Registration processing method, network element and computer readable storage medium

Abstract

The invention provides a registration processing method, a network element and a computer readable storage medium, and relates to the field of communication. The method comprises the following steps: in response to a first registration request of first user equipment, triggering abnormal registration behavior analysis; and when the analysis result is abnormal registration, sending a notification of registration failure and registration limitation. On the basis of abnormal registration behavior analysis and registration limitation, registration limitation is carried out under the condition that abnormal registration of the user equipment is found, so that a prevention and disaster recovery solution is provided for the problems of overload of network elements for processing registration and incapability of continuing service possibly caused by abnormal registration of the user equipment.

Description

Technical Field

[0001] The present disclosure relates to the field of communications, and in particular to a registration processing method, a network element, and a computer-readable storage medium. Background Art

[0002] Sometimes serious accidents may occur in the communication network, resulting in the interruption of voice and SMS services for tens of millions of users. Some accidents are caused by incorrect configuration of backbone network routing, which causes a large number of users to be disconnected. The re-access of a large number of disconnected users triggers a signaling storm, which overloads the HSS (home subscriber server) or unified data management (UDM) network element and makes it unable to continue service. In other accidents, the Internet of Things (IoT) users fail to switch to a new HSS, causing a large number of IoT users to re-register and go online with the old HSS, thus triggering a signaling storm.

[0003] There is no solution in the related art to the problem that a signaling storm caused by abnormal registration of user equipment (UE) causes an overload of network elements such as HSS or UDM that process registration and cannot continue to provide services. Summary of the invention

[0004] The disclosed embodiment is based on abnormal registration behavior analysis and registration restriction. When abnormal registration of user equipment is found, registration restriction will be performed, thereby providing a preventive and disaster recovery solution for the problem of overload of network elements processing registration and inability to continue service that may be caused by abnormal registration of user equipment.

[0005] Some embodiments of the present disclosure provide a method for processing registration, including: in response to a first registration request of a first user device, triggering abnormal registration behavior analysis; if the analysis result is abnormal registration, sending a notification of registration failure and registration restriction.

[0006] In some embodiments, the triggering of abnormal registration behavior analysis includes: triggering abnormal registration behavior analysis when a trigger condition is met, wherein the trigger condition includes one or more of the following: the first user device abnormally registers a preset number of times, the number of abnormally registered user devices reaches a preset number within a preset time period, the duration of the abnormal registration reaches a preset time, and the network element processing the registration is overloaded or congested.

[0007] In some embodiments, the abnormal registration behavior analysis includes: performing abnormal registration behavior analysis based on at least one of a triggering event of the abnormal registration behavior analysis, a busy status of the network or a network element processing registration, and a registration record of a related user device, wherein the related user device includes the first user device and a user device whose registration request is of the same type as the first registration request of the first user device.

[0008] In some embodiments, the abnormal registration behavior analysis includes one or more of the following: when the registration record shows that the first user device has registered with incomplete or erroneous registration parameters for a preset number of times, determining that the first user device has registered abnormally; when the registration record shows that the first user device has illegally registered for a preset number of times, determining that the first user device has registered abnormally; when the registration record shows that the number of user devices with the same type of registration requests that have registered with incomplete or erroneous registration parameters of the same type reaches a preset number, determining that the user devices with the same type of registration requests have registered abnormally.

[0009] In some embodiments, the abnormal registration behavior analysis includes one or more of the following: if at least one of the triggering events of the abnormal registration behavior analysis, the network, or the network element processing the registration is in a busy state, occurs, and the registration record shows that the first user device has registered with incomplete or erroneous registration parameters for a preset number of times, it is determined that the first user device is abnormally registered; if at least one of the triggering events of the abnormal registration behavior analysis, the network, or the network element processing the registration is in a busy state, occurs, and the registration record shows that the first user device has illegally registered for a preset number of times, it is determined that the first user device is abnormally registered; if at least one of the triggering events of the abnormal registration behavior analysis, the network, or the network element processing the registration is in a busy state, occurs, and the registration record shows that the number of user devices with the same type of registration requests registering with incomplete or erroneous registration parameters of the same type reaches a preset number, it is determined that the user device with the same type of registration request is abnormally registered.

[0010] In some embodiments, the busy status of the network or the network element processing registration is obtained from a network manager.

