Signaling security protection method, device, system, equipment, medium and product

Abstract

The invention provides a signaling security protection method, device, system, equipment, medium and product, and relates to the technical field of data interaction, the method is applied to a UPF, and the method comprises the following steps: based on the flow of a PFCP (Packet Forwarding Control Protocol) signaling of an interface between the UPF and a session management function network element SMF, the security of a field of the PFCP signaling, and an abnormal port where the UPF is butted with a network security component; determining a threat comprehensive score; determining a protection strategy of signaling security based on the threat comprehensive score; and performing security protection on the PFCP signaling based on the protection strategy. According to the invention, the defense level is dynamically regulated and controlled according to the threat comprehensive score, the signaling security is ensured, the influence of the protection strategy on the system performance is reduced as far as possible, the security of the protection strategy and the influence on the system performance can be better balanced, and the security protection efficiency and the network stability and reliability are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data interaction, and in particular to a signaling security protection method, device, system, equipment, medium and product. BACKGROUND

[0002] In the 5th Generation Mobile Communication Technology (5G) core network architecture, the N4 interface between the User Plane Function (UPF) network element and the Session Management Function (SMF) network element relies on the Packet Forwarding Control Protocol (PFCP) to realize signaling interaction. According to the 3rd Generation Partnership Project Technical Specifications (3GPP TS 29.244) standard, the PFCP protocol is implemented based on the User Datagram Protocol (UDP) transport layer, adopts a lightweight connectionless design to improve signaling interaction efficiency, and uses the Session Endpoint Identifier (SEID) and the Tunnel Endpoint Identifier (TEID) as key session parameters to uniquely identify the PFCP session and the Tunnel Endpoint (GTP), respectively.

[0003] With the development of edge computing and Network Functions Virtualization (NFV) technology, the UPF is sinking to the edge node (such as the base station side and the park computer room), which has become a trend. Compared with the traditional centralized core network architecture, the edge UPF deployment exposes the N4 interface in a more open network environment, and the signaling is more vulnerable to attacks from various networks. However, the traditional signaling security protection method does not dynamically adjust the protection strategy for multi-dimensional attacks, and the use of a unified protection strategy cannot balance the security of the protection strategy and the impact on system performance, thereby reducing the efficiency of security protection and the stability and reliability of the network. SUMMARY

[0004] The present application provides a signaling security protection method, device, system, equipment, medium and product, to solve the problem that the uniform protection strategy cannot balance the security of the protection strategy and the influence on the system performance in the prior art, reduce the defects of the efficiency of security protection and the stability and reliability of the network, realize the threat comprehensive score representing the protection level by multi-dimensional attack detection, dynamically regulate the defense level according to the threat comprehensive score, and respond to various network attacks in a targeted manner, while ensuring the security of signaling, as much as possible to reduce the influence of the protection strategy on the system performance, which can better balance the security of the protection strategy and the influence on the system performance, improve the efficiency of security protection and the stability and reliability of the network.

[0005] The present application provides a signaling security protection method, applied to a user plane function network element UPF, comprising the following steps: Based on the traffic of the packet forwarding control protocol PFCP signaling of the interface between the UPF and the session management function network element SMF, the security of the field of the PFCP signaling, and the abnormal port of the UPF and the network security component, determine the threat comprehensive score; Based on the threat comprehensive score, determine the protection strategy of signaling security; Based on the protection strategy, perform security protection on the PFCP signaling; wherein the period of the SEID hopping mechanism in different protection strategies is different.

[0006] According to the signaling security protection method provided by the present application, based on the traffic of the packet forwarding control protocol PFCP signaling of the interface between the UPF and the session management function network element SMF, the security of the field of the PFCP signaling, and the abnormal port of the UPF and the network security component, determine the threat comprehensive score, comprising: based on the traffic of the PFCP signaling, determine the first perceived threat information; based on the security of the field of the PFCP signaling, determine the second perceived threat information; based on the abnormal port of the UPF and the network security component, determine the third perceived threat information; based on the first perceived threat information, the second perceived threat information and the third perceived threat information, determine the threat comprehensive score.

[0007] According to the signaling security protection method provided by the application, the protection strategy of signaling security is determined based on the threat comprehensive score, including: in the case that the threat comprehensive score meets a first score threshold, the protection strategy is to start a session endpoint identifier (SEID) hopping mechanism, set a first hopping period, and only perform binding verification of a packet detection rule identifier and a tunnel endpoint identifier in a session creation stage of the UPF and the SMF; in the case that the threat comprehensive score meets a second score threshold, the protection strategy is to start the session endpoint identifier (SEID) hopping mechanism, set a second hopping period, and perform the binding verification of the packet detection rule identifier and the tunnel endpoint identifier in the whole session life cycle; the first hopping period is greater than the second hopping period; in the case that the threat comprehensive score meets a third score threshold, the protection strategy is to continuously start the session endpoint identifier (SEID) hopping mechanism, set a third hopping period, and perform an updating operation on all identifiers in a packet detection rule, and the third hopping period is less than the second hopping period.

[0008] According to the signaling security protection method provided by the application, the protection strategy is to start a session endpoint identifier (SEID) hopping mechanism, set a first hopping period, and only perform binding verification of a packet detection rule identifier and a tunnel endpoint identifier in a session creation stage of the UPF and the SMF, and the security protection of the PFCP signaling based on the protection strategy includes: receiving a session establishment request signaling based on a packet forwarding control protocol (PFCP) sent by the SMF, the session establishment request signaling including a first all session endpoint identifier; analyzing the session establishment request signaling to obtain a first user identity fingerprint and a first bearer context in the tunnel endpoint identifier, a second user identity fingerprint and a second bearer context in the packet detection rule identifier; creating a second all session endpoint identifier based on a first comparison result of the first user identity fingerprint and the second user identity fingerprint, a second comparison result of the first bearer context and the second bearer context, and the first all session endpoint identifier; sending a session establishment response containing the first all session endpoint identifier and the second all session endpoint identifier to the SMF to perform security protection on the PFCP signaling.

[0009] According to a signaling security protection method provided by the present invention, the step of creating a second all-session endpoint identifier based on a first comparison result of the first user identity fingerprint and the second user identity fingerprint, a second comparison result of the first bearer context and the second bearer context, and the first all-session endpoint identifier includes: determining whether the PFCP signaling is valid based on the first comparison result and the second comparison result; if the PFCP signaling is valid, generating a second session endpoint identifier based on the first session endpoint identifier in the first all-session endpoint identifier and a hash algorithm, creating a session context with the second session endpoint identifier as an index, and associating it with the first session endpoint identifier; and creating the second all-session endpoint identifier based on the IP address of the UPF and the second session endpoint identifier.

[0010] According to a signaling security protection method provided by the present invention, the step of sending a session establishment response containing a first all-session endpoint identifier and a second all-session endpoint identifier to the SMF to protect the PFCP signaling includes: receiving a session hopping request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF, and parsing the session hopping request signaling to obtain the second session endpoint identifier and a third all-session endpoint identifier; the third all-session endpoint identifier is created by the SMF based on the SMF's IP address and the third session endpoint identifier, and the third session endpoint identifier is generated by the SMF when the first hopping period expires; the session hopping request is a session update request containing only all-session endpoint identifiers. One type; when the PFCP signaling is determined to be legitimate based on the associated session context retrieved based on the second session endpoint identifier, a fourth session endpoint identifier is generated based on the third session endpoint identifier in the third all session endpoint identifier and a hash algorithm; the index of the session context is replaced by the fourth session endpoint identifier from the second session endpoint identifier, and the first session endpoint identifier associated with the session context is updated to the third session endpoint identifier; based on the IP address of the UPF and the fourth session endpoint identifier, a fourth all session endpoint identifier is created, and a session jump response signaling containing the third session endpoint identifier and the fourth all session endpoint identifier is sent to the SMF to provide security protection for the PFCP signaling.

