing association within the N11 interface, association within the N16 interface, and association between the N11 and N16 interfaces based on the 5G core network N11 and N16 interfaces, so as to achieve efficient and accurate generation of signaling summary.

[0006] The present invention adopts the following technical solutions to solve the above technical problems: A signaling summary generation method based on 5G core network N11 and N16 interfaces, which parses 5G core network N11 and N16 interface signaling and efficiently completes the synthesis of signaling summaries based on a synthesis algorithm, specifically including three parts: SBI signaling preprocessing, parsing N11 / N16 interface core signaling, and signaling summary synthesis; Among them, 1) SBI signaling preprocessing: Process the original signaling traffic, and output a complete HTTP2 uplink and downlink message of a request response to the parsing module through HTTP2 traffic identification, HTTP2 message assembly, and invalid signaling filtering operations; The HTTP2 message assembly specifically includes the following steps: Step A1, TCP packet assembly: The 5G core network N11 and N16 signaling interfaces adopt HTTP2 protocol for transmission, and the transport layer adopts TCP protocol; during traffic collection, the original bitstream is assembled according to the TCP sequence number; Step A2, HTTP2 protocol framing: The HTTP2 protocol decomposes the ordinary HTTP response into frame request and response concurrently, and assembles the binary code stream of one frame together according to the frame format; Step A3, HTTP2 protocol request and response assembly: HTTP2 protocol request and response assembly strings the frames of a request and response together through Stream Identifier to facilitate the parsing module to parse the request and response; a specific request and response includes HEADERS frame and DATA frame type; Identify the interface service type through the path field in the upstream request HEADERS frame, and only pass the request and response frames of the interface service type that the business is concerned about to the parsing module to filter out useless data; 2) Analyze the core signaling of N11 and N16 interfaces: The parsing module receives the message content sent by the SBI signaling pre-processing module, and extracts the associated elements and parsing elements in the original code stream according to the preset parsing rules of different service types, including processing JSON, i.e. key-value pairs, n1msg, i.e. NAS protocol messages, and n2msg, i.e. NGAP protocol messages. 3) Signaling summary synthesis: The signaling synthesis algorithm based on multi-index hash table completes the integration of extracted elements of each process and outputs the signaling summary; it includes two components: index hash table and summary synthesis unit; Among them, the index hash table is used to allow multiple different indexes to quickly locate the summary synthesis unit; The summary synthesis unit is responsible for synthesizing signaling parsing elements and outputting signaling summaries.

[0007] As a further preferred solution of the signaling summary generation method based on the 5G core network N11 and N16 interfaces of the present invention, parsing the core signaling of the N11 and N16 interfaces specifically includes: Since smContextRef and pduSessionRef are PDU session indexes generated and maintained by the SMF network element, they are unique within a single SMF network element. However, there will be conflicts between smContextRef and pduSessionRef across SMF network elements, and the SMF IP and smfInstanceId need to be combined. The N11 interface uses the smfInstanceId+SMF IP+smContextRef index and the IMSI+PDU session ID index to implement intra-interface association, as follows: a) If it is N11 Nsmf_PDUSession_CreateSMContext signaling data, the user three-code information, location information, SMF IP and smfInstanceId mapping relationship and SMF IP + smContextRef information are extracted, and the mapping relationship between smfInstanceId+SMF IP+smContextRef and IMSI+PDU session ID can be established; b) If it is N11 Nsmf_PDUSession_UpdateSMContext signaling data, extract the PDU session user plane tunnel information, location information, SMF IP + smContextRef and other information, and establish the smfInstanceId+SMF IP+smContextRef index; c) If it is N11 Nsmf_PDUSession_ReleaseSMContext signaling data, extract the location information, SMF IP + smContextRef and other information, and establish the smfInstanceId+SMF IP+smContextRef index; d) If it is N11 Namf_Communication_N1N2MessageTransfer signaling data, extract the IMSI, PDU session ID, user plane tunnel and other information, and establish the IMSI+PDU session ID index; The N16 interface uses the smfInstanceId+SMF IP+pduSessionRef index and the IMSI+PDU session ID index to implement intra-interface association, as follows: a) If it is N16 Nsmf_PDUSession_Create signaling data, the user three-code information, location information, user plane tunnel information, SMF IP and smfInstanceId mapping relationship, and SMF IP + pduSessionRef and other information are extracted to establish the mapping relationship between smfInstanceId+SMF IP+pduSessionRef and IMSI+PDU session ID; b) If it is N16 Nsmf_PDUSession_Update signaling data, extract the location information, SMF IP + pduSessionRef and other information, and establish the smfInstanceId+SMF IP+pduSessionRef index; c) If it is N16 Nsmf_PDUSession_Release signaling data, extract the location information, SMF IP + pduSessionRef and other information, and establish the smfInstanceId+SMF IP+pduSessionRef index; d) If it is N16 Nsmf_PDUSession_RetrieveContext signaling data, then extract the SMF IP +pduSessionRef and other information, and establish a mapping relationship between smfInstanceId+SMF IP+pduSessionRef and IMSI+PDU session ID; N11 and N16 signaling data are associated between interfaces through IMSI+PDU session ID, realizing full-element association of N11 and N16 signaling data; the precise construction of association index effectively guarantees the accuracy of subsequent signaling summary synthesis.