[0011] In some embodiments, the registration record of the relevant user equipment is obtained from a home subscription server, a unified data management network element, or an authentication server function network element.

[0012] In some embodiments, the abnormal registration behavior analysis is performed by an abnormal registration behavior analysis module, and the abnormal registration behavior analysis module is deployed as an independent network element, or deployed in a network element that processes registration, or deployed in a network data analysis function network element.

[0013] In some embodiments, the notification also includes reasons for registration failure, and the reasons for registration failure include one or more of the following: incomplete or incorrect registration parameters of the first user device, malicious registration of the first user device, and abnormal registration of multiple user devices.

[0014] In some embodiments, the notification is used to indicate that registration of the first user equipment is restricted, or that registration requests of the same type as the first registration request of the first user equipment are restricted.

[0015] In some embodiments, when the reason for registration failure is incomplete or incorrect registration parameters of the first user device, the notification is used to indicate that the registration frequency or number of the first user device is limited; or when the reason for registration failure is malicious registration by the first user device, the notification is used to indicate that the first user device is prohibited from initiating registration; or when the reason for registration failure is abnormal registration of multiple user devices, the notification is used to indicate that the total number of requests or the total number of failures for the same type of registration is limited.

[0016] In some embodiments, the method is performed by a network element that processes registration, and the network element that processes registration includes a home subscription server or a unified data management network element.

[0017] In some embodiments, sending the notification of registration failure and registration restriction includes: sending the notification of registration failure and registration restriction to at least one of an access and mobility management function network element, a radio access network element, and the first user equipment.

[0018] Some embodiments of the present disclosure provide a network element for processing registration, including: a memory; and a processor coupled to the memory, wherein the processor is configured to execute a method for processing registration based on instructions stored in the memory.

[0019] Some embodiments of the present disclosure provide a network element for processing registration, including: a module for executing a method for processing registration.

[0020] Some embodiments of the present disclosure provide a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method for processing registration when the program is executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The following is a brief introduction to the drawings required for use in the embodiments or related technical descriptions. The present disclosure can be more clearly understood according to the following detailed description with reference to the drawings.

[0022] Obviously, the drawings described below are only some embodiments of the present disclosure, and a person skilled in the art can obtain other drawings based on these drawings without creative work.

[0023] Figure 1 A flowchart illustrating a method for processing registration according to some embodiments of the present disclosure is shown.

[0024] Figure 2 A schematic diagram of information interaction showing a method for processing registration in some embodiments of the present disclosure.

[0025] Figure 3 A schematic diagram showing the structure of a network element for processing registration according to some embodiments of the present disclosure.

[0026] Figure 4 A schematic diagram showing the structure of a network element for processing registration according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0027] It should be noted that the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless specifically stated otherwise.

[0028] Those skilled in the art can understand that the terms "first" and "second" in the embodiments of the present disclosure are only used to distinguish different steps, devices or modules, etc., and neither represent any specific technical meaning nor indicate the necessary logical order between them.

[0029] It should also be understood that in the embodiments of the present disclosure, “plurality” may refer to two or more than two, and “at least one” may refer to one, two, or more than two.

[0030] It should also be understood that any component, data or structure mentioned in the embodiments of the present disclosure can generally be understood as one or more, unless explicitly limited or otherwise indicated in the context.

[0031] In addition, the term "and / or" in the present disclosure is only a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in the present disclosure generally indicates that the associated objects before and after are in an "or" relationship.

[0032] It should also be understood that the description of the various embodiments in the present disclosure focuses on the differences between the various embodiments, and the same or similar aspects thereof can be referenced to each other, and for the sake of brevity, they will not be described one by one.

[0033] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0034] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0035] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0036] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0037] In addition, in order to avoid obscuring the present disclosure due to unnecessary details, only the processing steps and / or device structures closely related to at least the scheme according to the present disclosure are shown in the drawings, and other details that are not closely related to the present disclosure are omitted. It should also be noted that similar reference numerals and letters in the drawings indicate similar items, and therefore once an item is defined in one drawing, it does not need to be discussed again for subsequent drawings.

[0038] Figure 1 A flowchart illustrating a method for processing registration according to some embodiments of the present disclosure is shown.

[0039] like Figure 1 As shown, the registration processing method of this embodiment can be executed by a network element for processing registration, and includes the following steps: Wherein, the network element for processing registration includes, but is not limited to, a home subscription server or a unified data management network element.

