A signaling digest generation method based on the N11 and N16 interfaces of the 5G core network

Abstract

The present invention discloses a signaling digest generation method based on the N11 and N16 interfaces of the 5G core network, belonging to the technical field of signaling digest generation. By parsing the signaling of the N11 and N16 interfaces of the 5G core network and efficiently completing the synthesis of the signaling digest based on a synthesis algorithm, it specifically includes three parts: SBI signaling preprocessing, parsing the core signaling of the N11 / N16 interfaces, and signaling digest synthesis; the present invention efficiently completes the synthesis of the signaling digest by parsing the signaling of the N11 and N16 interfaces of the 5G core network and based on a synthesis algorithm, specifically including three parts: SBI signaling preprocessing, parsing the core signaling of the N11 / N16 interfaces, and signaling digest synthesis; the present invention provides a method for realizing the intra-association of the N11 interface, the intra-association of the N16 interface, and the inter-association between the N11 and N16 interfaces based on the N11 and N16 interfaces of the 5G core network, realizing the efficient and accurate generation of the signaling digest.

Description

Technical Field

[0001] The present invention belongs to the technical field of signaling digest generation, and particularly relates to a signaling digest generation method based on the N11 and N16 interfaces of the 5G core network. Background Art

[0002] A signaling digest is a form of recording the signaling parsing result, similar to the industry's XDR (eXtensible Data Record) log, with more concise fields and more flexible formats. With the gradual improvement of the 5G mobile communication network, how to ensure 5G network security is an urgent problem to be solved. 5G signaling digests can provide traceability information for the 5G network security system, effectively handle network attacks and data leakage, and thus protect the security of 5G systems such as the vehicle network and edge MEC. The 5G signaling data volume is huge and there are numerous interfaces. How to efficiently synthesize signaling digests to support the 5G network security system is a research direction in the industry.

[0003] Currently, for the 5G core network signaling digest generation method, the engineering approach is to parse the full-volume signaling interface or parse the combination of N2 and N4 interfaces or the combination of N2 and N11 interfaces, and integrate the parsing results to generate a signaling digest.

[0004] Due to the huge data volume of 5G, the 5G network security system has extremely high requirements for the complexity and accuracy of signaling digest generation, and it is necessary to use the fewest signaling interfaces and cover all scenarios. The traditional generation methods can no longer meet the requirements. Although the methods based on N2 and N4 interfaces or N2 and N11 interfaces can both achieve the generation of signaling digest information, they are not the optimal technical solutions for the complexity and accuracy of generating signaling digest information. The specific manifestations are as follows:

[0005] 1) The protocol is complex. The N2 and N4 interfaces need to parse two protocols, NGAP and PFCP; the N2 and N11 interfaces need to parse two protocols, NGAP and HTTP2, both involving the parsing and association of different protocols;

[0006] 2) The association relationship is complex. For example, the association within the N2 interface involves many indexes such as imsi, ran_n3u_ip_teid, upf_n3u_ip_teid, guti_5g, ran_ip_ran_ngap_id, etc., and it also needs to involve the association with the N11 interface or N4 interface, and the association logic is complex;

[0007] 3) It cannot cover all scenarios. For some special scenarios (such as the scenarios generating N16 interfaces in overseas roaming, cross-network roaming, etc.), the existing technologies have problems with insufficient adaptation in generating signaling digests;

[0008] 4) In some existing technologies, there will be a phenomenon of incorrect association when using smContextRef for association within the N11 interface, resulting in accuracy issues with some signaling digest information. Summary of the Invention

[0009] To solve the problems of the high complexity, doubtful accuracy, and insufficient adaptation to special scenarios in generating signaling digest information in existing technologies, the present invention provides a method for realizing the association within the N11 interface, the association within the N16 interface, and the association between the N11 and N16 interfaces based on the N11 and N16 interfaces of the 5G core network, so as to efficiently and accurately generate signaling digests.