[0008] As a further preferred solution of the signaling summary generation method based on the 5G core network N11 and N16 interfaces of the present invention, a signaling synthesis algorithm based on a multi-index hash table specifically includes the following steps: Step B1, establishment of index hash table: initialize three hash tables, index hash table #1, index hash table #2 and index hash table #3, where index hash table #1 stores index IMSI+PDU session ID, index hash table #2 stores index smfInstanceId+SMF IP+pduSessionRef, and index hash table #3 stores smfInstanceId+SMF IP+pduSessionRef; assuming that the index keyword k is calculated by hash function h(k) to obtain the hash slot, then function h maps the keyword domain U to the slot of hash table T[0,…,n-1]: .

[0009] Considering that the synthesis algorithm of this signaling summary involves frequent hash node modification and deletion operations, the zipper method is selected to solve the hash conflict problem, that is, if , then the keyword , , , then the keyword , , The corresponding nodes are hung in the same slot in the form of a linked list; Step B2, signaling summary synthesis: After the signaling data of different interface service types are parsed, correlation elements and parsing elements are generated, wherein the correlation elements are converted into indexes after splicing, and the parsing elements are converted into the content of the signaling summary after synthesis; a) Creation of summary synthesis unit: After the signaling is parsed, the associated elements are converted into index nodes, and the corresponding index hash table is searched; if the index node does not exist, a node is created and hung under the corresponding slot, and the summary synthesis unit is created through the pointer in the node; for a signaling process containing multiple indexes, multiple index nodes are created, but there is only one entity of the summary synthesis unit, namely the N11 interface Nsmf_PDUSession_CreateSMContext process, which is shared through pointers. At the same time, the reference count use_cnt in the synthesis unit records how many index nodes the unit is shared by; b) Update of content in summary synthesis unit: when searching the index hash table, if the index exists, the parsed elements of the data need to be updated to the summary synthesis unit; c) Deletion of summary synthesis unit: When a session is released, such as the Nsmf_PDUSession_Release signaling process, the parsed elements of this data need to be updated to the summary synthesis unit according to b), and then the signaling summary is output, and finally the summary synthesis unit is released; Step B3: Output of signaling summary; The output of the signaling summary refers to the output of the content in the summary synthesis unit in a specific format including XML, TLV, and JSON to meet the requirements of business analysis, user data association, etc.

[0010] As a further preferred solution of the signaling summary generation method based on the 5G core network N11 and N16 interfaces of the present invention, in step B3, the output conditions of the signaling summary specifically include: a) The summary synthesis unit needs to be output after creation or before deletion to inform the service of the current signaling status; b) After the update operation of the content in the summary synthesis unit, it is necessary to decide whether to output the signaling summary based on whether the content in the container is actually changed, so as to minimize the number of output signaling summaries.