[0011] According to a signaling security protection method provided by the present invention, the protection strategy is to enable the Session Endpoint Identifier (SEID) hopping mechanism, set a second hopping period, and perform binding verification of the Packet Inspection Rule Identifier (PIR) and Tunnel Endpoint Identifier throughout the entire session lifecycle. The security protection of the PFCP signaling based on the protection strategy includes: receiving a Session Update Request signaling sent by the SMF based on the Message Forwarding Control Protocol (PFCP) throughout the entire session lifecycle; parsing the Session Update Request signaling; and, in the case where the Session Update Request signaling only contains the PIR and Tunnel Endpoint Identifier and does not contain all session endpoint identifiers, extracting the first user identity fingerprint and first bearer context from the Tunnel Endpoint Identifier, and the second user identity fingerprint and second bearer context from the PIR; and based on the first user identity fingerprint and the second bearer context, extracting the first user identity fingerprint and the second bearer context from the PIR; and performing security verification of the PFCP signaling based on the first user identity fingerprint and the second bearer context. The system compares the user identity fingerprints and the first bearer context with the second bearer context, then sends a session update response containing a successful session update result to the SMF to provide security protection for the PFCP signaling. If the session update request signaling contains all session endpoint identifiers but does not contain a packet detection rule identifier and a tunnel endpoint identifier, the system transitions the current session endpoint identifier and sends a session update response containing a successful session update result to the SMF to provide security protection for the PFCP signaling. If the session update request signaling contains both the packet detection rule identifier and the tunnel endpoint identifier in a packet detection rule and also contains all session endpoint identifiers, the system transitions the current session endpoint identifier and sends a session update response containing a successful session update result to the SMF to provide security protection for the PFCP signaling.

[0012] According to a signaling security protection method provided by the present invention, the protection strategy is to continuously activate the Session Endpoint Identifier (SEID) hopping mechanism, set a third hopping period, and re-operate on all identifiers within the packet detection rule. The third hopping period is shorter than the second hopping period. The security protection of the PFCP signaling based on the protection strategy includes: receiving a session update request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF, wherein the session update request signaling includes deleting a first packet detection rule and creating a second packet detection rule; the core business logic of the second packet detection rule is the same as the core business logic of the first packet detection rule; based on the second packet detection rule, creating a new rule context and writing it into the UPF memory, while associating it with the session context index, and activating the matching permission of the second packet detection rule for data packets; based on the second packet detection rule, terminating the matching permission of the first packet detection rule for data packets, while clearing the memory occupation and associated index of the first packet detection rule; determining the rule identifier corresponding to the second packet detection rule; and based on the rule identifier corresponding to the second packet detection rule, cutting off the exploitation path of the rule identifier corresponding to the first packet detection rule, thereby providing security protection for the PFCP signaling.

[0013] The present invention also provides a signaling security protection device, comprising the following modules: The first determination module is used to determine the comprehensive threat score based on the packet forwarding control protocol (PFCP) signaling traffic of the interface between the UPF and the session management function network element (SMF), the security of the PFCP signaling fields, and the abnormal ports of the UPF and network security components. The second determining module is used to determine the signaling security protection strategy based on the comprehensive threat score. The protection module is used to provide security protection for the PFCP signaling based on the protection strategy; wherein the SEID transition mechanism in different protection strategies has a different cycle.

[0014] This invention also provides a signaling security protection system, including the aforementioned User Plane Function (UPF) and Session Management Function (SMF) network elements, wherein: The UPF is used to determine a comprehensive threat score based on the packet forwarding control protocol signaling traffic at the interface between the UPF and the session management function network element (SMF), the security of the PFCP signaling fields, and abnormal ports where the UPF interfaces with network security components; based on the comprehensive threat score, a signaling security protection strategy is determined; and based on the protection strategy, the PFCP signaling is protected; wherein the SEID transition mechanism in different protection strategies has a different cycle. The SMF is used to send session establishment request signaling, session transition request signaling, and session update request signaling based on the Message Forwarding Control Protocol (PFCP) to the UPF. The session establishment request signaling, session transition request signaling, and session update request signaling include session endpoint identifier, tunnel endpoint identifier, and packet detection rule identifier.

[0015] According to a signaling security protection system provided by the present invention, the SMF is further configured to receive a hopping request response signaling sent by the UPF, parse the hopping request response signaling to obtain a third session endpoint identifier and a fourth all session endpoint identifier; retrieve relevant session contexts based on the third session endpoint identifier to determine the hopping result; if the hopping result is normal, update the fourth session endpoint identifier in the fourth all session endpoint identifier associated with the session context; and if the hopping result is abnormal, perform hopping abnormality handling.

[0016] According to a signaling security protection system provided by the present invention, the SMF is further configured to generate a tunnel endpoint identifier based on user identity fingerprint information, bearer context, and dynamic mask; determine a truncated hash value based on the user identity fingerprint information and the bearer context; and generate a packet detection rule identifier based on the truncated hash value and an in-session incrementing counter.

[0017] According to a signaling security protection system provided by the present invention, the SMF is further configured to generate a second rule identifier based on a first rule identifier and an in-session incrementing counter using a hash algorithm. The core business logic of the second data packet detection rule corresponding to the second rule identifier is the same as that of the first data packet detection rule corresponding to the first rule identifier. A session update request signaling is created based on the second data packet detection rule.

[0018] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the signaling security protection method described above.

[0019] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the signaling security protection method as described above.

[0020] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the signaling security protection method as described above.

[0021] The signaling security protection method, apparatus, system, equipment, medium, and product provided by this invention determine a comprehensive threat score by analyzing the packet forwarding control protocol (PFCP) signaling traffic at the interface between the UPF and the Session Management Function (SMF) network element, the security of PFCP signaling fields, and abnormal ports where the UPF intersects with network security components. Based on the comprehensive threat score, a signaling security protection strategy is determined. Based on the protection strategy, security protection is implemented for PFCP signaling. Thus, through multi-dimensional attack detection, a comprehensive threat score representing the protection level is determined. The defense level is dynamically adjusted according to the comprehensive threat score to specifically address various network attacks. While ensuring signaling security, the impact of the protection strategy on system performance is minimized, achieving a better balance between the security of the protection strategy and its impact on system performance, thereby improving the efficiency of security protection and the stability and reliability of the network. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating the signaling security protection method provided by the present invention.

[0024] Figure 2 This is a schematic diagram of the structured security coding rules provided by the present invention.

[0025] Figure 3 This is a schematic diagram of the signaling security protection device provided by the present invention.

[0026] Figure 4 This is a schematic diagram of the signaling security protection system provided by the present invention.

[0027] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0029] For edge UPF deployments, besides the inability of a unified protection strategy to balance the security and impact on system performance, reducing security efficiency and network stability and reliability, the following issues may also exist: Session hijacking risk: Attackers can hijack unencrypted PFCP sessions with SEID and TEID by scanning the UDP ports exposed by network edge devices (default 8805), and forge SMFs to send illegal signaling (such as traffic redirection, QoS parameter tampering); Signaling tampering threat: Due to the lack of field-level integrity protection mechanisms in the PFCP protocol, attackers can intercept signaling messages and tamper with key parameters (such as IP filters and TEID mapping relationships in PDR rules), leading to abnormal user data plane functions; Static identifier tracking vulnerability: Traditional SEID allocation mechanisms remain fixed throughout the session lifecycle, allowing attackers to track specific session identifier characteristics for a long time and launch targeted attacks.

[0030] The following is combined Figures 1-2 The signaling security protection method of the present invention can be executed by an electronic device or a signaling security protection method installed in the electronic device. The signaling security protection device can be implemented by software, hardware or a combination of both.

[0031] Figure 1 This is a flowchart illustrating the signaling security protection method provided by the present invention, as shown below. Figure 1 As shown, the method includes the following: Step 101: Determine the overall threat score based on the packet forwarding control protocol (PFCP) signaling traffic at the interface between the UPF and the session management function (SMF), the security of the PFCP signaling fields, and the abnormal ports where the UPF intersects with the network security components.

[0032] It should be noted that the interface between the UPF and SMF is the N4 interface, which mainly uses the Packet Forwarding Control Protocol (PFCP) to implement signaling message exchange. Figure 1 This is a schematic diagram of the N4 interface communication protocol stack provided by the present invention, as shown below. Figure 1As shown, the session management network element and the user plane network element include PFCP, User Datagram Protocol (UDP), Internet Protocol (IP), Data Link Layer (L2), and Physical Layer (L1), respectively. The N4 interface, exposed to the network environment, has a protocol stack that is more vulnerable to attacks from network attackers. For example, attackers can hijack and illegally tamper with PFCP messages, modify traffic filtering rules or Quality of Service (QoS) parameters, all of which can lead to a decline in network service quality or even prevent users from accessing the internet.