[0040] In step 110, in response to a first registration request of a first user equipment, abnormal registration behavior analysis is triggered.

[0041] In some embodiments, when a trigger condition is met, abnormal registration behavior analysis is triggered. The trigger condition includes one or more of the following: the number of abnormal registrations of the first user equipment reaches a preset number, the number of abnormally registered user equipment reaches a preset number within a preset time period, the duration of abnormal registration reaches a preset time, and the network element processing the registration is overloaded or congested. The trigger condition can be pre-configured or adjusted according to the situation. The trigger condition can be set in the home contract server or the unified data management network element.

[0042] Thus, in the case of multiple abnormal registrations of the same user device, or abnormal registrations of a large number of user devices at the same time, or abnormal registrations of the same user device / a large number of user devices continuing for a period of time, abnormal registration behavior analysis is triggered so that registration restrictions can be made when abnormal registrations of user devices are found, thereby providing a preventive solution to the problem of overload of network elements processing registrations and inability to continue service caused by abnormal registrations of user devices; in the case of current overload or congestion of network elements processing registrations such as home contract servers or unified data management network elements, abnormal registration behavior analysis is triggered so that registration restrictions can be made when abnormal registrations of user devices are found, thereby providing a disaster recovery solution to the problem of overload of network elements processing registrations and inability to continue service caused by abnormal registrations of user devices.

[0043] In some embodiments, the abnormal registration behavior analysis includes: performing abnormal registration behavior analysis according to at least one of the triggering event of the abnormal registration behavior analysis, the busy status of the network or the network element that processes the registration, and the registration record of the relevant user equipment. Wherein, the relevant user equipment includes the first user equipment and the user equipment whose registration request is the same type as the first registration request of the first user equipment. The busy status of the network or the network element that processes the registration is obtained from the network management, for example, to obtain whether the network or the network element that processes the registration is currently busy or idle. Generally, the busier the network or the network element that processes the registration is, the lower the tolerance for abnormal registration behavior of the user equipment is, and the easier it is to trigger the normal registration behavior analysis. The registration record of the relevant user equipment is obtained from the home contract server, the unified data management network element, or the authentication server function (AUSF) network element to obtain whether the user equipment has an abnormal registration record, for example, a registration record with incomplete or erroneous registration parameters, or an illegal registration record.

[0044] For example, when the registration record shows that the first user device has registered with incomplete or erroneous registration parameters for a preset number of times, the first user device is determined to be abnormally registered. In this way, abnormal registration behavior of the same user device is identified, and the cause (or type) of registration failure is that the registration parameters of the first user device are incomplete or erroneous. Incomplete or erroneous registration parameters include, for example, but are not limited to, source IP (Internet Protocol) address, source port, destination IP address, destination port, and incomplete or erroneous five-tuple parameters of the transport layer protocol.

[0045] For example, if the registration record shows that the first user device has registered illegally for a preset number of times, the first user device is determined to be abnormally registered, thereby identifying abnormal registration behavior of the same user device, and the reason (or type) for registration failure is malicious registration of the first user device.

[0046] For example, when the registration record shows that the number of user devices with the same type of registration request carrying incomplete or erroneous registration parameters of the same type for registration reaches a preset number, it is determined that the user devices with the same type of registration request are abnormally registered. Thus, the abnormal registration behavior of a large number of user devices is identified, and the reason (or type) for registration failure is the abnormal registration of multiple user devices.

[0047] For example, if at least one of the triggering event of abnormal registration behavior analysis, the network or the network element processing registration is in a busy state, and the registration record shows that the first user device has registered with incomplete or erroneous registration parameters for a preset number of times, it is determined that the first user device has registered abnormally. In this way, by combining multiple pieces of information, the abnormal registration behavior of the same user device can be more accurately identified, and the cause (or type) of registration failure is the incomplete or erroneous registration parameters of the first user device.

[0048] For example, if at least one of the triggering event of abnormal registration behavior analysis, the network or the network element processing registration is in a busy state, and the registration record shows that the first user device has registered illegally for a preset number of times, it is determined that the first user device is abnormally registered. Thus, by integrating multiple pieces of information, the abnormal registration behavior of the same user device can be more accurately identified, and the cause (or type) of registration failure is malicious registration of the first user device.