[0011] Compared with the prior art, the present invention adopts the above technical solution and has the following technical effects: 1. The present invention parses the signaling of the 5G core network N11 and N16 interfaces, and efficiently completes the synthesis of the signaling summary based on the synthesis algorithm, which specifically includes three parts: SBI signaling preprocessing, parsing the core signaling of the N11 / N16 interface, and signaling summary synthesis; The present invention provides a method for realizing the association within the N11 interface, the association within the N16 interface, and the association between the N11 and N16 interfaces based on the 5G core network N11 and N16 interfaces, so as to realize the efficient and accurate generation of the signaling summary; 2. In the process of processing the content of N11 and N16 signaling interfaces, the accurate construction of the association indexes within and between N11 and N16 interfaces can effectively ensure the accuracy of signaling synthesis, including adding smfInstanceId and SMF IP restrictions to the construction of smContextRef and pduSessionRef association element indexes to ensure their uniqueness and avoid the output of erroneous signaling summary information caused by the uniqueness of the association element index value; 3. In the signaling summary synthesis algorithm of the present invention, multiple hash tables are used to implement multiple indexes and hash conflicts are optimized, thereby achieving a time complexity of O(1); at the same time, different index nodes are allowed to share summary synthesis units through pointers, and the creation and release of containers are managed through reference counting, thereby increasing the efficiency of memory use through this sharing method; 4. The present invention can improve the accuracy of association within the N11 interface, the N16 interface, and between the N11 and N16 interfaces by accurately constructing an associated element index when parsing the N11 and N16 signaling interfaces. It can also cover the comprehensiveness of the signaling summary in special scenarios such as overseas roaming and roaming on different networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is the overall architecture of a method for generating a signaling summary based on the N11 and N16 interfaces of the 5G core network of the present invention; Figure 2 It is a frame format diagram of HTTP2 of the present invention; Figure 3 It is a schematic diagram of signaling summary synthesis of the present invention. DETAILED DESCRIPTION

[0013] The technical solution of the present invention is further described in detail below in conjunction with the accompanying drawings: The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The present invention is described in detail below based on the drawings and preferred embodiments, and the purpose and effect of the present invention will become clearer. It should be understood that the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0014] The present invention analyzes the 5G core network N11 and N16 interface signaling and efficiently completes the synthesis of signaling summaries based on the synthesis algorithm, which mainly includes three parts: SBI (Service-Based Interface) signaling preprocessing, parsing N11 / N16 interface core signaling, and signaling summary synthesis. Figure 1 shown.

[0015] 1) SBI signaling preprocessing SBI signaling preprocessing mainly processes the original signaling traffic, and outputs a complete HTTP2 uplink and downlink message of a request response to the parsing module through operations such as HTTP2 traffic identification, HTTP2 message assembly, and invalid signaling filtering. The HTTP2 message assembly includes the following steps: Step 1: TCP packet assembly. The 5G core network N11 and N16 signaling interfaces use the HTTP2 protocol for transmission, and the transport layer uses the TCP protocol. During the actual network transmission process, TCP fragmentation and out-of-order retransmission may occur. In traffic collection, we need to assemble the original code stream according to the TCP sequence number.

[0016] Step 2: HTTP2 protocol framing. The HTTP2 protocol breaks down ordinary HTTP responses into concurrent frame requests and responses. To facilitate subsequent parsing, we need to further assemble a frame of binary code streams according to the frame format. The HTTP2 frame format is as follows: Figure 2 shown.

[0017] Step 3: HTTP2 protocol request and response assembly. HTTP2 protocol request and response assembly requires stringing together the frames of a request and response through Stream Identifier to facilitate the parsing module to parse the request and response. A specific request and response may include HEADERS frames, DATA frames, and other types.

[0018] The interface service type is identified by the path field (using Huffman coding) in the uplink request HEADERS frame, and only the request and response frames of the interface service types (as shown in Table 1) that the business cares about are transferred to the parsing module to filter out useless data and improve parsing efficiency. Table 1 shows the overall architecture of interface parsing.

[0019] Table 1 .

[0020] 2) Analyze the core signaling of N11 and N16 interfaces The parsing module receives the message content sent by the SBI signaling preprocessing module, and extracts the associated elements and parsing elements in the original code stream according to the preset parsing rules of different service types. It mainly involves processing three formats of data: JSON (key-value pair), n1msg (NAS protocol message) and n2msg (NGAP protocol message). The specific associated elements and parsing elements that need to be extracted for different service interfaces are shown in Table 1.

