A 5G core network packet cache decryption method, device and readable storage medium

Abstract

The present invention provides a 5G core network packet cache decryption method, including: for the interface between the user equipment UE and the AMF network element, and the interface between the gNodeB base station and the AMF network element, it is necessary to obtain a decryption key from the interface between the AMF network element and the AUSF network element to realize the decryption of the NAS message of the interface between the user equipment UE and the AMF network element, and the interface between the gNodeB base station and the AMF network element; if the decryption key has not been obtained from the interface between the AMF network element and the AUSF network element when decrypting the NAS message of the interface between the user equipment UE and the AMF network element, and the interface between the gNodeB base station and the AMF network element, then the interface message between the user equipment UE and the AMF network element, and the interface message between the gNodeB base station and the AMF network element are cached until the cache release condition is triggered, and then the message is reprocessed for decryption and other operations.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular relates to a 5G core network packet cache decryption method, device and readable storage medium. Background Art

[0002] Current 5G signaling collection and parsing technologies typically utilize multi-core processors and multiple threads to simultaneously process traffic from various 5G interfaces. When processing the N1N2 interface, the decryption key must be obtained from the N12 interface. Under normal timing, the key-carrying signaling from the N12 interface arrives before the signaling to be decrypted on the N1N2 interface during the same registration process. However, the N1N2 signaling and the corresponding N12 signaling are often processed by different CPU cores and threads, resulting in a timing mismatch during actual processing and, consequently, decryption failure due to the inability to obtain the key.

[0003] In the existing technology, it is generally completely dependent on the processing timing of the processor, and no targeted processing is performed for disorder. This makes it impossible to 100% guarantee that the key can be obtained in time. Another method is to use a distribution mechanism to ensure that the N1N2 and N12 signaling of the same registration process are distributed to the same thread for processing. However, this method often requires distribution at the network element granularity, which cannot fully utilize processor resources and increases processing bottlenecks. Summary of the Invention

[0004] The purpose of the present invention is to solve the problem in the prior art that, during the 5G core network signaling parsing process, for the N1N2 interface, it is necessary to obtain a decryption key from the N12 interface to decrypt the NAS message of the N1N2 interface. If the key cannot be obtained in time, decryption will fail and the signaling process cannot be fully restored. The reason for not being able to obtain the key in time is generally due to the problem of asynchronous processing timing between the N1N2 interface and the N12 interface. A processing mechanism is proposed. If the decryption key has not been obtained from the N12 interface when decrypting the NAS message of the N1N2 interface, the N1N2 interface message will be cached until the cache release condition is triggered, and the message will be reprocessed for decryption and other operations.

[0005] In order to achieve the above-mentioned purpose, the present invention adopts the following technical solutions.

[0006] The 5G core network packet cache decryption method includes:

[0007] The function management network element receives the registration request message sent by the user equipment, initiates authentication to the function authentication network element according to the received registration request information, and receives the authentication vector information returned by the function authentication network element;

[0008] The function management network element initiates an authentication request to the user equipment, the authentication request carries the authentication vector information, and the user equipment calculates an authentication result based on the authentication vector information and returns the result to the function management network element;

[0009] The function management network element sends the authentication result to the function authentication network element, and the function authentication network element verifies the value of the authentication result. If the verification is successful, a request success response code is returned to the function management network element;

[0010] The function management network element sends an encryption algorithm to the user equipment and determines whether a decryption key is obtained from the current session context through a signaling analysis program;

[0011] If the signaling parser fails to obtain the decryption key from the session context, it is determined that the decryption process is out of order, the current session is marked as requiring caching, and the network packet containing the current message is cached;

[0012] If the signaling parser obtains the decryption key, the session is marked as not requiring caching, all cached packets of the current session are released, and the cached packets are reprocessed in the chronological order of the packets;

[0013] The signaling parsing program uses the decryption key and algorithm in the session context to decrypt the non-access layer message.

[0014] Furthermore, the calculating, by the user equipment, an authentication result based on the authentication vector information and returning the result to the function management network element includes:

[0015] The signaling parsing program uses the authentication result as an index to store the session context corresponding to the current message.

[0016] Further, the function management network element sends the authentication result to the function authentication network element, and the function authentication network element verifies the value of the authentication result. If the verification passes, returning a request success response code to the function management network element includes:

[0017] The request success response code carries the user equipment international mobile user identity code and intermediate key. The signaling parsing program uses the authentication result to query the stored session context and stores the international mobile user identity code and intermediate key in the session context.

