Security management method and device and storage medium

Abstract

The invention discloses a security management method and device and a storage medium. The method comprises the following steps: receiving target data of a terminal; wherein the target data comprises an identifier of the terminal, service information and a target user strategy; predicting a user security level and a service security level required by the terminal based on the identifier of the terminal and the service information; analyzing whether a user path determined by using the target user strategy in the current network and the safety of completing a service corresponding to the service information meet the user safety level and the service safety level or not, and obtaining a safety analysis result of the target user strategy; wherein the user path is a path between a network element and the terminal, wherein the network element provides service for the service by the network side; and sending the analysis result to the PCF, so that the PCF determines a user strategy meeting the user security level and the service security level according to the analysis result.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to a security management method, device and storage medium. Background Art

[0002] The service-oriented architecture of the fifth generation mobile communication network (5G) makes it easier for network elements to communicate with each other. Virtualization increases the exposure of network elements, increases the security risks of network elements and intranets, makes them more vulnerable to attacks, and brings new security challenges.

[0003] As a relatively weak link in the 5G network security protection system, terminals are more likely to introduce security risks.

[0004] In view of this, how to conduct security management on terminals has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present invention provides a security management method, device and storage medium, which are used to solve the technical problem in the prior art that the terminal cannot be securely managed.

[0006] In the first aspect, in order to solve the above technical problems, an embodiment of the present invention provides a security management method, which is applied to a network data analysis function network element NWDAF. The technical solution of the method is as follows:

[0007] Receive target data of a terminal; wherein the target data includes an identification of the terminal, service information, and target user policy;

[0008] Predicting a user security level and a service security level required by the terminal based on the identifier of the terminal and the service information;

[0009] Analyze the user path determined by the target user policy under the current network and the security of completing the service corresponding to the service information to determine whether the user security level and the service security level are met, and obtain the security analysis result of the target user policy; wherein the user path is the path between the network element providing service for the service on the network side and the terminal;

[0010] The analysis result is sent to the PCF, so that the PCF determines a user policy that satisfies the user security level and the service security level according to the analysis result.

[0011] In a second aspect, an embodiment of the present invention provides a security management method, which is applied to a policy control function network element PCF, including:

[0012] Acquire first user information related to the terminal security provided by the terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information and a first user policy pre-stored in the terminal;

[0013] Perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by the network data analysis function network element NWDAF taking the first user information or the second user information related to the terminal security stored on the network side as the target data, and analyzing based on the target data whether the user path and completed service information determined by the target user policy contained in the target data under the current network meet the user security level and service security level, the user security level and service security level are predicted based on the identifier of the terminal and the service information contained in the target data, and the user path is the path between the network element on the network side that provides services for the service and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information;

[0014] A user policy that satisfies the user security level and the service security level is determined based on the security analysis result.

[0015] In a possible implementation manner, obtaining first user information related to terminal security provided by a terminal and a second user policy of the terminal locally stored by the PCF includes:

[0016] Receiving a user policy association request sent by an authentication management function network element AMF; wherein the user policy association request is used to request to associate a user policy for the terminal accessing the network;

[0017] obtaining the first user information from the AMF according to the user policy association request; wherein the first user information is sent by the terminal to the AMF;

[0018] Obtain the second user policy stored locally by the PCF.

[0019] In a possible implementation manner, performing security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result includes:

[0020] Determining whether the second user policy is the same as the first user policy;

[0021] If the second user policy is different from the first user policy, sending the first user information to the NWDAF to obtain a security analysis result corresponding to the first user policy;

[0022] If the second user policy is the same as the first user policy, the second user information is sent to the NWDAF to obtain a security analysis result corresponding to the second user policy.

[0023] In a possible implementation manner, the second user policy is different from the first user policy, and determining a user policy that satisfies the user security level and the service security level based on the security analysis result includes:

[0024] If the security analysis result of the first user policy indicates that it is safe for the terminal to use the first user policy under the current network, determining that the first user policy satisfies the user security level and the service security level;

[0025] If the security analysis result of the first user policy indicates that it is not safe for the terminal to use the first user policy under the current network, the second user information is sent to the NWDAF to obtain the security analysis result corresponding to the second user policy; based on the security analysis result corresponding to the second user policy, a user policy that meets the user security level and the service security level is determined.

[0026] In a possible implementation manner, the second user policy is the same as the first user policy, and a user policy that satisfies the user security level and the service security level is determined based on the security analysis result; or, based on the security analysis result corresponding to the second user policy, a user policy that satisfies the user security level and the service security level is determined, including:

[0027] If the security analysis result of the second user policy indicates that it is safe for the terminal to use the second user policy under the current network, determining that the second user policy meets the user security level and the service security level, and updating the first user policy with the second user policy;

[0028] If the security analysis result of the second user policy indicates that it is not safe for the terminal to use the second user policy under the current network, a third user policy that meets the user security level and the service security level is generated based on the user security level label of the terminal carried in the security analysis result of the second user policy and the corresponding application function network element AF address of the same level; and the first user policy is updated with the third user policy.

[0029] In a third aspect, an embodiment of the present invention further provides a security management device, which is applied to a network data analysis function network element NWDAF, including:

[0030] A receiving unit, configured to receive target data of a terminal; wherein the target data includes an identification of the terminal, service information, and a target user policy;

[0031] A prediction unit, configured to predict a user security level and a service security level required by the terminal based on the terminal identifier and the service information;

[0032] An analysis unit, configured to analyze the user path determined by the target user policy under the current network and the security of completing the service corresponding to the service information, whether the user security level and the service security level are met, and obtain a security analysis result of the target user policy; wherein the user path is a path between a network element providing service for the service on the network side and the terminal;

[0033] The sending unit is used to send the analysis result to the PCF, so that the PCF determines a user policy that meets the user security level and the service security level according to the analysis result.

[0034] In a fourth aspect, an embodiment of the present invention provides a security management device, which is applied to a policy control function network element PCF, including:

[0035] An acquisition unit, configured to acquire first user information related to the terminal security provided by the terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information, and a first user policy pre-stored in the terminal;

[0036] An analysis unit, configured to perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by the network data analysis function network element NWDAF taking the first user information or the second user information related to the terminal security stored on the network side as target data, and analyzing based on the target data whether the user path and completed service information determined by the target user policy contained in the target data under the current network meet the user security level and service security level, wherein the user security level and service security level are predicted based on the identifier of the terminal and the service information contained in the target data, and the user path is the path between the network element on the network side that provides services for the service and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information;

[0037] A processing unit is used to determine a user policy that meets the user security level and the service security level based on the security analysis result.

[0038] In a possible implementation manner, the acquisition unit is further configured to:

[0039] Receiving a user policy association request sent by an authentication management function network element AMF; wherein the user policy association request is used to request to associate a user policy for the terminal accessing the network;

[0040] obtaining the first user information from the AMF according to the user policy association request; wherein the first user information is sent by the terminal to the AMF;

[0041] Obtain the second user policy stored locally by the PCF.

