Communication system, control device, and communication method

Abstract

The invention relates to a communication system, a control device, and a communication method. A communication system configured to provide a communication network to a communication device is provided with a control device. The control device is configured to execute: a reception process for receiving threat information relating to a threat to the communication device using the communication network from an organization outside the communication system; and a defending process for defending the communication device on the basis of the received threat information.

Description

Technical Field

[0001] The present disclosure relates to a communication system, a control device, and a communication method. Background Art

[0002] As exemplified by the fifth generation (5G), 5G Evolution, and the sixth generation (6G), the sophistication of communication systems is expected. However, even if the communication system is sophisticated, the impact of external communication signals on the network cannot be ignored. Therefore, for example, as a prior art, a system is proposed for determining the characteristic amount of a normal call flow (normal signal group) containing at least one normal communication signal and an abnormal call flow (abnormal signal group) containing at least one abnormal communication signal. Here, the abnormal call flow refers to a known attack call flow containing a signal related to an attack from the outside. The system determines whether the determination object call flow is an unknown call flow, i.e., an unknown call flow (unknown signal group), based on a learning model (learning data) that has previously learned the normal call flow and the abnormal call flow, and the characteristic amount of the determination object call flow extracted by the preprocessing unit. Japanese Patent Publication No. 2020-025220, Japanese Patent Publication No. 2020-174391, 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System (5GS); Stage 2 (Release 18) 3GPP (registered trademark) TS 23.502 V18.2.0 (2023-06), 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; 5G System Enhancements for Edge Computing; Stage 2 (Release 18) 3GPP (registered trademark) TS 23.548 V18.3.0 (2023-09) disclose related technologies. Summary of the invention

[0003] However, if the communication system is advanced and the communication network provided by the communication system is complicated, it is not easy for the communication system that manages the communication network to independently identify a signal involved in an attack on the communication network.

[0004] The embodiments of the present disclosure can grasp attacks on communication networks more widely and reliably than before, and can respond appropriately to the attacks.

[0005] One disclosed embodiment is exemplified by a communication system that provides a communication network to a communication device. The communication system includes a control device. The control device is configured to perform the following processing: acceptance processing, receiving threat information related to a threat to the communication device using the communication network from an organization outside the communication system; and defense processing, implementing defense of the communication device based on the received threat information.

[0006] The control device may be configured to collectively execute the defense process on the communication devices connected to the communication system.

[0007] The threat information may include information identifying a specific communication device that is a target of the attack caused by the threat. The control device may be configured to execute the defense process on the specific communication device.

[0008] The specific communication device may be mounted on a vehicle, and the information identifying the specific communication device may include information identifying the vehicle.

[0009] The communication network may also include a 5G core network, and the control device may also be configured to receive the threat information related to the threat by utilizing a network exposure function (NEF) provided in the 5G core network.

[0010] The communication network may also include a 5G core network, and the control device may also be configured to directly accept the threat information related to the threat without going through a network exposure function (NEF) provided in the 5G core network.

[0011] The control device can also be configured to perform the defense processing in a user plane function (UPF) via a policy control function (PCF) set in the 5G core network.

[0012] The control device may also be configured as follows:

[0013] In a case where the form of the threat information is different from a form capable of executing the defense processing, the form of the threat information is converted into a form capable of executing the defense processing, or the defense processing executed in the UPF corresponding to the threat information is determined, and the defense processing corresponding to the converted form of the threat information or the determined defense processing is executed in the UPF.

[0014] The control device may be configured to execute the defense process on a router connected to the communication network or a security device connected to the communication network.

[0015] The control device may also be configured as follows:

[0016] In a case where the form of the threat information is different from a form capable of executing the defense processing, the form of the threat information is converted into a form capable of executing the defense processing, or the defense processing executed in the router or the security device corresponding to the threat information is determined, and the defense processing corresponding to the converted form of the threat information or the determined defense processing is executed in the router or the security device.

[0017] The control device may include a storage device configured to store contract data based on a contract between a user of the communication device and an operator managing the communication system. The control device may also be configured to determine the communication device to which the defense process is applied based on the contract data among the plurality of communication devices.

[0018] The control device may also be configured as follows:

[0019] A simulated receiving system is created in an information processing environment connected to the outside of the communication system, which simulates the environment of the communication device or a mobile body equipped with the communication device, and attacks from inside and outside the communication network provided by the communication system are induced to the simulated receiving system.

[0020] The communication network may also include a 5G core network, and the control device may also be arranged in the 5G core network.

[0021] The communication network may also include a 5G core network, and the control device may also be configured as an application function (AF) connected to the 5G core network.

[0022] Another embodiment of the present disclosure is a control device of a communication system configured to provide a communication network to a communication device. The control device is configured to perform the following processing: acceptance processing, accepting threat information related to a threat to the communication device using the communication network from an organization outside the communication system; and defense processing, implementing defense of the communication device based on the accepted threat information.

[0023] Another embodiment of the present disclosure is a communication method in a communication system configured to provide a communication network to a communication device. The communication method includes the following actions:

[0024] An acceptance process is performed to accept threat information related to a threat to the communication device using the communication network from an organization outside the communication system; and a defense process is performed to implement defense of the communication device based on the accepted threat information.

[0025] The threat information may include information identifying a specific communication device that is a target of the attack by the threat, and may also include executing the defense process on the specific communication device.

[0026] The specific communication device may be mounted on a vehicle, and the information identifying the specific communication device may include information identifying the vehicle.

[0027] The communication network may also include a 5G core network, and the acceptance process may also include utilizing a network exposure function (NEF) provided in the 5G core network to accept the threat information related to the threat.

[0028] The communication method may also include: creating a simulated receiving system that imitates the environment of the communication device or a mobile body equipped with the communication device in an information processing environment externally connected to the communication system; and inducing attacks from inside and outside the communication network provided by the communication system to the simulated receiving system.

[0029] According to the present communication system, it is possible to grasp attacks on the communication network provided by the communication system more widely and reliably than before, and to appropriately respond to the attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Features, advantages, and technical and industrial significance of exemplary embodiments of the present invention will be described below with reference to the accompanying drawings, in which like reference numerals represent like elements, and in which:

[0031] Figure 1 This is a diagram illustrating components constituting a fifth-generation mobile communication system.

[0032] Figure 2 This is a diagram illustrating the structure of threat information.

[0033] Figure 3 It is a diagram showing a configuration example of NF, AF, and other information processing devices.

[0034] Figure 4 This is a diagram showing a structural example of a terminal serving as a UE.

[0035] Figure 5 This is a sequence diagram illustrating the acceptance of threat information and the defense process in the communication system according to the first embodiment.

[0036] Figure 6 This is a sequence diagram illustrating the acceptance of threat information and the defense process in the communication system according to the first embodiment.

[0037] Figure 7 is a diagram illustrating the format conversion process.

[0038] Figure 8 This is a diagram illustrating a process of selecting a defense process to be executed when the security collaboration unit receives threat information in a different format.

[0039] Fig. 9 This is a sequence diagram illustrating the acceptance of threat information and the defense process in the communication system according to the second embodiment.

[0040] Fig.10 This is a sequence diagram illustrating the acceptance of threat information and the defense process in the communication system according to the second embodiment.

[0041] Fig.11 This is a sequence diagram illustrating the acceptance of threat information and the honeypot induction process in the communication system according to the third embodiment.

