DHCP security enhancement method and system applied to 5G core network

Abstract

The invention provides a DHCP security enhancement method and system applied to a 5G core network, and belongs to the technical field of fifth generation mobile communication. The invention aims to solve the problems of potential safety hazard, complex network and high cost in the DHCP process in the prior art. The method comprises the following steps: receiving a DHCP request message of a user terminal, and determining a user identity; judging whether a security enhancement condition is met or not according to the strategy; if yes, safety information is added to the request message, and then the request message is forwarded to a DHCP server; and after a response message returned by the DHCP server is received, the security information in the response message is removed, and the purified response message is forwarded to the user terminal. According to the invention, the 5G core network is integrated with the security function, the network architecture is simplified, the cost is reduced, refined security control is realized, and the process is transparent to the terminal.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of fifth-generation mobile related technologies, in particular to a DHCP security enhancement method and system applied to a 5G core network. BACKGROUND

[0002] Fixed wireless access in the fifth-generation mobile communication technology provides a flexible broadband access method for users, especially in areas where optical fibers are difficult to deploy. In a typical fixed wireless access application scenario, a user terminal accesses a layer-two transmission network by establishing an Ethernet protocol data unit (PDU) session with a 5G network. After accessing, the user terminal usually needs to obtain an IP address from a dynamic host configuration protocol (DHCP) server in the layer-two network through DHCP to normally use network services.

[0003] In the prior art, when processing a DHCP message initiated by a user terminal, a 5G core network usually only acts as a transparent transmission channel and directly forwards the message to a layer-two network. This transparent forwarding mode has a significant security defect, i.e., a DHCP server cannot verify the legitimacy of a user terminal initiating a request, and any accessed terminal can obtain an IP address, thereby causing network security risks. In order to solve this problem, a common practice is to additionally deploy a dedicated DHCP relay device between the 5G core network and the layer-two network. The relay device is responsible for intercepting DHCP requests, adding authentication information, such as an Option82 field in the DHCP message, and then forwarding the message to the DHCP server. However, this way increases an additional hardware device, resulting in a more complex network architecture, and the deployment and maintenance costs are also correspondingly increased, and it cannot achieve flexible control based on the internal user policy of the 5G network. SUMMARY

[0004] The purpose of the present application is to provide a DHCP security enhancement method and system based on a 5G core network, aiming to solve the problems in the prior art that, in a fixed wireless access scenario, due to the 5G core network only acting as a transparent transmission channel or relying on an external DHCP relay device, the address allocation process has security risks, the network architecture is complex, the deployment cost is high, and the control is not flexible.

[0005] The first aspect of the present application provides a DHCP security enhancement method applied to a 5G core network, comprising: After receiving a DHCP request message from a user terminal, determining the user identity corresponding to the DHCP request message; determine whether a preset security enhancement condition is met, and add security information for authentication to the DHCP server in the DHCP request message to generate an enhanced DHCP request message if the preset condition is met; forward the enhanced DHCP request message to the DHCP server; remove the security information from the DHCP response message received from the DHCP server to generate a purified DHCP response message; forward the purified DHCP response message to the user terminal.

[0006] In some embodiments, the determining the user identity corresponding to the DHCP request message comprises: determining the user identity according to an Ethernet Protocol Data Unit (PDU) session context to which the DHCP request message belongs.

[0007] In some embodiments, the security information is an Option 82 field in the Dynamic Host Configuration Protocol (DHCP). Further, the preset security enhancement condition comprises an identification of enabling a DHCP security enhancement service in user subscription data associated with the user identity.

[0008] In some embodiments, the determining the policy associated with the user identity comprises: the 5G core network sends a policy query request carrying the user identity to a policy control function module; determining whether the preset security enhancement condition is met according to a policy decision received from the policy control function module.

[0009] In some embodiments, the security information is a security token containing a digital signature. Further, the security token is added to a custom option of the DHCP request message.

[0010] In some embodiments, the determining the user identity corresponding to the DHCP request message further comprises: the user terminal establishes an Ethernet PDU session with the 5G core network and records a correspondence between the PDU session and the user identity.

[0011] The second aspect of the present application provides a DHCP security enhancement system applied to a 5G core network, comprising: a receiving module configured to receive a DHCP request message from a user terminal and a DHCP response message from a DHCP server; a user identification module configured to determine a user identity corresponding to the received DHCP request message according to the received DHCP request message; a policy determination module configured to determine a policy associated with the user identity to determine whether a preset security enhancement condition is met; a message modification module configured to add security information for authentication to the DHCP server in the DHCP request message if the policy determination module determines that the preset condition is met, and configured to remove the security information from the received DHCP response message to generate a purified DHCP response message if the received DHCP response message contains the security information; a forwarding module configured to forward the DHCP request message with the added security information to the DHCP server, and forward the purified DHCP response message to the user terminal.