[0042] In a possible implementation manner, the analysis unit is used to:

[0043] Determining whether the second user policy is the same as the first user policy;

[0044] If the second user policy is different from the first user policy, sending the first user information to the NWDAF to obtain a security analysis result corresponding to the first user policy;

[0045] If the second user policy is the same as the first user policy, the second user information is sent to the NWDAF to obtain a security analysis result corresponding to the second user policy.

[0046] In a possible implementation manner, the processing unit is used to:

[0047] If the security analysis result of the first user policy indicates that it is safe for the terminal to use the first user policy under the current network, determining that the first user policy satisfies the user security level and the service security level;

[0048] If the security analysis result of the first user policy indicates that it is not safe for the terminal to use the first user policy under the current network, the second user information is sent to the NWDAF to obtain the security analysis result corresponding to the second user policy; based on the security analysis result corresponding to the second user policy, a user policy that meets the user security level and the service security level is determined.

[0049] In a possible implementation mode, the second user policy is the same as the first user policy, and a user policy that satisfies the user security level and the service security level is determined based on the security analysis result; or, based on the security analysis result corresponding to the second user policy, the processing unit is further used to:

[0050] If the security analysis result of the second user policy indicates that it is safe for the terminal to use the second user policy under the current network, determining that the second user policy meets the user security level and the service security level, and updating the first user policy with the second user policy;

[0051] If the security analysis result of the second user policy indicates that it is not safe for the terminal to use the second user policy under the current network, a third user policy that meets the user security level and the service security level is generated based on the user security level label of the terminal carried in the security analysis result of the second user policy and the corresponding application function network element AF address of the same level; and the first user policy is updated with the third user policy.

[0052] In a fifth aspect, an embodiment of the present invention provides a security management device, which is applied to a network data analysis function network element NWDAF, including: a memory, a transceiver, and a processor:

[0053] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0054] Receive target data of a terminal; wherein the target data includes an identification of the terminal, service information, and target user policy;

[0055] Predicting a user security level and a service security level required by the terminal based on the identifier of the terminal and the service information;

[0056] Analyze the user path determined by the target user policy under the current network and the security of completing the service corresponding to the service information to determine whether the user security level and the service security level are met, and obtain the security analysis result of the target user policy; wherein the user path is the path between the network element providing service for the service on the network side and the terminal;

[0057] The analysis result is sent to the PCF, so that the PCF determines a user policy that satisfies the user security level and the service security level according to the analysis result.

[0058] In a sixth aspect, an embodiment of the present invention provides a security management device, which is applied to a policy control function network element PCF, including a memory, a transceiver, and a processor:

[0059] A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations:

[0060] Acquire first user information related to the terminal security provided by the terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information and a first user policy pre-stored in the terminal;

[0061] Perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by the network data analysis function network element NWDAF taking the first user information or the second user information related to the terminal security stored on the network side as the target data, and analyzing based on the target data whether the user path and completed service information determined by the target user policy contained in the target data under the current network meet the user security level and service security level, the user security level and service security level are predicted based on the identifier of the terminal and the service information contained in the target data, and the user path is the path between the network element on the network side that provides services for the service and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information;

[0062] A user policy that satisfies the user security level and the service security level is determined based on the security analysis result.

[0063] In a possible implementation manner, the processor is further configured to:

[0064] Receiving a user policy association request sent by an authentication management function network element AMF; wherein the user policy association request is used to request to associate a user policy for the terminal accessing the network;

[0065] obtaining the first user information from the AMF according to the user policy association request; wherein the first user information is sent by the terminal to the AMF;

[0066] Obtain the second user policy stored locally by the PCF.

[0067] In a possible implementation manner, the processor is further configured to:

[0068] Determining whether the second user policy is the same as the first user policy;

[0069] If the second user policy is different from the first user policy, sending the first user information to the NWDAF to obtain a security analysis result corresponding to the first user policy;

[0070] If the second user policy is the same as the first user policy, the second user information is sent to the NWDAF to obtain a security analysis result corresponding to the second user policy.

[0071] In a possible implementation manner, the processor is further configured to:

[0072] If the security analysis result of the first user policy indicates that it is safe for the terminal to use the first user policy under the current network, determining that the first user policy satisfies the user security level and the service security level;

[0073] If the security analysis result of the first user policy indicates that it is not safe for the terminal to use the first user policy under the current network, the second user information is sent to the NWDAF to obtain the security analysis result corresponding to the second user policy; based on the security analysis result corresponding to the second user policy, a user policy that meets the user security level and the service security level is determined.

[0074] In a possible implementation manner, the second user policy is the same as the first user policy, and a user policy that satisfies the user security level and the service security level is determined based on the security analysis result; or, based on the security analysis result corresponding to the second user policy, the processor is further configured to:

[0075] If the security analysis result of the second user policy indicates that it is safe for the terminal to use the second user policy under the current network, determining that the second user policy meets the user security level and the service security level, and updating the first user policy with the second user policy;

[0076] If the security analysis result of the second user policy indicates that it is not safe for the terminal to use the second user policy under the current network, a third user policy that meets the user security level and the service security level is generated based on the user security level label of the terminal carried in the security analysis result of the second user policy and the corresponding application function network element AF address of the same level; and the first user policy is updated with the third user policy.

[0077] In a seventh aspect, an embodiment of the present invention further provides a processor-readable storage medium storing a computer program, wherein the computer program is used to enable the processor to execute the method described in the first aspect or the second aspect.

[0078] Through the technical solutions in one or more of the above embodiments of the embodiments of the present invention, the embodiments of the present invention have at least the following technical effects:

[0079] In the embodiment provided by the present invention, the following scheme for analyzing the security of user policies is added to NWDAF: using the terminal's identification and service information to predict the user security level and service security level required by the terminal; and according to the security status of the network elements that the user path needs to pass through in the current network and the security status of the network elements that provide services for the services, the user path determined by the target user policy in the current network and the security of the services corresponding to the completed service information are analyzed, and then it is determined whether they meet the user security level and the service security level. In this way, the security analysis result corresponding to the target user policy can be determined, and then the security analysis result is fed back to PCF, so that PCF can dynamically adjust the user policy of the terminal according to the security analysis result to make it meet the user security level and the service security level. In this way, the user path and the corresponding network behavior of the terminal can be changed by using the above-mentioned user policy that meets the user security level and the service security level to adapt to the changes in network services caused by security threats, and realize the 5G core network closed-loop response to security incidents. No new network elements will be added to the entire network side, and the network complexity will not be increased. Moreover, since the above-mentioned scheme is based on autonomous analysis at the network level to determine user policies that meet terminal security needs, it can achieve self-adjustment and adaptation of network security, which is helpful to promote network intelligence; and, through the above-mentioned scheme, network security can be linked to the network elements in the network to respond, and network functions can be smoothly adjusted to reduce the sudden impact of security incidents and increase business stability; security threats can be automatically shielded to prevent threat factors from entering the network, thereby improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] Figure 1 A schematic diagram of a network functional architecture;

[0081] Figure 2 An embodiment of the present invention provides a flow chart of a security management method;

[0082] Figure 3 A flowchart of another security management method provided by an embodiment of the present invention;

[0083] Figure 4 An interactive schematic diagram of security management is provided for an embodiment of the present invention;

[0084] Figure 5 A schematic diagram of the structure of a security management device provided by an embodiment of the present invention;

[0085] Figure 6 A schematic diagram of the structure of another security management device provided by an embodiment of the present invention;

[0086] Figure 7 A schematic diagram of the structure of another security management device provided by an embodiment of the present invention;

[0087] Figure 8 A schematic diagram of the structure of another security management device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0088] The embodiments of the present application provide a security management method, device and storage medium to solve the technical problem in the prior art that a terminal cannot be securely managed.