[0042] Fig.12 This is a sequence diagram illustrating the acceptance of threat information and the honeypot induction process in the communication system according to the third embodiment. DETAILED DESCRIPTION

[0043] Hereinafter, a communication system, a control device, and a communication method according to an embodiment of the present disclosure will be described with reference to the accompanying drawings. Each of the following embodiments is merely an illustration for explanation, and the present disclosure is not limited to the structure of the embodiments. For example, the following description applies the present disclosure to a fifth-generation mobile communication system, but the present disclosure may also be applied to a mobile communication system of the fourth or fifth generation or later. In addition, the present disclosure may be applied to a mobile communication system specified by a system other than 3GPP (registered trademark), or to any wireless communication system or wired communication system other than a mobile communication system.

[0044] The communication system provides a communication network to a communication device. The communication system includes a control device. The control device performs a process of receiving threat information related to a threat to a communication device using the communication network from an organization outside the communication system and a defense process of implementing defense of the communication device based on the received threat information. In addition, the communication system has, for example, Figure 1 The network exposure function (NEF) 11e shown in the example discloses the functions provided from the communication system to the outside. In addition, NEF 11e receives information provided to the communication system from an external application server, etc. Threat information includes information related to network attacks on the communication network, information related to the vulnerability of the communication network, etc. Network attacks generally refer to attacks on information processing devices or terminals, etc. In this embodiment, the main focus is on communication devices ( Figure 1 The attack on UE 2) is taken as an example to illustrate.

[0045] An organization outside the communication system is connected to the communication system, for example, and uses a computer called an application server. The application server provides threat information to the control device directly, for example, via the NEF 11e described above or without going through the NEF 11e. The control device performs defense processing to implement defense of the communication device based on the received threat information. Here, the threat information includes information for determining an attacker 90 (for example, referring to Figure 5 ) information. It should be noted that in the following embodiments, "attacker" refers to a communication device, information processing device, etc. that is the source of the attack data packet or attack traffic that is a threat. In addition, the threat information may also include a communication device that is identified as the target of the attack by the attacker 90, such as a user equipment (UE, User Equipment) 2 (refer to Figure 1 ) or information identifying a mobile body equipped with UE 2. The mobile body may be a vehicle, and the vehicle may be an autonomous driving vehicle.

[0046] The communication system is characterized in that it is capable of performing defense processing on a communication device (UE 2) using a communication network based on threat information received from an organization outside the communication system. That is, the communication system not only effectively utilizes information that the communication system alone possesses, but also effectively utilizes threat information from external organizations, and is capable of defending a communication device using a communication network provided by the communication system from attacks.

[0047] First Embodiment

[0048] Communication system structure

[0049] Hereinafter, the first embodiment will be described with reference to the drawings. Figure 1The components constituting the fifth generation mobile communication system (also referred to as 5G Network (NW)) are illustrated. Figure 1 In the example, UE 2 is a terminal of a user (subscriber). Radio Access Network (RAN) 3 is an access network to the 5G Core Network (5GC). RAN 3 is composed of base stations (next generation NodeB, gNB).

[0050] The 5G network has a 5G core network (5GC) and an access network ((R)AN), and the 5G network is connected to UE 2, a data network (Data Network, DN) 5, and an application function (Application Function, AF) 12. In addition, 5GC has NF11a~11k, 11n indicated in bold. NF 11a~11k, 11n are functions implemented by executing programs by one or more computers (information processing devices). However, a single computer can also implement any two or more of NF 11a~11k, 11n. It should be noted that in this embodiment, the components of 5GC are collectively referred to as network functions (Network Function, NF) 11. In addition, the components of 5GC are individually referred to as NEF 11e, etc. In Figure 1 In the figure, each component is marked with a separate reference numeral in parentheses together with the collective reference numeral. 5GC can be said to be an example of a communication system.

[0051] As described above, 5GC is composed of a collection of components called NF 11 having predetermined functions. Figure 1 In FIG. 1 , the following contents are illustrated as NF 11 constituting 5GC. Figure 1 Indicated by a thick rectangle.

[0052] User Plane Function (UPF) 11a

[0053] Access and Mobility Management Function (AMF) 11b

[0054] Session Management Function (SMF) 11c

[0055] Policy Control Function (PCF) 11d

[0056] Network Exposure Function (NEF) 11e

[0057] Network Repository Function (NRF) 11g

[0058] Network Slice Selection Function (NSSF) 11h Authentication Server Function (AUSF) 11i

[0059] Unified Data Management (UDM)11j

[0060] Network Data Analytics Function (NWDAF) 11k

[0061] Security Cooperation Department 11n

[0062] In this embodiment, the user-side data packets sent and received by UE 2 are called user data packets. UPF 11a performs routing and forwarding of user data packets, data packet inspection, and QoS processing. AMF 11b is a device for accommodating the area where UE 2 is located in 5GC. AMF 11b accommodates RAN 3 and performs subscriber authentication control, location (mobility) management of UE 2, etc.

[0063] SMF 11c manages the Protocol Data Unit (PDU) session and controls UPF 11a for the implementation of Quality of Service (QoS) control and policy control. The PDU session is a virtual communication path for exchanging data between UE 2 and DN 5. DN 5 is a data network (Internet, etc.) outside 5GC.

[0064] PCF 11d cooperates with SMF 11c to perform QoS control, policy control, and billing control. In QoS control, the quality of communication such as priority forwarding of packets is controlled. In policy control, communication control such as QoS, packet forwarding permission, and billing based on network or subscriber information is performed.

[0065] NEF 11e plays a role in mediating the communication between AF 12 or nodes outside 5GC and NF 11 of 3GPP (registered trademark). For example, NEF 11e makes the functions and events of each NF 11 securely public to third parties, AF 12, edge computers, etc. In addition, NEF 11e converts internal information of 5GC with external information. NEF 11e converts, for example, information processed by AF 12 and information processed by each NF 11 of 5GC. For example, NEF 11e converts the service identifier in AF 12 and 5GC internal information.

[0066] AF 12 is an element that interacts with 5GC to provide services to users, and is called an external application server, for example. AF 12, which is considered to be trusted by the operator of the 5G network, can directly access the NF 11 associated with 5GC. AF 12, which is not allowed to directly access the NF 11 associated with 5GC, uses an interface exposed to the outside via NEF 11e to access the network functions of 5GC.

[0067] Information source AF 12a is one of AF 12. Information source AF 12a is, for example, an application server that can be accessed from an organization outside 5GC. Information source AF 12a receives information related to network attacks on UE 2, etc., which is a communication device using a communication network, from an organization outside 5GC, which is a communication system. As an organization outside 5GC, for example, Computer Emergency Response Team (CERT) outside the communication network operator using 5GC, National Institute of Standards and Technology (NIST), Japan Computer Emergency Response Team (JPCERT) / Coordination Center (CC), Industry Information Sharing and Analysis Center (ISAC), individual terminal manufacturers, mobile manufacturer operators, seller operators, Original Equipment Manufacturer (OEM), etc. can be exemplified.

[0068] The information source AF 12a is, for example, set in an organization outside the 5GC. Alternatively, the information source AF 12a is connected to a computer of an organization outside the 5GC in a manner that can be accessed from an organization outside the 5GC. The information source AF 12a provides threat information (in the form of Structured Threat Information eXpression (STIX) or the like) from an organization outside the 5GC to the security collaboration unit 11n.

[0069] In this embodiment, the threat information provided from the information source AF 12a to the NEF 11e or the security coordination unit 11n is provided by, for example, a request / response model. For example, the information source AF 12a sends a request message for providing threat information to the NEF 11e or the security coordination unit 11n. Then, when the NEF 11e or the security coordination unit 11n receives the threat information, it returns a response message to the information source AF 12a.

[0070] However, the threat information provided from the information source AF 12a to the NEF 11e or the security collaboration unit 11n may also be provided through a subscription / notification model, for example. That is, the NEF 11e or the security collaboration unit 11n sends a subscription message to the information source AF 12a. Then, when a trigger condition such as threat information being updated is met, the information source AF 12a sends a notification to the NEF 11e or the security collaboration unit 11n. Then, the NEF 11e or the security collaboration unit 11n accesses the information source AF 12a to obtain the threat information.