[0018] Furthermore, the International Mobile Subscriber Identity is an identifier of the user equipment. After the International Mobile Subscriber Identity is obtained, key information of the user equipment is stored with the International Mobile Subscriber Identity as an index.

[0019] Furthermore, the function management network element sends an encryption algorithm to the user equipment, and determines whether to obtain a decryption key from the current session context through a signaling parsing program, including: the signaling parsing program uses the encryption algorithm in the message and the intermediate key in the current session context to calculate the decryption key.

[0020] Furthermore, if the signaling parsing program fails to obtain the decryption key from the session context, it is determined that the decryption process is out of order, the current session is marked as requiring caching, and the network packet containing the current message is cached, including:

[0021] The cache structure is a hash table, the value vector of the hash table is a linked list structure, storing all cached data packets of the current session, and the key vector of the hash table is the unique identification information of the current session user in the base station.

[0022] Furthermore, the method further includes storing subsequent data packets of the current session into a cache hash table when determining that the current session is marked as needing to be cached.

[0023] Furthermore, if the signaling parser obtains the decryption key, the session is marked as not requiring caching, all cached packets of the current session are released, and the cached packets are reprocessed in chronological order, including:

[0024] Set session release conditions, including timeout release and session end release;

[0025] The timeout release condition is that when the cache time exceeds the set time threshold, all cached data packets are released;

[0026] The session end release condition is to release all cached data packets when judging that the current session ends.

[0027] In order to achieve the above-mentioned purpose, the present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a program running on the processor, and when the processor runs the program, it executes the steps of the 5G core network packet cache decryption method described above.

[0028] In order to achieve the above-mentioned objectives, the present invention also provides a computer-readable storage medium on which computer instructions are stored, and when the computer instructions are executed, the steps of the 5G core network packet cache decryption method as described above are executed.

[0029] The present invention proposes a 5G core network packet cache decryption method, device, and readable storage medium, which have the following beneficial effects:

[0030] The present invention solves the problem of decryption failure caused by disordered multi-core and multi-threaded processing in the 5G traffic analysis scenario, significantly improves the decryption success rate of 5G NAS messages, and achieves the effect of completely restoring the signaling process. At the same time, it also improves the backfill rate of key information such as IMSI / mobile phone number / IMEI in the signaling process, which is of great help to many services such as user location positioning, network quality analysis and network optimization.

[0031] Other features and advantages of the present invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0033] Figure 1 This is a flow chart of a 5G core network packet cache decryption method of the present invention;

[0034] Figure 2 This is a schematic diagram of a 5G core network packet cache decryption standard process of the present invention;

[0035] Figure 3 This is a schematic diagram of the out-of-order processing flow of 5G core network packet cache decryption according to the present invention. DETAILED DESCRIPTION

[0036] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0037] Example 1

[0038] Figure 1 This is a flow chart of the 5G core network packet cache decryption method according to the present invention, which will be referenced below. Figure 1 , the 5G core network packet cache decryption method of the present invention is described in detail.

[0039] N1 interface: The interface between the user equipment UE and the AMF network element in the 5G network.

[0040] N2 interface: The interface between the gNodeB base station and the AMF network element in the 5G network.

[0041] N1N2 interface: a general term for the N1 interface and the N2 interface. Since the NAS message of the N1 interface is carried by the NGAP (NG Application Protocol) message of the N2 interface, it is generally referred to as the N1N2 interface.

[0042] N12 interface: In 5G networks, the interface between the AMF (Access and Mobility Management Function) network element and the AUSF (Authentication Server Function) network element.

[0043] NAS (Non-Access Stratum): Messages used for signaling exchanges between user equipment (UE) and the core network in mobile networks. It is primarily used for control plane communications and handles functions related to user access, mobility management, and session management.

[0044] In step 101, the AMF receives a registration request message sent by the UE, initiates authentication to the AUSF based on the received registration request information, and receives information such as the authentication vector returned by the AUSF.

[0045] In this embodiment, AMF is used to manage user access and message encryption, and AUSF is used to store authentication information.

[0046] In this embodiment, non-access layer message processing is performed between the UE, AMF and AUSF through multi-core and multi-threading, and the signaling parsing program obtains all message contents between the UE, AMF and AUSF.