[0089] In the embodiments of the present invention, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0090] In the embodiments of the present application, the term "plurality" refers to two or more than two, and other quantifiers are similar.

[0091] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0092] The technical solution provided in the embodiment of the present application can be applicable to a variety of systems, especially 5G systems. For example, the applicable system can be a global system of mobile communication (GSM) system, a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) general packet radio service (GPRS) system, a long term evolution (LTE) system, a LTE frequency division duplex (FDD) system, a LTE time division duplex (TDD) system, an advanced long term evolution (LTE-A) system, a universal mobile telecommunication system (UMTS), a world-wide interoperability for microwave access (WiMAX) system, a 5G new air interface (NR) system, etc. These various systems include terminal equipment and network equipment. The system may also include a core network part, such as an evolved packet system (EPS), a 5G system (5GS), etc.

[0093] The terminal device (terminal for short) involved in the embodiments of the present application may be a device that provides voice and / or data connectivity to a user, a handheld device with a wireless connection function, or other processing devices connected to a wireless modem. In different systems, the names of terminal devices may also be different. For example, in a 5G system, the terminal device may be called a user equipment (UE). A wireless terminal device may communicate with one or more core networks (CN) via a radio access network (RAN). The wireless terminal device may be a mobile terminal device, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal device. For example, it may be a portable, pocket-sized, handheld, computer-built-in or vehicle-mounted mobile device that exchanges language and / or data with a wireless access network. For example, personal communication service (PCS) phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (PDAs) and other devices. The wireless terminal device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, an access point, a remote terminal device, an access terminal device, a user terminal device, a user agent, and a user device, but is not limited in the embodiments of the present application.

[0094] See also Figure 1The figure is a schematic diagram of a network function architecture, which includes a network layer and a user plane layer. The network layer may include network data analysis function network element (Network Data Analytics Function, NWDAF), data management function network element (Unified Data Management, UDM), network exposure function network element (Network Exposure Function, NEF), application function network element (Application Function, AF) and policy control function network element (Policy Control Function, PCF) and other network function network elements; UDM includes a user data warehouse (Unified Data Management, UDR), which is a user subscription data storage server, which can provide user subscription data, including subscription identification, security credit, access / mobile management design user subscription information and session management design user subscription information, and can also provide policy data to PCF, that is, UDR provides subscription data storage services. The user plane layer may include user plane function network elements (User Plane Function, UPF), mobility management function network elements (Access and Mobility Management Function, AMF), session management network elements (Session Management Function, SMF), etc. The functional network elements of the user plane layer can be connected to the user terminal (User Equipment, UE) through base stations, etc. The functional entities in the mobile network are connected through corresponding network interfaces.

[0095] In the 5G system, PCF can determine the access and mobility management (AM) policy, UE policy (i.e. user policy) and session management (SM) policy. AM policy includes policies related to access and mobility management, UE policy includes access discovery and selection policy and UE path selection policy, and SM policy includes policies related to session management. AM policy and UE policy are determined by the PCF selected by AMF.

[0096] NWDAF can collect load data of network slices according to static configuration for analysis, and provide network data analysis results related to slice load to network functional network elements such as PCF, so that network functional network elements such as PCF can formulate corresponding network control policies or execute corresponding network behaviors for terminals belonging to the slice according to the analysis results of NWDAF.

[0097] However, there is currently a gap in the industry's network regulation based on security policies in the 5G core network. Even if some solutions take security policies into consideration, it is necessary to introduce a security controller in the 5G core network to make decisions and handle security events in the network, which requires the introduction of new system equipment in the existing architecture, which may bring instability. Other solutions propose to analyze network data to feedback abnormal services from network elements and instruct the PCF to release the corresponding abnormal service sessions, but this solution is relatively limited, targeting a single service, and the handling method is simple and crude.

[0098] Please refer to Figure 2 , an embodiment of the present invention provides a security management method, which is applied to NWDAF. The processing process of the method is as follows.

[0099] Step 201: receiving target data of a terminal; wherein the target data includes the terminal's identification, service information, and target user policy;

[0100] The above target data is sent to NWDAF by a network element that requires NWDAF to analyze the security of the target user policy, such as PCF or other network elements, without specific limitation.

[0101] The above-mentioned target user policy is the user policy configured for the terminal. The target user policy may be stored in the terminal and provided to NWDAF after being obtained by the network element on the network side from the terminal. For example, when the terminal accesses the network, the first user policy stored in the terminal needs to be reported to AMF, AMF sends the first user policy to PCF, and PCF provides the first user policy as the target user policy to NWDAF for security analysis. The target user policy may also be stored in UDR and provided to NWDAF after being obtained by the network element on the network side from UDR. For example, PCF obtains the second user policy of the above-mentioned terminal stored in UDR, and provides the second user policy as the target user policy to NWDAF for security analysis. The target user policy may also be obtained directly by NWDAF from UDR. For example, if other network elements subscribe to the security analysis of the second user policy stored in UDR, NWDAF may obtain the second user policy from UDR at regular intervals and perform security analysis, and feed back the analysis results to the subscriber, without specific restrictions.

[0102] It should be understood that the first user policy and the second user policy for the same terminal should theoretically be the same user policy, but in an actual network environment, due to problems such as network delays, the first user policy stored in the terminal and the second user policy stored on the network side may not be the same. For the sake of distinction, the user policy stored in the terminal is referred to as the first user policy, and the user policy of the above terminal stored on the network side is referred to as the second user policy.

[0103] Step 202: predicting the user security level and service security level required by the terminal based on the terminal identification and service information;

[0104] In NWDAF, the received target data can be analyzed by designing an intelligent model. Specifically, during the analysis, the user security level and business security level required by the terminal can be predicted based on the terminal identification and business information provided in the target data.

[0105] When designing an intelligent model, users can be classified through training and learning based on a large amount of historical user subscription information, payment tendency information, and accountability information; and then the user's business and security can be graded according to the user's sensitivity to data leakage, sensitivity to network robustness, sensitivity to public opinion, etc. In this way, when using the intelligent model to analyze the target data, the possible business level and corresponding security level (i.e., business security level) and user security level of the terminal can be determined in real time.