[0071] In the present embodiment, in order to deal with the threat information provided from the information source AF 12a, the security collaboration unit 11n is set as one of the NF 11. However, the security collaboration unit 11n may also be set as one of the AF 12. The information source AF 12a is an example of a control device. For example, when the security collaboration unit 11n receives threat information from the manufacturer operator (or the seller operator) of the vehicle, it may also perform defense processing against attacks on all UE 2 mounted on vehicles manufactured by the manufacturer connected to the communication network. In addition, the security collaboration unit 11n may also be limited to performing defense processing on UE 2 mounted on a vehicle connected to the communication network and of a specific model of the vehicle manufactured by the manufacturer. Here, the defense processing includes, for example, filtering a threatening data packet or flow based on the threat information, mitigating a flow exceeding a predetermined mitigation value and discarding abnormal data packets, and analyzing the attack.

[0072] The security collaboration unit 11n implements defense processing for attacks based on threat information through the communication network, thereby being able to uniformly and quickly respond to the threat within the communication network. The security collaboration unit 11n applies the cutoff or mitigation measures of the data packets or flows that become threats in the entire communication network regardless of the manufacturer of UE 2, etc., based on the information provided by CERT / NIST. In addition, the security collaboration unit 11n also responds to information such as the disclosure of a vulnerability with a CVSS score of 10, that is, the severity of which is "urgent". For example, the security collaboration unit 11n selects a UE 2 or the like that is equipped with a computer program or the like that is determined to be a vulnerable object, and applies defense processing through the communication network in the UPF 11a to which the UE 2 is connected.

[0073] The security collaboration unit 11n is an example of a control device. That is, the present communication system is a communication system that provides a communication network to a communication device, and is provided with the security collaboration unit 11n as a control device. The security collaboration unit 11n performs processing of threat information related to threats to a communication device (UE 2) using the communication network received from an organization outside the communication system and defense processing of the communication device based on the received threat information. Here, the threat information may also include data called a signature that records the characteristics of various attacks.

[0074] NRF 11g stores and manages information of NF 11 (for example, AMF 11b, SMF 11c, UPF 11a, etc.) in 5GC. In response to an inquiry about a desired NF 11, NRF 11g can reply to the inquiry source with a plurality of candidates of NF 11.

[0075] The NSSF 11h has a function of selecting a network slice to be used by a subscriber from among network slices generated by the network slicing technology. A network slice is a virtual network having specifications corresponding to the application.

[0076] AUSF 11i is a subscriber authentication server that performs subscriber authentication under the control of AMF 11b. UDM 11j maintains or manages information related to subscribers. Information related to subscribers can be referred to as an example of contract data. Contract data is, for example, information based on a contract between a user of a communication device (UE 2) and an operator (Operator, also known as a mobile network operator (MNO)) that manages a communication system. UDM 11j provides information related to subscribers to each NF 11 or acquires, registers, deletes, and changes the status of UE 2.

[0077] NWDAF 11k has the function of collecting and analyzing data from each NF 11, operations, administration, and maintenance (OAM) terminals, etc. Here, the OAM terminal operates, manages, and maintains the network (5GC). In other words, NWDAF 11k is the NF 11 that provides analysis information of the network.

[0078] DN 5 is a network outside the communication system, such as the Internet. DN 5 is connected to the communication network provided by the present communication system (5GC) via one of the UPFs 11a. It should be noted that UPF 11a can adopt a multi-level structure. The final-level UPF 11a connected to DN 5 is called a PDU Session Anchor User Plane Function (PSAUPF). In addition, the UPF 11a set between RAN 3 and PSAUPF is called an intermediate UPF (Intermediary UPF, IUPF).

[0079] exist Figure 1 In the example, DN 5 is connected to a security device 51, a router 52, and an information source edge application server (EAS) 50. The security device 51 is, for example, a computer with a firewall built in it. The information source EAS 50 is a computer on DN 5 that notifies the security collaboration unit 11n of the communication system of threat information. However, the security device 51 and the router 52 may also be one of the AFs 12. It should be noted that when the application of the information source EAS 50 provides threat information to the NEF 11e or the security collaboration unit 11n, the threat information is provided via one of the AFs 12. Therefore, in the following embodiments, it is described that the provision of threat information is based on the information source AF 12a.

[0080] exist Figure 2 The structure of threat information is illustrated in FIG. In this embodiment, threat information has a header and a body. However, threat information is not limited to Figure 2 It should be noted that the threat information may also be described in a string according to the syntax of the STIX language or the like. However, the threat information may also be data in binary format.

[0081] The header may include, for example, at least one of the following information: protocol, source IP address, source port number, destination IP address, destination port number, direction of the packet, etc. The security coordination unit 11n may Figure 2 The illustrated information identifies packets or flows that are targets of monitoring and are threats.

[0082] The protocol is a protocol for sending and receiving data packets that are to be monitored based on threat information. The source IP address is the source of the data packet, that is, the IP address of the attacker 90. The source port number is the port number of the data packet. The destination IP address and the destination port number are the IP address and port number that determine the destination of the data packet, respectively. The direction of the data packet is the direction in which the data packet that is to be monitored is sent, for example, specifying the direction from the source to the destination, or from the destination to the source. In addition, the information recorded in the header can be omitted separately. In the case where any of these information is omitted, the security collaboration unit 11n, for example, interprets it as specifying "all" for the omitted information. For example, in the case where the destination IP address is omitted, all destinations become monitored objects.

[0083] Additional information for identifying the attacker 90 is set for the subject. The additional information for identifying the attacker 90 includes, for example, at least one of the specification of data in the packet, the state of the flow, information for identifying the application of the communication, header information of the packet, and header information of the application (HTTP, etc.). However, any or all of the additional information for identifying the attacker 90 may be omitted.

[0084] The data in the data packet may be specified by, for example, specifying the data contained in the data packet of the monitored object. The data contained in the data packet of the monitored object may be, for example, character string information. In addition, the data contained in the data packet of the monitored object may also be binary data (bit pattern). The binary data (bit pattern) may also be specified by, for example, hexadecimal numbers.

[0085] The state of the flow is, for example, whether the connection of the Transmission Control Protocol (TCP) is established. The information for determining the application of the communication is, for example, an example of an application layer protocol such as the Hypertext Transfer Protocol (HTTP). The header information of the data packet is, for example, the designation of the fragment bit in the IP datagram header. The header information of the application is, for example, the designation of the request method in HTTP and the request Uniform Resource Identifier (URI) specified in the method. Furthermore, the additional information for determining the attacker 90 may also include information indicating the sending source domain of the data packet.

[0086] In addition, additional information for specifying the communication device of the attack target may be set in the main body. The additional information for specifying the communication device of the attack target may include, for example, the model of the communication device (UE 2), the type and version of the operating system (OS), the type and version of the computer program installed in UE 2, and information for specifying the mobile body equipped with UE 2. The information for specifying the mobile body equipped with UE 2 may include, for example, the manufacturer (OEM), model, year (first registration year), etc. when the mobile body is a vehicle.

[0087] The security coordination unit 11n may uniformly execute defense processing on UE 2 connected to the communication system. Uniformly means that the UE 2 to be the target of defense processing is not limited. Figure 2 In this way, the threat information may also include information that specifies a specific communication device (target UE 2) that is the target of the threat attack. The specified information refers to the destination IP address, the destination port number, additional information that specifies the target UE 2 that is the target of the attack, etc. Therefore, the security cooperation unit 11n may also perform defense processing on the target UE 2 specified by the threat information.