[0010] The present invention adopts the following technical solutions to solve the above technical problems:

[0011] A method for generating signaling digests based on the N11 and N16 interfaces of the 5G core network, which parses the signaling of the N11 and N16 interfaces of the 5G core network and efficiently completes the synthesis of signaling digests based on a synthesis algorithm, specifically including three parts: SBI signaling preprocessing, parsing the core signaling of the N11 / N16 interface, and signaling digest synthesis;

[0012] Among them, 1) SBI signaling preprocessing:

[0013] Process the original signaling traffic, and output the complete HTTP2 uplink and downlink packets of a single request response to the parsing module through operations such as HTTP2 traffic recognition, HTTP2 packet assembly, and filtering of invalid signaling;

[0014] Among them, the HTTP2 packet assembly specifically includes the following steps:

[0015] Step A1, TCP packet assembly: Both the N11 and N16 signaling interfaces of the 5G core network use the HTTP2 protocol for transmission, and the transport layer uses the TCP protocol; assemble the original code stream according to the TCP sequence number during traffic collection;

[0016] Step A2, HTTP2 protocol frame assembly: The HTTP2 protocol disassembles the ordinary HTTP response into frame requests and responses and concurs, and assembles the binary code stream of one frame together according to the frame format;

[0017] Step A3, HTTP2 protocol request-response assembly: The HTTP2 protocol request-response assembly strings the frames of a single request response together through the Stream Identifier, facilitating the parsing of the request response by the parsing module; specifically, a single request response includes frame types such as HEADERS frames and DATA frames;

[0018] Identify the interface service type through the path field in the uplink request HEADERS frame, and only send the request and response frames of the interface service types concerned by the service to the parsing module to filter out useless data;

[0019] 2) Parse the core signaling of N11 and N16 interfaces:

[0020] The parsing module receives the message content sent by the SBI signaling preprocessing module, and extracts the associated elements and parsing elements in the original code stream according to the parsing rules preset for different service types, including processing 3 types of data in JSON (i.e., key-value pairs), n1msg (i.e., NAS protocol messages), and n2msg (i.e., NGAP protocol messages);

[0021] 3) Signaling digest synthesis:

[0022] Based on the signaling synthesis algorithm of the multi-index hash table, complete the integration of the extracted elements of each process and output the signaling digest; it includes two components: an index hash table and a digest synthesis unit;

[0023] Among them, the index hash table is used to quickly locate multiple different indexes to the digest synthesis unit;

[0024] The digest synthesis unit is responsible for the synthesis of the signaling parsing elements and the output of the signaling digest.

[0025] As a further preferred solution of a signaling digest generation method based on the N11 and N16 interfaces of the 5G core network in the present invention, parsing the core signaling of the N11 and N16 interfaces specifically includes:

[0026] Since both smContextRef and pduSessionRef are PDU session indexes generated and maintained internally by the SMF network element, they are unique within a single SMF network element, but there will be conflicts between smContextRef and pduSessionRef across SMF network elements, and it is necessary to combine the SMF IP and smfInstanceId;

[0027] The N11 interface uses the smfInstanceId + SMF IP + smContextRef index and the IMSI + PDU session ID index to achieve intra-interface association, specifically as follows:

[0028] a) If it is the signaling data of N11 Nsmf_PDUSession_CreateSMContext, extract the user's triple-code information, location information, the mapping relationship between SMF IP and smfInstanceId, and the SMF IP + smContextRef information, and a mapping relationship between smfInstanceId + SMF IP + smContextRef and IMSI + PDU session ID can be established;

[0029] b) If it is the signaling data of N11 Nsmf_PDUSession_UpdateSMContext, extract the PDU session user plane tunnel information, location information, SMF IP + smContextRef, etc. information, and a smfInstanceId + SMF IP + smContextRef index can be established;

[0030] c) If it is the signaling data of N11 Nsmf_PDUSession_ReleaseSMContext, extract the location information, SMF IP + smContextRef, etc. information, and a smfInstanceId + SMF IP + smContextRef index can be established;

[0031] d) If it is the signaling data of N11 Namf_Communication_N1N2MessageTransfer, extract the IMSI, PDU session ID, user plane tunnel, etc. information, and an IMSI + PDU session ID index can be established;

[0032] The N16 interface uses the smfInstanceId + SMF IP + pduSessionRef index and the IMSI + PDU session ID index to achieve the association within the interface, specifically as follows:

[0033] a) If it is the signaling data of N16 Nsmf_PDUSession_Create, extract the user's triple-code information, location information, user plane tunnel information, the mapping relationship between SMF IP and smfInstanceId, and the SMF IP + pduSessionRef, etc. information, and a mapping relationship between smfInstanceId + SMF IP + pduSessionRef and IMSI + PDU session ID can be established;