[0033] Optionally, signaling traffic may include the amount of signaling messages sent and received within a preset time window timer, message type distribution, and the proportion of signaling traffic in different IP address ranges. Among these, message types include session establishment, modification, deletion, etc., and message type distribution refers to the proportion of each type of signaling message.

[0034] Optionally, the security of PFCP signaling fields can include the legitimacy of individual signaling messages and strong validation binding. For example, legitimacy can include whether there are conflicting abrupt changes in QoS parameters in the session modification request (such as GBR traffic burst setting exceeding 400% of the subscribed value), whether the uplink classifier rules contain illegal IP ranges (such as 0.0.0.0 / 0 fully open rules), etc. Strong validation binding can be a strong binding validation mechanism for Packet Detection Rule Identifier (PDRID) and Tunnel Endpoint Identifier (TEID).

[0035] Optional network security components can be edge firewalls, intrusion detection systems, etc. An abnormal port refers to a port that is scanned abnormally, such as detecting that an unauthorized IP has made more than 500 connection attempts to port 8805 of the UPF node within 5 minutes.

[0036] Here, the overall threat score is used to characterize the level of network security status. The higher the overall threat score, the worse the network security status, and vice versa.

[0037] Step 102: Based on the comprehensive threat score, determine the protection strategy for signaling security.

[0038] Here, the method for determining the security protection strategy can be any suitable method. For example, it can be determined based on the mapping relationship between the comprehensive threat score and the protection strategy, or by inputting the comprehensive threat score into a neural network model.

[0039] Step 103: Based on the protection strategy, perform security protection on the PFCP signaling.

[0040] The SEID transition mechanism in different protection strategies has a different cycle.

[0041] Specifically, after determining the protection strategy, security protection is carried out on PFCP signaling in accordance with the protection strategy.

[0042] In another embodiment, in addition to determining the period of the SEID transition mechanism of the protection policy based on the threat comprehensive score, it is also possible to determine whether the binding verification of packet detection rule identifiers and tunnel endpoint identifiers needs to be performed in the protection policy, and the execution stage when performing binding verification, based on the threat comprehensive score; it is also possible to determine whether all identifiers in the packet detection rules need to be updated in the protection policy based on the threat comprehensive score.

[0043] In this embodiment of the invention, a comprehensive threat score is determined by analyzing the packet forwarding control protocol (PFCP) signaling traffic at the interface between the UPF and the Session Management Function (SMF) network element, the security of PFCP signaling fields, and abnormal ports where the UPF interfaces with network security components. Based on the comprehensive threat score, a signaling security protection strategy is determined. Based on the protection strategy, security protection is implemented for PFCP signaling. Thus, through multi-dimensional attack detection, a comprehensive threat score representing the protection level is determined. The defense level is dynamically adjusted based on the comprehensive threat score to specifically address various network attacks. While ensuring signaling security, the impact of the protection strategy on system performance is minimized, achieving a better balance between the security of the protection strategy and its impact on system performance, thereby improving the efficiency of security protection and the stability and reliability of the network.

[0044] Furthermore, the determination of the comprehensive threat score based on the Message Forwarding Control Protocol (PFCP) signaling traffic at the interface between the UPF and the Session Management Function (SMF) network element, the security of the PFCP signaling fields, and the abnormal ports where the UPF intersects with the network security component includes: determining first perceived threat information based on the PFCP signaling traffic; determining second perceived threat information based on the security of the PFCP signaling fields; determining third perceived threat information based on the abnormal ports where the UPF intersects with the network security component; and determining the comprehensive threat score based on the first perceived threat information, the second perceived threat information, and the third perceived threat information.

[0045] Here, the first perceived threat information, the second perceived threat information, and the third perceived threat information are used to ensure the degree of threat level of their respective networks under attack.

[0046] Optionally, the first perceived threat information can be determined by comparing various characteristics of PFCP signaling traffic (such as send / receive volume, message type distribution, and the proportion of signaling traffic in different IP address ranges) with the corresponding thresholds. Alternatively, the first perceived threat information can be obtained by inputting PFCP signaling traffic into a calculation model. For example, if the number of sent / received signaling messages suddenly increases within a 300-second time window, exceeding a preset threshold of 1000, the first perceived threat information is a potential DDoS attack or scanning behavior.

[0047] Optionally, the second perceived threat information can be determined based on the mapping relationship between security and second perceived threat information. The higher the security, the lower the second perceived threat information, and the lower the security, the higher the second perceived threat information. Alternatively, the second perceived threat information can be calculated based on a calculation model.

[0048] It should be noted that an interaction interface between the UPF and the network security component can be defined. If there is an abnormal port scan (for example, an unauthorized IP makes more than 500 connection attempts to port 8805 of the UPF node within 5 minutes), the network security component can send external alarm information to the UPF through the defined interaction interface. The UPF can then determine the third-party perceived threat information based on the external alarm information.

[0049] It is optional. The comprehensive threat score can be the sum of the first perceived threat information, the second perceived threat information, and the third perceived threat information, or it can be a weighted sum of the first perceived threat information, the second perceived threat information, and the third perceived threat information. The weight of the first perceived threat information and the second perceived threat information can each account for 40%, and the weight of the third perceived threat information can account for 20%.

[0050] In this embodiment of the invention, by detecting signaling traffic, the security of signaling fields, and the interface ports of network security components from multiple dimensions, the accuracy of network threat perception is improved. Furthermore, based on the comprehensive threat score, the defense strategy can be dynamically optimized in real time, which can quickly and effectively respond to various network attacks and improve the stability and reliability of the network.

[0051] Furthermore, the step of determining the signaling security protection strategy based on the comprehensive threat score includes: when the comprehensive threat score meets a first score threshold, the protection strategy is to enable the Session Endpoint Identifier (SEID) transition mechanism, set a first transition period, and perform binding verification of the packet detection rule identifier and the tunnel endpoint identifier only during the session creation phase of the UPF and the SMF; when the comprehensive threat score meets a second score threshold, the protection strategy is to enable the Session Endpoint Identifier (SEID) transition mechanism, set a second transition period, and perform binding verification of the packet detection rule identifier and the tunnel endpoint identifier throughout the entire session lifecycle; the first transition period is longer than the second transition period; when the comprehensive threat score meets a third score threshold, the protection strategy is to continuously activate the Session Endpoint Identifier (SEID) transition mechanism, set a third transition period, and perform update operations on all identifiers within the packet detection rule; the third transition period is shorter than the second transition period.

[0052] Optionally, the rating threshold can be an appropriate rating value or a rating range.

[0053] Here, the Packet Detection Rule Identifier (PDR ID) is part of the information elements in PFCP and is used to uniquely identify a packet detection rule; the Tunnel Endpoint Identifier (TEID) is an important identifier used in the General Packet Radio Services Tunneling Protocol (GTP) to uniquely identify the endpoint of a tunnel in the network.

[0054] It should be noted that different overall threat scores indicate different levels of threat to signaling, and corresponding protection strategy levels vary. The higher the overall threat score, the higher the security of the corresponding protection strategy level.

[0055] Here, the update operation involves regenerating all identifiers within the packet inspection rules and replacing the original identifiers with the regenerated ones.

[0056] For example, when the overall threat score is less than 40, it is in normal mode, the network is in a relatively secure state, and a more lenient protection strategy is adopted. For instance, the SEID end-to-end transition timer T is set to 300s, and the strong binding verification of PDR ID and TEID is only performed when the session rule is created. This ensures security while minimizing the impact on system performance to improve efficiency. When the overall threat score is greater than or equal to 40 but less than 70, it is in enhanced mode. The SEID transition period is shortened by 100s, and event-triggered SEID transition mode is enabled, making it more difficult for attackers to track and exploit SEIDs. When a new session rule is modified, strong binding verification of PDR ID and TEID is performed to further ensure the legality and security of the rule. When the overall threat score is greater than or equal to 70, it is in emergency mode. Forced SEID transition is triggered immediately, and the new SEID takes effect immediately, blocking possible attack paths for attackers. At the same time, all PDR rule identifiers are regenerated to ensure the security and effectiveness of all rules, maximizing network security.