[0088] Structure of information processing device and terminal

[0089] Figure 3 1 is a diagram showing a configuration example of an information processing device 20 capable of operating as NFs 11a to 11k, 11n, AF 12, information source AF 12a, security device 51, router 52, information source EAS 50, etc. Figure 3 In the embodiment, the information processing device 20 can be formed using a dedicated or general-purpose information processing device (computer) such as a personal computer (PC), a workstation (WS), or a server machine. Of course, the information processing device 20 can also be a collection of one or more computers (cloud).

[0090] The information processing device 20 includes a processor 21 as a processing unit or a control unit (controller), a storage device 22 , a communication interface 23 (communication IF 23 ), an input device 24 , and a display 25 , which are connected to each other via a bus 26 .

[0091] The storage device 22 includes a main storage device and an auxiliary storage device. The main storage device is used as at least one of a storage area for programs and data, a program expansion area, a program operation area, and a buffer area for communication data. The main storage device is composed of a random access memory (RAM) or a combination of a RAM and a read-only memory (ROM). The auxiliary storage device is used as a storage area for data and programs. A non-volatile storage medium is applied to the auxiliary storage device. Non-volatile storage media are, for example, hard disks, solid-state drives (SSDs), flash memories, or electrically erasable programmable read-only memories (EEPROMs). In addition, the storage device 22 can include a drive device for a disk recording medium.

[0092] The communication IF 23 is a circuit that performs communication processing. For example, the communication IF 23 is a network interface card (NIC). In addition, the communication IF 23 may be a wireless communication circuit that performs wireless communication (5G, wireless LAN (Wi-Fi (registered trademark)), Bluetooth (registered trademark) Low Energy (BLE) etc.). In addition, the communication IF 23 may be a combination of a circuit that performs wired communication processing and a wireless communication circuit.

[0093] The input device 24 includes keys, buttons, pointing devices, and a touch panel, etc., and is used for inputting information. The display 25 is, for example, a liquid crystal display, an organic electro-luminescence (OEL) display, etc. The display 25 displays information and data.

[0094] The processor 21 performs various processes by executing various programs stored in the storage device 22. By the processor 21 executing the programs stored in the storage device 22, the information processing device 20 can act as NF 11 (UPF 11a, etc.), AF 12, information source AF 12a, security device 51, router 52, information source EAS 50, etc.

[0095] Figure 44 is a diagram showing a configuration example of a terminal 40 that can operate as a UE 2. The terminal 40 includes a processor 41, a storage device 42, a communication interface 43 (communication IF 43), an input device 44, and a display 45 that are connected to each other via a bus 46. The processor 41, the storage device 42, the communication IF 43, the input device 44, and the display 45 can use the same components as the processor 21, the storage device 22, the communication IF 23, the input device 24, and the display 25. Therefore, their description is omitted.

[0096] Processors 21 and 41 are, for example, central processing units (CPUs). CPUs are also called microprocessor units (MPUs). Processors 21 and 41 may be either single processor structures or multi-processor structures. In addition, a single physical CPU connected by a single socket may also have a multi-core structure. Processors 21 and 41 may also include computing devices of various circuit structures such as digital signal processors (DSPs) or graphics processing units (GPUs). In addition, processors 21 and 41 may also have a structure that cooperates with at least one of an integrated circuit (IC), other digital circuits, and analog circuits. Integrated circuits include LSIs, application specific integrated circuits (ASICs), programmable logic devices (PLDs), and the like. PLDs include, for example, field programmable gate arrays (FPGAs). Processors 21 and 41 also include processors called microcontrollers (MCUs), system-on-a-chip (SoCs), system LSIs, or chipsets, and the like.

[0097] Processing example

[0098] Figure 5 and Figure 6 This is a sequence diagram illustrating the acceptance and defense processing of threat information in this communication system. Figure 5 and Figure 6 The terminals A1 to H1 are connected. In this process, first, the information source AF 12a notifies the NEF 11e of threat information (S1). The notification of threat information can also be called the notification of defense information. For example, Figure 2 As illustrated, the threat information can include information identifying the attacker 90 and information identifying the target UE 2 that is the target of the attack. The NEF 11e accepts the threat information as an example of acceptance processing.

[0099] Then, NEF 11e further notifies the security cooperation unit 11n of the threat information (defense information) (S2). It should be noted that, if the information source AF 12a is trusted by the MNO of the communication system, the information source AF 12a can directly notify the security cooperation unit 11n of the threat information (defense information) without going through NEF 11e (S1A). The security cooperation unit 11n accepts the threat information as an example of acceptance processing.

[0100] Next, the security coordination unit 11n obtains information for specifying the target UE 2 that is the target of the attack in the threat information from the notified threat information. Then, the security coordination unit 11n sends a message to the UDM 11j requesting a search for the target UE 2 or the UPF information to which the target UE 2 is connected (S3). The message requesting a search includes information for specifying the target UE 2. The information for specifying the target UE 2 is in Figure 2 The destination IP address, the destination port number, the model of the target UE 2, the type and version of the OS, the type and version of the installed computer program, and the information specifying the mobile object on which the target UE 2 is mounted (model) are exemplified.

[0101] Then, UDM 11j responds to the security cooperation unit 11n with information of the target UE 2, such as a unique identifier in 5GC, or UPF information connected to the target UE 2 (S4). Here, UPF information refers to an identifier such as an IP address or URI that can uniquely identify any UPF in 5GC.

[0102] However, the UDM 11j may also obtain whether the defense process can be executed or needs to be executed from the contract data in the subscriber-related information in response to the search request for the information of the target UE 2 from the security collaboration unit 11n (S3), and respond to the security collaboration unit 11n (S4). The security collaboration unit 11n may execute the defense process only for the UE 2 that is set as being able to execute the defense process in the contract data. In addition, the security collaboration unit 11n may also execute the defense process only for the UE 2 of the user that is clearly recorded in the contract data to execute the defense process.

[0103] When receiving the information of the target UE 2 or the response of the UPF information connected to the target UE 2, the security cooperation unit 11n implements the defense setting against the threat to the corresponding UPF 11a connected to the target UE 2 (S5). Here, the defense setting is, for example, a setting for the corresponding UPF 11a to perform a process of cutting off, filtering or mitigating the data packet or flow from the attacker 90. The data packet or flow from the attacker 90 is Figure 2 The illustrated threat information includes a header, additional information for identifying the attacker 90, and the like.

[0104] The security collaboration unit 11n can cut off the data packets or traffic from the attacker 90 at least in the UPF 11a to which the target UE 2 has established a UDP session through the defense setting. It should be noted that the security collaboration unit 11n can also perform defense settings for all UPFs 11a except the UPF 11a to which the target UE 2 is connected. The security collaboration unit 11n can uniformly defend against attacks in the entire communication network managed by the present communication system through the defense setting for all UPFs 11a.

[0105] Similarly, for the security cooperation unit 11n, the UPF 11a to which the target UE 2 is connected becomes an anchor point, and executes defense settings against threats for the external security device 51, router 52, etc. connected via DN5 (S6). Figure 1 As described above, the last-stage UPF 11a connected to the DN 5 is called PSAUPF. In addition, the UPF 11a provided between the RAN 3 and the PSAUPF is called IUPF. The above-mentioned defense setting can be performed on either the PSAUPF or the IUPF.

