5G core network packet cache decryption method and device, and readable storage medium

Abstract

The invention provides a 5G core network packet cache decryption method, which comprises the following steps: for an interface between user equipment UE and an AMF network element and an interface between a gNodeB base station and the AMF network element, obtaining a decryption key from an interface between the AMF network element and an AUSF network element so as to decrypt NAS messages of the interface between the user equipment UE and the AMF network element and the interface between the gNodeB base station and the AMF network element, if the NAS messages of the interface between the UE and the AMF network element and the interface between the gNodeB base station and the AMF network element have not been obtained from the interface between the AMF network element and the AUSF network element when the NAS messages of the interface between the UE and the AMF network element and the interface between the gNodeB base station and the AMF network element are decrypted, caching the interface between the UE and the AMF network element and the interface between the gNodeB base station and the AMF network element until a cache release condition is triggered, and sending the cached NAS messages to the AMF network element. And re-processing the message to perform operations such as decryption and the like.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular to a 5G core network packet cache decryption method, device and readable storage medium. Background Art

[0002] The current 5G signaling collection and parsing technology generally uses multi-core processors and multiple threads to process the traffic of each 5G interface at the same time. When processing the N1N2 interface, it is necessary to obtain the decryption key from the N12 interface. Under normal timing, the signaling carrying the key on the N12 interface in the same registration process is earlier than the signaling to be decrypted on the N1N2 interface, but often the N1N2 signaling and the corresponding N12 signaling are processed by different CPU cores and different threads, which will cause the timing to be reversed during the actual processing process, and then the decryption fails due to the inability to obtain the key.

[0003] In the prior art, it is generally completely dependent on the processing sequence of the processor, and no targeted processing is done for disorder, so it is impossible to 100% guarantee that the key can be obtained in time; there is also a method of ensuring that the N1N2 and N12 signaling of the same registration process are distributed to the same thread for processing through a distribution mechanism, but this method often needs to be distributed according to the granularity of the network element, which cannot fully utilize the processor resources and increases the processing bottleneck. Summary of the invention

[0004] The purpose of the present invention is to solve the problem in the prior art that in the process of 5G core network signaling parsing, for the N1N2 interface, it is necessary to obtain a decryption key from the N12 interface to realize the decryption of the N1N2 interface NAS message. If the key cannot be obtained in time, the decryption will fail and the signaling process cannot be completely restored. The reason for the failure to obtain the key in time is generally the problem of asynchronous processing timing between the N1N2 interface and the N12 interface. A processing mechanism is proposed. If the decryption key has not been obtained from the N12 interface when decrypting the NAS message of the N1N2 interface, the N1N2 interface message is cached until the cache release condition is triggered, and the message is reprocessed for decryption and other operations.

[0005] In order to achieve the above object, the present invention adopts the following technical scheme.

[0006] The 5G core network packet cache decryption method comprises:

[0007] The function management network element receives the registration request message sent by the user equipment, initiates authentication to the function authentication network element according to the received registration request information, and receives the authentication vector information returned by the function authentication network element;

[0008] The function management network element initiates an authentication request to the user equipment, the authentication request carries the authentication vector information, and the user equipment calculates an authentication result according to the authentication vector information and returns the result to the function management network element;

[0009] The function management network element sends the authentication result to the function authentication network element, and the function authentication network element verifies the value of the authentication result. If the verification passes, a request success response code is returned to the function management network element;

[0010] The function management network element sends an encryption algorithm to the user equipment, and determines whether a decryption key is obtained from the current session context through a signaling analysis program;

[0011] If the signaling parsing program fails to obtain the decryption key from the session context, it is determined that the decryption process is out of order, the current session is marked as requiring caching, and the network packet containing the current message is cached;

[0012] If the signaling parsing program obtains the decryption key, the session is marked as not requiring caching, all cached packets of the current session are released, and the cached messages are reprocessed in the time sequence of the messages;

[0013] The signaling parsing program uses the decryption key and algorithm in the session context to decrypt the non-access layer message.

[0014] Further, the calculating, by the user equipment, an authentication result according to the authentication vector information and returning the result to the function management network element includes:

[0015] The signaling parsing program uses the authentication result as an index to store the session context corresponding to the current message.