[0057] It should be noted that the PDR ID and F-TEID values ​​are uniformly allocated by the SMF and generated according to structured security coding rules. First, before the session establishment phase, the SMF interacts with the terminal and other control plane network elements to obtain data information related to the user equipment and the session. The data information includes the user equipment's subscription data (such as data rate and QoS level requirements) and the user equipment access type (such as 5G-NR, E-UTRA, etc.) and context information provided by the access network. The SMF allocates the F-TEID value based on this data information. Then, the tunnel endpoint identifier is determined based on the user identity fingerprint information, bearer context, and dynamic mask. The packet detection rule identifier is determined based on the user identity fingerprint information, bearer context, and in-session incrementing counter. This facilitates centralized management and coordination.

[0058] For example, Figure 2 This is a schematic diagram of the structured security coding rules provided by the present invention, as shown below. Figure 2As shown, the TEID is 32 bits long according to the 3GPP protocol. The high 16 bits are the user identity fingerprint UE_FP, which is calculated by performing a CRC16 algorithm on the IMSI and UE_IP. The middle 8 bits are the bearer context ERAB_CTX, which combines 5QI and ARP parameters to form a QoS level marker. The low 8 bits are the dynamic mask RAND, which generates a pseudo-random number based on the session key K_sess and the sequence number Seq_Num. The PDR RULE ID is 16 bits long according to the 3GPP protocol. The highest bit (the 8th bit) is used to mark the data flow direction (0 for uplink, 1 for downlink). The middle 7 bits embed a truncated hash value calculated from the user identity fingerprint UE_FP and the bearer context ERAB_CTX to enhance the association with the TEID. The last 8 bits are an in-session incrementing counter.

[0059] It should be noted that if the strong binding verification between PDR ID and TEID fails, the UPF can reject the SMF's session establishment or update request. Simultaneously, the UPF will log the exception information, including detailed information about the PFCP message and its error type, such as TEID mismatch, incorrect uplink / downlink PDR marking, or abnormal PDR ID increment. This facilitates subsequent analysis and handling by network maintenance personnel. In certain situations, the UPF can trigger alarm messages to notify the network management system, enabling timely detection of potential network security issues or faults, and allowing for appropriate security measures, such as notifying relevant personnel to inspect and repair the network environment.

[0060] In this embodiment of the invention, when the overall threat score is low, the network is in a relatively secure state. Periodic SEID transitions are enabled, with the period T set to 300 seconds. Strong binding verification of PDR ID and TEID is only performed when a session rule is created. When the overall threat score is relatively high, the SEID transition period is shortened to 100 seconds, and event-triggered SEID transition mode is enabled, making it more difficult for attackers to track and exploit SEIDs. At the same time, strong binding verification of PDR ID and TEID is performed when a new session rule is modified, further ensuring the legality and security of the rule. When the overall threat score is particularly high, a forced SEID transition is immediately triggered, and the new SEID takes effect immediately, blocking possible attack paths for attackers. Simultaneously, all PDR rule identifiers are regenerated to ensure the security and effectiveness of all rules, maximizing network security.

[0061] Furthermore, the protection strategy involves enabling the Session Endpoint Identifier (SEID) transition mechanism, setting a first transition period, and performing packet detection rule identifier and tunnel endpoint identifier binding verification only during the session creation phase between the UPF and the SMF. Based on this protection strategy, security protection is provided for the PFCP signaling, including: The system receives a session establishment request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF, the session establishment request signaling including a first all-session endpoint identifier; it parses the session establishment request signaling to obtain a first user identity fingerprint and a first bearer context in the tunnel endpoint identifier, and a second user identity fingerprint and a second bearer context in the packet detection rule identifier; based on a first comparison result of the first user identity fingerprint and the second user identity fingerprint, a second comparison result of the first bearer context and the second bearer context, and the first all-session endpoint identifier, it creates a second all-session endpoint identifier; and it sends a session establishment response containing the first all-session endpoint identifier and the second all-session endpoint identifier to the SMF to provide security protection for the PFCP signaling.

[0062] Here, the first set of all session endpoint identifiers includes the SMF's IP address and the session endpoint identifier SEID. SEID represents the session endpoint identifier, a parameter in the PFCP header used to uniquely identify a PFCP session. It typically carries a SEID value maintained by the peer and plays a crucial identifying role throughout the session's lifecycle, including establishment, modification, and deletion. For example, the SEID value in a session request message initiated by the SMF is UP SEID, while the SEID value in a session response message returned by the UPF is CP SEID. F-SEID represents the all session endpoint identifier, belonging to the information element portion of PFCP. It consists of the IP address and the SEID value maintained by the local end. It is mainly used to transmit the local SEID value to the peer in PFCP session establishment request and response messages. For example, the SMF passes the assigned CP SEID value to the UPF via CP F-SEID, and the UPF returns its assigned UP SEID value to the SMF via UPF-SEID.

[0063] Here, the user identity and bearer context in the PDR ID can be obtained from the truncated hash value in the PDR ID. The user identity is calculated from the IMSI and UE_IP, which are stored in the UE's context. The bearer context consists of 5QI and ARP parameters, which are stored in the UE's subscription data.

[0064] Here, the PFCP signaling includes a tunnel endpoint identifier and a packet detection rule identifier. The tunnel endpoint identifier and the packet detection rule identifier include their respective user identity fingerprints and bearer contexts. The two user identity fingerprints and bearer contexts are compared. Based on the comparison result, a second total session endpoint identifier is created, and a session establishment response is sent to the SMF. The SMF stores the second session endpoint identifier in the second total session endpoint identifier in the session establishment response in correspondence with the first session endpoint identifier, and performs security protection on the PFCP signaling.

[0065] Optionally, the comparison result may include consistency or inconsistency. If consistent, a second all-session endpoint identifier is created; if inconsistent, the session establishment request is rejected, an establishment failure response is sent to the SMF, and a second all-session endpoint identifier is created for the session establishment request resent by the SMF.

[0066] Optionally, the conditions for triggering the session transition mechanism can be set to trigger only by a timer. The SMF internally configures a timer with a set interval (default 300 seconds, configurable), and triggers the SEID transition whenever the timer expires. Alternatively, it can be set to trigger only by an event: the SMF internally configures a counter that records the number of signaling transmissions for a single session, sets the counter threshold to 100, and triggers the SEID transition when the number of signaling transmissions for a session exceeds the threshold. It can also be set to trigger both a timer and an event simultaneously, meaning that the session transition mechanism is triggered when both the timer and the counter expire at the same time.

[0067] In this embodiment of the invention, by comparing the user identity fingerprint and bearer context in the tunnel endpoint identifier and packet detection rule identifier respectively, binding verification is performed based on PDR ID and F-TEID to prevent malicious tampering of elements in the PFCP message, thereby ensuring the security of the user plane data stream.

[0068] Furthermore, the step of creating a second all-session endpoint identifier based on the first comparison result of the first user identity fingerprint and the second user identity fingerprint, the second comparison result of the first bearer context and the second bearer context, and the first all-session endpoint identifier includes: determining whether the PFCP signaling is valid based on the first comparison result and the second comparison result; if the PFCP signaling is valid, generating a second session endpoint identifier based on the first session endpoint identifier in the first all-session endpoint identifier and a hash algorithm, creating a session context with the second session endpoint identifier as an index, and associating it with the first session endpoint identifier; and creating the second all-session endpoint identifier based on the IP address of the UPF and the second session endpoint identifier.

[0069] For example, the process of performing strong binding verification of PDR ID and TEID during the session establishment phase between UPF and SMF includes: (1) SMF generates CP SEID_0 through a hash algorithm and stores it in the session endpoint identifier (SMF SEID POOL), initiates an N4PFCP session establishment request and a PFCP message, the SEID value of the PFCP packet header is 0, and the F-SEID field carries the value, i.e., the first all session endpoint identifier is {SMF IP, CP SEID_0}; (2) UPF receives the session establishment request and the PFCP message; (3) UPF parses the PFCP message to obtain PDR ID and TEID, and UPF extracts the first user identity fingerprint and the first bearer context from the PDR ID, and the second user identity fingerprint information and the second bearer context from the TEID; (4) UPF compares the first user identity fingerprint and the second user identity fingerprint, and the first bearer context and the second bearer context to see if they are consistent. If they are consistent, the PFCP message is confirmed to be valid, and the second all session endpoint identifier is created, i.e., {UPF IP, UP (5) Send a session establishment response request containing the second full session endpoint identifier to the SMF. The SEID value of the PFCP header is CP SEID_0, and the F-SEID field carries the value {UPF IP, UP SEID_0}. (6) The SMF receives the session establishment response and stores the correspondence between UP SEID_0 and CP SEID_0 in the SEID Context.

