A mobile terminal access control method based on core network PCC policy

Abstract

The application discloses a kind of mobile terminal access control methods based on core network PCC strategy, its steps include: 1) in 5G core network setting a security control module;2) security control module generates security control strategy according to the security monitoring data of mobile terminal, base station and core network in current 5G core network and is issued to the PCF network element of 5G core network;3) PCF network element generates session management security control strategy or access and mobility management security control strategy based on security control strategy mobile terminal access control;4) PCF network element issues session management security control strategy to SMF network element, then SMF network element communicates with UPF network element, and UPF network element executes received policy to identify abnormal service traffic and carries out access control to mobile terminal;5) PCF network element sends the policy received to AMF network element, and AMF network element carries out access control to mobile terminal according to the policy received.

Description

Technical Field

[0001] This invention belongs to the field of network communication technology and relates to a mobile terminal access control method based on core network PCC policy. Background Technology

[0002] In 5G networks, mobile terminals include not only smartphones and tablets, but also various Internet of Things (IoT) devices and industrial control systems. These devices access the 5G network in different ways, leading to greater diversity and complexity in access. However, this also introduces various security threats to the 5G network, including signaling plane security threats (such as unauthorized terminal access and abnormal terminal access) and user plane security threats (such as data theft and man-in-the-middle attacks). To address the security threats posed by mobile terminals, access control measures can be implemented to regulate terminal access behavior.

[0003] Currently, deploying access control gateways in data networks (DNs) is the primary method for implementing mobile terminal access control or dynamic access control. These control measures aim to manage and monitor devices' access permissions to network resources and the data packets they transmit. However, protection from the data network side alone can only address user-plane security threats; it cannot address signaling-plane threats. For example, it cannot effectively address security threats arising from unauthorized terminal access, terminal spoofing, authentication deficiencies, and mobility management, nor can it protect the mobile network from security incidents caused by terminals.

[0004] Taking security measures from the mobile communication network side can effectively supplement the protection on the data network side. However, existing policy control functions (PCF) mainly target the quality of service (QoS) and billing services of mobile communication networks, and usually do not directly consider security protection policies, especially security protection policies for potential risks to terminals such as malicious access and device identity fraud. This makes it difficult to achieve fine-grained access control for the behavior of various terminal devices. Furthermore, current PCF policy configuration methods are mainly static PCC policy configuration methods, which cannot dynamically generate and distribute appropriate policies based on the existing network environment, and lack the ability to perform security detection across the entire network environment.

[0005] The diversification of 5G mobile terminals and the increasing complexity of access have brought about increasingly serious security threats to the signaling and user planes. Therefore, appropriate access control measures are needed to control 5G mobile terminals. However, current security protection and control measures have obvious shortcomings in secure access control for mobile terminals:

[0006] 1) Existing dynamic access control methods for mobile terminals typically involve deploying access control gateways and firewalls within the data network (DN). This approach struggles to effectively analyze potential security issues at the communication network signaling layer and to effectively analyze and control abnormal terminal access to or access to the mobile communication network.

[0007] 2) Existing mobile communication networks have policy control function (PCF) network elements, but the policy control function is mainly used for quality of service (QoS) and billing. It does not integrate security policies, lacks mobile terminal security access control policies, and also lacks dynamic security policy generation and distribution functions. The system cannot automatically adjust and deploy appropriate security policies according to real-time changes in the network environment. Summary of the Invention

[0008] To address the problems existing in the prior art, the purpose of this invention is to provide a mobile terminal access control method based on core network PCC policy. This method can generate and distribute security control policies on the mobile communication network side through core network PCC policy. The security control policies provide fine-grained network access control for mobile terminals, thereby enhancing network security.

[0009] This invention analyzes data from the signaling plane and user plane to perform real-time analysis and decision-making on devices accessing the network, enabling fine-grained and dynamic mobile terminal access control, such as authorizing or denying their network access rights.

[0010] The key points of the invention are mainly reflected in the following five aspects:

[0011] 1) Based on the unified analysis results of security monitoring data (user plane and signaling plane data) from terminals, base stations, and core networks, security policies are generated to perform fine-grained control over the access behavior of mobile terminals.