[0012] In some embodiments, the policy determination module is specifically configured to: send a policy query request carrying the user identity to a policy control function (PCF) entity, and determine whether the preset security enhancement condition is met according to a policy decision received from the PCF entity.

[0013] In some embodiments, the security information is an Option 82 field in the dynamic host configuration protocol (DHCP). In addition, the preset security enhancement condition includes that the user subscription data associated with the user identity contains an identifier indicating that the DHCP security enhancement service is enabled.

[0014] The technical solution provided by the present application has the following beneficial effects: first, the present application directly integrates the security enhancement function in the 5G core network, without the need to deploy a dedicated DHCP relay device, thereby simplifying the network architecture, reducing the hardware cost and operation and maintenance complexity, and reducing the network complexity and cost. Second, by determining based on the user identity and the policy within the 5G core network, fine and dynamic security control of the DHCP process is achieved, which can effectively prevent illegal terminals from obtaining IP addresses and improve security and control flexibility. Finally, the addition and removal of security information are completed within the 5G core network, and the entire security enhancement process is completely transparent to the user terminal, without the need to modify the terminal in any way, and has good compatibility. BRIEF DESCRIPTION OF DRAWINGS

[0015] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description thereof taken in conjunction with the accompanying drawings, in which:

[0016] Figure 1 A network architecture diagram of a DHCP security enhancement system provided by an embodiment of the present application.

[0017] Figure 2 A signaling interaction timing diagram of a DHCP security enhancement method provided by an embodiment of the present application.

[0018] Figure 3 A method flowchart for processing a DHCP message at a 5G core network side provided by an embodiment of the present application.

[0019] Figure 4 A structure block diagram of a core network function entity provided by an embodiment of the present application.

[0020] Figure 5 An electronic device structure diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0021] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0022] Before the various embodiments of the present application are described, the network architecture related to the present application is first described. Please refer to Figure 1 which shows a network architecture diagram of a dynamic host configuration protocol security enhancement system provided by an embodiment of the present application. The architecture is mainly applicable to a fixed wireless access scenario in the fifth generation mobile communication technology.

[0023] As shown in Figure 1As shown, the system architecture includes a user terminal (which can be a fixed wireless access terminal 10 in particular), a base station 20 (e.g., a GNB in a 5G network), a 5G core network 30, a layer-2 network 40, and a dynamic host configuration protocol server 50. The 5G core network 30 can logically include multiple network function entities, and this embodiment schematically shows a user plane function entity 31 and a session management function / policy control function entity 32. The fixed wireless access terminal 10 is a user equipment that needs to obtain an IP address to access the Internet or other data networks. The base station 20 provides wireless access services for the fixed wireless access terminal 10 and merges its data stream into the 5G core network 30.

[0024] The 5G core network 30 serves as the hub of the mobile communication network and is responsible for core functions such as user access control, session management, policy control, and user plane data routing. In the embodiments of the present application, key security enhancement functions are mainly performed by specific network elements in the 5G core network 30, such as the user plane function entity 31. The user plane function entity 31 is the anchor point of the user plane data and undertakes the responsibility of processing and forwarding user data packets. The session management function / policy control function entity 32 belongs to the control plane entity, wherein the session management function is responsible for the establishment, modification, and release of protocol data unit sessions, and the policy control function is responsible for providing network policies and charging control rules. The layer-2 network 40 is a layer-2 data transmission network, such as an Ethernet network, and the dynamic host configuration protocol server 50 is deployed in this network to dynamically allocate IP addresses and other network configuration parameters for devices accessing the network.

[0025] In Figure 1 In the architecture shown, the path of the user plane data stream (indicated by solid arrows) is as follows: the data packets generated by the fixed wireless access terminal 10 are transmitted to the user plane function entity 31 via the base station 20 through the N3 interface, then the user plane function entity 31 forwards the data packets to the layer-2 network 40 through the N6 interface, and finally reaches the dynamic host configuration protocol server 50 or an external data network. Correspondingly, the control plane signaling (indicated by dashed arrows) is exchanged among the fixed wireless access terminal 10, the base station 20, and the session management function / policy control function entity 32 and other control plane network elements to complete processes such as user registration, authentication, and session establishment. The technical solution provided by the present application is to enhance the function of the user plane function entity 31 so that it can intelligently perform security enhancement operations when forwarding dynamic host configuration protocol messages in the user plane.

[0026] In one embodiment of the present application, a basic scheme for implementing security enhancement based on user subscription information and standard dynamic host configuration protocol relay agent information option field is described in detail. This scheme aims to fully demonstrate the core process of the dynamic host configuration protocol security enhancement method provided by the present application.

[0027] For better understanding of the technical solutions, please combine Figure 1 , Figure 2 and Figure 3 . Figure 2 The signaling interaction timing chart involved in the present embodiment is as follows: Figure 3 The general method flow chart for processing dynamic host configuration protocol messages on the 5G core network side is as follows, and the present embodiment is a specific implementation of the flow chart.