[0070] In another embodiment, if the first user identity fingerprint is inconsistent with the second user identity fingerprint and / or the first bearer context is inconsistent with the second bearer context, the PFCP message is confirmed to have been tampered with or forged by an attacker and is therefore illegitimate. The UPF can reject the PFCP message and prevent it from creating the current session or PDR.

[0071] In this embodiment of the invention, when processing the downlink PDR, since the PDR ID stores some TEID information and the PDR ID is allocated incrementally, the TEID value in the corresponding uplink PDR can also be found when creating or modifying the downlink PDR. If the user identity fingerprint segment in the downlink PDR ID is inconsistent with the TEID user identity fingerprint information stored in the corresponding uplink PDR TEID, it can be considered that there is a problem with the downlink PDR, thereby triggering the corresponding security mechanism (for example, refusing session creation, and the UPF will reply to the SMF with a session creation failure message).

[0072] In this embodiment of the invention, strong binding verification between PDR-ID and F-TEID enhances the security and reliability of the association between PDR-ID and F-TEID, and reduces the risk of signaling messages being tampered with and abused.

[0073] Further, the step of sending a session establishment response containing the first all session endpoint identifiers and the second all session endpoint identifiers to the SMF, and providing security protection for the PFCP signaling, includes: receiving a session hopping request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF, parsing the session hopping request signaling to obtain the second session endpoint identifier and the third all session endpoint identifier; the third all session endpoint identifier is created by the SMF based on the SMF's IP address and the third session endpoint identifier, and the third session endpoint identifier is generated by the SMF when the first hopping period expires; the session hopping request is a type of session update request that only contains all session endpoint identifiers; based on If the second session endpoint identifier retrieves the associated session context and determines that the PFCP signaling is legitimate, a fourth session endpoint identifier is generated based on the third session endpoint identifier in the third all session endpoint identifier and a hash algorithm; the index of the session context is replaced by the fourth session endpoint identifier, and the first session endpoint identifier associated with the session context is updated to the third session endpoint identifier; based on the IP address of the UPF and the fourth session endpoint identifier, a fourth all session endpoint identifier is created, and a session jump response signaling containing the third session endpoint identifier and the fourth all session endpoint identifier is sent to the SMF to provide security protection for the PFCP signaling.

[0074] Here, the third total session endpoint identifier can be understood as the SMF changing the first total session endpoint identifier after the session is created and the SEID transition period expires, resulting in a new third total session endpoint identifier. The third total session endpoint identifier includes the SMF's IP address and the third session endpoint identifier.

[0075] Here, the second session endpoint identifier is used to retrieve the corresponding SEID Context in the UPF. If the corresponding SEID Context can be retrieved, the session transition request signaling message is considered valid.

[0076] Here, when the session transition request signaling message is valid, the UPF transitions the second session endpoint identifier based on the third all-session endpoint identifier to obtain a new fourth all-session endpoint identifier. The fourth all-session endpoint identifier includes the IP address of the UPF and the fourth session endpoint identifier. The UPF then sends a session transition response containing the fourth all-session endpoint identifier and the third session endpoint identifier to the SMF to provide security protection for the PFCP signaling.

[0077] For example, the process of SMF and UPF performing session endpoint identifier switching during the session persistence phase includes: (1) SMF considers that SEID switching is required when the timer expires, and generates a new SEID value of CPSEID_1 through a hash algorithm, which is the third session endpoint identifier. It iterates through the SMF SEID POOL. If there is a matching SEID, it regenerates it. If there is no matching SEID, it stores it in the SMF SEID POOL and updates the SEID Context associated with CP F-SEID_0, updating its index to CP F-SEID_1; (2) SMF initiates an N4 session switching request PFCP Session ModificationRequest message. The SEID value in the PFCP header is UP SEID_0, and the F-SEID field carries the value {SMF IP, CP SEID_1}, which is the third session endpoint identifier. (3) After receiving the session switching request message, UPF finds that the message carries the F-SEID field and considers that SEID switching is required. UPF verifies the validity of the SEID value UP SEID_0 in the PFCP message header. If the corresponding SEID Context can be retrieved based on the SEID value UP SEID_0, the message is considered valid. At the same time, CP SEID_1 is extracted from the F-SEID of the PFCP message. (4) The UPF generates UP SEID_1 based on CP SEID_1 using a hash algorithm. This is the fourth session endpoint identifier. It iterates through the UPF SEID POOL. If there is a matching SEID, it regenerates it. If there is no matching SEID, it stores it in the UPF SEID POOL. It also updates the SEID Context associated with UP F-SEID_0, updates its index to UP F-SEID_1, and updates the CP SEID_0 associated in the context to CP SEID_1. (5) The UPF initiates the N4 session hopping response PFCP Session Modification Response. The SEID value in the PFCP header is CP SEID_1, and the F-SEID field carries the value {UPF IP, UP SEID_1}, which is the fourth session endpoint identifier. (6) The SMF receives the session hopping response. If it finds that the message carries the F-SEID field, it considers that SEID hopping confirmation is required. SMF verifies the validity of the SEID value in the packet header. If the corresponding SEID Context can be retrieved based on the SEID value CP SEID_1, the message is considered valid, and the UP SEID_0 associated with the context is updated to UP SEID_1 to provide security protection for PFCP signaling.

[0078] In another example, the SMF compares the obtained UP SEID_1 with the UP SEID_0 recorded in the original context. If they do not match, the transition is confirmed to be effective. If any abnormal situation occurs during the session, such as SEID transition failure or session timeout, the SMF and UPF will handle it according to the pre-defined exception handling mechanism. The handling methods include retrying the transition operation, terminating the session, or logging the exception.

[0079] In another embodiment, when the session ends normally, the SMF and UPF will respectively clear the SEID and other session information (such as SEID Context) recorded locally related to the session, release related resources, and ensure the reasonable use of resources and efficient operation of the system.

[0080] In this embodiment of the invention, dynamic F-SEID management and end-to-end synchronous transition mechanism effectively prevent session identifiers from being cracked and attacked, thereby improving the security of signaling interaction.

[0081] Furthermore, the protection strategy involves enabling the Session Endpoint Identifier (SEID) hopping mechanism, setting a second hopping period, and performing binding verification of the Packet Inspection Rule Identifier and the Tunnel Endpoint Identifier throughout the entire session lifecycle. Based on this protection strategy, security protection for the PFCP signaling includes: receiving session update request signaling sent by the SMF based on the Message Forwarding Control Protocol (PFCP) throughout the entire session lifecycle; parsing the session update request signaling; and, if the session update request signaling contains both the Packet Inspection Rule Identifier and the Tunnel Endpoint Identifier in the Packet Inspection Rule Identifier but does not contain all session endpoint identifiers, extracting the first user identity fingerprint and the first bearer context from the tunnel endpoint identifier, and the second user identity fingerprint and the second bearer context from the Packet Inspection Rule Identifier; and based on the first user identity fingerprint and the second user identity fingerprint... The system compares the results of the comparison between the first bearer context and the second bearer context, sends a session update response containing a successful session update result to the SMF, and provides security protection for the PFCP signaling. If all session endpoint identifiers exist in the session update request signaling but no packet detection rule contains a packet detection rule identifier and a tunnel endpoint identifier, the system transitions the current session endpoint identifier and sends a session update response containing a successful session update result to the SMF, providing security protection for the PFCP signaling. If the session update request signaling contains both the packet detection rule identifier and the tunnel endpoint identifier in a packet detection rule and all session endpoint identifiers exist, the system transitions the current session endpoint identifier and sends a session update response containing a successful session update result to the SMF, providing security protection for the PFCP signaling.