[0012] 2) Introduce a security control module, which is responsible for receiving security monitoring data from terminals, base stations, and core networks, generating security control policies based on the data, and sending them to PCF network elements through the N5 interface.

[0013] 3) Based on the analysis of real-time monitoring data, dynamic security control strategies are generated to ensure comprehensive security management of mobile terminal access behavior.

[0014] 4) The security control policies generated by the security control module are converted and distributed through the PCF network element. The PCF converts the security control policies into Session Management Security Control (SMF) policies and Access and Mobility Management (AMF) security control (PCC) policies, and then distributes them. The SMF security control (PCC) policies are distributed to the Session Management Function (SMF) through the Npcf_SMPolicyControl service interface, and the AMF security control (PCC) policies are distributed to the Access and Mobility Management Function (AMF) through the Npcf_AMPolicyControl service interface, ensuring the effective implementation of mobile terminal access control.

[0015] 5) Session management security control PCC policies (such as QoS flow-level policies, PDU session-level policies, and service data flow-level policies) and access and mobility management security control PCC policies (such as service area restrictions and radio frequency selection priority) are executed in SMF and AMF network elements to identify and control abnormal service traffic and manage the access behavior of mobile terminals.

[0016] The technical solution of this invention is as follows:

[0017] A mobile terminal access control method based on core network PCC policy, comprising the following steps:

[0018] 1) Install a security control module within the 5G core network;

[0019] 2) The security control module generates security control policies based on the mobile terminal security monitoring data, base station security monitoring data and core network security monitoring data in the current 5G core network and sends them to the PCF network elements of the 5G core network;

[0020] 3) The PCF network element generates a session management security control policy or an access and mobility management security control policy for mobile terminal access control based on the received security control policy;

[0021] 4) The PCF network element sends the session management security control policy to the SMF network element, and then the SMF network element communicates with the UPF network element of the 5G core network. The UPF network element executes the session management security control policy, identifies abnormal service traffic, and performs access control on the mobile terminal.

[0022] 5) The PCF network element sends the access and mobility management security control policy to the AMF network element of the 5G core network.

[0023] The AMF network element performs access control on the mobile terminal according to the access and mobility management security control policy.

[0024] Furthermore, the method for generating the security control policy is as follows:

[0025] 21) Construct a corresponding security control policy template for different security event types, including network attack events, abnormal behavior events, unauthorized operation events, security vulnerability events, and other events;

[0026] 22) The security control module selects the corresponding security control strategy template based on the received security event, determines the specific parameters of the corresponding security control strategy template based on the received security event, and forms a specific security control strategy.

[0027] Furthermore, the information in the security control policy template includes the mobile terminal ID, policy duration, and handling measures; the security control policy template includes a session management security control policy template and an access and mobility management security control policy template; the session management security control policy template is used to control SMF network elements and UPF network elements; the access and mobility management security control policy template is used to control AMF network elements.

[0028] Furthermore, the method for determining the specific parameters of the corresponding security control policy template is as follows: determine the mobile terminal ID in the security control policy template based on the mobile terminal ID obtained from the security event; determine the policy duration based on the event level obtained from the security event, wherein the event level includes four levels: general, major, serious, and extremely serious, corresponding to event classifications of level one, level two, level three, and level four; determine the corresponding handling measures based on the specific behavior of the security event, wherein the handling measures include, but are not limited to, prohibiting mobile terminal access, reducing mobile terminal QoS, disconnecting suspicious device connections, and restricting UE access to the service area.

[0029] Furthermore, when the number of security events occurring on the same mobile terminal exceeds a set threshold, the policy duration for that mobile terminal is increased; when a security event occurring on a mobile terminal at the same time is related to events reported by the base station or core network, the policy duration for that mobile terminal is increased; when security events occurring on the same mobile terminal at different times are related, the policy duration for that mobile terminal is increased.