[0106] After the user security level and the service security level are predicted, step 203 may be performed.

[0107] Step 203: Analyze the security of the user path determined by the target user policy and the service information corresponding to the completed service information in the current network to determine whether the user security level and service security level are met, obtain the target user policy, and obtain the corresponding security analysis result; wherein the user path is the path between the network element and the terminal that provides services for the service on the network side;

[0108] The network elements on the network side may become unsafe due to network attacks, or the communication methods used by the network elements are not secure, making the network elements vulnerable to attacks, or the locations of some network elements have changed, resulting in changes in their security, or network element vulnerabilities have been repaired, resulting in changes in their security, etc. Since the user path determined according to the target user policy will pass through some network elements on the network side, the security of these network elements will also affect the security of the user path, and the security of the network elements that provide services to users will also affect the completeness of the completed services. NWDAF collects the latest security information of each network element on the network side. NWDAF can evaluate the security of the user path and the corresponding services by analyzing the user path determined by the target user policy in the current network and the security of the services corresponding to the completed service information. Their security can be obtained by comprehensively evaluating the security of the network elements involved, such as scoring the security of each network element, and then giving a total score to all network elements involved in the user path, and then giving a total score to all network elements involved in the service. A total score is used to determine whether the security of the user path determined by the target user policy and the service corresponding to the service information completed in the current network meets the user security level and the service security level, based on whether the corresponding scoring results of the user path and the service fall within the score range corresponding to the user security level and the service security level respectively. Of course, a security rating can also be performed based on the security status of each network element. By judging whether the security rating of each network element involved in the user path is greater than or equal to the user security level, and whether the security level of each network element involved in the service is greater than or equal to the service security level, it can be determined whether the security of the user path determined by the target user policy and the service corresponding to the service information completed in the current network meets the user security level and the service security level.

[0109] If the conditions are met, the security analysis result fed back includes the user security level and the confirmed target user policy; if not, the security analysis result fed back includes the user security level and the address of the network element that meets the user security level and the service security level, and this network element can provide services for the terminal's services. In addition, the user security level included in the above security analysis result can also be replaced by the user security level label, and the target user policy can also be replaced by the target user policy label.

[0110] Step 204: Send the analysis result to the PCF, so that the PCF determines a user policy that meets the user security level and the service security level according to the analysis result.

[0111] After obtaining the security analysis results, NWDAF can send them to PCF, so that PCF can determine the user policy that meets the user security level and business security level based on the analysis results. In this way, it can drive the terminal to match its security needs (including the terminal's own security needs and the terminal's business security needs).

[0112] In the embodiment provided by the present invention, the following scheme for analyzing the security of user policies is added to NWDAF: using the terminal's identification and service information to predict the user security level and service security level required by the terminal; and according to the security status of the network elements that the user path needs to pass through in the current network and the security status of the network elements that provide services for the services, the user path determined by the target user policy in the current network and the security of the services corresponding to the completed service information are analyzed, and then it is determined whether they meet the user security level and the service security level. In this way, the security analysis result corresponding to the target user policy can be determined, and then the security analysis result is fed back to PCF, so that PCF can dynamically adjust the user policy of the terminal according to the security analysis result to make it meet the user security level and the service security level. In this way, the user path and the corresponding network behavior of the terminal can be changed by using the above-mentioned user policy that meets the user security level and the service security level to adapt to the changes in network services caused by security threats, and realize the 5G core network closed-loop response to security incidents. No new network elements will be added to the entire network side, and the network complexity will not be increased. Moreover, since the above-mentioned scheme is based on autonomous analysis at the network level to determine user policies that meet terminal security needs, it can achieve self-adjustment and adaptation of network security, which is helpful to promote network intelligence; and, through the above-mentioned scheme, network security can be linked to the network elements in the network to respond, and network functions can be smoothly adjusted to reduce the sudden impact of security incidents and increase business stability; security threats can be automatically shielded to prevent threat factors from entering the network, thereby improving network security.

[0113] After introducing the working method of NWDAF, the following will explain the process of PCF receiving and using the security analysis results of NWDAF to make decisions from the PCF side.

[0114] See also Figure 3 A flowchart of another security management method provided by an embodiment of the present invention is applied to PCF, and the method includes:

[0115] Step 301: Acquire first user information related to terminal security provided by the terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information, and a first user policy pre-stored in the terminal;

[0116] In some embodiments, obtaining the first user information related to terminal security provided by the terminal and the second user policy of the terminal stored locally by the PCF can be achieved in the following ways:

[0117] Receiving a user policy association request sent by an authentication management function network element AMF; wherein the user policy association request is used to request association of a user policy for a terminal accessing the network;

[0118] Obtaining first user information from the AMF according to the user policy association request; wherein the first user information is sent by the terminal to the AMF;

[0119] Get the second user policy stored locally by PCF.

[0120] Afterwards, PCF can also obtain the user contract data of the terminal from UDR, which includes: International Mobile Subscriber Identification Number (IMSI), International Mobile Equipment Identity (IMEI) and other user identifiers, as well as user category, user level, service subscription information, service priority, etc. The user identifier in the user contract information of the above terminal is used as the second user identifier, the service information corresponding to the service subscription information is used as the second service information, and the second user identifier, the second service information and the second user policy together constitute the second user information.

[0121] After obtaining the first user information and the second user policy, step 302 may be executed.

[0122] Step 302: Perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by NWDAF using the first user information or the second user information related to terminal security stored on the network side as target data, and analyzing based on the target data whether the user path and completed service information determined by the target user policy contained in the target data under the current network meet the user security level and service security level, the user security level and service security level are predicted based on the terminal identifier and service information contained in the target data, and the user path is the path between the network element providing service for the service on the network side and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information;

[0123] In some embodiments, performing security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result includes:

[0124] Determining whether the second user policy is the same as the first user policy;

[0125] If the second user policy is different from the first user policy, the first user information is sent to NWDAF to obtain the security analysis result corresponding to the first user policy;

[0126] If the second user policy is the same as the first user policy, the second user information is sent to the NWDAF to obtain a security analysis result corresponding to the second user policy.

[0127] In the embodiment provided by the present invention, when the second user policy is different from the first user policy, the first user information is sent to NWDAF to perform a security analysis on the security of the first user policy. When NWDAF determines that the first user policy is secure, the security of the second user policy does not need to be analyzed, thereby avoiding unnecessary analysis and processing processes and saving resources. When the second user policy is the same as the first user policy, the second user information is sent to DWDAF to analyze the security of the second user policy. This can prevent the information in the first user information from being inaccurate due to factors such as network delays rather than the latest information, thereby making the security analysis of the second user policy by NWDAF using the second user information more in line with the actual situation of the current network and improving the accuracy of the analysis results.