[0028] First, as a preparation stage, a communication pipeline for carrying subsequent dynamic host configuration protocol messages needs to be established for the fixed wireless access terminal 10. Specifically, after the fixed wireless access terminal 10 is powered on, it initiates a registration and authentication process with the 5G core network 30. After authentication, the fixed wireless access terminal 10 requests to establish an Ethernet type protocol data unit session to access the layer 2 network 40. The establishment request of the protocol data unit session is processed by the session management function entity 32, which will cooperate with the user plane function entity 31 to allocate necessary network resources for the session, such as establishing a protocol data unit session anchor on the user plane function entity 31, and allocating a tunnel endpoint identifier for the N3 interface tunnel between the base station 20 and the user plane function entity 31. During the session establishment process, the session management function entity 32 obtains the user's subscription data from the user data management function entity, and records the correspondence between the protocol data unit session and the user's unique identity (such as the user's permanent identity SUPI). These information collectively constitute the context of the protocol data unit session, and are issued to the user plane function entity 31. At this point, a user plane data path from the fixed wireless access terminal 10 to the user plane function entity 31 has been established, so that the user plane function entity 31 can accurately associate to a specific protocol data unit session and corresponding user identity according to the N3 tunnel (identified by the tunnel endpoint identifier) to which the data packet belongs. This step lays the foundation for subsequent identification of the source user identity of the dynamic host configuration protocol request message at the user plane function entity 31.

[0029] In the setting of the present embodiment, the user's subscription data contains a specific service identifier, such as "dynamic host configuration protocol security enhancement service enabled". This subscription information is obtained by the session management function entity 32 at the time of protocol data unit session establishment, and is issued to the user plane function entity 31 for storage as part of the policy information.

[0030] After the successful establishment of the protocol data unit session, since the IP address has not been configured, the fixed wireless access terminal 10 will initiate a dynamic host configuration protocol process to obtain the address. Referring to Figure 2 , the process is as follows: Step S201, the fixed wireless access terminal 10 broadcasts a DHCP Discover message on its local network interface, the source IP address of which is 0.0.0.0 and the destination IP address of which is 255.255.255.255. After the base station 20 captures this broadcast message, it encapsulates the DHCP Discover message in a general packet radio service tunneling protocol packet and sends the packet to the user plane function entity 31 through the N3 interface tunnel because the protocol data unit session has been established for the fixed wireless access terminal 10. The header of the general packet radio service tunneling protocol packet contains the tunnel endpoint identifier allocated for the protocol data unit session.

[0031] The user plane function entity 31 receives the general packet radio service tunneling protocol packet, and this process corresponds to step S301 (receiving a DHCP request message) of Figure 3 The user plane function entity 31 decapsulates the packet and identifies that it is a dynamic host configuration protocol message by checking the Ethernet frame header and the IP header in the internal load. Then, the user plane function entity 31 performs step S302 (determining a user identity) of Figure 3 Specifically, the user plane function entity 31 extracts the tunnel endpoint identifier from the header of the general packet radio service tunneling protocol packet and queries the locally stored protocol data unit session context information table by using the identifier to accurately find the protocol data unit session ID and the corresponding user identity (SUPI) associated with the tunnel endpoint identifier.

[0032] Then, the flow proceeds to step S303 (judging whether a security enhancement condition is met) of Figure 3 In this embodiment, the judgment is based on the static subscription data of the user. The user plane function entity 31 checks the policy information associated with the identified user identity to find whether there is an identifier of “dynamic host configuration protocol security enhancement service enabled”. Based on the premise setting of this embodiment, the user has subscribed to this service, and the judgment result is “yes”.

[0033] Since the security enhancement condition is met, the flow enters step S304 (performing security enhancement) of Figure 3S304 (add security information). The user plane function entity 31 modifies the original DHCP Discover message and adds a Relay Agent Information Option field of the Dynamic Host Configuration Protocol. The option field itself contains multiple sub-options, in which the user plane function entity 31 can fill in information that can uniquely identify the user or the access location of the user. For example, the unique identifier of the protocol data unit session can be filled in the "Circuit ID" sub-option, or the SUPI or the encrypted / hashed user identity of the user can be filled in the "Remote ID" sub-option. In this way, an enhanced DHCP Discover message carrying authentication information is generated. This process corresponds to step S202 of Figure 2 the "add security information" mark at the user plane function entity 31.

[0034] Subsequently, the user plane function entity 31 forwards the enhanced DHCP Discover message (corresponding to step S202 of Figure 2 ) to the Layer 2 network 40 through the N6 interface, and finally the switching device of the Layer 2 network 40 delivers the message to the Dynamic Host Configuration Protocol server 50. This process corresponds to step S306 (forward the request message) of Figure 3 .