[0030] Furthermore, after receiving the session management security control policy, the SMF network element sends a receive confirmation response message to the PCF network element; after receiving the access and mobility management security control policy, the AMF network element sends a receive confirmation response message to the PCF network element; and the PCF network element sends a security control policy response to the security control module.

[0031] Furthermore, the security control module distributes the security control policy to the PCF network element through the N5 interface; the PCF network element establishes an N7 session with the SMF network element through the Npcf_SMPolicyControl service and distributes the session management security control policy to the SMF network element; the SMF network element establishes an N4 session with the UPF network element for communication; the PCF network element establishes an N15 session with the AMF network element through the Npcf_AMPolicyControl service and sends the access and mobility management security control policy to the AMF network element.

[0032] Furthermore, the security control module is also used to perform real-time analysis and decision-making on mobile terminals accessing the 5G core network, thereby achieving fine-grained and dynamic mobile terminal access control.

[0033] Furthermore, the security control module dynamically generates the security control policy based on the analysis of real-time monitoring data, ensuring comprehensive security management of mobile terminal access behavior.

[0034] The advantages of this invention are as follows:

[0035] 1) This method implements access control for mobile terminals on the mobile communication network side, generating dynamic security control policies based on real-time changes in the mobile network environment and the actual behavior of the mobile terminals, thus achieving refined management of mobile terminals. Compared with existing access control methods on the data network side, this method significantly improves the controllability and management capabilities of mobile terminal access behavior.

[0036] 2) Compared with the existing core network PCC strategy, this invention makes full use of the policy control function (PCF) in the existing mobile communication network and makes up for the lack of security protection strategies in the core network PCC, especially the lack of mobile terminal security access control strategies. It has the ability to generate and distribute dynamic security control strategies, which significantly improves the security protection capability of the mobile communication network for mobile terminals. Attached Figure Description

[0037] Figure 1 This is the access control flowchart of the present invention.

[0038] Figure 2 This is a diagram of the mobile terminal access control architecture based on the core network PCC policy. Detailed Implementation

[0039] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0040] like Figure 1The diagram illustrates the mobile terminal access control process based on the core network PCC policy. To implement this process, a security control module, known as the 5G core network security control NF (Network Function), is first set up within the 5G core network. This module generates security control policies based on data uploaded from mobile terminals, base stations, and the core network, and then distributes these policies to the PCF for session, access, and mobility control. This module conforms to 3GPP standards and can be directly integrated into the 5G core network SBA architecture. The remaining components are existing mobile terminals, base stations, and network elements within the 5G core network.

[0041] 1. The access control process is as follows:

[0042] 1) The security control module receives and stores the reported information of mobile terminal security monitoring data, base station security monitoring data, and core network security monitoring data.

[0043] 2) The security control module dynamically generates security control policies based on the reported data. The specific dynamic generation method is introduced in Section 2, which introduces the dynamic generation of security control policies.

[0044] 3) Through the N5 interface, the security control module distributes the security control policy to the PCF network element. The PCF network element sends a security control policy response to the security control module. This response includes whether the policy execution was successful, and if an error occurs, it includes the error code and the reason for the error.

[0045] 4) Based on the received security control policies (user ID, handling measures, etc.), the PCF network element generates a session management security control policy (session management security control PCC rule) for mobile terminal access control when the handling measures of the security control policy require the SMF network element or User Plane Function (UPF) to control the mobile terminal, such as when disconnecting the PDU session. When the handling measures in the security control policy require the AMF to control the mobile terminal, such as when restricting the location of the mobile terminal, it generates an access and mobility management security control policy (access and mobility management security control PCC rule). The specific generation method is introduced in Section 3, Mobile Terminal Access Control.

[0046] 5) The PCF network element communicates with the SMF network element through the Npcf_SMPolicyControl service to establish an N7 session and distribute the session management security control policy (session management security control PCC rule) to the SMF network element.

[0047] 6) The SMF network element sends a response message to the PCF network element to confirm that the relevant policy has been successfully received.

[0048] 7) The SMF network element and the UPF network element establish an N4 session for communication. The UPF network element executes session management security control policies, identifies corresponding abnormal service traffic, and performs access control on mobile terminals.