[0047] In step 102, the AMF initiates an authentication request to the UE. The authentication request carries an authentication vector. The UE uses the authentication vector to calculate the authentication result RES (Response) and returns it to the AMF.

[0048] Optionally, the signaling parser may store the session context corresponding to the current message using RES as an index.

[0049] In step 103, AMF sends RES to AUSF. After receiving it, AUSF verifies the value of RES. If the verification passes, it returns a response code of 200OK to AMF, indicating that the request is successful, and carries the UE's IMSI (International Mobile Subscriber Identity) and intermediate key.

[0050] Optionally, the signaling parsing program may use RES to query the session context stored in step 102 and store the IMSI and the intermediate key in the session context.

[0051] In this embodiment, IMSI is the identifier of the UE, which is used to uniquely identify a UE. After obtaining the IMSI, some key information of the user (key, etc.) is stored with the IMSI as the index. When processing the next session of this user, the key is obtained by obtaining the IMSI.

[0052] In step 104, the AMF sends the algorithm used for subsequent encryption to the UE. The signaling parser uses the encryption algorithm in the message and the key in the session context to calculate the decryption key.

[0053] In this embodiment, the signaling parsing program obtains the communication content and imitates the AMF to calculate the decryption key.

[0054] In step 105, if the decryption key is not obtained from the session context, it is considered that the problem may be caused by disorder. In this case, the current session is marked as "needs to be cached" and the network packet containing the current message is cached.

[0055] Optionally, the cache structure is a hash table. The key of the hash table is the gNodeB ID + the Ran ue ngap ID, which represents the unique identification information of the user in the current session in the gNodeB base station and can uniquely index a session. The value of the hash table is a linked list structure that stores all cached packets in the current session.

[0056] Optionally, when processing subsequent packets of this session, if it is determined that the session is marked as "needs to be cached", the packet is stored in the cache hash table.

[0057] Optionally, when the message corresponding to step 103 arrives and the decryption key is obtained, the session is marked as "no need to cache" and all cached packets for the session are released. Release means reprocessing the cached packets in chronological order. At this point, the key has been obtained and can therefore be correctly decrypted.

[0058] In this embodiment, considering that even when N12 traffic is not connected, the caching mechanism will be triggered, resulting in continued packet caching. Therefore, two release conditions are designed: timeout release and session end release. Timeout release means that all cached packets are released when the cache time exceeds a certain threshold, for example, 10 seconds. Session end release means that all cached packets are released when the session ends.

[0059] Figure 2 This is a schematic diagram of a 5G core network packet cache decryption standard process of the present invention, such as Figure 2As shown, the UE sends a registration request to the AMF, and the AMF sends an authentication request to the AUSF based on the received registration request. The AUSF returns an authentication response to the AMF based on the received authentication request. The AMF sends an authentication request to the UE based on the returned authentication response. The UE returns an authentication response to the AMF. The AMF sends an authentication confirmation to the AUSF. The AUSF returns an authentication confirmation response to the AMF. The AMF sends a security mode command to the UE. The UE returns an encrypted security mode completion to the AMF. The AMF sends an encrypted registration acceptance to the UE, and the UE returns an encrypted registration completion to the AMF. Currently, almost all 5G signaling parsing programs are multi-core and multi-threaded architectures, and the processing timing cannot be guaranteed. Figure 3 This is a schematic diagram of a 5G core network packet cache decryption out-of-order processing flow of the present invention. A typical out-of-order processing situation is as follows Figure 3 As shown, the UE sends a registration request to the AMF, the AMF sends an authentication request to the UE and AUSF, the UE returns an authentication response to the AMF, the AUSF returns an authentication response to the AMF, the AMF sends a security mode command to the UE, the UE returns an encrypted security mode completion to the AMF, the AMF sends an authentication confirmation to the AUSF, the AMF sends an encrypted registration acceptance to the UE, the AUSF returns an authentication confirmation response to the AMF, and the UE returns an encrypted registration completion to the AMF. Figure 3 As can be seen, step 7 is not completed until step 10 is completed. At this time, the messages in steps 9 and 10 will fail to be decrypted. Since the messages that fail to be decrypted carry important information, the decryption failure will also affect the subsequent parsing process.

[0060] In step 106, all subsequent signaling processes, including NAS messages, are encrypted. The signaling parser will use the decryption key and algorithm in the session context to decrypt the NAS messages.