[0034] b) If it is N16 Nsmf_PDUSession_Update signaling data, extract information such as location information, SMF IP + pduSessionRef, etc., and an index of smfInstanceId + SMF IP + pduSessionRef can be established;

[0035] c) If it is N16 Nsmf_PDUSession_Release signaling data, extract information such as location information, SMF IP + pduSessionRef, etc., and an index of smfInstanceId + SMF IP + pduSessionRef can be established;

[0036] d) If it is N16 Nsmf_PDUSession_RetrieveContext signaling data, extract information such as SMF IP + pduSessionRef, etc., and a mapping relationship between smfInstanceId + SMF IP + pduSessionRef and IMSI + PDU session ID can be established;

[0037] The N11 and N16 signaling data are associated between interfaces through IMSI + PDU session ID to achieve the full-element association of N11 and N16 signaling data; the precise construction of the association index effectively guarantees the accuracy of subsequent signaling digest synthesis.

[0038] As a further preferred solution of the signaling digest generation method based on the N11 and N16 interfaces of the 5G core network of the present invention, a signaling synthesis algorithm based on a multi-index hash table specifically includes the following steps:

[0039] Step B1, establishment of the index hash table: Initialize three hash tables, index hash table #1, index hashtable #2, and index hash table #3, where index hash table #1 stores the index IMSI + PDU session ID, index hash table #2 stores the index smfInstanceId + SMF IP + pduSessionRef, and index hash table #3 stores smfInstanceId + SMF IP + pduSessionRef; assuming that the index key k calculates the hash slot through the hash function h(k), then the function h maps the keyword universe U to the slots of the hash table T[0,..., n - 1]: 。

[0040] Considering that the synthesis algorithm of this signaling digest involves frequent hash node modification and deletion operations, the chaining method is selected to solve the hash conflict problem, that is, if , then the keyword , , , then the keyword , , The corresponding nodes are hung under the same slot in the form of a linked list;

[0041] Step B2, signaling digest synthesis:

[0042] After the signaling data of different interface service types are parsed, associated elements and parsing elements are generated. Among them, the associated elements are spliced and then converted into an index, and the parsing elements are synthesized and then converted into the content of the signaling digest;

[0043] a) Creation of the digest synthesis unit: After the signaling parsing is completed, the associated elements are converted into index nodes, and the corresponding index hash table is searched; if the index node does not exist, a node is created and hung under the corresponding slot, and a digest synthesis unit is created through the pointer in the node; for a signaling process containing multiple indexes, multiple index nodes are created, but there is only one entity of the digest synthesis unit, that is, the Nsmf_PDUSession_CreateSMContext process of the N11 interface, which is shared through pointers. At the same time, the reference count use_cnt in the synthesis unit records how many index nodes share this unit;

[0044] b) Update of the content in the digest synthesis unit: When searching the index hash table and the index exists, the parsing elements of this piece of data need to be updated to the digest synthesis unit;

[0045] c) Deletion of the digest synthesis unit: When a session release and other processes such as the Nsmf_PDUSession_Release signaling process, first update the parsing elements of this piece of data to the digest synthesis unit according to b), then output the signaling digest, and finally release the digest synthesis unit;

[0046] Step B3: Output of the signaling digest;

[0047] The output of the signaling digest means outputting the content in the digest synthesis unit in a specific format, including XML, TLV, JSON, etc. to meet the requirements of service analysis, user data association, etc.

[0048] As a further preferred solution of the signaling digest generation method based on the N11 and N16 interfaces of the 5G core network of the present invention, in step B3, the output conditions of the signaling digest specifically include:

[0049] a) It needs to be output after the creation or before the deletion of the digest synthesis unit to inform the service of the current signaling status;

[0050] b) After the update operation of the content in the summary synthesis unit, it is necessary to determine whether to output the signaling summary according to whether the content in the container actually changes, so as to minimize the number of output signaling summaries.

[0051] Compared with the prior art, the present invention adopts the above technical solutions and has the following technical effects:

[0052] 1. The present invention parses the signaling of the 5G core network N11 and N16 interfaces and efficiently completes the synthesis of signaling summaries based on the synthesis algorithm, which specifically includes three parts: SBI signaling preprocessing, parsing the core signaling of the N11 / N16 interfaces, and signaling summary synthesis; the present invention provides a method for realizing the association within the N11 interface, the association within the N16 interface, and the association between the N11 and N16 interfaces based on the 5G core network N11 and N16 interfaces, so as to efficiently and accurately generate signaling summaries.