[0049] 8) The PCF network element establishes an N15 session with the AMF network element through the Npcf_AMPolicyControl service, and sends the access and mobility management security control policy (access and mobility management security control PCC rules) to the AMF network element. The AMF network element controls the access of the mobile terminal according to the access and mobility management security control policy, thereby performing access control on the mobile terminal.

[0050] 9) The AMF network element sends a response message to the PCF network element to confirm that the relevant policy has been successfully received.

[0051] 2. Dynamic generation of security control strategies

[0052] Security control policy templates are pre-built for different security events. During runtime, the security control module receives security events reported by mobile terminals, base stations, and core networks. The security control module matches the security control policy template according to the security event type, and further analyzes the security event to dynamically generate security control policies and send them to PCF network elements to achieve the purpose of access control.

[0053] 1) Construct a security control strategy template

[0054] Pre-analyze the signaling flow at different stages, including the signaling flow process and protocol fields within the signaling flow, list possible abnormal behaviors, and classify these abnormal behaviors into different security events, referring to the "Information Security Technology Network Security Incident Classification and Grading Guide". For different security events, develop corresponding security control policy templates. When the security control module receives a reported security event, it matches the corresponding security control policy template. Examples of security control policy templates are shown in Table 1.

[0055] Security control policy templates can be divided into session management security control policy templates and access and mobility management security control policy templates. The former mainly controls SMF and UPF network elements, thereby controlling mobile terminals; the latter mainly controls AMF network elements, thereby controlling mobile terminals. The main information in the policy template includes the mobile terminal ID (identifying the mobile terminal's SUPI, etc.), the policy duration (the duration of the issued security control policy, which needs to be determined after further analysis based on the reported security incident), and the handling measures (the specific control measures to be issued for the reported security incident, which needs to be determined after further analysis based on the reported security incident).

[0056] Table 1 Security Incident Types and Security Control Strategy Templates

[0057]

[0058] 2) The security control module matches security control strategy templates based on the type of security event.

[0059] After receiving security events reported by mobile terminals, base stations, and the core network, the security control module matches a security control policy template based on the reported security event category. Then, it performs security event analysis to determine the specific parameters corresponding to the security control policy template, further formulating a specific security control policy.

[0060] 3) Analyze security events to dynamically generate security control policies and distribute them to PCF network elements.

[0061] The aforementioned security control module determines the corresponding policy template for a security event based on the type of security event, but the specific parameters need to be dynamically determined.

[0062] 1. For mobile terminal IDs, the corresponding IDs from the collected security events are used to dynamically determine the mobile terminals that need to be controlled and adjusted.

[0063] 2. The duration of the strategy is set in a tiered manner. The event tiering is based on the "Information Security Technology: Guidelines for Classification and Grading of Network Security Incidents" and the "Information Security Technology: Guidelines for Network Security Early Warning," dividing events into four levels: general, significant, major, and extremely major. The corresponding time tiers are Level 1, Level 2, Level 3, and Level 4. Different levels of response measures are taken depending on the situation, allowing for different handling of events such as user error or attacks.

[0064] (1) If it is clearly an attack, such as a 5G abnormal terminal access attack event, set the policy duration to level four.

[0065] (2) For attacks with unclear attack behaviors, such as non-compliant 5G terminal configuration events, the duration of the policy is determined by combining multi-source data correlation analysis. Multi-source data correlation analysis includes analyzing the correlation between events reported by mobile terminals, base stations, and the core network. When a security event occurring on a mobile terminal at the same time is correlated with events reported by the base station and the core network, the policy duration for that mobile terminal is increased. Correlation is also performed based on ID, time, number of occurrences of the same event, and connections between different events. When security events occurring on the same mobile terminal at different times are correlated, the policy duration for that mobile terminal is increased. Based on the correlation, it is determined whether to enhance the security threat level of the event and increase the policy duration. For example, if a large number of 5G abnormal terminal access attack events occur simultaneously, exceeding the set threshold, the policy duration will be increased. As another example, if a 5G terminal PDU session abnormal event and a 5G network congestion event occur simultaneously, and the two events are set to be correlated, the policy duration will be increased.