[0049] For example, if at least one of the triggering event of abnormal registration behavior analysis, the network or the network element processing registration is in a busy state, occurs, and the registration record shows that the number of user devices with the same type of registration request carrying incomplete or erroneous registration parameters of the same type for registration reaches a preset number, it is determined that the user devices with the same type of registration request are abnormally registered. In this way, multiple pieces of information are combined to more accurately identify the abnormal registration behavior of a large number of user devices, and the cause (or type) of registration failure is the abnormal registration of multiple user devices.

[0050] The abnormal registration behavior analysis is performed by an abnormal registration behavior analysis module, and the abnormal registration behavior analysis module is deployed as an independent network element, or deployed in a network element that processes registration, or deployed in a network data analysis function network element. Wherein, in the case where the abnormal registration behavior analysis module is deployed as an independent network element or deployed in a network data analysis function network element, after the network element that processes registration decides to trigger the abnormal registration behavior analysis, it sends an abnormal registration behavior analysis request to the abnormal registration behavior analysis module, and after the abnormal registration behavior analysis module analyzes, it receives the abnormal registration behavior analysis result returned by the abnormal registration behavior analysis module. Wherein, if it is necessary to perform abnormal registration behavior analysis on the first user device, the abnormal registration behavior analysis request may indicate information of the first user device that needs to be analyzed. If it is necessary to perform abnormal registration behavior analysis on a user device whose registration request is of the same type as the first registration request of the first user device, the abnormal registration behavior analysis request may indicate information of the registration request type that needs to be analyzed.

[0051] In step 120, if the analysis result is abnormal registration, a notification of registration failure and registration restriction is sent.

[0052] In some embodiments, sending a notification of registration failure and registration restriction includes: sending a notification of registration failure and registration restriction to at least one of an access and mobility management function (AMF) network element, a radio access network (RAN) network element, and a first user device.

[0053] The notification (especially the registration failure part in the notification) is used to indicate that the current registration (such as the first registration request) has failed, so that the notified object can be informed of the registration status in a timely manner. In the case of a registration failure, the notification can also include the reason for the registration failure, which includes one or more of the following: incomplete or incorrect registration parameters of the first user device, malicious registration of the first user device, and abnormal registration of multiple user devices, so that the notified object can be informed of the reason for the registration failure in a timely manner.

[0054] The notification (particularly the registration restriction portion in the notification) is used to indicate that the registration of the first user equipment is restricted, or that the registration request of the same type as the first registration request of the first user equipment is restricted.

[0055] For example, when the reason for registration failure is that the registration parameters of the first user equipment are incomplete or wrong, the notification is used to indicate that the registration frequency or number of the first user equipment is limited, so that the first user equipment cannot continue to register when the registration frequency or number exceeds the limited frequency or number.

[0056] For example, when the reason for registration failure is malicious registration by the first user equipment, the notification is used to indicate that the first user equipment is prohibited from initiating registration, so that the first user equipment cannot continue to register. When the network element resources for processing the registration are sufficient, the prohibition measure can be cancelled.

[0057] For example, when the reason for registration failure is abnormal registration of multiple user devices, the notification is used to indicate that the total number of requests or total number of failures for the same type of registration is limited. When the registration of this type exceeds the limit, no new registration request is allowed.

[0058] The disclosed embodiment is based on abnormal registration behavior analysis and registration restriction. When abnormal registration of user equipment is found, registration restriction will be performed, thereby providing a preventive and disaster recovery solution for the problem of overload of network elements processing registration and inability to continue service that may be caused by abnormal registration of user equipment.

[0059] Figure 2 A schematic diagram of information interaction showing a method for processing registration in some embodiments of the present disclosure.

[0060] like Figure 2 As shown, the registration processing method of this embodiment includes the following steps.

[0061] In steps 210, 220, and 230, a certain UE repeatedly initiates registration with incomplete / erroneous registration information and always receives registration failure notifications sent by HSS / UDM; or, multiple UEs initiate registration with incomplete / erroneous registration information and always receive registration failure notifications sent by HSS / UDM.

[0062] The registration initiated by the UE reaches the UDM via the RAN and AMF, and the registration failure notification returned by the UDM reaches the UE via the AMF and RAN.