[0128] Step 303: Determine a user policy that meets the user security level and the service security level based on the security analysis result.

[0129] In some embodiments, if the second user policy is different from the first user policy, after sending the first user information to NWDAF, the security analysis result received by PCF is the security analysis result corresponding to the first user policy. PCF determines the user policy that meets the user security level and the service security level based on the security analysis result, which can be implemented in the following ways:

[0130] If the security analysis result of the first user policy indicates that it is safe for the terminal to use the first user policy in the current network, then the first user policy is determined to be a user policy that meets the user security level and the service security level; at this time, there is no need to update the first user policy;

[0131] If the security analysis result of the first user policy indicates that it is not safe for the terminal to use the first user policy under the current network, it is determined that the first user policy does not meet the user security level and the service security level. At this time, the second user information is sent to NWDAF to obtain the security analysis result corresponding to the second user policy; based on the security analysis result corresponding to the second user policy, a user policy that meets the user security level and the service security level is determined.

[0132] For example, the PCF determines that the first user policy and the second user policy are different, so the PCF sends the first user information including the first user policy to the NWDAF to analyze the security of the first user policy. The NWDAF uses the aforementioned NWDAF-side method to analyze and return the security analysis result of the first user policy. The security analysis result shows that it is safe to use the first user policy under the current network. The first user policy satisfies the user security level and service security level of the terminal, and the PCF decides not to update the first user policy.

[0133] However, if the security analysis result of the first user policy indicates that it is not safe to use the first user policy in the current network, then the first user policy does not meet the user security level and service security level of the terminal. PCF will use NWDAF to further analyze whether it is safe to use the second user policy in the current network, and then determine the user policy that meets the user security level and service security level of the terminal based on the security analysis result of the second user policy.

[0134] In other embodiments, the second user policy is the same as the first user policy, and a user policy that satisfies the user security level and the service security level is determined based on the security analysis result; or, based on the security analysis result corresponding to the second user policy, a user policy that satisfies the user security level and the service security level is determined, which can be implemented in the following ways:

[0135] If the security analysis result of the second user policy indicates that it is safe for the terminal to use the second user policy in the current network, determine that the second user policy meets the user security level and the service security level, and update the first user policy with the second user policy;

[0136] If the security analysis result of the second user policy indicates that it is not safe for the terminal to use the second user policy under the current network, a third user policy that meets the user security level and service security level is generated based on the user security level label of the terminal carried in the security analysis result of the second user policy and the AF address of the application function network element of the corresponding level; and the first user policy is updated with the third user policy.

[0137] For example, the first user policy is different from the second user policy, and the security analysis result of the first user policy shows that it is not safe to use the first user policy in the current network. The PCF sends the second user information containing the second user policy to the NWDAF for security analysis. If the security analysis result of the second user policy received by the PCF shows that it is safe for the terminal to use the second user policy in the current network, the user security level and service security level satisfied by the second user policy are determined, and the first user policy is updated with the second user policy. The specific update process is: the PCF sends the second user policy to the AMF, so that the AMF sends the second user policy to the terminal, and the terminal updates the first user policy with the second user policy; if the security analysis result of the second user policy received by the PCF shows that it is not safe for the terminal to use the second user policy in the current network, the PCF generates a third user policy that meets the user security level and service security level of the terminal based on the user security level label of the terminal carried in the security analysis result of the received second user policy and the AF address of the application function network element of the same level, and updates the first user policy with the third user policy; the specific update process is: the PCF sends the third user policy to the AMF, so that the AMF sends the third user policy to the terminal, and the terminal updates the first user policy with the third user policy.

[0138] For another example, the first user policy is the same as the second user policy, and the PCF sends the second user information including the second user policy to the NWDAF for security analysis; if the security analysis result of the second user policy received by the PCF indicates that the second user policy is safe, then it is determined that the second user policy meets the user security and service security level of the terminal, and the PCF updates the first user policy with the second user policy; if the security analysis result of the second user policy received by the PCF indicates that it is not safe for the terminal to use the second user policy under the current network, then the PCF generates a third user policy that meets the user security level and service security level of the terminal based on the user security level label of the terminal carried in the security analysis result of the received second user policy and the corresponding application function network element AF address of the same level, and updates the first user policy with the third user policy.

[0139] In addition, when the first user policy is the same as the second user policy, and the PCF receives a security analysis result of the second user policy indicating that the second user policy is safe, the first user policy may not be updated. However, in this case, the processing of the security analysis result of the second user policy in the case where the first user policy and the second user policy are the same or different requires writing corresponding implementation programs respectively, resulting in an increase in programs and the subsequent maintenance workload.

[0140] However, as in the present embodiment, regardless of whether the first user policy and the second user policy are the same, as long as the security of the second user policy is analyzed, the corresponding processing procedures are the same, that is, when the security analysis result of the second user policy shows that it is safe, the second user policy is used to update the first user policy, and when the security analysis result of the second user policy shows that it is not safe, a third user policy is generated to update the first user policy; although an unnecessary update process is performed when the first user policy is the same as the second user policy, this update process does not affect the terminal business, and can also reduce the programs that need to be written, and can also reduce the amount of program maintenance in subsequent maintenance, thereby achieving the technical effect of streamlining the program.

[0141] See also Figure 4 An interactive schematic diagram of security management is provided for an embodiment of the present invention. Figure 4 This example takes the scenario of a terminal accessing the network as an example.

[0142] S1, access request;

[0143] When the terminal wants to access the network, it sends an access request to the AMF. The terminal may or may not store the first user policy; if the terminal stores the first user policy, the first user policy will be carried in the access request.

[0144] S2. Check whether the access request carries the first user policy; if yes, associate the first user policy with the terminal identifier; if no, determine whether the terminal status has changed;

[0145] After receiving the access request from the terminal, the AMF queries whether the access request carries the first user policy. If yes, the first user policy is associated with the terminal identifier; if not, or the state of the terminal changes, a user policy association request is generated for the terminal.

[0146] S3. Send a user policy association request;

[0147] AMF sends the generated user policy association request to PCF.

[0148] S4. Based on the user policy association request, obtain first user information of the terminal, where the first user information includes a first user policy;

[0149] PCF interacts with AMF based on the user policy association request to obtain the first user information of the terminal, where the first user information includes the first user identifier, first service information and first user policy obtained from the terminal through AMF; of course, if the first user policy is not stored on the terminal side, PCF queries whether the second user policy of the terminal is stored locally. If the second user policy of the terminal is not stored locally, PCF generates a second user policy for the terminal based on the service information of the terminal.

[0150] In this embodiment, it is assumed that the terminal stores a first user policy, and the corresponding PCF also locally stores a second user policy of the terminal.

[0151] S5. Obtain user contract information of the terminal;

[0152] PCF obtains the user contract information of the terminal from UDR.

[0153] S6. Obtain the second user policy stored locally, and construct the second user information with the user contract information;

[0154] The PCF forms the second user information with the second user identification and the second service information of the terminal obtained from the user subscription information and the second user policy.