[0016] Further, the function management network element sends the authentication result to the function authentication network element, and the function authentication network element verifies the value of the authentication result. If the verification passes, returning a request success response code to the function management network element includes:

[0017] The request success response code carries the international mobile user identity code and the intermediate key of the user equipment. The signaling parsing program uses the authentication result to query the stored session context and stores the international mobile user identity code and the intermediate key in the session context.

[0018] Furthermore, the international mobile subscriber identity code is an identifier of the user equipment. After the international mobile subscriber identity code is obtained, the key information of the user equipment is stored with the international mobile subscriber identity code as an index.

[0019] Furthermore, the function management network element sends an encryption algorithm to the user equipment, and determines whether to obtain a decryption key from the current session context through a signaling parsing program, including: the signaling parsing program uses the encryption algorithm in the message and the intermediate key in the current session context to calculate the decryption key.

[0020] Further, if the signaling parsing program fails to obtain the decryption key from the session context, it is determined that the decryption process is out of order, the current session is marked as requiring caching, and the network packet containing the current message is cached, including:

[0021] The cache structure is a hash table, the value vector of the hash table is a linked list structure, storing all cached data packets of the current session, and the key vector of the hash table is the unique identification information of the user of the current session in the base station.

[0022] Furthermore, the method further includes storing subsequent data packets of the current session into a cached hash table when determining that the current session is marked as needing to be cached.

[0023] Furthermore, if the signaling parsing program obtains the decryption key, the session is marked as not requiring caching, and all cached packets of the current session are released, and the cached packets are reprocessed in the time sequence of the packets, including:

[0024] Set session release conditions, including timeout release and session end release;

[0025] The timeout release condition is that when the cache time exceeds the set time threshold, all cached data packets are released;

[0026] The session end release condition is to release all cached data packets when judging that the current session ends.

[0027] In order to achieve the above-mentioned purpose, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a program running on the processor, and when the processor runs the program, the steps of the 5G core network packet cache decryption method described above are executed.

[0028] In order to achieve the above-mentioned objectives, the present invention also provides a computer-readable storage medium on which computer instructions are stored, and when the computer instructions are executed, the steps of the 5G core network packet cache decryption method as described above are executed.

[0029] The present invention proposes a 5G core network packet cache decryption method, device and readable storage medium, which have the following beneficial effects:

[0030] The present invention solves the problem of decryption failure caused by disordered multi-core and multi-threaded processing in the scenario of parsing 5G traffic, significantly improves the decryption success rate of 5G NAS messages, and achieves the effect of completely restoring the signaling process. At the same time, it also improves the backfill rate of key information such as IMSI / mobile phone number / IMEI of the signaling process, which is of great help to many businesses such as user location positioning, network quality analysis and network optimization.

[0031] Other features and advantages of the present invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0033] Figure 1 This is a flow chart of a 5G core network packet cache decryption method of the present invention;

[0034] Figure 2 A schematic diagram of a 5G core network packet cache decryption standard process of the present invention;

[0035] Figure 3 A schematic diagram of a 5G core network packet cache decryption out-of-order processing flow of the present invention. DETAILED DESCRIPTION

[0036] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0037] Example 1

[0038] Figure 1 This is a flow chart of the 5G core network packet cache decryption method according to the present invention. Figure 1 , the 5G core network packet cache decryption method of the present invention is described in detail.

[0039] N1 interface: The interface between the user equipment UE and the AMF network element in the 5G network.

[0040] N2 interface: The interface between the gNodeB base station and the AMF network element in the 5G network.

[0041] N1N2 interface: a general term for N1 interface and N2 interface. Since the NAS message of N1 interface is carried by NGAP (NG Application Protocol) message of N2 interface, it is generally referred to as N1N2 interface.

[0042] N12 interface: The interface between the AMF (Access and Mobility Management Function) network element and the AUSF (Authentication Server Function) network element in the 5G network.

[0043] NAS (Non-Access Stratum): Messages used for signaling exchange between user equipment UE and the core network in mobile networks. It is mainly used for control plane communications and handles functions related to user access, mobility management, and session management.

[0044] In step 101, AMF receives a registration request message sent by UE, initiates authentication to AUSF according to the received registration request information, and receives information such as authentication vector returned by AUSF.

[0045] In this embodiment, AMF is used to manage user access and message encryption, and AUSF is used to store authentication information.

[0046] In this embodiment, non-access layer message processing is performed between UE, AMF and AUSF through multi-core and multi-threading, and the signaling parsing program obtains all message contents between UE, AMF and AUSF.

