Signaling security risk detection method and device, equipment, storage medium and product

Abstract

The invention relates to the field of signaling security, and provides a signaling security risk detection method and device, equipment, a storage medium and a product. The method comprises the following steps: receiving a signaling message; and based on the message link layer information and the message routing layer information, determining whether the flow direction of the signaling message accords with a normal service feature so as to determine whether the signaling message has a security risk. According to the method and the device, whether the flow direction of the signaling message accords with the normal service characteristics is judged by jointly checking the information contents of the link layer and the routing layer, and then whether the signaling message has the security risk is judged, so that cross-layer joint detection of the security risk of the signaling is realized, the security risk existing in the signaling can be identified more accurately, and the safety of the signaling is improved. According to the method, the possibility of missing blocking of risk signaling is greatly reduced, meanwhile, the risk of mistakenly blocking normal domestic intercommunication signaling due to simple configuration of protection measures can be prevented, and the problem that risk signaling missing blocking or normal signaling mistakenly blocking exists due to the fact that only single-layer signaling message content of a routing layer is used for risk judgment and safety protection is solved.

Description

Technical Field

[0001] This application relates to the field of signaling security technology, and in particular to a signaling security risk detection method, apparatus, equipment, storage medium and product. Background Technology

[0002] Existing methods for protecting international interconnection signaling security are all based on classifying the signaling involved in the business processes of international interconnection networks into three categories of security risks (Cat1 signaling refers to various types of signaling that should not appear in interconnection scenarios and are only used within the home network; Cat2 signaling refers to signaling that impersonates the home network and is sent to the visited network; and Cat3 signaling refers to signaling that impersonates the visited network and is sent to the home network), and then designing corresponding security protection accordingly.

[0003] In security protection design, the basis for classifying signaling is the signaling message itself, while the basis for judging security risks needs to be a comprehensive judgment based on the flow of signaling messages, the specific signaling messages, and the relevant information carried in the messages (such as the user identifier IMSI (International Mobile Subscriber Identity) or MSISDN (Mobile Subscriber Integrated Services Digital Network Number)).

[0004] However, existing security risk assessment logic only uses information contained in the routing layer combined with signaling messages to assess and protect against security risks, which leads to problems such as missed blocking of risky signaling or false blocking of normal signaling. Summary of the Invention

[0005] This application provides a signaling security risk detection method, apparatus, device, storage medium, and product to solve the technical problem that existing security risk judgment logic only uses information contained in the routing layer combined with signaling messages for security risk judgment and security protection, resulting in missed blocking of risky signaling or false blocking of normal signaling.

[0006] In a first aspect, embodiments of this application provide a signaling security risk detection method, including: Receive signaling messages; Based on message link layer information and message routing layer information, it is determined whether the signaling message flow conforms to normal business characteristics, so as to determine whether the signaling message has any security risks.

[0007] In one embodiment, the message routing layer information includes routing layer sending address information and routing layer destination address information, and the message link layer information includes link layer sending address information and link layer destination address information; when both the routing layer sending address information and the routing layer destination address information are home network address information, determining whether the signaling message flow conforms to normal service characteristics based on the message link layer information and the message routing layer information, in order to determine whether the signaling message has a security risk, includes: Extract the link layer transmit address information and link layer destination address information; If the address information sent at the link layer is a non-home network address, it is determined that the signaling message flow does not conform to normal service characteristics, and the signaling message poses a security risk. When the link layer sends the home network address information, based on the link layer destination address information, it is determined whether the signaling message flow conforms to normal service characteristics and whether the signaling message has security risks.

[0008] In one embodiment, determining whether the signaling message flow conforms to normal service characteristics and whether the signaling message poses a security risk based on the link layer destination address information includes: If the destination address information at the link layer is a non-home network address, it is determined that the signaling message flow does not conform to normal service characteristics, and the signaling message is determined to have a security risk. If the destination address information at the link layer is the home network address information, it is determined that the signaling message flow conforms to normal service characteristics and that the signaling message does not pose a security risk.

[0009] In one embodiment, the signaling message is international interoperability SS7 signaling, and the link layer sending address information is source signaling point code (OPC) address information; when the link layer sending address information is a non-home network address, determining that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk includes: If the OPC address information is a non-current home country address in the global SS7 international signaling point code table, or if the OPC address information is not configured to the home network SS7 signaling link source point code address, it is determined that the signaling message flow does not conform to normal business characteristics, and it is determined that the signaling message has a security risk.

[0010] In one embodiment, the signaling message is international interoperability SS7 signaling, and the link layer destination address information is destination signaling point code (DPC) address information; when the link layer destination address information is a non-home network address, determining that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk includes: If the DPC address information is not configured to the destination point code address of the home network SS7 signaling link, it is determined that the signaling message flow does not conform to normal service characteristics, and it is determined that the signaling message has a security risk.