[0063] In step 240, the HSS / UDM repeatedly receives invalid registrations from the UE side and reaches certain trigger conditions, such as the number of abnormal times of the same UE reaches a preset number, the number of UEs initiating abnormal registrations reaches a preset number, the duration of the abnormal registration reaches a preset time, the HSS / UDM is overloaded or congested, etc., triggering abnormal registration behavior analysis.

[0064] If the trigger condition is that the number of abnormal times of the same UE reaches a preset number, HSS / UDM can trigger abnormal registration behavior analysis for the UE. If the trigger condition is that the number of UEs initiating abnormal registration reaches a preset number, HSS / UDM can trigger abnormal registration behavior analysis for the registration request types of these UEs.

[0065] The abnormal registration behavior analysis is performed by the abnormal registration behavior analysis module, which is deployed as an independent network element, or deployed in a network element that processes registration, or deployed in a network data analysis function network element. Where the abnormal registration behavior analysis module is deployed as an independent network element or deployed in a network data analysis function network element, steps 250-270 need to be performed; where the abnormal registration behavior analysis module is deployed in a network element HSS / UDM that processes registration, step 260 can be performed without performing steps 250 and 270.

[0066] In step 250, the HSS / UDM sends an abnormal registration behavior analysis request to the abnormal registration behavior analysis module. If abnormal registration behavior analysis needs to be performed on a certain UE, the abnormal registration behavior analysis request may indicate information of the UE to be analyzed. If abnormal registration behavior analysis needs to be performed on a user equipment of a certain registration request type, the abnormal registration behavior analysis request may indicate information of the registration request type to be analyzed.

[0067] In step 260, the abnormal registration behavior analysis module performs abnormal registration behavior analysis according to the abnormal registration behavior analysis request and returns the analysis result.

[0068] The abnormal registration behavior analysis module performs abnormal registration behavior analysis according to at least one of the triggering event of abnormal registration behavior analysis, the busy status of the network or HSS / UDM, and the registration record of the relevant user equipment. The relevant user equipment includes a certain UE that needs to be analyzed and certain user equipment of the registration request type that needs to be analyzed. The busy status of the network or HSS / UDM is obtained from the network management, for example, to obtain whether the network or HSS / UDM is currently busy or idle. Generally, the busier the network or HSS / UDM, the lower the tolerance for abnormal registration behavior of the user equipment, and the easier it is to trigger normal registration behavior analysis. The registration record of the relevant user equipment is obtained from the home contract server, the unified data management network element, or the authentication server function network element to obtain whether the user equipment has an abnormal registration record, for example, a registration record with incomplete or erroneous registration parameters, or an illegal registration record.

[0069] For example, when the registration record shows that the UE1 to be analyzed has registered with incomplete or erroneous registration parameters for a preset number of times, it is also possible to determine the abnormal registration of UE1 in combination with at least one of the triggering event of abnormal registration behavior analysis and whether the network or the network element processing the registration is in a busy state as needed. In this way, the abnormal registration behavior of the same user equipment is identified, and the cause (or type) of registration failure is the incomplete or erroneous registration parameters of UE1.

[0070] For example, when the registration record shows that UE1 has registered illegally for a preset number of times, it is also possible to determine the abnormal registration of UE1 based on the trigger event of abnormal registration behavior analysis and whether at least one of the network or the network element processing the registration is in a busy state. In this way, the abnormal registration behavior of the same user equipment is identified, and the cause (or type) of the registration failure is the malicious registration of UE1.

[0071] For example, when the registration record shows that the number of user devices with the same type of registration request carrying incomplete or erroneous registration parameters of the same type for registration has reached a preset number, it is also possible to determine the abnormal registration of user devices with the same type of registration request in combination with at least one of the triggering event of abnormal registration behavior analysis and whether the network or the network element processing the registration is in a busy state as needed. Thereby, the abnormal registration behavior of a large number of user devices is identified, and the cause (or type) of registration failure is the abnormal registration of multiple user devices. For example, a batch of IoT user devices have the same configuration problem, and these IoT user devices carry incorrect registration parameters for registration. HSS / UDM triggers abnormal registration behavior analysis to promptly discover the collective abnormal behavior and take restrictive measures.

[0072] In step 270, the HSS / UDM receives the abnormal registration behavior analysis result returned by the abnormal registration behavior analysis module. If the abnormal registration behavior analysis result is determined to be a normal registration, the process is still processed according to the conventional registration 0 process. If the abnormal registration behavior analysis result is determined to be an abnormal registration, the abnormal registration behavior analysis result may also include the reason for the registration failure, and step 280 is executed.