[0061] The present invention proposes a 5G core network packet caching and decryption method. If the decryption key has not been obtained from the N12 interface when decrypting the NAS message of the N1N2 interface, the N1N2 interface message will be cached until the cache release condition is triggered. Generally, after the decryption key has been obtained at this time, the message will be reprocessed for decryption and other operations, solving the problem of decryption failure in multi-core and multi-threaded parsing of 5G traffic scenarios.

[0062] Those skilled in the art will understand that the foregoing descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will be able to modify the technical solutions described in the foregoing embodiments or substitute equivalents for some of the technical features. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A 5G core network packet cache decryption method, characterized in that: include: The function management network element receives the registration request message sent by the user equipment, initiates authentication to the function authentication network element according to the received registration request message, and receives authentication vector information returned by the function authentication network element; The function management network element initiates an authentication request to the user equipment, the authentication request carries the authentication vector information, and the user equipment calculates an authentication result based on the authentication vector information and returns the result to the function management network element; The function management network element sends the authentication result to the function authentication network element, and the function authentication network element verifies the value of the authentication result. If the verification is successful, a request success response code is returned to the function management network element; The function management network element sends an encryption algorithm to the user equipment and determines whether a decryption key is obtained from the current session context through a signaling analysis program; If the signaling parser fails to obtain the decryption key from the session context, it is determined that the decryption process is out of order, the current session is marked as requiring caching, and the network packet containing the current message is cached; If the signaling parser obtains the decryption key, the session is marked as not requiring caching, all cached packets of the current session are released, and the cached packets are reprocessed in the chronological order of the packets; The signaling parsing program uses the decryption key and algorithm in the session context to decrypt the non-access layer message.

2. A 5G core network packet cache decryption method according to claim 1, characterized in that: The calculating, by the user equipment, an authentication result according to the authentication vector information and returning the result to the function management network element includes: The signaling parsing program uses the authentication result as an index to store the session context corresponding to the current message.

3. A 5G core network packet cache decryption method according to claim 1, characterized in that: The function management network element sends the authentication result to the function authentication network element, and the function authentication network element verifies the value of the authentication result. If the verification passes, returning a request success response code to the function management network element includes: The request success response code carries the user equipment international mobile user identity code and intermediate key. The signaling parsing program uses the authentication result to query the stored session context and stores the international mobile user identity code and intermediate key in the session context.

4. A 5G core network packet cache decryption method according to claim 3, characterized in that: The International Mobile Subscriber Identity is an identifier of the user equipment. After the International Mobile Subscriber Identity is obtained, the key information of the user equipment is stored with the International Mobile Subscriber Identity as an index.

5. A 5G core network packet cache decryption method according to claim 1, characterized in that: The function management network element sends an encryption algorithm to the user equipment, and determines whether a decryption key is obtained from the current session context through a signaling parsing program, including: the signaling parsing program uses the encryption algorithm in the message and the intermediate key in the current session context to calculate the decryption key.

6. A 5G core network packet cache decryption method according to claim 1, characterized in that: If the signaling parser fails to obtain the decryption key from the session context, it is determined that the decryption process is out of order, the current session is marked as requiring caching, and the network packet containing the current message is cached, including: The cache structure is a hash table, the value vector of the hash table is a linked list structure, storing all cached data packets of the current session, and the key vector of the hash table is the unique identification information of the current session user in the base station.

7. A 5G core network packet cache decryption method according to claim 6, characterized in that: The method further includes storing subsequent data packets of the current session into a cache hash table when determining that the current session is marked as needing to be cached.

8. A 5G core network packet cache decryption method according to claim 1, characterized in that: If the signaling parser obtains the decryption key, the session is marked as not requiring caching, all cached packets of the current session are released, and the cached packets are reprocessed in chronological order, including: Set session release conditions, including timeout release conditions and session end release conditions; The timeout release condition is that when the cache time exceeds the set time threshold, all cached data packets are released; The session end release condition is to release all cached data packets when judging that the current session ends.

9. An electronic device, characterized in that: It includes a memory and a processor, the memory stores a program running on the processor, and the processor executes a 5G core network packet cache decryption method as described in any one of claims 1-8 when running the program.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed, a 5G core network packet cache decryption method as described in any one of claims 1 to 8 is executed.

Images