[0021] Since both smContextRef and pduSessionRef are PDU session indexes generated and maintained by the SMF network element, they are unique within a single SMF network element. However, there will be conflicts between smContextRef and pduSessionRef across SMF network elements, and the SMF IP and smfInstanceId need to be combined.

[0022] N11 interface can use smfInstanceId+SMF IP+smContextRef index and IMSI+PDU session ID index to achieve intra-interface association, as follows: a) If it is N11 Nsmf_PDUSession_CreateSMContext signaling data, the user three-code information, location information, SMF IP and smfInstanceId mapping relationship and SMF IP + smContextRef information are extracted, and the mapping relationship between smfInstanceId+SMF IP+smContextRef and IMSI+PDU session ID can be established; b) If it is N11 Nsmf_PDUSession_UpdateSMContext signaling data, extract the PDU session user plane tunnel information, location information, SMF IP + smContextRef and other information, and establish the smfInstanceId+SMF IP+smContextRef index; c) If it is N11 Nsmf_PDUSession_ReleaseSMContext signaling data, extract the location information, SMF IP + smContextRef and other information, and establish the smfInstanceId+SMF IP+smContextRef index; d) If it is N11 Namf_Communication_N1N2MessageTransfer signaling data, extract the IMSI, PDU session ID, user plane tunnel and other information, and establish the IMSI+PDU session ID index; N16 interface can use smfInstanceId+SMF IP+pduSessionRef index and IMSI+PDU session ID index to achieve intra-interface association, as follows: a) If it is N16 Nsmf_PDUSession_Create signaling data, the user three-code information, location information, user plane tunnel information, SMF IP and smfInstanceId mapping relationship, and SMF IP + pduSessionRef and other information are extracted to establish the mapping relationship between smfInstanceId+SMF IP+pduSessionRef and IMSI+PDU session ID; b) If it is N16 Nsmf_PDUSession_Update signaling data, extract the location information, SMF IP + pduSessionRef and other information, and establish the smfInstanceId+SMF IP+pduSessionRef index; c) If it is N16 Nsmf_PDUSession_Release signaling data, extract the location information, SMF IP + pduSessionRef and other information, and establish the smfInstanceId+SMF IP+pduSessionRef index; d) If it is N16 Nsmf_PDUSession_RetrieveContext signaling data, then extract the SMF IP +pduSessionRef and other information, and establish a mapping relationship between smfInstanceId+SMF IP+pduSessionRef and IMSI+PDU session ID; N11 and N16 signaling data are associated between interfaces through IMSI+PDU session ID, and finally all elements of N11 and N16 signaling data are associated. The precise construction of the association index can effectively ensure the accuracy of subsequent signaling summary synthesis.

[0023] 3) Signaling summary synthesis As can be seen from Table 1, the signaling of the N11 and N16 interfaces is composed of multiple signaling processes. Different signaling processes can obtain different parsing elements. The information is scattered and incomplete, and it is necessary to efficiently synthesize the processes to form a complete signaling summary. In the previous chapter, the associated elements and parsing elements of each process were sorted out in detail. In summary, there are three types of associated elements: IMSI+PDU session ID, smfInstanceId+SMF IP+smContextRef, and smfInstanceId+SMF IP+pduSessionRef. Based on this, this application proposes a signaling synthesis algorithm based on a multi-index hash table to complete the integration of the extracted elements of each process and output the signaling summary. This algorithm consists of two components: an index hash table and a summary synthesis unit. The index hash table allows multiple different indexes to quickly locate the summary synthesis unit. The summary synthesis unit is responsible for the synthesis of signaling parsing elements and the output of the signaling summary. The detailed steps of the algorithm are as follows: Step 1: Establishment of index hash table. Initialize three hash tables, index hash table #1, index hash table #2 and index hash table #3, where index hash table #1 stores index "IMSI+PDU session ID", index hash table #2 stores index "smfInstanceId+SMF IP+pduSessionRef", and index hash table #3 stores "smfInstanceId+SMF IP+pduSessionRef". Assuming that the index keyword k is calculated by hash function h(k) to get the hash slot, the function h maps the keyword domain U to the slot of hash table T[0,…,n-1]: .