[0073] The reasons (or types) for registration failure include one or more of the following: incomplete or incorrect registration parameters of a single user device, malicious registration of a single user device, abnormal registration of multiple user devices, so that the notified object can know the reason for the registration failure in time.

[0074] In step 280, the HSS / UDM sends a notification of registration failure and registration restriction, which can be sent to the AMF, RAN, and UE. The notification is used to indicate that the current registration has failed. The notification is also used to indicate that the registration of the same UE is restricted, or the registration request of the same type is restricted, and the UE is restricted from initiating registration with incomplete / erroneous registration information.

[0075] The notification may include the reason (or type) for registration failure. The reasons (or types) for registration failure include, for example, UE registering with incomplete / wrong parameters (incomplete / wrong parameters leading to repeated registrations), malicious registration by UE (there are a large number of illegal registration records by UE before or at other UDMs), and abnormal registration behavior of a large number of UEs (a large number of UEs lack / bring the same type of parameters incorrectly, for example, a group of IoT users may have the same configuration problem).

[0076] HSS / UDM can use different methods to handle different abnormal registrations. Some examples are listed below.

[0077] If the exception type is "UE registers with incomplete / incorrect parameters", HSS / UDM can inform the UE which specific parameter is incomplete / incorrect and limit the frequency or number of subsequent repeated registrations. If the error frequency or number exceeds the limit, registration cannot continue.

[0078] If the exception type is "UE malicious registration", HSS / UDM can temporarily prohibit UE from initiating registration. When HSS / UDM resources are sufficient, this type of UE can be allowed to initiate registration requests again.

[0079] If the exception type is "abnormal registration behavior of a large number of UEs", the HSS / UDM limits parameters such as the total number of registration requests and the total number of registration failures for UEs with the same registration tags. When the limit is exceeded, new registration requests are temporarily not allowed.

[0080] This embodiment enhances HSS / UDM, supports triggering UE abnormal registration behavior analysis, supports identifying various types of abnormal registration behaviors, and can adopt different restriction processing strategies for different types. This embodiment adds a UE abnormal registration behavior analysis function, supports retrieving UE registration records from UDM, network management, etc., analyzes UE registration behaviors, classifies them into different types of abnormal behaviors, and feeds back the analysis results to HSS / UDM.

[0081] In order to solve the problem that after the UE fails to register due to carrying incomplete registration information or erroneous registration information, it still repeatedly registers with the same registration information, this embodiment proposes to add a new UE abnormal registration analysis function to identify the abnormal registration behavior of the UE. The HSS / UDM restricts the registration of abnormal UEs, thereby providing a preventive and disaster recovery solution for the HSS / UDM overload and inability to continue service problems that may be caused by abnormal registration of user equipment.

[0082] Figure 3 A schematic diagram of the structure of a network element for processing registration in some embodiments of the present disclosure is shown. The network element for processing registration is, for example, an HSS / UDM.

[0083] like Figure 3As shown, the network element 300 for processing registration in this embodiment includes: a module for executing the method for processing registration.

[0084] The trigger module 310 is configured to trigger abnormal registration behavior analysis in response to a first registration request of a first user equipment.

[0085] The trigger module 310 is configured to trigger abnormal registration behavior analysis when a trigger condition is met, wherein the trigger condition includes one or more of the following:

[0086] The number of abnormal registrations of the first user equipment reaches a preset number,

[0087] The number of abnormally registered user devices reaches the preset number within the preset time period.

[0088] The duration of abnormal registration reaches the preset time,

[0089] The network element that handles registrations is overloaded or congested.

[0090] The restriction module 320 is configured to send a notification of registration failure and registration restriction when the analysis result is abnormal registration, and can send a notification of registration failure and registration restriction to at least one of the access and mobility management function network element, the radio access network network element, and the first user equipment. The notification is used to indicate that the registration of the first user equipment is restricted, or the registration request of the same type as the first registration request of the first user equipment is restricted. The notification also includes the reason for the registration failure, and the reason for the registration failure includes one or more of the following: the registration parameter of the first user equipment is incomplete or wrong, the first user equipment is maliciously registered, and multiple user equipments are abnormally registered. In the case where the reason for the registration failure is that the registration parameter of the first user equipment is incomplete or wrong, the notification is used to indicate that the registration frequency or number of the first user equipment is restricted; or in the case where the reason for the registration failure is that the first user equipment is maliciously registered, the notification is used to indicate that the first user equipment is prohibited from initiating registration; or in the case where the reason for the registration failure is that multiple user equipments are abnormally registered, the notification is used to indicate that the total number of requests or the total number of failures of the same type of registration is restricted.