[0053] 2. In the process of processing the content of the N11 and N16 signaling interfaces, the accurate construction of the association index within and between the N11 and N16 interfaces can effectively ensure the accuracy of signaling synthesis, including adding smfInstanceId and SMF IP restrictions to the construction of the smContextRef and pduSessionRef association element indexes to ensure their uniqueness and avoid the problem of the uniqueness of the association element index value leading to incorrect signaling summary information output.

[0054] 3. In the signaling summary synthesis algorithm of the present invention, multiple hash tables are used to implement multiple indexes and optimize hash conflicts, so as to achieve a time complexity of O(1); at the same time, different index nodes share the summary synthesis unit through pointers, and the creation and release of the container are managed through reference counting. In this shared way, the memory usage efficiency is increased.

[0055] 4. The present invention can improve the accuracy of the association within the N11 interface, the association within the N16 interface, and the association between the N11 and N16 interfaces by accurately constructing the association element index when parsing the N11 and N16 signaling interfaces, and can also cover the comprehensiveness of signaling summaries in special scenarios such as overseas roaming and different network roaming. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 is the overall architecture of a method for generating a signaling summary based on the 5G core network N11 and N16 interfaces of the present invention;

[0057] Figure 2 is the frame format diagram of HTTP2 of the present invention;

[0058] Figure 3 is the schematic diagram of signaling summary synthesis of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0059] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings:

[0060] The technical solution in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention. The present invention will be described in detail below according to the accompanying drawings and preferred embodiments, and the purpose and effect of the present invention will become more apparent. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0061] The present invention parses the signaling of the N11 and N16 interfaces of the 5G core network and efficiently completes the synthesis of signaling summaries based on a synthesis algorithm, mainly including: SBI (Service-Based Interface) signaling preprocessing, parsing the core signaling of the N11 / N16 interfaces, and signaling summary synthesis, as Figure 1 shown.

[0062] 1) SBI signaling preprocessing

[0063] SBI signaling preprocessing mainly processes the original signaling traffic. Through operations such as HTTP2 traffic identification, HTTP2 message assembly, and filtering of invalid signaling, a complete HTTP2 uplink and downlink message for a single request-response is output to the parsing module. The HTTP2 message assembly includes the following steps:

[0064] The first step: TCP packet assembly. The N11 and N16 signaling interfaces of the 5G core network both use the HTTP2 protocol for transmission, and the transport layer uses the TCP protocol. During the actual network transmission of the message, TCP fragmentation, out-of-order retransmission, etc. may occur. During traffic collection, we need to assemble the original code stream according to the TCP sequence number (Sequence Number).

[0065] The second step: HTTP2 protocol frame assembly. The HTTP2 protocol disassembles ordinary HTTP responses into frame requests and responses for concurrency. For the convenience of subsequent parsing, we need to further assemble the binary code stream of a frame together according to the frame format. The frame format of HTTP2 is as Figure 2 shown.

[0066] The third step: HTTP2 protocol request-response assembly. The HTTP2 protocol request-response assembly needs to string together the frames of a single request-response through the Stream Identifier to facilitate the parsing of the request-response by the parsing module. A specific single request-response may include types such as HEADERS frames and DATA frames.

[0067] The interface service type is identified by using the path field (using Huffman encoding) in the upstream request HEADERS frame. Only request and response frames for the interface service types of interest (as shown in Table 1) are passed to the parsing module, filtering out useless data and improving parsing efficiency. Table 1 shows the overall architecture of interface parsing.

[0068] Table 1

[0069] .

[0070] 2) Analyze the core signaling of N11 and N16 interfaces

[0071] The parsing module receives the message content sent by the SBI signaling pre-processing module and extracts the associated elements and parsing elements in the original code stream according to the preset parsing rules of different service types. It mainly involves processing three formats of data: JSON (key-value pairs), n1msg (NAS protocol messages), and n2msg (NGAP protocol messages). The specific associated elements and parsing elements that need to be extracted for different service interfaces are shown in Table 1.

[0072] Since smContextRef and pduSessionRef are PDU session indexes generated and maintained by the SMF network element, they are unique within a single SMF network element. However, there will be conflicts between smContextRef and pduSessionRef across SMF network elements, and the SMF IP and smfInstanceId need to be combined.