[0035] After receiving the enhanced DHCP Discover message, the Dynamic Host Configuration Protocol server 50 parses the Relay Agent Information Option field. The server 50 has been pre-configured with a corresponding security policy, for example, it can maintain an authorized user list or an authorized protocol data unit session ID list. The server 50 compares the information (such as the SUPI or the protocol data unit session ID) extracted from the Relay Agent Information Option field with its own authorized list. If the comparison is successful, the authentication is passed, the server 50 selects an available IP address from its address pool, and constructs a DHCP Offer message as a response. According to the specification of the Dynamic Host Configuration Protocol, the response message usually needs to contain the Relay Agent Information Option field carried in the request message.

[0036] The Dynamic Host Configuration Protocol server 50 sends the DHCP Offer message (corresponding to step S203 of Figure 2 ) containing the IP address information and the Relay Agent Information Option field back to the user plane function entity 31.

[0037] The user plane function entity 31 receives the DHCP Offer message, which corresponds to step S204 of Figure 3The process proceeds to the "Receive DHCP Response Message" step. User plane functional entity 31 examines the message and finds that it contains a relay agent information option field, and can identify that this field was added by itself in the uplink path (e.g., by checking the field content format or comparing it with the session context). Therefore, the process continues... Figure 3 The judgment step "Does the response message contain security information?" is executed. If the result is "yes", then step S305 (remove security information) is performed. User plane functional entity 31 completely removes the relay agent information option field from the DHCP Offer message, and may need to recalculate the checksums of the IP header and UDP header to generate a cleaned-up DHCP Offer message that does not contain any relay agent information. This process corresponds to... Figure 2 The "Remove security information" label is located at point 31 of the user plane functional entity.

[0038] Finally, user plane functional entity 31 executes. Figure 3 Step S306 (forwarding the response message) involves sending this purified DHCP Offer message (corresponding to...) Figure 2 (Step S204) The message is re-encapsulated into the downlink General Packet Radio Service Tunneling Protocol (GPRS) tunnel of the corresponding protocol data unit session and sent to base station 20 via the N3 interface. After decapsulation, base station 20 forwards this "clean" DHCP Offer message to fixed wireless access terminal 10.

[0039] After receiving the DHCP Offer message, the fixed wireless access terminal 10 will continue the subsequent Dynamic Host Configuration Protocol (DHCP) process, that is, send a DHCP Request message to formally request the IP address. The uplink and downlink processing of this DHCP Request message is exactly the same as the DHCP Discover / Offer process described above: the user plane function entity 31 will also add the relay agent information option field to it on the uplink path and remove the field from the DHCP ACK message returned by the DHCP server 50 on the downlink path.

[0040] In this embodiment, the user plane functional entity 31 of the 5G core network 30 acts as an intelligent and transparent Dynamic Host Configuration Protocol (DHCP) relay proxy. It utilizes existing user identity and session information within the 5G network to add a user-subscribed authentication step to the DHCP process, effectively preventing unsubscribed or unauthorized users from obtaining IP addresses through DHCP. Furthermore, this solution eliminates the need for additional physical DHCP relay equipment in the network, simplifying the network architecture and reducing costs. The entire security enhancement process is completely transparent to the fixed wireless access terminal 10, requiring no modifications to the terminal.

[0041] As an alternative implementation, this embodiment describes a security enhancement scheme based on dynamic policy triggering, which can be considered as a variant of embodiment 1. In this scheme, whether to perform security enhancement operation no longer depends on static user subscription data, but is dynamically decided by policy control function entity 32 according to real-time network status or more complex policy rules.

[0042] Most of the procedures in this embodiment are the same as those in embodiment 1, including the initial steps of establishing a protocol data unit session, fixed wireless access terminal 10 initiating a DHCP Discover message, forwarding by base station 20, and user plane function entity 31 receiving the message and identifying the user identity. The core difference lies in Figure 3 The implementation of step S303 (determining whether the security enhancement condition is met) in the flow shown.

[0043] In embodiment 1, user plane function entity 31 makes the determination by querying static subscription data cached locally or obtained from session management function entity 32. Unlike this, in this embodiment, after determining the user identity (e.g. SUPI) in step S302, user plane function entity 31 will actively interact with policy control function entity 32 to obtain dynamic policy.

[0044] Specifically, user plane function entity 31 will initiate a policy query request to policy control function entity 32. This request can be carried based on the standard interface and protocol defined in 5G (e.g. service interface based on HTTP / 2), and the request message will at least contain the identity of the current user (SUPI), and can also contain more rich context information, including but not limited to: 1. Access location information of the terminal (such as cell ID or geographic location information); 2. Network slice identifier to which the terminal belongs; 3. Current time information; 4. Type of protocol data unit session (Ethernet type); 5. Application identifier of the request (which can be identified as Dynamic Host Configuration Protocol here).