[0155] S7, determining whether the first user policy is the same as the second user policy stored locally;

[0156] If the first user policy is different from the second user policy, S8 is executed; if the first user policy is the same as the second user policy, S12 is executed.

[0157] S8: If not the same, send the first user information;

[0158] The PCF determines whether the first user policy is the same as the second user policy. If they are not the same, the PCF sends the first user information to the NWDAF to analyze the security of the first user policy.

[0159] S9. Analyze the security of the first user policy based on the first user information;

[0160] NWDAF analyzes the security of the first user policy based on the first user information. For the specific processing process, please refer to Figure 2 The corresponding NWDAF analysis of the security of the target policy is not described in detail here.

[0161] S10. Return the security analysis result of the first user policy;

[0162] NWDAF returns the security analysis result of the first user policy to PCF.

[0163] S11. If it is determined that the first user policy is safe according to the security analysis result of the first user policy, then the first user policy is not updated;

[0164] If the PCF determines that the first user policy is secure according to the security analysis result of the first user policy (i.e., the first user policy satisfies the user security level and service security level of the terminal), the first user policy is not updated;

[0165] If it is determined that the first user policy is not safe according to the security analysis result of the first user policy, S12 is executed.

[0166] S12, sending second user information;

[0167] If the PCF determines that the first user policy is the same as the second user policy, or determines that the first user policy is different from the second user policy and determines that the first user policy is unsafe based on the security analysis result of the first user policy, the second user information is sent to the NWDAF.

[0168] S13, analyzing the security of the second user policy based on the second user information;

[0169] NWDAF analyzes the security of the second user policy based on the second user information. For the specific processing process, please refer to Figure 2 The corresponding NWDAF analysis of the security of the target policy is not described in detail here.

[0170] S14. Return the security analysis result of the second user policy;

[0171] NWDAF returns the security analysis result of the second user policy to PCF.

[0172] S15. If the second user policy is determined to be safe according to the security analysis result of the second user policy, the first user policy is updated with the second user policy; if the second user policy is determined to be unsafe, a third user policy is generated, and the first user policy is updated with the third user policy;

[0173] If the PCF determines that the second user policy is safe based on the security analysis results of the second user policy, the first user policy is updated with the second user policy; if the PCF determines that the second user policy is unsafe, a third user policy is generated based on the security analysis results of the second user policy, and the first user policy is updated with the third user policy.

[0174] S16. Update the first user policy.

[0175] If the PCF determines to update the first user policy with the second user policy, the second user policy is sent to the AMF. The AMF associates the second user policy with the user identifier of the terminal and sends the second user policy to the terminal, so that the terminal updates the first user policy with the second user policy.

[0176] If the PCF determines to update the first user policy with the third user policy, the third user policy is sent to the AMF. The AMF associates the third user policy with the user identifier of the terminal and sends the third user policy to the terminal, so that the terminal updates the first user policy with the third user policy.

[0177] In addition, after the terminal accesses the network, when the state of the terminal changes, the process after the above step S3 will be triggered.

[0178] In the embodiment provided by the present invention, by acquiring the first user information related to terminal security provided by the terminal and the second user policy of the terminal stored locally by the PCF; wherein the first user information includes the first identifier of the terminal, the first service information and the first user policy pre-stored in the terminal; the security analysis result of performing security analysis on at least one of the first user policy and the second user policy; wherein the security analysis result is obtained by the network data analysis function network element NWDAF using the first user information or the second user information related to terminal security stored on the network side as the target data, and analyzing based on the target data whether the user path and the completed service information determined by the target user policy contained in the target data under the current network meet the user security level and the service security level, the user security level and the service security level are predicted based on the identifier and service information of the terminal contained in the target data, and the user path is the path between the network element providing services for the service on the network side and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information; based on the security analysis result, the user policy that meets the user security level and service security level of the terminal is determined. The above scheme enables PCF to dynamically adjust the user policy of the terminal according to the security analysis results to make it consistent with the user security level and business security level. In this way, the user path and corresponding network behavior of the terminal can be changed by using the user policy that meets the user security level and business security level to adapt to the changes in network services caused by security threats, and realize the 5G core network closed-loop response to security incidents. No new network elements will be added to the entire network side, and the network complexity will not be increased. And because the above scheme is based on the autonomous analysis at the network level to determine the user policy that meets the terminal security requirements, it can achieve self-adjustment and self-adaptation of network security, which helps to promote network intelligence; and, through the above scheme, network security can be linked with network elements in the network to respond, and network functions can be smoothly adjusted to reduce the sudden impact of security incidents and increase business stability; automatically shield security threats and prevent threat factors from entering the network, thereby improving network security.

[0179] like Figure 5 As shown, a security management device provided by an embodiment of the present invention is applied to a network data analysis function network element NWDAF, including a memory 501, a transceiver 502, and a processor 503:

[0180] The memory 501 is used to store computer programs; the transceiver 502 is used to send and receive data under the control of the processor 503; the processor 503 is used to read the computer program in the memory 501 and perform the following operations:

[0181] Receive target data of a terminal; wherein the target data includes an identification of the terminal, service information, and target user policy;

[0182] Predicting a user security level and a service security level required by the terminal based on the identifier of the terminal and the service information;

[0183] Analyze the user path determined by the target user policy under the current network and the security of completing the service corresponding to the service information to determine whether the user security level and the service security level are met, and obtain the security analysis result of the target user policy; wherein the user path is the path between the network element providing service for the service on the network side and the terminal;

[0184] The analysis result is sent to the PCF, so that the PCF determines a user policy that satisfies the user security level and the service security level according to the analysis result.

[0185] The transceiver 502 is used to receive and send data under the control of the processor 503 .

[0186] Among them, Figure 5 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 503 and various circuits of memory represented by memory 501 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 502 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, which may include a wireless channel, a wired channel, an optical cable, and other transmission media. The processor 503 is responsible for managing the bus architecture and general processing, and the memory 501 may store data used by the processor 503 when performing operations.

[0187] The processor 503 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0188] like Figure 6 As shown, a security management device provided by an embodiment of the present invention is applied to a policy control function network element PCF, including a memory 601, a transceiver 602, and a processor 603:

[0189] The memory 601 is used to store computer programs; the transceiver 602 is used to send and receive data under the control of the processor 603; the processor 603 is used to read the computer program in the memory 601 and perform the following operations:

[0190] Acquire first user information related to the terminal security provided by the terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information and a first user policy pre-stored in the terminal;

[0191] Perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by the network data analysis function network element NWDAF taking the first user information or the second user information related to the terminal security stored on the network side as the target data, and analyzing based on the target data whether the user path and completed service information determined by the target user policy contained in the target data under the current network meet the user security level and service security level, the user security level and service security level are predicted based on the identifier of the terminal and the service information contained in the target data, and the user path is the path between the network element on the network side that provides services for the service and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information;

[0192] A user policy that satisfies the user security level and the service security level is determined based on the security analysis result.