[0073] N11 interfaces can use the smfInstanceId+SMF IP+smContextRef index and the IMSI+PDU session ID index to implement intra-interface correlation, as follows:

[0074] a) If it is N11 Nsmf_PDUSession_CreateSMContext signaling data, the user three-code information, location information, SMF IP and smfInstanceId mapping relationship, and SMF IP + smContextRef information are extracted to establish the mapping relationship between smfInstanceId+SMF IP+smContextRef and IMSI+PDU session ID;

[0075] b) If it is the N11 Nsmf_PDUSession_UpdateSMContext signaling data, extract information such as PDU session user plane tunnel information, location information, SMF IP + smContextRef, etc., and an smfInstanceId + SMF IP + smContextRef index can be established;

[0076] c) If it is the N11 Nsmf_PDUSession_ReleaseSMContext signaling data, extract information such as location information, SMF IP + smContextRef, etc., and an smfInstanceId + SMF IP + smContextRef index can be established;

[0077] d) If it is the N11 Namf_Communication_N1N2MessageTransfer signaling data, extract information such as IMSI, PDU session ID, user plane tunnel, etc., and an IMSI + PDU session ID index can be established;

[0078] The N16 interface can implement in-interface association using the smfInstanceId + SMF IP + pduSessionRef index and the IMSI + PDU session ID index, as follows:

[0079] a) If it is the N16 Nsmf_PDUSession_Create signaling data, extract information such as the user's triple code information, location information, user plane tunnel information, the mapping relationship between SMF IP and smfInstanceId, and SMF IP + pduSessionRef, etc., and a mapping relationship between smfInstanceId + SMF IP + pduSessionRef and IMSI + PDU session ID can be established;

[0080] b) If it is the N16 Nsmf_PDUSession_Update signaling data, extract information such as location information, SMF IP + pduSessionRef, etc., and an smfInstanceId + SMF IP + pduSessionRef index can be established;

[0081] c) If it is the N16 Nsmf_PDUSession_Release signaling data, extract information such as location information, SMF IP + pduSessionRef, etc., and an smfInstanceId + SMF IP + pduSessionRef index can be established;

[0082] d) If it is the N16 Nsmf_PDUSession_RetrieveContext signaling data, extract information such as SMF IP + pduSessionRef, and a mapping relationship can be established between smfInstanceId + SMF IP + pduSessionRef and IMSI + PDU session ID;

[0083] The N11 and N16 signaling data are associated between interfaces through IMSI + PDU session ID, and finally the full-element association of N11 and N16 signaling data is achieved. The precise construction of the association index can effectively ensure the accuracy of subsequent signaling digest synthesis.

[0084] 3) Signaling digest synthesis

[0085] As can be seen from Table 1, the signaling of the N11 and N16 interfaces consists of multiple signaling processes. Different signaling processes can obtain different parsing elements, and the information is scattered and incomplete. It is necessary to efficiently synthesize each process to form a complete signaling digest. In the previous chapter, the associated elements and parsing elements of each process were detailedly sorted out. Summarized, there are three types of associated elements: IMSI + PDU session ID, smfInstanceId + SMF IP + smContextRef, and smfInstanceId + SMF IP + pduSessionRef. Based on this, this application proposes a signaling synthesis algorithm based on a multi-index hash table to complete the integration of the extracted elements of each process and output the signaling digest. This algorithm consists of two components: an index hash table and a digest synthesis unit. Among them, the index hash table can quickly locate multiple different indexes to the digest synthesis unit, and the digest synthesis unit is responsible for the synthesis of signaling parsing elements and the output of the signaling digest. The detailed steps of the algorithm are as follows:

[0086] The first step: Establishment of the index hash table. Initialize three hash tables, index hash table #1, index hashtable #2, and index hash table #3. Among them, index hash table #1 stores the index "IMSI + PDU session ID", index hash table #2 stores the index "smfInstanceId + SMF IP + pduSessionRef", and index hash table#3 stores "smfInstanceId + SMF IP + pduSessionRef". Assume that the index keyword k calculates the hash slot through the hash function h(k), then the function h maps the keyword universe U to the slot of the hash table T[0,…,n-1]: 。

[0087] Considering that the synthesis algorithm of this signaling digest involves frequent hash node modification and deletion operations, we choose the chaining method to solve the hash conflict problem, that is, if , then the keywords , , corresponding nodes are hung under the same slot in the form of a linked list.