[0045] After receiving this policy query request, policy control function entity 32 will evaluate according to pre-configured policy rules. These rules can be very flexible and complex, far beyond simple static subscription identifier. For example, the following policy rules can be configured in policy control function entity 32: Rule 1: “If the access location of the user belongs to ‘high security risk area’ (e.g. an area covered by a public, untrusted access point), security enhancement must be enabled for the user’s Dynamic Host Configuration Protocol request.” Rule 2: "If the network slice the user belongs to is dedicated for IoT devices and the current network security posture level is 'high', then enable security enhancement for all DHCP requests in this slice." Rule 3: "Enable security enhancement for all DHCP requests from enterprise users during 9:00-18:00 on weekdays." The policy control function entity 32 makes matching and decision based on the received context information and internal policy rules. If the current situation meets the condition for enabling security enhancement, the policy control function entity 32 returns a policy decision response to the user plane function entity 31. The response contains an explicit instruction, such as a Boolean flag EnableDhcpSecurity = true, or a specific operation instruction code.

[0046] Upon receiving the policy decision returned by the policy control function entity 32, the user plane function entity 31 parses the instruction. If the instruction requires enabling security enhancement, the user plane function entity 31 determines the result of step S303 to be "yes", and then performs the same step S304 (adding security information) as in Embodiment 1, i.e. adding the relay agent information option field in the DHCP Discover message.

[0047] On the contrary, if the policy control function entity 32 considers that security enhancement is not required (e.g. the user is accessing in a trusted home network) based on policy evaluation, it returns an instruction of EnableDhcpSecurity = false. In this case, the user plane function entity 31 determines the result of step S303 to be "no", and it will skip step S304, and directly perform step S306, i.e. forwarding the original, unmodified DHCP Discover message to the DHCP server 50.

[0048] The subsequent procedures, including the response of the DHCP server 50, the reception of the response message by the user plane function entity 31, the judgment and removal of possible security information (if added in the uplink), and the forwarding of the cleaned response message to the fixed wireless access terminal 10, are all the same as in Embodiment 1.

[0049] Through the scheme of this embodiment, the trigger mechanism of dynamic host configuration protocol security enhancement becomes highly dynamic and intelligent. The 5G core network 30 can determine in real time and on demand whether to perform security reinforcement on a certain dynamic host configuration protocol request according to multi-dimensional information such as users, locations, times, and network states. Compared with the static subscription switch, this approach provides more fine-grained and flexible security management and control capabilities, and can better adapt to complex network environments and changing security threats. For example, dynamic host configuration protocol authentication can be implemented only for roaming users or users in specific public Wi-Fi switching scenarios, while a simplified pass-through mode is adopted for home fixed users, thereby achieving a better balance between security and processing efficiency.

[0050] This embodiment describes another variant, in which the security information for authentication is no longer limited to the standard relay agent information option field, but adopts a self-defined and more secure format, such as a security token containing a digital signature. This embodiment aims to illustrate the universality of the scheme proposed in this application, and the core idea thereof does not depend on any specific dynamic host configuration protocol option.

[0051] The flow framework of this embodiment also follows the logic shown in Figure 3 The main difference between this embodiment and Embodiments 1 and 2 is the step S304 (adding security information) and the authentication method on the dynamic host configuration protocol server 50 side.

[0052] It is assumed in this embodiment that the condition for triggering security enhancement has been met (whether through the static subscription method of Embodiment 1 or the dynamic policy method of Embodiment 2). When the flow enters step S304, the user plane function entity 31 no longer simply adds the relay agent information option field, but performs a series of more complex operations to generate and add a self-defined security token.

[0053] Specifically, the security token can be a JSON web token. The user plane function entity 31 performs the following operations to generate this token: 1. Build the payload of the token: The payload part is a JSON object that contains a series of authentication statements. These statements can include: sub (Subject): The unique identity of the user, such as SUPI.

[0054] sid (Session ID): The unique identifier of the current protocol data unit session.

[0055] iat (Issued At): The token issuance timestamp, used to prevent replay attacks.

[0056] exp (Expiration Time): Expiration timestamp of the token, further enhancing security by setting a short validity period (e.g., seconds).

[0057] aud (Audience): Intended recipient of the token, i.e., the identity of the Dynamic Host Configuration Protocol server 50.

[0058] iss (Issuer): Issuer of the token, i.e., the unique identity of the user plane function entity 31. An example of a payload is as follows: {"sub":"imsi-1234567890", "sid":"pdu-session-abc", "iat":1678886400, "exp":1678886405, "aud":"dhcp-server-01", "iss":"upf-01"}.

[0059] 2. Generate digital signature: The user plane function entity 31 signs the header (specifying the signature algorithm, such as RS256) and the above-mentioned payload using a pre-configured private key. The signature algorithm can use asymmetric encryption algorithms such as RSA or elliptic curve algorithms. This digital signature ensures that the token has not been tampered with during transmission and was indeed issued by the legitimate user plane function entity 31.

[0060] 3. Combine into complete token: The Base64Url encoded header, payload, and signature are concatenated with a dot (.) to form the final JSON Web Token string.