[0024] Considering that the synthesis algorithm of this signaling summary involves frequent hash node modification and deletion operations, we choose the zipper method to solve the hash conflict problem, that is, if , then the keyword , , The corresponding nodes are hung in the same slot in the form of a linked list.

[0025] Step 2: Signaling summary synthesis.

[0026] After the signaling data of different interface service types are parsed, association elements and parsing elements are generated, wherein the association elements are converted into indexes after splicing, and the parsing elements are converted into the content of the signaling summary after synthesis.

[0027] a) Creation of summary synthesis unit: After the signaling parsing is completed, the associated elements are converted into index nodes and the corresponding index hash table is searched. If the index node does not exist, a node is created and hung under the corresponding slot, and the summary synthesis unit is created through the pointer in the node. For signaling processes containing multiple indexes, multiple index nodes are created, but there is only one entity of the summary synthesis unit (such as the N11 interface Nsmf_PDUSession_CreateSMContext process), which is shared through pointers. At the same time, the reference count use_cnt in the synthesis unit records how many index nodes the unit is shared by.

[0028] b) Update of content in summary synthesis unit: When searching the index hash table, if the index exists, the parsed elements of the data need to be updated to the summary synthesis unit.

[0029] c) Deletion of summary synthesis unit: When the session is released, such as the Nsmf_PDUSession_Release signaling process, it is necessary to first update the parsed elements of this data into the summary synthesis unit according to b), then output the signaling summary, and finally release the summary synthesis unit.

[0030] Step 3: Output of signaling summary.

[0031] The output of signaling summary refers to the output of the content in the summary synthesis unit in a specific format (such as XML, TLV, JSON, etc.) to meet the requirements of business analysis, user data association, etc. Output conditions of signaling summary: a) The summary synthesis unit needs to be output after creation or before deletion to inform the service of the current signaling status.

[0032] b) After the update operation of the content in the summary synthesis unit, it is necessary to decide whether to output the signaling summary based on whether the content in the container is actually changed, so as to minimize the number of output signaling summaries.

[0033] Due to the large amount of data and high reuse of associated elements in 5G signaling, hash imbalance occurred in actual testing, resulting in a large number of nodes being mounted on some slots of the index hash table, which seriously affected the access efficiency of the index hash table and thus affected the synthesis efficiency of the signaling summary. Based on this, this application reduces the traversal length of the slot linked list by optimizing hash conflicts. The key points are as follows: a) When the hash table is initialized, the initial capacity is reasonably evaluated based on the index characteristics. Although the hash table expansion operation can improve the performance of the hash table, it will also bring certain performance overhead during the expansion period, so it is necessary to reasonably evaluate the initial capacity. Taking the "IMSI+PDU session ID" index as an example, assuming that there are M users (IMSI) in the current 5G system, and each user can have a maximum of N PDU sessions, the maximum number of slots required for this index is M*N.

[0034] b) Use double hash functions to reduce hash conflicts. First, we define two hash functions and ,definition is the maximum length of the linked list allowed to be mounted on the hash slot. When we need to insert into the hash table, for index x, we first use Calculate and locate the hash slot number (Total number of slots is n): .

[0035] If the current slot actually mounts the number of nodes ,Right now If the slot is not full, the node is mounted on slot.

[0036] On the contrary, if If the slot is full, the hash function Recalculate the hash and hang on the corresponding Slot No. ( slot is not full). If Slot number and If all slots are full, the player will be kicked out randomly. Slot number or Some nodes in the slot list make the current slot have space ( ) Mount the current node, and kick out the node according to and The calculation is hung on other slots, and so on. In order to prevent too many kicks, it is necessary to configure the maximum number of kicks c allowed for a single insertion. When the number of kicks c is exceeded, it means that the conflict in the hash table can no longer be reconciled, and the hash table expansion operation is performed.

[0037] c) Hash table adaptive expansion to reduce hash conflicts. Define load factor is the ratio of the number of nodes k actually stored in the hash table to the number of slots n, that is: .

[0038] Load Factor The larger the value, the fuller the hash table is and the greater the hash collision is. The smaller it is, the emptier the hash table is and the lower the memory utilization is. We define The hash table can achieve optimal performance and take into account memory efficiency. Or when a single insertion exceeds the kickout threshold c, we expand the hash table so that Reduced to , the number of hash slots after expansion is obtained: .