[0193] In a possible implementation manner, the processor 603 is further configured to:

[0194] Receiving a user policy association request sent by an authentication management function network element AMF; wherein the user policy association request is used to request to associate a user policy for the terminal accessing the network;

[0195] obtaining the first user information from the AMF according to the user policy association request; wherein the first user information is sent by the terminal to the AMF;

[0196] Obtain the second user policy stored locally by the PCF.

[0197] In a possible implementation manner, the processor 603 is further configured to:

[0198] Determining whether the second user policy is the same as the first user policy;

[0199] If the second user policy is different from the first user policy, sending the first user information to the NWDAF to obtain a security analysis result corresponding to the first user policy;

[0200] If the second user policy is the same as the first user policy, the second user information is sent to the NWDAF to obtain a security analysis result corresponding to the second user policy.

[0201] In a possible implementation manner, the processor 603 is further configured to:

[0202] If the security analysis result of the first user policy indicates that it is safe for the terminal to use the first user policy under the current network, determining that the first user policy satisfies the user security level and the service security level;

[0203] If the security analysis result of the first user policy indicates that it is not safe for the terminal to use the first user policy under the current network, the second user information is sent to the NWDAF to obtain the security analysis result corresponding to the second user policy; based on the security analysis result corresponding to the second user policy, a user policy that meets the user security level and the service security level is determined.

[0204] In a possible implementation manner, the second user policy is the same as the first user policy, and a user policy that satisfies the user security level and the service security level is determined based on the security analysis result; or, based on the security analysis result corresponding to the second user policy, the processor 603 is further used to:

[0205] If the security analysis result of the second user policy indicates that it is safe for the terminal to use the second user policy under the current network, determining that the second user policy meets the user security level and the service security level, and updating the first user policy with the second user policy;

[0206] If the security analysis result of the second user policy indicates that it is not safe for the terminal to use the second user policy under the current network, a third user policy that meets the user security level and the service security level is generated based on the user security level label of the terminal carried in the security analysis result of the second user policy and the corresponding application function network element AF address of the same level; and the first user policy is updated with the third user policy.

[0207] The transceiver 602 is used to receive and send data under the control of the processor 603 .

[0208] Among them, Figure 6 In the embodiment, the bus architecture may include any number of interconnected buses and bridges, specifically one or more processors represented by processor 603 and various circuits of memory represented by memory 601 are linked together. The bus architecture may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface. The transceiver 602 may be a plurality of components, namely, a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium, which transmission medium may include a wireless channel, a wired channel, an optical cable, and other transmission media. The processor 603 is responsible for managing the bus architecture and general processing, and the memory 601 may store data used by the processor 603 when performing operations.

[0209] The processor 603 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a complex programmable logic device (CPLD). The processor may also adopt a multi-core architecture.

[0210] It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0211] Based on the same inventive concept, an embodiment of the present invention provides a security management device, which is applied to NWDAF. The specific implementation of the security method of the device can refer to the description of the NWDAF method side embodiment part, and the repeated parts will not be repeated. Figure 7 , the device comprises:

[0212] The receiving unit 701 is used to receive target data of a terminal; wherein the target data includes an identification of the terminal, service information and a target user policy;

[0213] A prediction unit 702, configured to predict a user security level and a service security level required by the terminal based on the identifier of the terminal and the service information;

[0214] The analysis unit 703 is used to analyze the user path determined by the target user policy under the current network and the security of completing the service corresponding to the service information, whether the user security level and the service security level are met, and obtain the security analysis result of the target user policy; wherein the user path is the path between the network element providing service for the service on the network side and the terminal;

[0215] The sending unit 704 is used to send the analysis result to the PCF, so that the PCF determines a user policy that meets the user security level and the service security level according to the analysis result.

[0216] Based on the same inventive concept, an embodiment of the present invention provides a security management device, which is applied to PCF. The specific implementation method of the security method of the device can refer to the description of the embodiment part of the PCF method side. The repeated parts will not be repeated. Please refer to Figure 8 , the device comprises:

[0217] An acquisition unit 801 is configured to acquire first user information related to terminal security provided by a terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information, and a first user policy pre-stored in the terminal;

[0218] The analysis unit 802 is used to perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by the network data analysis function network element NWDAF taking the first user information or the second user information related to the terminal security stored on the network side as the target data, and analyzing based on the target data whether the user path and the completed service information determined by the target user policy contained in the target data under the current network meet the user security level and the service security level, the user security level and the service security level are predicted based on the identifier of the terminal contained in the target data and the service information, and the user path is the path between the network element on the network side that provides services for the service and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information;

[0219] The processing unit 803 is used to determine a user policy that meets the user security level and the service security level based on the security analysis result.

[0220] In a possible implementation manner, the acquiring unit 801 is further configured to:

[0221] Receiving a user policy association request sent by an authentication management function network element AMF; wherein the user policy association request is used to request to associate a user policy for the terminal accessing the network;

[0222] obtaining the first user information from the AMF according to the user policy association request; wherein the first user information is sent by the terminal to the AMF;

[0223] Obtain the second user policy stored locally by the PCF.

[0224] In a possible implementation manner, the analysis unit 802 is used to:

[0225] Determining whether the second user policy is the same as the first user policy;

[0226] If the second user policy is different from the first user policy, sending the first user information to the NWDAF to obtain a security analysis result corresponding to the first user policy;

[0227] If the second user policy is the same as the first user policy, the second user information is sent to the NWDAF to obtain a security analysis result corresponding to the second user policy.

[0228] In a possible implementation manner, the processing unit 803 is configured to:

[0229] If the security analysis result of the first user policy indicates that it is safe for the terminal to use the first user policy under the current network, determining that the first user policy satisfies the user security level and the service security level;

[0230] If the security analysis result of the first user policy indicates that it is not safe for the terminal to use the first user policy under the current network, the second user information is sent to the NWDAF to obtain the security analysis result corresponding to the second user policy; based on the security analysis result corresponding to the second user policy, a user policy that meets the user security level and the service security level is determined.

[0231] A possible implementation mode is that the second user policy is the same as the first user policy, and a user policy that satisfies the user security level and the service security level is determined based on the security analysis result; or, based on the security analysis result corresponding to the second user policy, the processing unit 803 is further used to:

[0232] If the security analysis result of the second user policy indicates that it is safe for the terminal to use the second user policy under the current network, determining that the second user policy meets the user security level and the service security level, and updating the first user policy with the second user policy;

[0233] If the security analysis result of the second user policy indicates that it is not safe for the terminal to use the second user policy under the current network, a third user policy that meets the user security level and the service security level is generated based on the user security level label of the terminal carried in the security analysis result of the second user policy and the corresponding application function network element AF address of the same level; and the first user policy is updated with the third user policy.