[0106] However, the security device 51 and the router 52 may also be one of the AFs 12. When the security device 51 and the router 52 are one of the AFs 12, the security coordination unit 11n may also request the security device 51 and the router 52 for notification of threat information and setting of defense processing according to the request / response model. In addition, when the security device 51 and the router 52 are one of the AFs 12, the security coordination unit 11n may also provide information for setting defense processing together with threat information to the security device 51 and the router 52 according to the subscription / notification model. In the case of the subscription / notification model, when the security coordination unit 11n receives notification of threat information as a trigger condition, it notifies the security device 51 and the router 52 of the generation of threat information. Then, when the security device 51 and the router 52 are notified of the generation of threat information, they obtain the threat information and the information for setting defense processing from the security coordination unit 11n and set defense processing. By the above-mentioned defense setting, at least in the security device 51 and the router 52 to which the target UE2 is connected and the connection is set, the data packet or flow from the attacker 90 is cut off.

[0107] When the defense setting is performed by the process of S5 or S6, the communication of the target UE 2 to the attacker 90 is cut off (S7-1). In addition, the communication of the target UE 2 to the attacker 90 is cut off in the connected security device 51, router 52, etc. (S7-2). It should be noted that the security cooperation unit 11n may also notify the target UE 2 of the threat information via the AMF 11b and perform the defense setting against the threat in the target UE 2 itself. Next, according to Figure 6 Continue with the description.

[0108] By Figure 5 According to the threat defense setting described in , in the UPF 11a, the attack from the attacker 90 to the target UE 2 is cut off (S8). In addition, in the security device 51 and the router 52, the attack from the attacker 90 to the target UE 2 is cut off (S9).

[0109] Afterwards, when the threat of the attacker 90 disappears, the information source AF 12a receives the setting that the threat disappears from the organization outside the communication system. Then, the information source AF 12a notifies the NEF 11e of a message requesting the defense to stop (S10). Furthermore, the NEF 11e notifies the security cooperation unit 11n of a message requesting the defense to stop (S11). It should be noted that, if the information source AF 12a is trusted by the MNO of the communication system, the information source AF 12a can directly notify the security cooperation unit 11n of the message requesting the defense to stop (S10A) without going through the NEF 11e.

[0110] Then, when the security coordination unit 11n is notified of the request to stop the defense, it sends a message requesting deletion of the threat defense setting in the UPF 11a (S12). In addition, the security coordination unit 11n sends a message requesting deletion of the threat defense setting to the security device 51, the router 52, etc. (S13).

[0111] Figure 7 is exemplified in the above Figure 5 FIG. 1 shows a format conversion process performed by the security cooperation unit 11n or the like after the process of S2 or the process of S1A. The threat information provided by the information source AF 12a is, for example, Figure 2 However, there may be a case where the format of the threat information that can be processed by the NF 11 of the present communication system is different from the format of the threat information provided from the information source AF 12a. In such a case, for example, the security collaboration unit 11n converts the threat information provided from the information source AF 12a into the format of the threat information that can be processed by the NF 11 of the present communication system.

[0112] In this process, for example, the security collaboration unit 11n is started when it receives threat information in a format different from the format supported by the NF 11 of the communication system (S101). The security collaboration unit 11n receives threat information in a format different from the format supported by the NF 11 of the communication system (referred to as a different format) from, for example, an application programming interface (API) dedicated to the different format (S101). Therefore, when the security collaboration unit 11n receives threat information in a format supported by the NF 11 of the communication system, Figure 7 The processing is not performed.

[0113] Then, the security coordination unit 11n converts the format of the threat information received from the API dedicated to the different format into a format supported by the NF 11 of the communication system (S102). Figure 2 The components of different formats among the various components such as the header and body illustrated in the example are converted into the format of threat information that can be processed by the NF 11 of the present communication system.

[0114] Then, the security coordination unit 11n sends the threat information after format conversion to the next NF 11 of the communication system (S103). Figure 5 In the process of S2 or S1A, the next NF 11 is, for example, the UDM 11j. Figure 5 In the process of S6, based on the threat information after format conversion, a defense method that can be set for the external security device 51, router 52, etc. is selected. It should be noted that Figure 7 The security cooperation unit 11n is shown as an example to perform the process of format conversion, but such format conversion may be performed by other NFs 11, such as NEF 11e, UDM 11j, etc.

[0115] Figure 8 This is a diagram illustrating the process of selecting a defense process when the security collaboration unit 11n receives threat information in a different format. That is, when the security collaboration unit 11n receives threat information in a different format (S111), it may select a defense process corresponding to the threat information in a different format instead of converting the format (S112). The security collaboration unit 11n may request the selected defense process from the next NF 11. The next NF 11 may select a defense process corresponding to the threat information in a different format. Figure 5 In the process of S2 or S1A, the UDM 11j, UPF 11a, etc. However, the security cooperation unit 11n may also be Figure 5In the process of S6 of FIG. 11 , the defense process to be set for the security device 51 or the router 52 is selected in S112. Then, the security coordination unit 11n sets the selected defense process for the security device 51 or the router 52 (S113). That is, the security coordination unit 11n selects the defense process that can be set for the UDM 11j, the UPF 11a, the security device 51 or the router 52 based on the threat information in different formats.

[0116] Effects of the First Embodiment

[0117] As described above, as an example of a control device, the security coordination unit 11n performs a process of accepting threat information against the UE 2, which is a communication device using the communication network, from an organization outside the communication system. Furthermore, the security coordination unit 11n performs a defense process for realizing defense of the UE 2 based on the accepted threat information. Therefore, the present communication system can quickly defend against attacks on the UE 2 using the communication network through unified processing in the communication network.

[0118] In this case, the security collaboration unit 11n may also uniformly perform defense processing in the UPF 11a of each connection destination for the UE 2 connected to the present communication system. Thus, it is possible to implement defense for all UEs 2 connected to the communication system without omission. In addition, the security collaboration unit 11n may also uniformly perform defense processing in all UPFs 11a of the present communication system. In this case, it is possible to respond to threat information in the entire communication system.

[0119] However, the information source AF 12a can include information identifying a specific communication device (target UE 2) that is the target of the attack in the threat information. In this case, the security coordination unit 11n can perform defense processing on the specific communication device. Therefore, the security coordination unit 11n can perform defense processing without affecting the processing of the communication system that provides the communication network as much as possible.

[0120] Furthermore, when the specific communication device of the attack target is a mobile object, such as a device mounted on a vehicle, the information source AF 12a can include information such as the manufacturer, model, and year of the vehicle on which the specific communication device is mounted in the threat information. Then, for example, the information source AF 12a can request a search from the UDM 11j based on the information such as the model, and identify the target UE 2 that is the target of the attack.

[0121] In addition, the security coordination unit 11n receives threat information using the NEF 11e provided in the 5GC. Therefore, the security coordination unit 11n can receive threat information and set and cancel defense settings against threats through processing that conforms to the standards of the 5GC.

[0122] Furthermore, the security coordination unit 11n directly receives threat information without passing through the NEF 11e. Therefore, when the information source AF 12a is a trustworthy application server, the security coordination unit 11n can quickly receive threat information and set or cancel defense settings against threats.

[0123] In addition, the security cooperation unit 11n performs defense processing on the security device 51, router 52, etc. connected to the communication network via the DN 5. In addition, the security cooperation unit 11n performs defense processing on the security device 51, router 52, etc. connected to the present communication system (5GC, etc.) as one of the AF 12. That is, the security cooperation unit 11n can perform defense settings against threats in the security device 51, router 52, etc. on the communication network provided by the present communication system based on threat information provided from an organization outside the present communication system via the information source AF 12a.

[0124] In addition, the NF 11 such as the security coordination unit 11n, NEF 11e, and UDM 11j converts the threat information in a different format that is not supported by the communication system into a format supported by the NF 11 of the communication system. In addition, the security coordination unit 11n determines and selects a defense process that can be implemented by the NF 11 in accordance with the threat information in a different format that is not supported by the NF 11 of the communication system. And the NF 11 of the communication system such as the security coordination unit 11n can implement the determined defense process in the communication system. Furthermore, the security coordination unit 11n determines the defense process that can be requested in the security device 51 or the router 52 corresponding to the threat information in a different format that is not supported by the communication system. Then, the security coordination unit 11n can set the determined defense process to the security device 51 or the router 52.