[0082] Here, the session update request signaling includes a tunnel endpoint identifier and a packet detection rule identifier. The tunnel endpoint identifier and the packet detection rule identifier include their respective user identity fingerprints and bearer contexts. The two user identity fingerprints and bearer contexts are compared. Based on the comparison result, a session update response containing the session update result is sent to the SMF to provide security protection for the PFCP signaling.

[0083] For example, the process of performing strong binding verification of PDR ID and TEID during the SMF and UPF session update phase includes: (1) SMF initiates N4 PFCP session update request PFCP Session Modification Request message, which contains the tunnel endpoint identifier and packet detection rule identifier that need to be updated; (2) UPF receives the session update request message, parses the PFCP message to obtain PDR ID and TEID, and extracts the first user identity fingerprint and first bearer context from the PDR ID, and the second user identity fingerprint information and second bearer context from the TEID; (3) UPF compares the first user identity fingerprint and second user identity fingerprint, and the first bearer context and second bearer context to see if they are consistent, and judges whether the PFCP message is valid based on the comparison result; (4) If the comparison result is consistent, the PFCP message is confirmed to be valid, and UPF sends a session update response message containing the session update success result to SMF; (5) If the comparison result is inconsistent, the PFCP message is considered invalid, and UPF sends a session establishment response message containing the session update success or failure result to SMF, and records the failure result as an alarm.

[0084] In this embodiment of the invention, by performing strong binding verification on PDR-ID and F-TEID throughout the entire session lifecycle, the security and reliability of the association between PDR-ID and F-TEID are enhanced, further reducing the risk of signaling messages being tampered with and abused during the session lifecycle.

[0085] Furthermore, the protection strategy involves continuously activating the Session Endpoint Identifier (SEID) transition mechanism, setting a third transition period, and updating all identifiers within the packet detection rule. The third transition period is shorter than the second transition period. Based on this protection strategy, the security protection of the PFCP signaling includes: receiving session update request signaling sent by the SMF based on the Message Forwarding Control Protocol (PFCP). The session update request signaling includes deleting the first packet detection rule and creating a second packet detection rule. The core business logic of the second packet detection rule is the same as that of the first packet detection rule. Based on the second packet detection rule, a new rule context is created and written into the UPF memory, and a session context index is associated to activate the matching permission of the second packet detection rule for data packets. Based on the second packet detection rule, the matching permission of the first packet detection rule for data packets is terminated, and the memory usage and associated index of the first packet detection rule are cleared. The rule identifier corresponding to the second packet detection rule is determined. Based on the rule identifier corresponding to the second packet detection rule, the exploitation path of the rule identifier corresponding to the first packet detection rule is cut off, thereby providing security protection for the PFCP signaling.

[0086] For example, the process of regenerating and updating all identifiers in the packet detection rules during the SMF and UPF session update phase includes: (1) SMF generates new unique rule identifiers (including new packet detection rule identifier New_PDR ID, new forwarding action rule identifier New_FAR ID, new QoS service quality execution rule identifier New_QER ID, and new usage report rule identifier New_URR ID) based on all existing rule identifiers under the session (including packet detection rule identifier PDR ID, forwarding action rule identifier New_FAR ID, new QoS service quality execution rule identifier New_QER ID, and new usage report rule identifier New_URR ID) through a hash algorithm in combination with the current value of the session increment counter; (2) SMF creates new rule contexts based on the new rule identifiers and copies the context content indexed by the original rule identifiers to the new contexts, while deleting the original rule contexts; (3) SMF initiates an N4 session update request PFCP Session Modification Request message, which includes the deletion of all old rule identifiers and the creation of new rule identifiers and business logic; (4) UPF Upon receiving the session update request message, the PFCP message is parsed to obtain all old rule identifiers that need to be deleted and new rule identifiers and business logic that need to be created; (5) The UPF deletes the rule context of its index based on the old rule identifiers PDR ID, FAR ID, QER ID and URR ID, and creates a new rule context based on the new rule identifiers New_PDR ID, New_FAR ID, New_QER ID and New_URR ID and its business logic. After associating the new rule context with the session context, the memory occupation and associated index of the old rules are cleared, and the matching permission of the new rules for data packets is activated; (6) After successful deletion and creation, the UPF sends a session update response message containing the session update success result to the SMF.

[0087] In this embodiment of the invention, by regenerating and updating all identifiers within the packet detection rules, the path to exploiting the original identifiers is cut off, thereby reducing the risk of signaling messages being tampered with and abused.

[0088] The signaling security protection device provided by the present invention is described below. The signaling security protection device described below can be referred to in correspondence with the signaling security protection method described above.

[0089] Figure 3 This is a schematic diagram of the signaling security protection device provided by the present invention, as shown below. Figure 3 As shown, the signaling security protection device 300 includes: The first determination module 310 is used to determine a comprehensive threat score based on the packet forwarding control protocol (PFCP) signaling traffic of the interface between the UPF and the session management function network element (SMF), the security of the PFCP signaling fields, and the abnormal ports of the UPF and network security components. The second determining module 320 is used to determine a signaling security protection strategy based on the comprehensive threat score. The protection module 330 is used to provide security protection for the PFCP signaling based on the protection strategy; wherein the SEID transition mechanism in different protection strategies has a different cycle.

[0090] In another embodiment, the first determining module 310 is specifically used to determine first perceived threat information based on the traffic of the PFCP signaling; determine second perceived threat information based on the security of the PFCP signaling fields; determine third perceived threat information based on the abnormal port of the UPF interfacing with the network security component; and determine the comprehensive threat score based on the first perceived threat information, the second perceived threat information, and the third perceived threat information.

[0091] In another embodiment, the second determining module 320 is specifically configured to, when the overall threat score meets a first scoring threshold, enable the session endpoint identifier (SEID) transition mechanism, set a first transition period, and perform binding verification of the packet detection rule identifier and the tunnel endpoint identifier only during the session creation phase of the UPF and the SMF; when the overall threat score meets a second scoring threshold, enable the session endpoint identifier (SEID) transition mechanism, set a second transition period, and perform binding verification of the packet detection rule identifier and the tunnel endpoint identifier throughout the entire session lifecycle; the first transition period is longer than the second transition period; when the overall threat score meets a third scoring threshold, continuously activate the session endpoint identifier (SEID) transition mechanism, set a third transition period, and update all identifiers within the packet detection rule; the third transition period is shorter than the second transition period.

[0092] In another embodiment, the protection strategy is to enable the Session Endpoint Identifier (SEID) transition mechanism, set a first transition period, and perform the binding verification of the packet detection rule identifier and the tunnel endpoint identifier only during the session creation phase of the UPF and the SMF. The protection module 330 is specifically used for: The system receives a session establishment request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF, the session establishment request signaling including a first all-session endpoint identifier; it parses the session establishment request signaling to obtain a first user identity fingerprint and a first bearer context in the tunnel endpoint identifier, and a second user identity fingerprint and a second bearer context in the packet detection rule identifier; based on a first comparison result of the first user identity fingerprint and the second user identity fingerprint, a second comparison result of the first bearer context and the second bearer context, and the first all-session endpoint identifier, it creates a second all-session endpoint identifier; and it sends a session establishment response containing the first all-session endpoint identifier and the second all-session endpoint identifier to the SMF to provide security protection for the PFCP signaling.

[0093] In another embodiment, the protection module 330 is further configured to: determine whether the PFCP signaling is valid based on the first comparison result and the second comparison result; if the PFCP signaling is valid, generate a second session endpoint identifier based on the first session endpoint identifier in the first all session endpoint identifiers and a hash algorithm, create a session context with the second session endpoint identifier as an index, and associate it with the first session endpoint identifier; and create a second all session endpoint identifier based on the IP address of the UPF and the second session endpoint identifier.