[0088] Step 2: Signaling digest synthesis.

[0089] After the signaling data of different interface service types are parsed, associated elements and parsed elements are generated. Among them, the associated elements are concatenated and then converted into indexes, and the parsed elements are synthesized and then converted into the content of the signaling digest.

[0090] a) Creation of the digest synthesis unit: After the signaling parsing is completed, the associated elements are converted into index nodes and searched in the corresponding index hash table. If the index node does not exist, a node is created and hung under the corresponding slot, and a digest synthesis unit is created through the pointer in the node. For signaling processes containing multiple indexes, multiple index nodes are created, but there is only one entity of the digest synthesis unit (such as the Nsmf_PDUSession_CreateSMContext process of the N11 interface), which is shared by pointers. At the same time, the reference count use_cnt in the synthesis unit records how many index nodes share this unit.

[0091] b) Update of the content in the digest synthesis unit: When searching the index hash table and the index exists, the parsed elements of this piece of data need to be updated to the digest synthesis unit.

[0092] c) Deletion of the digest synthesis unit: When processes such as session release, such as the Nsmf_PDUSession_Release signaling process, first update the parsed elements of this piece of data to the digest synthesis unit according to b), then output the signaling digest, and finally release the digest synthesis unit.

[0093] Step 3: Output of the signaling digest.

[0094] The output of the signaling digest refers to outputting the content in the digest synthesis unit in a specific format (such as XML, TLV, JSON, etc.) to meet requirements such as service analysis and user data association. Output conditions of the signaling digest:

[0095] a) It needs to be output after the creation of the digest synthesis unit or before deletion to inform the service of the current signaling status.

[0096] b) After the update operation of the content in the summary synthesis unit, it is necessary to determine whether to output the signaling summary according to whether the content in the container actually changes, so as to minimize the number of output signaling summaries.

[0097] Due to the large data volume of 5G signaling and the high reuse of associated elements, hash imbalance occurred in actual tests, resulting in a large number of nodes being mounted on some slots of the index hash table, seriously affecting the access efficiency of the index hash table, and thus affecting the synthesis efficiency of the signaling summary. Therefore, this application optimizes hash conflicts to reduce the traversal length of the slot linked list. The key points are as follows:

[0098] a) Reasonably evaluate the initial capacity according to the index characteristics when initializing the hash table. Although the hash table expansion operation can improve the performance of the hash table, it will also bring certain performance overhead during the expansion period. Therefore, it is necessary to reasonably evaluate the initial capacity. Taking the "IMSI + PDU session ID" index as an example, assuming that there are M users (IMSI) in the current 5G system, and each user can have at most N PDU sessions, then the maximum number of slots required for this index is M * N.

[0099] b) Adopt the double hash function method to reduce hash conflicts. First, we define two hash functions and , define as the maximum length of the linked list allowed to be mounted on the hash slot. When inserting into the hash table, for the index x, we first calculate and locate the hash slot number (the total number of slots is n) through : .

[0100] If the actual number of nodes mounted on the current slot , that is, the slot is not full, then hang the node behind the slot.

[0101] Conversely, if the slot is full, then recalculate the hash according to the hash function and hang it behind the corresponding slot ( the slot is not full). If the slot and the slot are both full, then randomly kick out part of the nodes in the linked list of the slot or the slot to make room for the current slot ( ) to mount the current node. The kicked-out nodes are arranged according to and The calculation is hung on other slots and so on. To prevent excessive kicking times, it is necessary to configure the maximum allowed kicking times c for a single insertion. When the kicking times exceed c, it means that the hash table conflicts cannot be reconciled, and then the hash table expansion operation is executed.

[0102] c) The hash table adapts to expand to reduce hash conflicts. Define the load factor as the ratio of the actual number of nodes k stored in the hash table to the number of slots n, that is: .

[0103] Load factor The larger it is, the fuller the hash table is and the greater the hash conflicts are; the load factor The smaller it is, the emptier the hash table is and the lower the memory utilization rate is. We define When the hash table can reach the optimal performance and take into account the memory usage efficiency. When or the single insertion exceeds the kicking times threshold c, we expand the hash table so that the after expansion drops to , and the number of hash slots after expansion is obtained as: .