[0125] In addition, the above-mentioned UDM 11j maintains information related to the subscriber. The information related to the subscriber can be said to be an example of contract data. That is, the present communication system has a storage device (such as a Unified Data Repository (UDR)) for storing contract data based on the contract between the user of UE 2 and the operator (MNO) that manages the present communication system. Then, the security collaboration unit 11n determines or determines the object of application defense processing in multiple UE 2 based on the contract data maintained or managed by UDM 11j. Therefore, the present communication system can effectively utilize the above-mentioned contract data to perform defense processing. For example, as subscriber information, it is sufficient to save in the UDR whether the defense processing of the security collaboration unit 11n can be executed or whether it needs to be executed. Therefore, the present communication system can determine or limit the UE 2 to which the defense processing is applied based on the contract between the user and the MNO.

[0126] That is, the UDM 11j only needs to obtain from the UDR whether the defense process can be executed or whether it needs to be executed in the search request for the information of the target UE 2 from the security cooperation unit 11n, and respond to the security cooperation unit 11n. Therefore, the security cooperation unit 11n only needs to execute the defense process for the UE 2 that is set as being able to execute the defense process or needing to execute the defense process in the contract data.

[0127] As described above, the information source AF 12a is set as one of the AFs 12 connected to the 5GC as a communication system. Therefore, the information source AF 12a can cooperate with the NF 11 of the 5GC and obtain threat information from an organization outside the communication system. Figure 1 As illustrated, the information source AF 12a may be provided in the EAS or the like connected to the DN 5. In addition, the information source AF 12a may be provided in the UE 2 as well.

[0128] Second Embodiment

[0129] Processing example

[0130] Reference Fig. 9 , a communication system, a control device, and a communication method of the second embodiment are described. In the above-mentioned first embodiment, the security cooperation unit 11n performs defense settings against threats on the UPF 11a, such as cutting off communication to the attacker 90, based on threat information received via the NEF 11e or directly received from the information source AF 12a. However, instead of such processing, the security cooperation unit 11n may also request the PCF 11d to set a policy for defense settings. In addition, the PCF 11d may also set the policy of the received setting request, and further perform defense settings directly on the UPF 11a via the SMF 11c or not via the SMF 11c according to the set policy.

[0131] In this embodiment, the following processes other than (1) and (2) are the same as those in the first embodiment. (1) is the process of the security collaboration unit 11n setting a policy for setting defenses against threats to the PCF 11d. (2) is the process of the PCF 11d directly setting defenses for the UPF 11a via the SMF 11c or without going through the SMF 11c. Therefore, the description of the same processes as those in the first embodiment is omitted. In addition, the processes of the first embodiment other than the processes performed by the PCF 11d and the processes performed by the SMF 11c are also directly executed in this embodiment.

[0132] Fig. 9 and Fig.10 is a timing diagram illustrating the defense processing in this communication system. Figure 5 The processing of S1, S2 and S1A is Fig. 9 In addition, Fig. 9 The processing is connected to the Fig.10 In addition, Fig. 9 In the process of S3 and S6 Figure 5 are the same, so their description is omitted.

[0133] exist Fig. 9 In the text, the processing after the security collaboration unit 11n receives the information of the object UE 2 or the UPF information to which the object UE 2 is connected (S4) is recorded. In the present embodiment, the security collaboration unit 11n requests the PCF 11d to set a policy for implementing the defense settings against threats for the corresponding UPF 11a to which the object UE 2 is connected (S51). Therefore, the PCF 11d sets a policy for implementing the defense settings against threats. Then, the PCF 11d requests the SMF 11c to set the defense for the corresponding UPF 11a to which the object UE 2 is connected according to the set policy (S52). Therefore, the SMF 11c sets the defense for the corresponding UPF 11a to which the object UE 2 is connected (S53). It should be noted that the PCF 11d can also directly set the defense for the corresponding UPF 11a according to the set policy without going through the SMF 11c (S54). Later, in Fig. 9 In, with Figure 5 The process of S6 is executed in the same manner. Also, the communication is cut off in the same manner as S7-1 and S7-2.

[0134] Next, according to Fig.10 Continue with the description. Figure 6 Similarly, the processing of S8 to S11 and S10A is performed, but the description thereof is omitted. Fig.10 In , these processes are omitted. Fig.10 In the case where the security cooperation unit 11n is notified of the defense stop ( Figure 6 S11 and S10A), PCF 11d is requested to cancel the policy for implementing the defense settings against the threat (S121). Then, PCF 11d cancels the policy for implementing the defense settings. Then, PCF 11d requests SMF 11c to stop the defense against the threat (S122). Then, SMF 11c stops the defense (S123). It should be noted that PCF 11d can also cancel the policy for implementing the defense settings and directly stop the defense of the corresponding UPF 11a without going through SMF 11c (S124). Later, in Fig.10 In, with Figure 6 The process of S13 is performed in the same manner.

[0135] It should be noted that the same method as that of Embodiment 1 can also be performed in this embodiment. Figure 7 That is, the NF 11 of the communication system such as the security collaboration unit 11n can also convert the threat information of different formats into the format of the threat information that can be processed by the NF 11 of the communication system. Figure 8 Similarly to the above-mentioned process, the security cooperation unit 11n may determine and select a defense process corresponding to the received threat information when receiving threat information in a different format.

[0136] Effects of the Second Embodiment

[0137] As described above, the security collaboration unit 11n requests the PCF 11d to set the policy for the defense process, and executes the defense process in the UPF 11a via the PCF 11d. In addition, the PCF 11d directly sets the defense for the corresponding UPF 11a via the SMF 11c or without the SMF 11c. Therefore, the security collaboration unit 11n can uniformly execute the defense process corresponding to the threat information in the communication network.

[0138] In addition, the security cooperation unit 11n and the first embodiment Figure 7 Similarly to the processing of the embodiment 1, the processing is performed when the format of the threat information is different from the format that can be defended in the NF 11 of the communication system. That is, the security cooperation unit 11n etc. converts the format of the threat information into a format that can be defended in the NF 11. Figure 8 Similarly, when the format of threat information is different from the form in which defense processing can be performed, the security cooperation unit 11n determines and selects defense processing to be performed in the UPF 11a, the security device 51, the router 52, etc. according to the threat information. Furthermore, the security cooperation unit 11n executes the determined defense processing in the UPF 11a, the security device 51, the router 52, etc. Therefore, the present communication system can execute defense processing based on threat information of various formats from outside the present communication system.

[0139] Third Embodiment

[0140] Processing example

[0141] Reference Fig.11 and Fig.12, describing the communication system of the third embodiment. In the first embodiment, a communication system for setting a defense process based on threat information is illustrated. In the second embodiment, in addition to the process of the first embodiment, a process in which the security cooperation unit 11n requests the PCF 11d to set a policy for threat defense setting is illustrated. In addition, a process in which the PCF 11d performs threat defense setting directly on the UPF 11a via the SMF 11c or not via the SMF 11c according to the policy of the setting request received is illustrated.

[0142] In this embodiment, a process of inducing traffic from an attacker 90 to a honeypot built in Multi-access Edge Computing (MEC) based on threat information is illustrated (hereinafter also referred to as honeypot induction process). A honeypot refers to a computer that is built on the MEC platform 55 and is an induction target for inducing traffic from an attacker 90. In the honeypot, an application that responds to traffic from the attacker 90 is executed. It should be noted that a system that provides MEC by applying virtual technology to multiple computers, network devices, etc. is called a MEC platform 55.