[0061] After generating the secure token, the user plane function entity 31 needs to add it to the Dynamic Host Configuration Protocol request message. Since this is not a standard option, the user plane function entity 31 can place it in a custom option of the Dynamic Host Configuration Protocol, such as using DHCP Option 125 (Vendor-Specific Information Option) or other option numbers reserved for private use. The user plane function entity 31 inserts the generated JSON Web Token string as the value of this custom option into the option area of the Dynamic Host Configuration Protocol request message.

[0062] The enhanced Dynamic Host Configuration Protocol request message is forwarded to the Dynamic Host Configuration Protocol server 50. To go with this solution, the Dynamic Host Configuration Protocol server 50 also needs to be upgraded in terms of capabilities so that it can parse this custom Dynamic Host Configuration Protocol option and verify the security token. The server 50 performs the following authentication steps: 1. Extract token: Parse the custom option from the received Dynamic Host Configuration Protocol request message and extract the JSON Web Token string.

[0063] 2. Verify signature: The dynamic host configuration protocol server 50 is pre-configured with the public key of the user plane function entity 31 that issued the token. It uses the public key to verify the signature of the token. If the signature is invalid, it indicates that the token is tampered or from a fake source, and the authentication fails.

[0064] 3. Verify claims: If the signature verification passes, the server 50 further checks the claims in the token payload, such as checking the exp timestamp to ensure that the token is not expired, checking the aud to ensure that the token is issued to itself, checking the iss to confirm that the issuer is trusted. Finally, it performs authorization check using the sub (user identity) or sid (session ID) to confirm that the user has the right to obtain the IP address.

[0065] Only when all the verifications and checks pass, the dynamic host configuration protocol server 50 will allocate the IP address and generate a dynamic host configuration protocol response message (e.g., DHCP Offer). Similarly, the response message also carries the custom option and security token received in the request.

[0066] When the user plane function entity 31 receives this response message, in step S305 (remove security information), it identifies and removes the entire custom option, thereby generating a completely "clean" response message for the fixed wireless access terminal 10.

[0067] The scheme shown in this embodiment provides higher security than the standard relay agent information option by using a custom security token with digital signature. The digital signature can effectively prevent tampering of authentication information by man-in-the-middle attacks, and mechanisms such as timestamp can prevent replay attacks. This indicates that the core idea of the present application, i.e., transparent enhancement and purification of dynamic host configuration protocol messages by the 5G core network on the user plane path, has good scalability, and can flexibly adapt various security mechanisms from simple information insertion to complex cryptographic tokens according to different security requirements.

[0068] This embodiment describes in detail the 5G core network function entity for implementing the above method from the perspective of system and device. The entity can be a physical device, or a virtualized network function or cloud-native network function running on general hardware.

[0069] Please refer to Figure 4This is a block diagram illustrating the internal structure of a core network functional entity (e.g., an enhanced user plane functional entity 31) provided in an embodiment of this application. The entity typically includes a communication interface, one or more processors, and a memory in hardware. The memory stores computer program instructions, which, when executed by the processor, implement the Dynamic Host Configuration Protocol (DHCP) security enhancement method described in this application. Logically, the entity can be divided into the following cooperating modules: The receiving module 310 is responsible for receiving and sending data packets through the entity's communication interface. In this scheme, this module is specifically responsible for receiving Dynamic Host Configuration Protocol (DHCP) request messages encapsulated in GPRS Tunneling Protocol (GPRS) from base station 20 on the N3 interface, and receiving DHCP response messages encapsulated in ordinary IP from DHCP server 50 on the N6 interface. The receiving module 310 has deep packet inspection capabilities, enabling it to parse GPRS headers and IP / UDP / DHCP headers to identify DHCP messages requiring special processing and deliver them to subsequent modules.

[0070] User identification module 320 is connected to receiving module 310. When receiving module 310 captures an uplink Dynamic Host Configuration Protocol (DMP) request message, user identification module 320 is activated. It extracts the tunnel endpoint identifier from the GPRS Tunneling Protocol header of the message and then queries a session context table created and maintained by the control plane (session management function entity 32) during Protocol Data Unit (PDU) session establishment. This table maps the tunnel endpoint identifier to the PDU session ID and user identity (SUPI). Through this query, the module can accurately determine the unique user identity that initiated the DMP request and pass this identity information to policy query module 330.

[0071] The strategy query module 330, upon receiving the user identity transmitted from the user identification module 320, is responsible for executing... Figure 3 Step S303 in the module determines whether the security enhancement conditions are met. This module can be configured to operate in multiple modes to support different implementations. In the mode supporting Implementation 1, the module queries the local policy cache associated with the user's identity or queries the user's subscription data through the session management function entity 32 via an internal interface, checks for the existence of an identifier such as "Dynamic Host Configuration Protocol Security Enhancement Service," and outputs a "enabled" or "disabled" decision accordingly. In the mode supporting Implementation 2, the module constructs a policy query request (containing user identity, location, and other information), sends it through the service interface facing the policy control function entity 32, waits to receive the policy decision returned by the policy control function entity 32, and then outputs a decision based on the decision. The decision result of this module is then passed to the message modification module 340.