[0091] The abnormal registration behavior analysis module 330 is configured to perform abnormal registration behavior analysis based on at least one of the triggering event of the abnormal registration behavior analysis, the busy status of the network or the network element processing the registration, and the registration record of the relevant user equipment, wherein the relevant user equipment includes the first user equipment and the user equipment whose registration request is the same type as the first registration request of the first user equipment.

[0092] It should be noted that the abnormal registration behavior analysis module 330 is deployed in the network element that processes registration, or is deployed as an independent network element, or is deployed in a network data analysis function network element.

[0093] The abnormal registration behavior analysis module 330 is configured to perform one or more of the following: when the registration record shows that the first user device has registered with incomplete or erroneous registration parameters for a preset number of times, determine that the first user device has registered abnormally; when the registration record shows that the first user device has illegally registered for a preset number of times, determine that the first user device has registered abnormally; when the registration record shows that the number of user devices with the same type of registration requests that have registered with incomplete or erroneous registration parameters of the same type reaches a preset number, determine that the user devices with the same type of registration requests have registered abnormally.

[0094] The abnormal registration behavior analysis module 330 is configured to perform one or more of the following: if at least one of the triggering events of the abnormal registration behavior analysis, the network or the network element processing the registration is in a busy state, occurs, and the registration record shows that the first user device has registered with incomplete or erroneous registration parameters for a preset number of times, it is determined that the first user device has been abnormally registered; if at least one of the triggering events of the abnormal registration behavior analysis, the network or the network element processing the registration is in a busy state, occurs, and the registration record shows that the first user device has illegally registered for a preset number of times, it is determined that the first user device has been abnormally registered; if at least one of the triggering events of the abnormal registration behavior analysis, the network or the network element processing the registration is in a busy state, occurs, and the registration record shows that the number of user devices with the same type of registration requests that register with incomplete or erroneous registration parameters of the same type reaches a preset number, it is determined that the user devices with the same type of registration requests have been abnormally registered.

[0095] The abnormal registration behavior analysis module 330 is configured to obtain the busy status of the network or the network element processing registration from the network management; or obtain the registration record of the relevant user equipment from the home contract server, unified data management network element, or authentication server function network element.

[0096] Figure 4 A schematic diagram of the structure of a network element for processing registration in some embodiments of the present disclosure is shown. The network element for processing registration is, for example, an HSS / UDM.

[0097] like Figure 4 As shown, the network element 400 for processing registration in this embodiment includes: a memory 410 and a processor 420 coupled to the memory 410 , and the processor 420 is configured to execute the method for processing registration in any of some embodiments based on instructions stored in the memory 410 .

[0098] The network element 400 for processing registration may further include an input / output interface 430 , a network interface 440 , a storage interface 450 , etc. These interfaces 430 , 440 , 450 , the memory 410 and the processor 420 may be connected, for example, via a bus 440 .

[0099] The memory 410 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, and other programs.

[0100] The processor 420 may be implemented by a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistors and other discrete hardware components.

[0101] Among them, the input and output interface 430 provides a connection interface for input and output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 440 provides a connection interface for various networked devices. The storage interface 450 provides a connection interface for external storage devices such as SD cards and USB flash drives. The bus 440 can use any bus structure among a variety of bus structures. For example, the bus structure includes but is not limited to the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MCA) bus, and the Peripheral Component Interconnect (PCI) bus.

[0102] The embodiment of the present disclosure provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of the method for processing registration are implemented. The storage medium is, for example, a non-transitory computer-readable storage medium.

[0103] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more non-transient computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer program code.

[0104] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0105] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0106] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0107] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A method for processing registration, It is characterized in that include: In response to a first registration request of a first user equipment, triggering abnormal registration behavior analysis; If the analysis result indicates abnormal registration, a notification of registration failure and registration restriction is sent.