[0143] In addition, the processing of this embodiment can be implemented independently of the processing of Embodiment 1 and the processing of Embodiment 2. Therefore, the present communication system can freely select and implement the processing of Embodiment 1, the processing of Embodiment 2, or the processing of Embodiment 3.

[0144] Fig.11 and Fig.12 This is a sequence diagram illustrating the acceptance of threat information and honeypot induction processing in this communication system. Fig.11 and Fig.12 The terminals A2 to H2 are connected. In this process, first, the information source AF 12a notifies the NEF 11e of a request to start honeypot induction together with threat information (S21).

[0145] Then, NEF 11e further notifies the security cooperation unit 11n of the threat information and the request to start the honeypot induction (S22). It should be noted that, if the information source AF 12a is trusted by the MNO of the communication system, the information source AF 12a can directly notify the security cooperation unit 11n of the threat information and the request to start the honeypot induction without going through NEF 11e (S21A).

[0146] Next, the security coordination unit 11n acquires information for specifying the target UE 2 targeted for attack in the threat information from the notified threat information and the request to start the honeypot induction. Then, the security coordination unit 11n sends a message requesting a search for the target UE 2 or the UPF information to which the target UE 2 is connected to the UDM 11j (S23).

[0147] Then, UDM 11j responds to the security coordination unit 11n with information of the target UE 2, such as a unique identifier in 5GC, or UPF information connected to the target UE 2 (S24). Here, UPF information refers to an identifier such as an IP address or URI that can uniquely identify any UPF in 5GC.

[0148] However, the UDM 11j may also obtain information on whether the honeypot induction process can be executed or is necessary from the UDR, etc., in the search request (S23) for information of the target UE 2 from the security cooperation unit 11n, and respond to the security cooperation unit 11n (S24). The security cooperation unit 11n may execute the honeypot induction process only for the UE 2 that is set as being able to execute the honeypot induction process or being required to execute the honeypot induction process in the contract data.

[0149] When the security collaboration unit 11n receives a response such as information of the target UE 2 or information of the UPF to which the target UE 2 is connected, it starts one or more honeypots for the MEC that can access the corresponding UPF 11a to which the target UE 2 is connected as an anchor point (S25). However, the honeypot is not limited to the corresponding UPF 11a to which the target UE 2 is connected as an anchor point. In short, the security collaboration unit 11n can induce the data packet or traffic from the attacker 90 to the honeypot via the multi-level UPF 11a. In addition, the started honeypot is started, for example, by executing an application of a type corresponding to the threat information. In addition, the started honeypot is started, for example, by setting parameters corresponding to the threat information in the application. The type or setting corresponding to the threat information refers to, for example, a protocol for communication from the attacker 90, a source domain, a destination IP address, a destination port number, a type of application of the source, and a type or setting corresponding to the additional information for determining the attacker. Then, the MEC platform 55 returns a response indicating that the start of the honeypot is completed to the security collaboration unit 11n (S26).

[0150] Here, the MEC platform 55 is an example of an information processing environment connected to the outside of the communication system in the DN 5 connected to the PSAUPF serving as an anchor point. Therefore, starting the honeypot is an example of creating a simulated receiving system that simulates the environment in the communication device or the mobile body equipped with the communication device. The environment in the mobile body refers to, for example, the OS and applications of the UE 2 installed in the mobile body executed by the honeypot.

[0151] Therefore, the security collaboration unit 11n sets the corresponding UPF 11a to which the object UE 2 is connected in such a way as to guide the corresponding traffic to the honeypot of the MEC platform 55 (S27). It should be noted that the induction can also be performed through multiple levels of UPF 11a. In addition, the security collaboration unit 11n and the associated NF 11 can also perform the same steps as the processing described in Implementation Method 2. That is, the security collaboration unit 11n can also guide the corresponding traffic to the honeypot of the MEC platform 55 based on the setting of the policy of the PCF 11d and the induction request from the PCF 11d to the SMF 11c for the corresponding UPF 11a.

[0152] At this time, PCF 11d may also guide the corresponding traffic to the honeypot of the MEC platform 55 by directly setting the traffic induction to the corresponding UPF 11a without going through SMF 11c.

[0153] The specific steps for inducing the attacker's traffic to the honeypot are illustrated below. For example, in the 6.3Edge Relocation section of 3GPP (registered trademark) TS23.548 V18.3.0 (2023-09), the steps of reconfiguring the edge application server (EAS) on the DN 5 accessed by UE 2 and the steps of reconfiguring the PSAUPF connected to EAS are recorded. In addition, in the above section 6.3, it is recorded that the PSAUPF replaces the IP address and port number of EAS for the traffic associated with the application using EAS. In addition, when the EAS is transferred, the AF 12 simultaneously connects to the source PSA and the target PSA to the communication system (5GC) and records the processing thereof. Here, the source PSA refers to the PSA to which UE 2 is connected before the transfer of EAS, and the target PSA refers to the PSA to which UE 2 is connected after the transfer of EAS. These standards involve the processing of replacing the EAS and PSAUPF as the access destination of UE 2. In the present embodiment, these standard procedures are modified and applied as procedures for guiding attacking packets or traffic to the security cooperation unit 11n.

[0154] In addition, in the specific steps of guiding the attacker's traffic to the honeypot, the steps of Network Address Translation (NAT) in a gateway on a conventional network can be applied. The steps are exemplified as follows.

[0155] (11) The security cooperation unit 11n associates the source destination address and the source destination port number with the target destination address and the target destination port number in the UPF 11a directly or via the PCF 11d and the SMF 11c. Then, the security cooperation unit 11n sets the corresponding association between the source and the destination in the address conversion table for induction. Here, the source destination address and the source destination port number refer to the destination address and the destination port number before the address conversion, and refer to the destination of the data packet or traffic of the attacker 90. In addition, the target destination address and the target destination port number refer to the destination address and the destination port number after the address conversion, and refer to the destination address and the destination port number to the honeypot.

[0156] (12) The security coordination unit 11n instructs the UPF 11a to Figure 2 The characteristic source packet or flow indicated by the example instructs the address conversion process based on the induction address conversion table described in (11). The security cooperation unit 11n instructs the UPF 11a to perform the address conversion process directly or via the PCF 11d and SMF 11c.

[0157] (13) Thereafter, UPF 11a guides the attacker's data packets to the honeypot. It should be noted that the session between UE 2 and attacker 90 disappears due to timeout, for example. As already mentioned, UPF 11a sometimes adopts a multi-level structure between RAN 3 and DN 5. The above settings (11) and (12) can be performed on either PSAUPF or IUPF.

[0158] Next, according to Fig.12 The explanation continues. Here, the security collaboration unit 11n induces the data packet or traffic of the above-mentioned attacker 90 to the honeypot of the MEC platform 55, which is an example of inducing an attack from inside or outside the communication network provided by the communication system to the simulated receiving system. As an attack from within the communication network, it is assumed that there is an attack from other UEs inside the MNO to which UE 2 is connected or an attack from the 5GC function invaded by the attacker 90. The content of the attack is the same as that from the outside, and it is assumed that there is a denial of service attack (Denial of Service Attack, DoS) / distributed denial of service attack (Distributed Denial of Service Attack, DDoS) or attacks with various vulnerabilities. Here, DoS refers to a network attack that maliciously sends a large amount of data to an information processing device such as a server by taking advantage of the situation where the processing of the server is congested due to concentrated access. In addition, DDoS refers to the behavior of hindering the normal processing of a server, etc. by sending a large number of data packets from multiple computers to an information processing device such as a server.