[0094] In another embodiment, the protection module 330 is further specifically configured to: receive a session hopping request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF; parse the session hopping request signaling to obtain a second session endpoint identifier and a third all session endpoint identifier; the third all session endpoint identifier is created by the SMF based on the SMF's IP address and the third session endpoint identifier, and the third session endpoint identifier is generated by the SMF when the first hopping period expires; the session hopping request is a type of session update request that only contains all session endpoint identifiers; and determine the associated session context based on the second session endpoint identifier. If the PFCP signaling is valid, a fourth session endpoint identifier is generated based on the third session endpoint identifier and hash algorithm in the third total session endpoint identifier; the index of the session context is replaced by the fourth session endpoint identifier from the second session endpoint identifier, and the first session endpoint identifier associated with the session context is updated to the third session endpoint identifier; based on the IP address of the UPF and the fourth session endpoint identifier, a fourth total session endpoint identifier is created, and a session jump response signaling containing the third session endpoint identifier and the fourth total session endpoint identifier is sent to the SMF to provide security protection for the PFCP signaling.

[0095] In another embodiment, the protection strategy is to enable the Session Endpoint Identifier (SEID) transition mechanism, set a second transition period, and perform binding verification of the packet detection rule identifier and the tunnel endpoint identifier throughout the entire session lifecycle. The protection module 330 is further specifically used for: receiving session update request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF throughout the entire session lifecycle; parsing the session update request signaling; and, in the case where the session update request signaling only contains the packet detection rule identifier and the tunnel endpoint identifier in the packet detection rule and does not contain all session endpoint identifiers, extracting the first user identity fingerprint and the first bearer context from the tunnel endpoint identifier, and the second user identity fingerprint and the second bearer context from the packet detection rule identifier; based on the comparison result of the first user identity fingerprint and the second user identity fingerprint, Based on the comparison result between the first bearer context and the second bearer context, a session update response containing a successful session update result is sent to the SMF to provide security protection for the PFCP signaling; if all session endpoint identifiers exist in the session update request signaling but no packet detection rule identifier and tunnel endpoint identifier are included in the packet detection rule, the current session endpoint identifier is transitioned, and a session update response containing a successful session update result is sent to the SMF to provide security protection for the PFCP signaling; if the session update request signaling contains the packet detection rule identifier and the tunnel endpoint identifier in the packet detection rule and all session endpoint identifiers exist, the current session endpoint identifier is transitioned, and a session update response containing a successful session update result is sent to the SMF to provide security protection for the PFCP signaling.

[0096] In another embodiment, the protection module 330 is further configured to: receive session update request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF, wherein the session update request signaling includes deleting a first data packet detection rule and creating a second data packet detection rule; the core business logic of the second data packet detection rule is the same as the core business logic of the first data packet detection rule; based on the second data packet detection rule, create a new rule context and write it into the UPF memory, and simultaneously associate it with the session context index to activate the matching permission of the second data packet detection rule for data packets; based on the second data packet detection rule, terminate the matching permission of the first data packet detection rule for data packets, and simultaneously clear the memory occupation and associated index of the first data packet detection rule; determine the rule identifier corresponding to the second data packet detection rule; and based on the rule identifier corresponding to the second data packet detection rule, cut off the exploitation path of the rule identifier corresponding to the first data packet detection rule, thereby providing security protection for the PFCP signaling.

[0097] This invention also provides a signaling security protection system. Figure 4 This is a schematic diagram of the signaling security protection system provided by the present invention, as shown below. Figure 4 As shown, the signaling security protection system 400 includes the aforementioned user plane function network element UPF410 and session management function network element SMF420, wherein: The UPF410 is used to determine a comprehensive threat score based on the packet forwarding control protocol (PFCP) signaling traffic at the interface between the UPF and the session management function (SMF), the security of PFCP signaling fields, and abnormal ports where the UPF intersects with network security components; to determine a signaling security protection strategy based on the comprehensive threat score; and to perform security protection on the PFCP signaling based on the protection strategy. The SMF420 is used to send session establishment request signaling, session transition request signaling, and session update request signaling based on the Message Forwarding Control Protocol (PFCP) to the UPF. The session establishment request signaling, session transition request signaling, and session update request signaling include a session endpoint identifier, a tunnel endpoint identifier, and a packet detection rule identifier.

[0098] In another embodiment, the SMF is further configured to receive a hopping request response signaling sent by the UPF, parse the hopping request response signaling to obtain a third session endpoint identifier and a fourth all session endpoint identifier; retrieve relevant session contexts based on the third session endpoint identifier to determine the hopping result; if the hopping result is normal, update the fourth session endpoint identifier in the fourth all session endpoint identifier associated with the session context; and if the hopping result is abnormal, perform hopping exception handling.

[0099] In another embodiment, the SMF is further configured to generate a tunnel endpoint identifier based on user identity fingerprint information, bearer context, and dynamic mask; determine a truncated hash value based on the user identity fingerprint information and the bearer context; and generate a packet detection rule identifier based on the truncated hash value and an in-session incrementing counter.

[0100] In another embodiment, the SMF is further configured to generate a second rule identifier based on a first rule identifier and an in-session incrementing counter using a hash algorithm. The core business logic of the second packet detection rule corresponding to the second rule identifier is the same as that of the first packet detection rule corresponding to the first rule identifier. A session update request signaling is created based on the second packet detection rule.

[0101] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a signaling security protection method, which includes: determining a comprehensive threat score based on the packet forwarding control protocol (PFCP) signaling traffic at the interface between the UPF and the session management function (SMF), the security of the PFCP signaling fields, and abnormal ports where the UPF interfaces with network security components; determining a signaling security protection strategy based on the comprehensive threat score; and performing security protection on the PFCP signaling based on the protection strategy; wherein the SEID transition mechanism in different protection strategies has a different cycle.

[0102] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0103] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the signaling security protection method provided by the above methods. The method includes: determining a comprehensive threat score based on the packet forwarding control protocol signaling traffic of the interface between the UPF and the session management function network element SMF, the security of the PFCP signaling fields, and the abnormal ports of the UPF and network security components; determining a signaling security protection strategy based on the comprehensive threat score; and performing security protection on the PFCP signaling based on the protection strategy. The SEID transition mechanism in different protection strategies has a different cycle.

[0104] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the signaling security protection method provided by the above methods. The method includes: determining a comprehensive threat score based on the packet forwarding control protocol signaling traffic of the interface between the UPF and the session management function network element SMF, the security of the PFCP signaling fields, and the abnormal ports of the UPF and network security components; determining a signaling security protection strategy based on the comprehensive threat score; and performing security protection on the PFCP signaling based on the protection strategy. The SEID transition mechanism in different protection strategies has a different cycle.

[0105] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0106] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A signaling security protection method, characterized in that, Applications to User Plane Functional Network Elements (UPFs) include: Based on the packet forwarding control protocol (PFCP) signaling traffic at the interface between the UPF and the session management function network element (SMF), the security of PFCP signaling fields, and the abnormal ports where the UPF intersects with network security components, a comprehensive threat score is determined. Based on the comprehensive threat score, a signaling security protection strategy is determined; Based on the aforementioned protection strategy, the PFCP signaling is protected; wherein, the SEID transition mechanism in different protection strategies has a different cycle.

2. The signaling security protection method according to claim 1, characterized in that, The threat comprehensive score is determined by analyzing the packet forwarding control protocol (PFCP) signaling traffic at the interface between the UPF and the session management function (SMF), the security of PFCP signaling fields, and abnormal ports where the UPF intersects with network security components. This includes: Based on the traffic of the PFCP signaling, the first perceived threat information is determined; Based on the security of the fields in the PFCP signaling, the second perceived threat information is determined; Based on the abnormal port where the UPF interfaces with the network security component, third-party perceived threat information is determined; The comprehensive threat score is determined based on the first perceived threat information, the second perceived threat information, and the third perceived threat information.

3. The signaling security protection method according to claim 1 or 2, characterized in that, The determination of signaling security protection strategies based on the comprehensive threat score includes: If the overall threat score meets the first score threshold, the protection strategy is to enable the session endpoint identifier (SEID) transition mechanism, set the first transition period, and perform the binding verification of packet detection rule identifier and tunnel endpoint identifier only during the session creation phase of the UPF and the SMF. If the overall threat score meets the second score threshold, the protection strategy is to enable the Session Endpoint Identifier (SEID) transition mechanism, set a second transition period, and perform binding verification of the packet detection rule identifier and the tunnel endpoint identifier throughout the entire session lifecycle; the first transition period is longer than the second transition period. If the overall threat score meets the third score threshold, the protection strategy is to continuously activate the Session Endpoint Identifier (SEID) transition mechanism, set a third transition period, and update all identifiers within the packet detection rules. The third transition period is shorter than the second transition period.