[0104] This algorithm directly locates the digest synthesis unit by establishing an index hash table and optimizes hash conflicts, and can stably achieve a time complexity of O(1), can efficiently complete the synthesis task of signaling digest, and the accuracy rate of signaling digest in actual tests can be as high as 100%.

[0105] Those of ordinary skill in the art can understand that the above are only preferred examples of the invention and are not used to limit the invention. Although the invention has been described in detail with reference to the foregoing examples, for those skilled in the art, they can still modify the technical solutions described in the foregoing examples, or perform equivalent replacements for some of the technical features. Any modifications, equivalent replacements, etc. made within the spirit and principle of the invention shall be included within the protection scope of the invention. All technical features in this embodiment can be freely combined according to actual needs.

[0106] Finally, it should be noted that the above are only preferred embodiments of the present invention and are not used to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, for those skilled in the art, they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A signaling digest generation method based on the N11 and N16 interfaces of the 5G core network, characterized in that: By parsing the 5G core network N11 and N16 interface signaling, and efficiently completing the synthesis of signaling summaries based on the synthesis algorithm, it specifically includes three parts: SBI signaling preprocessing, parsing the N11 / N16 interface core signaling, and signaling summary synthesis; Among them, 1) SBI signaling preprocessing: Processes the original signaling traffic, and outputs a complete HTTP2 uplink and downlink message of a request and response to the parsing module through HTTP2 traffic identification, HTTP2 message assembly, and invalid signaling filtering operations; The HTTP2 message assembly specifically includes the following steps: Step A1, TCP packet assembly: The 5G core network N11 and N16 signaling interfaces both use the HTTP2 protocol for transmission, and the transport layer uses the TCP protocol. During traffic collection, the original bitstream is assembled according to the TCP sequence number. Step A2, HTTP2 protocol framing: The HTTP2 protocol decomposes the ordinary HTTP response into frame request and response concurrently, and assembles the binary code stream of a frame together according to the frame format; Step A3, HTTP2 protocol request and response assembly: HTTP2 protocol request and response assembly strings the frames of a request and response together through the Stream Identifier to facilitate the parsing module to parse the request and response; a specific request and response includes a HEADERS frame and a DATA frame type; The interface service type is identified by the path field in the upstream request HEADERS frame. Only request and response frames of the interface service type of interest are sent to the parsing module to filter out useless data. 2) Analyze the core signaling of N11 and N16 interfaces: The parsing module receives the message content sent by the SBI signaling pre-processing module and extracts the associated elements and parsing elements in the original code stream according to the preset parsing rules of different service types. It includes processing three formats of data: JSON (key-value pairs), n1msg (NAS protocol messages), and n2msg (NGAP protocol messages); 3) Signaling summary synthesis: A signaling synthesis algorithm based on a multi-index hash table integrates the extracted elements of each process and outputs a signaling summary. It includes two components: an index hash table and a summary synthesis unit. Among them, the index hash table is used to allow multiple different indexes to quickly locate the summary synthesis unit; The summary synthesis unit is responsible for synthesizing signaling parsing elements and outputting signaling summaries.