[0066] (3) If the same mobile terminal experiences multiple security incidents exceeding the threshold, the duration of its control measures will be increased. For example, if the same mobile terminal experiences multiple 5G abnormal terminal access attack incidents or multiple different security incidents, the duration of its control measures will be increased when the threshold is exceeded.

[0067] 3. For a given event, the current policy template may contain multiple specific handling measures, which need to be further determined based on the specific behavior of the event. Examples are as follows, including but not limited to: For a 5G terminal security mode denial event, upon the first occurrence, allow the terminal to attempt access again; when the number of attempts reaches a threshold, prohibit the terminal from accessing, and set the duration of the policy. For a 5G terminal location violation event, if the 5G terminal's current location is violated, prohibit the terminal from accessing; when the terminal returns to a legal location, allow normal access.

[0068] 3. Mobile terminal access control

[0069] 1) The security control module issues security control policies through the Npcf_PolicyAuthorization and Npcf_AMPolicyAuthorization services of the PCF network element, thereby realizing dynamic access control for mobile terminals.

[0070] For example, when the security control module issues a security control policy that prohibits unauthorized terminals from accessing a certain application, the mobile terminal ID, service ID, and suggested handling measures (gating measures, etc.) contained in the security control policy are sent to the PCF network element through the Npcf_PolicyAuthorization service, requesting the PCF network element to execute the security control policy and generate an access security control policy for the user.

[0071] For example, when the security control module issues a security control policy that prohibits users with location violations from accessing the network, the terminal ID (such as UE SUPI), the duration of the policy, and the suggested handling measures (location information, etc.) contained in the security control policy are sent to the PCF network element through the Npcf_AMPolicyAuthorization service, requesting the PCF network element to execute the security control policy and generate access security control policies for user access and mobility management.

[0072] 2) The PCF network element generates Session Management Security Control (PCC) policies and / or Access and Mobility Management (APM) security control (PCC) policies based on the received security control policy information. To ensure the efficiency of the conversion from security control policies to PCC policies, this invention adopts the method specified in the 3GPP standard, whereby the PCF network element implements the conversion from security control policies to session management security control (PCC) policies and / or APM security control (PCC) policies.

[0073] For example, when an unauthorized mobile terminal accesses an application on the network, the security control module will issue a security control policy prohibiting the mobile terminal from accessing that application. Upon receiving this security control policy, the PCF network element generates a corresponding Session Management Security Control (PCC) policy based on 3GPP standards. This access control PCC policy includes the mobile terminal device ID, IP flow direction (uplink / downlink), and handling measures (blocking the IP flow of the mobile terminal device's service application, i.e., disabling the service application's data flow, etc.). Other security control policies generating PCC policies related to session management security control are similar to the policies described above.

[0074] For example, when a 5G terminal location violation occurs in the core network, the security control module will issue a security control policy prohibiting the mobile terminal from accessing the core network. Upon receiving this security control policy, the PCF network element generates a corresponding Access and Mobility Management Security Control (PCC) policy based on 3GPP standards. This PCC policy includes the terminal ID (e.g., UE SUPI), the policy duration, and the appropriate actions (such as restricting UE access to the service area). Other security control policies generating PCC policies related to access and mobility management security control are similar to the policies described above.

[0075] 3) After the Session Management Security Control (PCC) policy and Access and Mobility Management Security Control (PCC) policy are generated, they are sent to the corresponding SMF and AMF network elements for execution.

[0076] The session management security control process is as follows: The PCF network element uses the N7 interface established by the Npcf_SMPolicyControl service to send the generated session management security control PCC policy to the SMF network element. Simultaneously, the SMF network element sends the policy information to the UPF network element through the established N4 interface for execution. The UPF network element then executes the policy to control the terminal session.

[0077] For example, when an unauthorized terminal accesses an application in the network, the UPF network element can disconnect the corresponding PDU session and prohibit the terminal from accessing the corresponding service according to the issued policies (gating measures, etc.).