[0072] The packet modification module 340, as a module for performing core packet operations, receives the original dynamic host configuration protocol packet from the receiving module 310 and the decision from the policy query module 330. Its function is bidirectional: for the upper dynamic host configuration protocol request packet, if the decision of the policy query module 330 is “enable”, the module generates the corresponding security information according to the preset configuration and adds it to the packet, for example, generates and inserts the relay agent information option field in the configuration supporting embodiment 1, or calls the encryption library to generate the signed JSON network token and encapsulates it into the custom option in the configuration supporting embodiment 3; if the decision is “not enable”, the packet is not modified. For the lower dynamic host configuration protocol response packet, the module checks whether the security information (whether it is the relay agent information option or the custom token) added by itself is contained in the packet, if detected, the removal operation is performed, the option is deleted from the packet, and the related length and checksum fields are corrected to generate the purified packet; if not detected, no modification is made. The processed packet will be passed to the forwarding module 350.

[0073] The forwarding module 350 is responsible for sending the packet to the correct next hop. The module receives the packet processed by the packet modification module 340, and decides its exit according to the destination of the packet. For the request packet sent to the dynamic host configuration protocol server 50, it will route it out as a standard IP packet through the N6 interface. For the response packet sent to the fixed wireless access terminal 10, it will use the downlink tunnel endpoint identifier associated with the protocol data unit session to encapsulate the packet in a general packet radio service tunneling protocol packet, and send it to the base station 20 through the N3 interface.

[0074] The above-mentioned receiving module 310, user identification module 320, policy query module 330, packet modification module 340 and forwarding module 350 cooperate closely to form an efficient dynamic host configuration protocol packet processing pipeline inside the user plane function entity 31, and completely realize the function of transparent dynamic host configuration protocol security enhancement inside the 5G core network proposed in the present application. The system design is clear, the modularization degree is high, and it is easy to implement and deploy.

[0075] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. The present application can have various changes and modifications for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

[0076] In summary of the above various pre-selected embodiments, the scheme provided by the present application specifically includes the following steps: Step S1_1: the user subscribes to the DHCP security enhancement information in the 5G core network.

[0077] Step S1_2: the user registers the 5G FWA terminal to the 5G core network; Step S1_3: the 5G FWA terminal initiates an Ethernet PDU (Protocol Data Unit) session establishment request to the 5G core network; Step S1_4: the 5G core network allocates PDU session resources for the 5G FWA, and associates the resources to the PDU session identifier; Step S1_5: the 5G core network sends a request for allocating PDU resources to the base station; Step S1_6: the base station allocates resources for the PDU and sends an establishment reception response; Step S1_7: the 5G core network returns a PDU session establishment response to the 5G FWA terminal, and records the relationship between the base station PDU resources and the core network PDU resources; at this point, the Ethernet PDU session establishment of the 5G FWA is completed.

[0078] Process of the 5G FWA terminal requesting address allocation from the fixed network DHCP: Step S2_1: the 5G FWA terminal sends a DHCP message; Step S2_2: the base station encapsulates the message in a GTP PDU and sends it to the 5G core network; Step S2_3: based on the saved relationship between the base station side PDU resources and the core network PDU resources, the 5G core network finds the corresponding PDU session, and thus determines the user corresponding to the session; Step S2_4: the 5G core network strips the GTPU header of the message, finds that it is a DHCP message and that the user of the session has subscribed to DHCP security enhancement, and then adds Option82 in the DHCP message, which carries the DHCP security enhancement information subscribed by the user; Step S2_5: the 5G core network sends the DHCP message with added Option82 to the Layer 2 network DHCP Server through the N6 interface; Step S2_6: the DHCP Server receives the DHCP message, performs security authentication according to the security information carried in the Option82 in the message, confirms that it is a secure user, and performs IP address allocation and other processing; Step S2_7: the DHCP Server returns a DHCP response, carrying the Option82 carried in the request; Step S2_8: The 5G core network receives the DHCP message from the Layer 2 network DHCP Server to the FWA, finds the PDU session, and discovers that the core network added Option 82 information. The core network deletes the Option 82 information in the DHCP message, encapsulates the processed DHCP message into the PDU session and sends it to the base station, which then sends it to the 5G FWA terminal. Compared to a typical DHCP relay, the DHCP address security allocation method described in this invention does not require an additional DHCP relay node. It can flexibly subscribe to DHCP security enhancement information for 5G FWA terminal users in the core network, realize DHCP security address allocation for 5G FWA terminals, and enrich the security enhancement methods for 5G FWA converged layer 2 transmission networks.

[0079] Below, for reference Figure 5 This describes an electronic device according to embodiments of the present application. Figure 5 A block diagram of an electronic device according to an embodiment of this application is illustrated.

[0080] like Figure 5 As shown, the electronic device 500 includes one or more processors 510 and memory 520.

[0081] The processor 510 may be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and may control other components in the electronic device 500 to perform desired functions.