2. A signaling digest generation method based on the N11 and N16 interfaces of the 5G core network according to claim 1, wherein: Parse the core signaling of the N11 and N16 interfaces, including: Since smContextRef and pduSessionRef are PDU session indexes generated and maintained by the SMF network element, they are unique within a single SMF network element. However, there will be conflicts between smContextRef and pduSessionRef across SMF network elements, and the SMF IP and smfInstanceId need to be combined; The N11 interface uses the smfInstanceId+SMF IP+smContextRef index and the IMSI+PDU session ID index to implement intra-interface association, as follows: a) If it is the signaling data of N11 Nsmf_PDUSession_CreateSMContext, extract the user's triple-code information, location information, the mapping relationship between SMF IP and smfInstanceId, and the SMF IP+smContextRef information, and establish the mapping relationship between smfInstanceId+SMF IP+smContextRef and IMSI+PDU session ID; b) If it is the signaling data of N11 Nsmf_PDUSession_UpdateSMContext, extract the PDU session user plane tunnel information, location information, and SMF IP+smContextRef information, and establish the smfInstanceId+SMF IP+smContextRef index; c) If it is the signaling data of N11 Nsmf_PDUSession_ReleaseSMContext, extract the location information and SMFIP+smContextRef information, and establish the smfInstanceId+SMF IP+smContextRef index; d) If it is the signaling data of N11 Nsmf_Communication_N1N2MessageTransfer, extract the IMSI, PDU session ID, and user plane tunnel information, and establish the IMSI+PDU session ID index; The N16 interface uses the smfInstanceId+SMF IP+pduSessionRef index and the IMSI+PDU session ID index to achieve the association within the interface, specifically as follows: a) If it is the signaling data of N16 Nsmf_PDUSession_Create, extract the user's triple-code information, location information, user plane tunnel information, the mapping relationship between SMF IP and smfInstanceId, and the SMF IP+pduSessionRef information, and establish the mapping relationship between smfInstanceId+SMF IP+pduSessionRef and IMSI+PDU session ID; b) If it is the signaling data of N16 Nsmf_PDUSession_Update, extract the location information and SMF IP+pduSessionRef information, and establish the smfInstanceId+SMF IP+pduSessionRef index; c) If it is the signaling data of N16 Nsmf_PDUSession_Release, extract the location information and SMF IP+pduSessionRef information, and establish the smfInstanceId+SMF IP+pduSessionRef index; d) If it is the N16 Nsmf_PDUSession_RetrieveContext signaling data, extract the SMF IP + pduSessionRef information, and establish the mapping relationship between smfInstanceId + SMF IP + pduSessionRef and IMSI + PDU session ID; The N11 and N16 signaling data are associated between interfaces through IMSI + PDU session ID to achieve the full-element association of N11 and N16 signaling data; the accurate construction of the association index effectively guarantees the accuracy of subsequent signaling digest synthesis.

3. A signaling digest generation method based on the N11 and N16 interfaces of the 5G core network according to claim 1, characterized in that: The signaling synthesis algorithm based on the multi-index hash table specifically includes the following steps: Step B1, establishment of the index hash table: Initialize three hash tables, index hash table#1, index hash table#2, and index hash table#3, where index hash table#1 stores the index IMSI + PDU session ID, index hashtable#2 stores the index smfInstanceId + SMF IP + smContextRef, and index hash table#3 stores smfInstanceId + SMF IP + pduSessionRef; assume that the index keyword k calculates the hash slot through the hash function h(k), then the function h maps the keyword universe U to the slots of the hash table T[0,..., n-1]: h: U → T{0,1,2,..., n-1} Considering that the synthesis algorithm of this signaling digest involves frequent hash node modification and deletion operations, the chaining method is selected to solve the hash conflict problem, that is, if h(k1) = h(k2) = h(k3), then the keyword nodes k1, k2, k3 are hung under the same slot in the form of a linked list; Step B2, signaling digest synthesis: After the signaling data of different interface service types are parsed, associated elements and parsed elements are generated, where the associated elements are converted into indexes after splicing, and the parsed elements are converted into the content of the signaling digest after synthesis; a) Creation of the digest synthesis unit: After the signaling parsing is completed, convert the associated elements into index nodes and look them up in the corresponding index hash table; if the index node does not exist, create a node and hang it under the corresponding slot, and create a digest synthesis unit through the pointer in the node; for the signaling process containing multiple indexes, multiple index nodes are created, but there is only one entity of the digest synthesis unit, that is, the N11 interface Nsmf_PDUSession_CreateSMContext process, which is shared through pointers. At the same time, the reference count use_cnt in the synthesis unit records how many index nodes share this unit; b) Update of the content in the digest synthesis unit: When looking up the index hash table and the index exists, update the parsed elements of this piece of data into the digest synthesis unit; c) Deletion of the summary synthesis unit: When the session release process Nsmf_PDUSession_Release signaling process updates the parsing elements of this piece of data to the summary synthesis unit, then outputs the signaling summary, and finally releases the summary synthesis unit; Step B3: Output of the signaling summary; The output of the signaling summary means outputting the content in the summary synthesis unit in a specific format including XML, TLV, JSON to meet the requirements of service analysis and user data association.

4. A signaling digest generation method based on the N11 and N16 interfaces of the 5G core network according to claim 3, characterized in that: In step B3, the output conditions of the signaling summary specifically include: a) It needs to be output after the creation or before the deletion of the summary synthesis unit to inform the service of the current signaling status; b) After the update operation of the content in the summary synthesis unit, it is necessary to decide whether to output the signaling summary according to whether the content in the container actually changes, so as to minimize the number of output signaling summaries.

Images