[0039] This algorithm directly locates the summary synthesis unit by establishing an index hash table and optimizes hash conflicts. It can stably achieve O(1) time complexity and efficiently complete the task of synthesizing signaling summaries. In actual tests, the accuracy of signaling summaries can be as high as 100%.

[0040] Those skilled in the art can understand that the above are only preferred examples of the invention and are not intended to limit the invention. Although the invention is described in detail with reference to the above examples, those skilled in the art can still modify the technical solutions recorded in the above examples or replace some of the technical features with equivalents. Any modification, equivalent replacement, etc. made within the spirit and principle of the invention should be included in the protection scope of the invention. All technical features in this embodiment can be freely combined according to actual needs.

[0041] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A signaling summary generation method based on 5G core network N11 and N16 interfaces, characterized in that: By parsing the 5G core network N11 and N16 interface signaling, and based on the synthesis algorithm, the signaling summary is efficiently synthesized, which specifically includes three parts: SBI signaling preprocessing, parsing the N11 / N16 interface core signaling, and signaling summary synthesis; Among them, 1) SBI signaling preprocessing: Process the original signaling traffic, and output a complete HTTP2 uplink and downlink message of a request response to the parsing module through HTTP2 traffic identification, HTTP2 message assembly, and invalid signaling filtering operations; Among them, HTTP2 message assembly specifically includes the following steps: Step A1, TCP packet assembly: The 5G core network N11 and N16 signaling interfaces adopt HTTP2 protocol for transmission, and the transport layer adopts TCP protocol; during traffic collection, the original code stream is assembled according to the TCP sequence number; Step A2, HTTP2 protocol framing: The HTTP2 protocol decomposes the ordinary HTTP response into frame request and response concurrently, and assembles the binary code stream of a frame together according to the frame format; Step A3, HTTP2 protocol request and response assembly: HTTP2 protocol request and response assembly strings the frames of a request and response together through Stream Identifier to facilitate the parsing module to parse the request and response; a specific request and response includes HEADERS frame and DATA frame type; the interface service type is identified through the path field in the upstream request HEADERS frame, and only the request and response frames of the interface service type concerned by the business are sent to the parsing module to filter out useless data; 2) Analyze the core signaling of N11 and N16 interfaces: The parsing module receives the message content sent by the SBI signaling pre-processing module, and extracts the associated elements and parsing elements in the original code stream according to the preset parsing rules of different service types, including processing JSON, i.e. key-value pairs, n1msg, i.e. NAS protocol messages, and n2msg, i.e. NGAP protocol messages. 3) Signaling summary synthesis: The signaling synthesis algorithm based on multi-index hash table completes the integration of extracted elements of each process and outputs the signaling summary; it includes two components: index hash table and summary synthesis unit; Among them, the index hash table is used to allow multiple different indexes to quickly locate the summary synthesis unit; The summary synthesis unit is responsible for synthesizing signaling parsing elements and outputting signaling summaries.