[0047] In step 102, the AMF initiates an authentication request to the UE. The authentication request carries an authentication vector. The UE uses the authentication vector to calculate the authentication result RES (RESponse) and returns it to the AMF.

[0048] Optionally, the signaling parsing program uses RES as an index to store the session context corresponding to the current message.

[0049] In step 103, AMF sends RES to AUSF. After receiving RES, AUSF verifies the value of RES. If the verification passes, it returns a response code of 200OK to AMF, indicating that the request is successful, and carries the IMSI (International Mobile Subscriber Identity) and intermediate key of the UE.

[0050] Optionally, the signaling parsing program may use RES to query the session context stored in step 102, and store the IMSI and the intermediate key in the session context.

[0051] In this embodiment, IMSI is the identifier of UE, which is used to uniquely identify a UE. After obtaining IMSI, some key information (key, etc.) of the user is stored with IMSI as the index. When processing the next session of this user, the key is obtained by obtaining IMSI.

[0052] In step 104, the AMF sends the algorithm used for subsequent encryption to the UE, and the signaling parser uses the encryption algorithm in the message and the key in the session context to calculate the decryption key.

[0053] In this embodiment, the signaling parsing program obtains the communication content and imitates the AMF to calculate the decryption key.

[0054] In step 105, if the decryption key is not obtained from the session context, it is considered that the disorder may be the cause, and the current session is marked as "needs to be cached", and the network packet containing the current message is cached.

[0055] Optionally, the cache structure is a hash table, the key of the hash table is gNodeB id + ran ue ngap id, which represents the unique identification information of the current session user in the gNodeB base station and can uniquely index a session. The value of the hash table is a linked list structure, which stores all cached packets of the current session.

[0056] Optionally, when processing subsequent packets of this session, if it is determined that the session is marked as "needs to be cached", the packet is stored in the cache hash table.

[0057] Optionally, when the message corresponding to step 103 arrives and the decryption key is obtained, the session is marked as "no need to cache" and all cached packets of the session are released. The release means reprocessing the cached packets in the time sequence of the packets, and the key has been obtained at this time, so the decryption can be performed correctly.

[0058] In this embodiment, considering that the non-access N12 traffic will also trigger the cache mechanism, resulting in continuous caching of packets, two release conditions are designed: timeout release and session end release. Timeout release means that when the cache time exceeds a certain threshold, for example, the threshold is set to 10 seconds, all cached packets are released; session end release means that when the session ends, all cached packets are released.

[0059] Figure 2 A schematic diagram of a 5G core network packet cache decryption standard process of the present invention is shown as follows: Figure 2As shown, the UE sends a registration request to the AMF, the AMF sends an authentication request to the AUSF according to the received registration request, the AUSF returns an authentication response to the AMF according to the received authentication request, the AMF sends an authentication request to the UE according to the returned authentication response, the UE returns the authentication response to the AMF, the AMF sends an authentication confirmation to the AUSF, the AUSF returns the authentication confirmation response to the AMF, the AMF sends a security mode command to the UE, the UE returns the encrypted security mode completion to the AMF, the AMF sends an encrypted registration acceptance to the UE, and the UE returns the encrypted registration completion to the AMF. Currently, almost all 5G signaling parsing programs are multi-core and multi-threaded architectures, and the processing timing cannot be guaranteed. Figure 3 This is a schematic diagram of a 5G core network packet cache decryption out-of-order processing flow of the present invention. A typical out-of-order processing situation is as follows Figure 3 As shown, the UE sends a registration request to the AMF, the AMF sends an authentication request to the UE and AUSF, the UE returns an authentication response to the AMF, the AUSF returns an authentication response to the AMF, the AMF sends a security mode command to the UE, the UE returns an encrypted security mode completion to the AMF, the AMF sends an authentication confirmation to the AUSF, the AMF sends an encrypted registration acceptance to the UE, the AUSF returns an authentication confirmation response to the AMF, and the UE returns an encrypted registration completion to the AMF. Figure 3 As can be seen, after step 10 is completed, step 7 is processed. At this time, the messages of steps 9 and 10 will fail to be decrypted. Since the messages that fail to be decrypted carry important information, the decryption failure will also affect the subsequent parsing process.