[0159] Similar to S27, the security collaboration unit 11n can also set the external router 52, etc. connected to the PSAUPF connected to the target UE 2 via the DN 5 in such a way as to induce the corresponding traffic to the honeypot of the MEC platform 55 (S28). The external router 52, etc. can also be connected to the communication system as one of the AFs 12. By setting the induction of the traffic, at least in the router 52, etc. where the target UE 2 is connected and the connection is set, the traffic from the attacker 90 will not reach the target UE 2, but will be received by the honeypot (S29).

[0160] Afterwards, when the threat of the attacker 90 disappears, the information source AF 12a receives the setting that the threat disappears from the organization outside the communication system. Then, the information source AF 12a notifies the NEF 11e to stop the induction to the honeypot (S30). Furthermore, the NEF 11e requests the security cooperation unit 11n to stop the induction to the honeypot (S31). It should be noted that, if the information source AF 12a is trusted by the MNO of the communication system, the information source AF 12a can directly notify the security cooperation unit 11n to stop the induction to the honeypot without going through the NEF 11e (S30A).

[0161] Then, when the security collaboration unit 11n notifies the UPF 11a to stop the induction to the honeypot, it stops the induction to the honeypot. Here, the stop of the setting also includes, for example, clearing or deleting the address conversion table used for the above-mentioned induction. In addition, the security collaboration unit 11n sends a message to the MEC platform 55 requesting the stop of the honeypot and the deletion of various settings (S32). When the stop of the honeypot and the deletion of various settings are completed for the MEC platform 55, the security collaboration unit 11n is notified of this intention and responds (S33).

[0162] Effects of Implementation 3

[0163] As described above, by inducing the above-mentioned traffic, at least the traffic from the attacker 90 to the target UE 2 does not reach the target UE 2, but is received by the honeypot. Therefore, the communication system and NF 11 of this embodiment can effectively defend against attacks from outside the communication system. In addition, the communication system and NF 11 of this embodiment can gain time until further processing is taken against attacks from outside the communication system.

[0164] Effects of the First to Third Embodiments

[0165] Manufacturers, OEMs, or suppliers that manufacture and sell UE 2 or mobile devices equipped with UE 2 can defend against network attacks through the communication network and seek to reduce the damage caused by the attack. For example, time can be gained until a patch for the OS or application is prepared. On the other hand, the MNO that manages the communication network and provides it to users can protect users. In addition, the MNO can obtain billing means for the above-mentioned manufacturers, OEMs, suppliers, and Over The Top (OTT), OS, or terminal suppliers that provide media content to users.

[0166] Other Implementations

[0167] The above-mentioned embodiment is only an example, and the present disclosure can be implemented with appropriate changes within the scope of the gist thereof. In addition, the processes and components described in the present disclosure can be implemented in combination as long as no technical contradiction occurs.

[0168] In addition, a process described as a process performed by one device may be shared and executed by multiple devices. Alternatively, a process described as a process performed by different devices may be executed by one device. In a computer system, it is possible to flexibly change the hardware structure (server structure) by which each function is implemented.

[0169] The present disclosure can also be implemented in the following manner: a computer program having the functions described in the above embodiments is supplied to a computer, and one or more processors of the computer read and execute the program. Such a computer program can be provided to the computer by a non-volatile computer-readable storage medium that can be connected to the system bus of the computer, or provided to the computer via a network. Non-volatile computer-readable storage media include, for example, any type of disk (floppy disk (registered trademark), hard disk drive (HDD)), optical disk (CD-ROM, DVD disk, Blu-ray disk, etc.), read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic card, flash memory or optical card, etc., any type of medium suitable for storing electronic instructions.

Claims

1. A communication system configured to provide a communication network to a communication device, characterized in that: The communication system includes a control device configured to execute the following processing: receiving, from an organization external to the communication system, threat information related to a threat to the communication device utilizing the communication network; as well as The defense process implements the defense of the communication device based on the received threat information.

2. The communication system according to claim 1, characterized in that The control device is configured to execute the defense process uniformly on the communication devices connected to the communication system.

3. The communication system according to claim 1, characterized in that: The threat information includes information identifying a specific communication device that is a target of the threat attack, and The control device is configured to execute the defense process on the specific communication device.

4. The communication system according to claim 3, characterized in that: The specific communication device is mounted on a vehicle, and Determining the information of the specific communication device includes determining the information of the vehicle.

5. The communication system according to claim 1, characterized in that: The communication network includes a 5G core network, and The control device is configured to receive the threat information related to the threat by utilizing a network opening function provided in the 5G core network.

6. The communication system according to claim 1, characterized in that: The communication network includes a 5G core network, and The control device is configured to directly accept the threat information related to the threat without going through a network open function provided in the 5G core network.

7. The communication system according to claim 5, characterized in that: The control device is configured to perform the defense processing in the user plane function via a policy control function provided in the 5G core network.

8. The communication system according to claim 7, characterized in that: The control device is constructed as follows: When the form of the threat information is different from the form in which the defense process can be executed, converting the form of the threat information into a form in which the defense process can be executed, or determining the defense process to be executed in the user plane function corresponding to the threat information, and The defense process corresponding to the threat information in the converted form or the determined defense process is performed in the user plane function.

9. The communication system according to claim 1, characterized in that: The control device is configured to execute the defense process on a router connected to the communication network or a security device connected to the communication network.

10. The communication system according to claim 9, characterized in that: The control device is constructed as follows: When the form of the threat information is different from the form in which the defense process can be executed, converting the form of the threat information into a form in which the defense process can be executed, or determining the defense process to be executed in the router or the security device corresponding to the threat information, and The defense process or the determined defense process corresponding to the threat information in the converted form is executed in the router or the security device.

11. The communication system according to claim 1, characterized in that: The communication system further includes a storage device configured to store contract data based on a contract between a user of the communication device and an operator managing the communication system, wherein: The control device is configured to determine the communication device to which the defense process is applied based on the contract data among the plurality of communication devices.

12. The communication system according to claim 1, characterized in that: The control device is constructed as follows: A simulated receiving system is created in an information processing environment connected to the outside of the communication system, which simulates the environment of the communication device or a mobile body equipped with the communication device, and An attack from inside or outside the communication network provided by the communication system is induced toward a simulated receiving system.

13. The communication system according to claim 1, characterized in that: The communication network includes a 5G core network, and The control device is arranged in the 5G core network.

14. The communication system according to claim 1, characterized in that The communication network includes a 5G core network, and The control device is configured as an application function connected to the 5G core network.

15. A control device, which is a control device of a communication system configured to provide a communication network to a communication device, wherein: The control device is configured to perform the following processing: receiving, from an organization external to the communication system, threat information related to a threat to the communication device utilizing the communication network; as well as The defense process implements the defense of the communication device based on the received threat information.

16. A communication method in a communication system configured to provide a communication network to a communication device, characterized in that: The communication method includes: executing acceptance processing to accept threat information related to a threat to the communication device using the communication network from an organization outside the communication system; and Defense processing is executed to implement defense of the communication device based on the received threat information.

17. The communication method according to claim 16, characterized in that: The threat information includes information identifying a specific communication device that is the target of the attack by the threat, and The communication method further includes: executing the defense process on the specific communication device.

18. The communication method according to claim 17, characterized in that: The specific communication device is mounted on a vehicle, and Determining the information of the specific communication device includes determining the information of the vehicle.

19. The communication method according to claim 16, characterized in that: The communication network includes a 5G core network, and The acceptance process includes utilizing a network open function provided in the 5G core network to accept the threat information related to the threat.

20. The communication method according to claim 16, characterized in that: Also includes: Creating a simulated receiving system that simulates the environment of the communication device or a mobile body equipped with the communication device in an information processing environment connected to the outside of the communication system; as well as An attack from inside or outside the communication network provided by the communication system is induced toward the simulated receiving system.

Images