[0234] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0235] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0236] It should be noted here that the above-mentioned device provided in the embodiment of the present invention can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects that are the same as the method embodiment in this embodiment will not be described in detail here.

[0237] Based on the same inventive concept, an embodiment of the present invention further provides a processor-readable storage medium storing a computer program, wherein the computer program is used to enable the processor to execute the security management method described in NWDAF or PCF.

[0238] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor storage (such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD)), etc.

[0239] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0240] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer executable instructions. These computer executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0241] These processor executable instructions may also be stored in a processor readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the processor readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0242] These processor-executable instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0243] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A security management method, applied to a network data analysis function network element NWDAF, characterized in that: The method includes: Receive target data of a terminal; wherein the target data includes an identification of the terminal, service information, and target user policy; Predicting a user security level and a service security level required by the terminal based on the identifier of the terminal and the service information; Analyze the user path determined by the target user policy under the current network and the security of completing the service corresponding to the service information to determine whether the user security level and the service security level are met, and obtain the security analysis result of the target user policy; wherein the user path is the path between the network element providing service for the service on the network side and the terminal; The analysis result is sent to the PCF, so that the PCF determines a user policy that satisfies the user security level and the service security level according to the analysis result.

2. A security management method, applied to a policy control function network element PCF, characterized in that: include: Acquire first user information related to the terminal security provided by the terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information and a first user policy pre-stored in the terminal; Perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by the network data analysis function network element NWDAF taking the first user information or the second user information related to the terminal security stored on the network side as the target data, and analyzing based on the target data whether the user path and completed service information determined by the target user policy contained in the target data under the current network meet the user security level and service security level, the user security level and service security level are predicted based on the identifier of the terminal and the service information contained in the target data, and the user path is the path between the network element on the network side that provides services for the service and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information; A user policy that satisfies the user security level and the service security level is determined based on the security analysis result.

3. The method according to claim 2, characterized in that Performing a security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result includes: Determining whether the second user policy is the same as the first user policy; If the second user policy is different from the first user policy, sending the first user information to the NWDAF to obtain a security analysis result corresponding to the first user policy; If the second user policy is the same as the first user policy, the second user information is sent to the NWDAF to obtain a security analysis result corresponding to the second user policy.

4. The method according to claim 3, characterized in that The second user policy is different from the first user policy, and a user policy that satisfies the user security level and the service security level is determined based on the security analysis result, including: If the security analysis result of the first user policy indicates that it is safe for the terminal to use the first user policy under the current network, determining that the first user policy satisfies the user security level and the service security level; If the security analysis result of the first user policy indicates that it is not safe for the terminal to use the first user policy under the current network, the second user information is sent to the NWDAF to obtain the security analysis result corresponding to the second user policy; based on the security analysis result corresponding to the second user policy, a user policy that meets the user security level and the service security level is determined.

5. The method according to claim 3 or 4, characterized in that The second user policy is the same as the first user policy, and is determined based on the security analysis result to satisfy the user security level and the service security level; Or, based on the security analysis result corresponding to the second user policy, determining a user policy that meets the user security level and the service security level, including: If the security analysis result of the second user policy indicates that it is safe for the terminal to use the second user policy under the current network, determining that the second user policy meets the user security level and the service security level, and updating the first user policy with the second user policy; If the security analysis result of the second user policy indicates that it is not safe for the terminal to use the second user policy under the current network, a third user policy that meets the user security level and the service security level is generated based on the user security level label of the terminal carried in the security analysis result of the second user policy and the corresponding application function network element AF address of the same level; and the first user policy is updated with the third user policy.

6. A security management device, applied to a network data analysis function network element NWDAF, characterized in that: include: A receiving unit, configured to receive target data of a terminal; wherein the target data includes an identification of the terminal, service information, and a target user policy; A prediction unit, configured to predict a user security level and a service security level required by the terminal based on the terminal identifier and the service information; An analysis unit, configured to analyze the user path determined by the target user policy under the current network and the security of completing the service corresponding to the service information, whether the user security level and the service security level are met, and obtain a security analysis result of the target user policy; wherein the user path is a path between a network element providing service for the service on the network side and the terminal; The sending unit is used to send the analysis result to the PCF, so that the PCF determines a user policy that meets the user security level and the service security level according to the analysis result.

7. A security management device, applied to a policy control function network element PCF, characterized in that: include: An acquisition unit, configured to acquire first user information related to the terminal security provided by the terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information, and a first user policy pre-stored in the terminal; An analysis unit, configured to perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by the network data analysis function network element NWDAF taking the first user information or the second user information related to the terminal security stored on the network side as target data, and analyzing based on the target data whether the user path and completed service information determined by the target user policy contained in the target data under the current network meet the user security level and service security level, wherein the user security level and service security level are predicted based on the identifier of the terminal and the service information contained in the target data, and the user path is the path between the network element providing service for the service on the network side and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information; A processing unit is used to determine a user policy that meets the user security level and the service security level based on the security analysis result.

8. A security management device, applied to a network data analysis function network element NWDAF, characterized in that: Including memory, transceiver, processor: A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: Receive target data of a terminal; wherein the target data includes an identification of the terminal, service information, and target user policy; Predicting a user security level and a service security level required by the terminal based on the identifier of the terminal and the service information; Analyze the user path determined by the target user policy under the current network and the security of completing the service corresponding to the service information to determine whether the user security level and the service security level are met, and obtain the security analysis result of the target user policy; wherein the user path is the path between the network element providing service for the service on the network side and the terminal; The analysis result is sent to the PCF, so that the PCF determines a user policy that satisfies the user security level and the service security level according to the analysis result.

9. A security management device, applied to a policy control function network element PCF, characterized in that: Including memory, transceiver, processor: A memory for storing a computer program; a transceiver for transmitting and receiving data under the control of the processor; and a processor for reading the computer program in the memory and performing the following operations: Acquire first user information related to the terminal security provided by the terminal and a second user policy of the terminal stored locally by the PCF; wherein the first user information includes a first identifier of the terminal, first service information and a first user policy pre-stored in the terminal; Perform security analysis on at least one of the first user policy and the second user policy to obtain a corresponding security analysis result; wherein the security analysis result is obtained by the network data analysis function network element NWDAF taking the first user information or the second user information related to the terminal security stored on the network side as the target data, and analyzing based on the target data whether the user path and completed service information determined by the target user policy contained in the target data under the current network meet the user security level and service security level, the user security level and service security level are predicted based on the identifier of the terminal and the service information contained in the target data, and the user path is the path between the network element on the network side that provides services for the service and the terminal; wherein the second user data includes the second user policy, the second identifier of the terminal and the second service information; the target user policy includes the first user policy or the second user policy, the identifier of the terminal includes the first identifier or the second identifier, and the service information includes the first service information or the second service information; A user policy that satisfies the user security level and the service security level is determined based on the security analysis result.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and the computer program is used to enable a processor to execute the method according to any one of claims 1 to 5.

Images