[0060] In step 106, in the subsequent signaling process, all NAS messages are encrypted. The signaling parser will use the decryption key and algorithm in the session context to decrypt the NAS message.

[0061] The present invention proposes a 5G core network packet cache decryption method. If the decryption key has not been obtained from the N12 interface when decrypting the NAS message of the N1N2 interface, the N1N2 interface message is cached until the cache release condition is triggered. Generally, after the decryption key has been obtained at this time, the message is reprocessed for decryption and other operations, thereby solving the problem of decryption failure in multi-core and multi-threaded parsing of 5G traffic scenarios.

[0062] Those skilled in the art can understand that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention is described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions recorded in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A 5G core network packet cache decryption method, characterized in that: include: The function management network element receives the registration request message sent by the user equipment, initiates authentication to the function authentication network element according to the received registration request information, and receives the authentication vector information returned by the function authentication network element; The function management network element initiates an authentication request to the user equipment, the authentication request carries the authentication vector information, and the user equipment calculates an authentication result according to the authentication vector information and returns the result to the function management network element; The function management network element sends the authentication result to the function authentication network element, and the function authentication network element verifies the value of the authentication result. If the verification passes, a request success response code is returned to the function management network element; The function management network element sends an encryption algorithm to the user equipment, and determines whether a decryption key is obtained from the current session context through a signaling analysis program; If the signaling parsing program fails to obtain the decryption key from the session context, it is determined that the decryption process is out of order, the current session is marked as requiring caching, and the network packet containing the current message is cached; If the signaling parsing program obtains the decryption key, the session is marked as not requiring caching, all cached packets of the current session are released, and the cached messages are reprocessed in the time sequence of the messages; The signaling parsing program uses the decryption key and algorithm in the session context to decrypt the non-access layer message.

2. A 5G core network packet cache decryption method according to claim 1, characterized in that: The calculating, by the user equipment, an authentication result according to the authentication vector information and returning the result to the function management network element comprises: The signaling parsing program uses the authentication result as an index to store the session context corresponding to the current message.

3. A 5G core network packet cache decryption method according to claim 1, characterized in that: The function management network element sends the authentication result to the function authentication network element, and the function authentication network element verifies the value of the authentication result. If the verification passes, returning a request success response code to the function management network element includes: The request success response code carries the international mobile user identity code and the intermediate key of the user equipment. The signaling parsing program uses the authentication result to query the stored session context and stores the international mobile user identity code and the intermediate key in the session context.

4. A 5G core network packet cache decryption method according to claim 3, characterized in that: The international mobile subscriber identity is an identifier of the user equipment. After the international mobile subscriber identity is obtained, the key information of the user equipment is stored with the international mobile subscriber identity as an index.

5. A 5G core network packet cache decryption method according to claim 1, characterized in that: The function management network element sends an encryption algorithm to the user equipment, and determines whether to obtain a decryption key from the current session context through a signaling parsing program, including: the signaling parsing program uses the encryption algorithm in the message and the intermediate key in the current session context to calculate the decryption key.

6. A 5G core network packet cache decryption method according to claim 1, characterized in that: If the signaling parsing program fails to obtain the decryption key from the session context, it is determined that the decryption process is out of order, the current session is marked as requiring caching, and the network packet containing the current message is cached, including: The cache structure is a hash table, the value vector of the hash table is a linked list structure, storing all cached data packets of the current session, and the key vector of the hash table is the unique identification information of the user of the current session in the base station.

7. A 5G core network packet cache decryption method according to claim 6, characterized in that: The method also includes storing subsequent data packets of the current session into a cached hash table when determining that the current session is marked as needing to be cached.

8. A 5G core network packet cache decryption method according to claim 1, characterized in that: If the signaling parsing program obtains the decryption key, the session is marked as not requiring caching, and all cached packets of the current session are released, and the cached messages are reprocessed in the time sequence of the messages, including: Set session release conditions, including timeout release and session end release; The timeout release condition is that when the cache time exceeds the set time threshold, all cached data packets are released; The session end release condition is to release all cached data packets when judging that the current session ends.

9. An electronic device, characterized in that: It includes a memory and a processor, the memory stores a program running on the processor, and the processor executes a 5G core network packet cache decryption method as described in any one of claims 1-8 when running the program.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed, a 5G core network packet cache decryption method as described in any one of claims 1-8 is executed.

Images