4. The signaling security protection method according to claim 3, characterized in that, The protection strategy involves enabling the Session Endpoint Identifier (SEID) transition mechanism, setting a first transition period, and performing packet detection rule identifier and tunnel endpoint identifier binding verification only during the session creation phase between the UPF and the SMF. Based on this protection strategy, security protection is provided for the PFCP signaling, including: Receive the session establishment request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF, wherein the session establishment request signaling includes a first all session endpoint identifier; The session establishment request signaling is parsed to obtain the first user identity fingerprint and the first bearer context in the tunnel endpoint identifier, and the second user identity fingerprint and the second bearer context in the packet detection rule identifier. Based on the first comparison result between the first user identity fingerprint and the second user identity fingerprint, the second comparison result between the first bearer context and the second bearer context, and the first all session endpoint identifier, a second all session endpoint identifier is created; Send a session establishment response containing the first total session endpoint identifier and the second total session endpoint identifier to the SMF to provide security protection for the PFCP signaling.

5. The signaling security protection method according to claim 4, characterized in that, The step of creating a second all-session endpoint identifier based on the first comparison result of the first user identity fingerprint and the second user identity fingerprint, the second comparison result of the first bearer context and the second bearer context, and the first all-session endpoint identifier includes: Based on the first comparison result and the second comparison result, determine whether the PFCP signaling is valid; If the PFCP signaling is valid, a second session endpoint identifier is generated based on the first session endpoint identifier and the hash algorithm in the first all session endpoint identifiers. A session context is created using the second session endpoint identifier as an index and associated with the first session endpoint identifier. Based on the IP address of the UPF and the second session endpoint identifier, create the second total session endpoint identifier.

6. The signaling security protection method according to claim 5, characterized in that, Sending a session establishment response containing the first and second all session endpoint identifiers to the SMF, and providing security protection for the PFCP signaling, includes: The system receives a session hopping request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF, and parses the session hopping request signaling to obtain the second session endpoint identifier and the third all session endpoint identifier. The third all session endpoint identifier is created by the SMF based on the SMF's IP address and the third session endpoint identifier. The third session endpoint identifier is generated by the SMF when the first hopping period expires. The session hopping request is a type of session update request that only contains the all session endpoint identifier. If the PFCP signaling is determined to be legitimate based on the associated session context retrieved based on the second session endpoint identifier, a fourth session endpoint identifier is generated based on the third session endpoint identifier from the third all session endpoint identifiers and a hash algorithm. Replace the index of the session context with the fourth session endpoint identifier, and update the first session endpoint identifier associated with the session context to the third session endpoint identifier; Based on the IP address of the UPF and the fourth session endpoint identifier, a fourth all-session endpoint identifier is created, and a session transition response signaling containing the third session endpoint identifier and the fourth all-session endpoint identifier is sent to the SMF to provide security protection for the PFCP signaling.

7. The signaling security protection method according to claim 3, characterized in that, The protection strategy involves enabling the Session Endpoint Identifier (SEID) transition mechanism, setting a second transition period, and performing binding verification between the packet detection rule identifier and the tunnel endpoint identifier throughout the entire session lifecycle. Based on this protection strategy, security protection is provided for the PFCP signaling, including: Throughout the entire session lifecycle, receive session update request signaling based on Message Forwarding Control Protocol (PFCP) sent by the SMF; The session update request signaling is parsed. If the session update request signaling contains a packet detection rule identifier and a tunnel endpoint identifier but does not contain all session endpoint identifiers, the first user identity fingerprint and the first bearer context in the tunnel endpoint identifier, and the second user identity fingerprint and the second bearer context in the packet detection rule identifier are extracted respectively. Based on the comparison results of the first user identity fingerprint and the second user identity fingerprint, and the comparison results of the first bearer context and the second bearer context, a session update response containing a successful session update result is sent to the SMF to provide security protection for the PFCP signaling; If all session endpoint identifiers exist in the session update request signaling but no packet detection rule contains packet detection rule identifiers and tunnel endpoint identifiers, the current session endpoint identifier is changed, and a session update response containing a successful session update result is sent to the SMF to provide security protection for the PFCP signaling. If the session update request signaling contains a packet detection rule identifier and a tunnel endpoint identifier, and all session endpoint identifiers are present, the current session endpoint identifier is changed, and a session update response containing a successful session update result is sent to the SMF to provide security protection for the PFCP signaling.

8. The signaling security protection method according to claim 3, characterized in that, The protection strategy involves continuously initiating a Session Endpoint Identifier (SEID) transition mechanism, setting a third transition period, and updating all identifiers within the packet detection rules. The third transition period is shorter than the second transition period. Based on this protection strategy, security protection is provided for the PFCP signaling, including: The system receives a session update request signaling based on the Message Forwarding Control Protocol (PFCP) sent by the SMF. The session update request signaling includes deleting a first packet detection rule and creating a second packet detection rule. The core business logic of the second packet detection rule is the same as that of the first packet detection rule. Based on the second packet detection rule, a new rule context is created and written into the UPF memory. At the same time, the session context index is associated to activate the matching permission of the second packet detection rule for data packets. Based on the second data packet detection rule, the matching permission of the first data packet detection rule for data packets is terminated, and the memory usage and associated index of the first data packet detection rule are cleared. Determine the rule identifier corresponding to the second data packet detection rule; Based on the rule identifier corresponding to the second data packet detection rule, the exploitation path of the rule identifier corresponding to the first data packet detection rule is cut off, thereby providing security protection for the PFCP signaling.

9. A signaling security protection device, characterized in that, include: The first determination module is used to determine the comprehensive threat score based on the packet forwarding control protocol (PFCP) signaling traffic of the interface between the UPF and the session management function network element (SMF), the security of the PFCP signaling fields, and the abnormal ports of the UPF and network security components. The second determining module is used to determine the signaling security protection strategy based on the comprehensive threat score. The protection module is used to provide security protection for the PFCP signaling based on the protection strategy; wherein the SEID transition mechanism in different protection strategies has a different cycle.

10. A signaling security protection system, characterized in that, Includes the User Plane Function (UPF) and Session Management Function (SMF) as described in claim 1, wherein: The UPF is used to determine a comprehensive threat score based on the packet forwarding control protocol (PFCP) signaling traffic at the interface between the UPF and the session management function (SMF), the security of PFCP signaling fields, and abnormal ports where the UPF interfaces with network security components; based on the comprehensive threat score, a signaling security protection strategy is determined; and based on the protection strategy, security protection is provided for the PFCP signaling; wherein the SEID transition mechanism in different protection strategies has a different cycle; The SMF is used to send session establishment request signaling, session transition request signaling, and session update request signaling based on the Message Forwarding Control Protocol (PFCP) to the UPF. The session establishment request signaling, session transition request signaling, and session update request signaling include session endpoint identifier, tunnel endpoint identifier, and packet detection rule identifier.

11. The signaling security protection system according to claim 10, characterized in that, The SMF is also used to receive the hop request response signaling sent by the UPF, and parse the hop request response signaling to obtain the third session endpoint identifier and the fourth all session endpoint identifier. Retrieve relevant session context based on the third session endpoint identifier to determine the transition result; If the transition result is normal, update the fourth session endpoint identifier in the fourth all session endpoint identifier associated with the session context; if the transition result is abnormal, perform transition exception handling.

12. The signaling security protection system according to claim 10 or 11, characterized in that, The SMF is also used to generate a tunnel endpoint identifier based on user identity fingerprint information, bearer context, and dynamic mask; determine a truncated hash value based on the user identity fingerprint information and the bearer context; and generate a packet detection rule identifier based on the truncated hash value and an in-session incrementing counter.

13. The signaling security protection system according to claim 10 or 11, characterized in that, The SMF is also used to generate a second rule identifier based on a first rule identifier and an in-session incrementing counter using a hash algorithm. The core business logic of the second packet detection rule corresponding to the second rule identifier is the same as that of the first packet detection rule corresponding to the first rule identifier. A session update request signaling is created based on the second packet detection rule.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the signaling security protection method as described in any one of claims 1 to 8.

15. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the signaling security protection method as described in any one of claims 1 to 8.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the signaling security protection method as described in any one of claims 1 to 8.

Images