2. According to claim 1, a signaling summary generation method based on 5G core network N11 and N16 interfaces is characterized in that: Parse the core signaling of N11 and N16 interfaces, including: Since smContextRef and pduSessionRef are PDU session indexes generated and maintained by the SMF network element, they are unique within a single SMF network element. However, there will be conflicts between smContextRef and pduSessionRef across SMF network elements, and the SMF IP and smfInstanceId need to be combined. The N11 interface uses the smfInstanceId+SMF IP+smContextRef index and the IMSI+PDU session ID index to implement intra-interface association, as follows: a) If it is N11 Nsmf_PDUSession_CreateSMContext signaling data, extract the user three-code information, location information, SMF IP and smfInstanceId mapping relationship and SMF IP + smContextRef information, and establish the mapping relationship between smfInstanceId+SMF IP+smContextRef and IMSI+PDU session ID; b) If it is N11 Nsmf_PDUSession_UpdateSMContext signaling data, extract the PDU session user plane tunnel information, location information, SMF IP + smContextRef information, and establish the smfInstanceId+SMF IP+smContextRef index; c) If it is N11 Nsmf_PDUSession_ReleaseSMContext signaling data, extract the location information, SMFIP + smContextRef information, and establish the smfInstanceId+SMF IP+smContextRef index; d) If it is N11 Namf_Communication_N1N2MessageTransfer signaling data, extract the IMSI, PDU session ID, and user plane tunnel information, and establish the IMSI+PDU session ID index; The N16 interface uses the smfInstanceId+SMF IP+pduSessionRef index and the IMSI+PDU session ID index to implement intra-interface association, as follows: a) If it is N16 Nsmf_PDUSession_Create signaling data, extract the user three-code information, location information, user plane tunnel information, SMF IP and smfInstanceId mapping relationship and SMF IP + pduSessionRef information, and establish the mapping relationship between smfInstanceId+SMF IP+pduSessionRef and IMSI+PDU session ID; b) If it is N16 Nsmf_PDUSession_Update signaling data, extract the location information, SMF IP + pduSessionRef information, and establish the smfInstanceId+SMF IP+pduSessionRef index; c) If it is N16 Nsmf_PDUSession_Release signaling data, extract the location information, SMF IP + pduSessionRef information, and establish the smfInstanceId+SMF IP+pduSessionRef index; d) If it is N16 Nsmf_PDUSession_RetrieveContext signaling data, extract the SMF IP + pduSessionRef information and establish a mapping relationship between smfInstanceId+SMF IP+pduSessionRef and IMSI+PDU session ID; N11 and N16 signaling data are associated between interfaces through IMSI+PDU session ID, realizing full-element association of N11 and N16 signaling data; the precise construction of association index effectively guarantees the accuracy of subsequent signaling summary synthesis.

3. According to claim 1, a signaling summary generation method based on 5G core network N11 and N16 interfaces is characterized in that: The signaling synthesis algorithm based on the multi-index hash table includes the following steps: Step B1, establishment of index hash table: initialize three hash tables, index hash table #1, index hash table #2 and index hash table #3, where index hash table #1 stores index IMSI+PDU session ID, index hash table #2 stores index smfInstanceId+SMF IP+pduSessionRef, and index hash table #3 stores smfInstanceId+SMF IP+pduSessionRef; assuming that the index keyword k is calculated by hash function h(k) to obtain the hash slot, then function h maps the keyword domain U to the slot of hash table T[0,…,n-1]: , considering that the synthesis algorithm of this signaling summary involves frequent hash node modification and deletion operations, the zipper method is selected to solve the hash conflict problem, that is, if , then the keyword , , The corresponding nodes are hung in the same slot in the form of a linked list; Step B2, signaling summary synthesis: after the signaling data of different interface service types are parsed, associated elements and parsing elements are generated, wherein the associated elements are converted into indexes after splicing, and the parsing elements are converted into the content of the signaling summary after synthesis; creation of summary synthesis unit: after the signaling parsing is completed, the associated elements are converted into index nodes, and the corresponding index hash table is searched; if the index node does not exist, a node is created and hung under the corresponding slot, and a summary synthesis unit is created through the pointer in the node; for a signaling process containing multiple indexes, multiple index nodes are created, but there is only one entity of the summary synthesis unit, namely the N11 interface Nsmf_PDUSession_CreateSMContext process, which is shared by pointers, and the reference count use_cnt in the synthesis unit records how many index nodes the unit is shared by; update of the content in the summary synthesis unit: when searching for the index hash table, the index exists, and the parsing elements of this data need to be updated to the summary synthesis unit; Deletion of the summary synthesis unit: When the session release process is such as the Nsmf_PDUSession_Release signaling process, it is necessary to first update the parsing elements of this data to the summary synthesis unit according to b), then output the signaling summary, and finally release the summary synthesis unit; Step B3: Output of signaling summary: Output of signaling summary refers to outputting the content in the summary synthesis unit in a specific format including XML, TLV, and JSON to meet the requirements of business analysis and user data association.

4. According to claim 3, a signaling summary generation method based on 5G core network N11 and N16 interfaces is characterized in that: In step B3, the output conditions of the signaling summary specifically include: the output is required after the creation of the summary synthesis unit or before the deletion, so as to inform the service of the current signaling status; after the update operation of the content in the summary synthesis unit, it is necessary to decide whether to output the signaling summary based on whether the content in the container is actually changed, so as to minimize the number of output signaling summaries.

Images