[0082] The memory 520 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 510 may execute the program instructions to implement the DHCP security enhancement method for 5G core networks and / or other desired functions described in the various embodiments of this application above. Various contents, such as category mapping relationships, may also be stored in the computer-readable storage medium.

[0083] In one example, the electronic device 500 may also include an input device 530 and an output device 540, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0084] Further, the input device 530 can include, for example, a keyboard, a mouse, an interface, and the like. The output device 540 can output various information including analysis results and the like to the outside. The output device 540 can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto, and the like.

[0085] Of course, in order to simplify, Figure 5 Only some of the components of the electronic device related to the present application are shown in the block diagram of FIG. 5, and components such as a bus, an input / output interface, and the like are omitted. In addition to this, the electronic device can include any other appropriate components according to the specific application.

[0086] In addition to the above-described method and device, an embodiment of the present application can be a computer program product including computer program instructions that, when executed by a processor, cause the processor to perform the steps of the method for DHCP security enhancement applied to a 5G core network according to various embodiments of the present application described in the above "Exemplary Method" section of the specification.

[0087] The computer program product can be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, C++, and the like, and conventional procedural programming languages, such as the "C" programming language, or the like. The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device, or entirely on the remote computing device or server.

[0088] In addition, an embodiment of the present application can also be a computer readable storage medium having stored thereon computer program instructions, which, when executed by a processor, cause the processor to perform the steps of the method for DHCP security enhancement applied to a 5G core network according to various embodiments of the present application described in the above "Exemplary Method" section of the specification.

[0089] The computer readable storage medium can be any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0090] The foregoing description has been presented for the purposes of illustration and description. Furthermore, the description is not intended to limit the embodiments of the application to the form disclosed herein. Although various example aspects and embodiments have been discussed above, those of ordinary skill in the art will appreciate a variety of modifications, alternatives, permutations, additions, and sub-combinations of the described aspects and embodiments.

Claims

1. A DHCP security enhancement method applied to 5G core networks, characterized in that, include: Upon receiving a DHCP request message from a user terminal, the user identity corresponding to the DHCP request message is determined. Determine the policy associated with the user's identity to determine whether the preset security enhancement conditions are met; And when the preset security enhancement conditions are met, security information for authenticating with the DHCP server is added to the DHCP request message to generate an enhanced DHCP request message; The enhanced DHCP request message is forwarded to the DHCP server; After receiving a DHCP response message containing the security information from the DHCP server, the security information is removed from the DHCP response message to generate a cleaned DHCP response message; The purified DHCP response message is forwarded to the user terminal.

2. The method according to claim 1, characterized in that, Determining the user identity corresponding to the DHCP request message includes: The user's identity is determined based on the Ethernet Protocol Data Unit (PDU) session context to which the DHCP request message belongs.

3. The method according to claim 1, characterized in that, The security information is the Option82 field in the Dynamic Host Configuration Protocol; Furthermore, the preset security enhancement conditions include: the user subscription data associated with the user identity contains an identifier for enabling DHCP security enhancement services.

4. The method according to claim 1, characterized in that, The strategy for determining the association with the user identity includes: The 5G core network sends a policy query request carrying the user's identity to the policy control function module. Based on the policy decision received from the policy control function module, determine whether the preset security enhancement conditions are met.

5. The method according to claim 1, characterized in that, The security information is a security token containing a digital signature; Furthermore, the security token is added to the custom options of the DHCP request message.

6. The method according to claim 1, characterized in that, The process of determining the user identity corresponding to the DHCP request message further includes: The user terminal establishes an Ethernet PDU session with the 5G core network and records the correspondence between the PDU session and the user identity.

7. A DHCP security enhancement system applied to a 5G core network, characterized in that, include: The receiving module is used to receive DHCP request messages from user terminals and DHCP response messages from DHCP servers. The user identification module is used to determine the user identity corresponding to the DHCP request message based on the DHCP request message received by the receiving module. The policy judgment module is used to judge the policy associated with the user identity in order to determine whether the preset security enhancement conditions are met. The message modification module is used to add security information for authenticating with the DHCP server to the DHCP request message when the policy judgment module determines that the preset security enhancement conditions are met, and to remove the security information from the DHCP response message after the receiving module receives the DHCP response message containing the security information, so as to generate a cleaned DHCP response message. The forwarding module is used to forward DHCP request messages with the added security information to the DHCP server, and to forward the purified DHCP response messages to the user terminal.

8. The system according to claim 7, characterized in that, The strategy determination module is specifically used for: Send a policy query request carrying the user's identity to the Policy Control Function (PCF) entity, and determine whether the preset security enhancement conditions are met based on the policy decision received from the PCF entity.

9. The system according to claim 8, characterized in that, The security information is the Option82 field in the Dynamic Host Configuration Protocol; Furthermore, the preset security enhancement conditions include: the user subscription data associated with the user identity contains an identifier for enabling DHCP security enhancement services.

Images