[0078] The access and mobility management security control process is as follows: the PCF network element uses the N15 interface established by the Npcf_AMPolicyControl service to send the generated access and mobility management security control PCC policy to the AMF network element. The AMF network element will then manage the access and mobility of the terminal according to the received PCC policy.

[0079] For example, when a 5G terminal location violation occurs, the AMF network element can, according to the restricted access area (PCC) policy issued by the PCF network element, prohibit the terminal from accessing the network until the terminal returns to the designated location.

[0080] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A method for mobile terminal access control based on core network PCC policy, comprising the steps of: 1) setting a security control module in the 5G core network; 2) the security control module generates a security control policy according to the mobile terminal security monitoring data, base station security monitoring data and core network security monitoring data in the current 5G core network and delivers it to the PCF network element of the 5G core network; wherein, the method for generating the security control policy is: 21) constructing a corresponding security control policy template for different security event types, including network attack events, abnormal behavior events, rule violation events, security hazard events and other events; 22) the security control module selects the corresponding security control policy template according to the received security event, determines the specific parameters of the corresponding security control policy template according to the security event, and forms a specific security control policy; the information of the security control policy template includes mobile terminal ID, policy duration and disposal measures; the security control policy template includes session management security control policy template and access and mobility management security control policy template; the session management security control policy template is used to control the SMF network element and the UPF network element; the access and mobility management security control policy template is used to control the AMF network element; the method for determining the specific parameters of the corresponding security control policy template is: determining the mobile terminal ID in the security control policy template according to the mobile terminal ID obtained from the security event; determining the policy duration according to the event level obtained from the security event, the event level including general, larger, major, and particularly major, corresponding to event classification of level one, level two, level three, and level four; determining the corresponding disposal measures according to the specific behavior of the security event, the disposal measures including but not limited to prohibiting mobile terminal access, reducing mobile terminal QOS, disconnecting suspicious device connection, and limiting UE access service area; 3) the PCF network element generates session management security control policy or access and mobility management security control policy for mobile terminal access control based on the received security control policy; 4) the PCF network element delivers the session management security control policy to the SMF network element, and then the SMF network element communicates with the UPF network element of the 5G core network, and the UPF network element executes the session management security control policy, identifies abnormal traffic and controls the access of the mobile terminal; 5) the PCF network element sends the access and mobility management security control policy to the AMF network element of the 5G core network, and the AMF network element controls the access of the mobile terminal according to the access and mobility management security control policy.

2. The method of claim 1, wherein, When the security events of the same mobile terminal exceed the set threshold, the policy duration of the mobile terminal is increased; when the security events of a mobile terminal at the same time have relevance with the events reported by the base station and the core network, the policy duration of the mobile terminal is increased; when the security events of the same mobile terminal at different times have relevance, the policy duration of the mobile terminal is increased.

3. The method of claim 1, wherein, The SMF network element sends an acknowledgement response message to the PCF network element after receiving the session management security control policy; The AMF network element sends an acknowledgement response message to the PCF network element after receiving the access and mobility management security control policy; and the PCF network element sends a security control policy response to the security control module.

4. The method of claim 1, wherein, The security control module sends the security control policy to the PCF network element through an N5 interface; and the PCF network element establishes an N7 session with the SMF network element through an Npcf_SMPolicyControl service, and sends the session management security control policy to the SMF network element. The SMF network element establishes an N4 session with the UPF network element for communication. The PCF network element establishes an N15 session with the AMF network element through an Npcf_AMPolicyControl service, and sends the access and mobility management security control policy to the AMF network element.

5. The method of claim 1, wherein, The security control module is further configured to perform real-time analysis and decision-making on a mobile terminal accessing a 5G core network, and to implement fine-grained and dynamic access control of the mobile terminal.

6. The method of claim 1, wherein, The security control module dynamically generates the security control policy based on analysis of real-time monitoring data, thereby ensuring comprehensive security management of access behavior of the mobile terminal.

Images