2. The method according to claim 1, It is characterized in that The triggering of abnormal registration behavior analysis includes: triggering abnormal registration behavior analysis when a trigger condition is met, wherein the trigger condition includes one or more of the following: The number of abnormal registrations of the first user equipment reaches a preset number, The number of abnormally registered user devices reaches the preset number within the preset time period. The duration of abnormal registration reaches the preset time, The network element that handles registrations is overloaded or congested.

3. The method according to claim 1, It is characterized in that The abnormal registration behavior analysis includes: Abnormal registration behavior analysis is performed based on at least one of a triggering event for abnormal registration behavior analysis, a busy status of a network or a network element processing registration, and a registration record of a related user device, wherein the related user device includes the first user device and a user device whose registration request is the same type as the first registration request of the first user device.

4. The method according to claim 3, It is characterized in that The abnormal registration behavior analysis may include one or more of the following: If the registration record shows that the first user equipment has registered with incomplete or erroneous registration parameters for a preset number of times, determining that the first user equipment is abnormally registered; If the registration record shows that the first user equipment has been illegally registered for a preset number of times, determining that the first user equipment is abnormally registered; When the registration record shows that the number of user devices with the same type of registration request carrying incomplete or erroneous registration parameters of the same type for registration reaches a preset number, it is determined that the user devices with the same type of registration request are abnormally registered.

5. The method according to claim 4, It is characterized in that The abnormal registration behavior analysis may include one or more of the following: If at least one of the triggering event of abnormal registration behavior analysis, the network or the network element processing registration is in a busy state, and the registration record shows that the first user equipment has registered with incomplete or erroneous registration parameters for a preset number of times, it is determined that the first user equipment is abnormally registered; If at least one of the triggering event of abnormal registration behavior analysis, the network or the network element processing registration is in a busy state, and the registration record shows that the first user equipment has been illegally registered for a preset number of times, it is determined that the first user equipment is abnormally registered; If at least one of the triggering events of abnormal registration behavior analysis, the network or the network element processing registration is in a busy state, and the registration record shows that the number of user devices with the same type of registration requests that register with incomplete or erroneous registration parameters of the same type reaches a preset number, it is determined that the user device with the same type of registration request is abnormally registered.

6. The method according to claim 3, It is characterized in that The busy status of the network or the network element processing the registration is obtained from the network management; or The registration record of the relevant user equipment is obtained from a home subscription server, a unified data management network element, or an authentication server function network element.

7. The method according to claim 1, It is characterized in that The abnormal registration behavior analysis is performed by an abnormal registration behavior analysis module, and the abnormal registration behavior analysis module is deployed as an independent network element, or deployed in a network element that processes registration, or deployed in a network data analysis function network element.

8. The method according to claim 1, It is characterized in that The notification also includes reasons for registration failure, which include one or more of the following: incomplete or incorrect registration parameters of the first user device, malicious registration of the first user device, and abnormal registration of multiple user devices.

9. The method according to claim 1, It is characterized in that The notification is used to instruct to restrict the registration of the first user equipment, or to restrict the registration request of the same type as the first registration request of the first user equipment.

10. The method according to claim 8 or 9, It is characterized in that When the reason for the registration failure is that the registration parameters of the first user equipment are incomplete or wrong, the notification is used to indicate that the registration frequency or number of times of the first user equipment is limited; or In a case where the reason for the registration failure is malicious registration by the first user equipment, the notification is used to indicate that the first user equipment is prohibited from initiating registration; or In the case where the reason for the registration failure is abnormal registration of multiple user equipments, the notification is used to instruct to limit the total number of requests or total number of failures for the same type of registration.

11. The method according to any one of claims 1 to 9, It is characterized in that The method is executed by a network element that processes registration, and the network element that processes registration includes a home subscription server or a unified data management network element.

12. The method according to any one of claims 1 to 9, It is characterized in that Sending the notification of registration failure and registration restriction includes: sending the notification of registration failure and registration restriction to at least one of an access and mobility management function network element, a radio access network element, and the first user equipment.

13. A network element for processing registration, include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method for processing registration according to any one of claims 1 to 12 based on instructions stored in the memory.

14. A network element for processing registration, include: A module for executing the method for processing registration as described in any one of claims 1-12.

15. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the steps of the method for processing registration according to any one of claims 1 to 12 are implemented.

Images