[0011] In one embodiment, the signaling message is an international interoperability Diameter signaling message, and the link layer sending address information is link layer sending IP address information; when the link layer sending address information is a non-home network address, determining that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk includes: If the IP address information sent at the link layer is configured to the peer address of the international signaling link in a non-home network, or if the IP address information sent at the link layer is not configured to the local address of the domestic signaling link in the home network, it is determined that the signaling message flow does not conform to normal service characteristics, and it is determined that the signaling message has a security risk.

[0012] In one embodiment, the signaling message is an international interoperability Diameter signaling message, and the link-layer destination address information is link-layer destination IP address information; the step of determining that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk when the link-layer destination address information is a non-home network address includes: If the destination IP address message at the link layer is not configured to the peer address of the domestic signaling link in the home network, it is determined that the direction of the signaling message does not conform to normal service characteristics, and it is determined that the signaling message has a security risk.

[0013] Secondly, embodiments of this application provide a signaling security risk detection device, comprising: The signaling receiving module is used to receive signaling messages; The risk detection module is used to determine whether the signaling message flow conforms to normal business characteristics based on message link layer information and message routing layer information, so as to determine whether the signaling message has security risks.

[0014] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the program to implement the steps of the signaling security risk detection method described in the first or second aspect.

[0015] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the steps of the signaling security risk detection method described in the first or second aspect.

[0016] Fifthly, embodiments of this application provide a computer program product, including a computer program, which, when executed by a processor, implements the steps of the signaling security risk detection method described in the first or second aspect.

[0017] The signaling security risk detection method, apparatus, device, storage medium, and product provided in this application jointly examine the information content of the link layer and routing layer to determine whether the signaling message flow conforms to normal business characteristics, and then determine whether the signaling message has security risks. This achieves cross-layer joint detection of signaling security risks, which can more accurately identify the security risks in the signaling, greatly reduce the possibility of missing risky signaling, and also prevent the risk of mistakenly blocking normal domestic inter-communication signaling due to simple configuration of protection measures. It solves the problem that the current method of using only the single-layer signaling message content of the routing layer for signaling security risk judgment and security protection has the problem of missing risky signaling or mistakenly blocking normal signaling. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating existing methods for determining the flow of international communication messages.

[0020] Figure 2 This is a schematic diagram illustrating the security risks of achieving a denial-of-service attack by modifying the calling address of SS7 inter-network Cat1 signaling to the address information of the home network element, as provided in the embodiments of this application.

[0021] Figure 3 This is a schematic diagram illustrating the security risks of achieving a denial-of-service attack by modifying the calling address of SS7 inter-network Cat2 signaling to the address information of the home network element, as provided in the embodiments of this application.

[0022] Figure 4 This is a schematic diagram illustrating the security risks of achieving a denial-of-service attack by modifying the calling address of SS7 inter-network Cat3 signaling to the address information of the home network element, as provided in the embodiments of this application.

[0023] Figure 5 This is a schematic diagram illustrating the security risks of bypassing existing security protection mechanisms to achieve denial-of-service attacks by modifying the calling address of Diameter inter-network Cat2 signaling to the address information of the home network element.

[0024] Figure 6 This is a schematic diagram illustrating the security risks of bypassing existing security protection mechanisms to achieve denial-of-service attacks by modifying the calling address of Diameter inter-network Cat3 signaling to the address information of the home network element.

[0025] Figure 7 This is a flowchart illustrating the signaling security risk detection method provided in the embodiments of this application.

[0026] Figure 8 This is a flowchart illustrating the logic for determining the international communication flow direction based on the routing layer and link layer, as provided in the embodiments of this application.

[0027] Figure 9 This is a flowchart illustrating the logic for determining cross-layer security risks in the international interoperability SS7 signaling flow provided in this application embodiment.

[0028] Figure 10 This is a flowchart illustrating the logic for determining cross-layer security risks in international interoperability Diameter signaling flow provided in this application embodiment.

[0029] Figure 11 This is a schematic diagram of the signaling security risk detection device provided in the embodiments of this application.

[0030] Figure 12 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] Existing methods for protecting international interconnection signaling security are all based on classifying the signaling involved in the business processes of international interconnection networks into three categories of security risks (Cat1 signaling refers to various types of signaling that should not appear in interconnection scenarios and are only used within the home network; Cat2 signaling refers to signaling that impersonates the home network and is sent to the visited network; and Cat3 signaling refers to signaling that impersonates the visited network and is sent to the home network), and then designing corresponding security protection accordingly.

[0033] In these security protection designs, the basis for classifying signaling is the signaling message itself, while the basis for judging security risks needs to be combined with: the flow of signaling messages, the specific signaling messages, and the relevant information carried in the messages (such as user identifiers (IMSI or MSISDN)) to make a comprehensive judgment. For example, the logic for determining illegal Cat1 signaling is usually as follows: the sending address (for SS7 signaling, the calling party address information at the SCCP (Signalling Connection Control Part) layer; for Diameter signaling, the source host (Origin-Host) or source Realm (Origin-Realm) field information at the Diameter protocol layer) is not the address of the local network, while the destination address (for SS7 signaling, the called party address information at the SCCP layer; for Diameter signaling, the destination host (Destination-Host) or destination Realm (Destination-Realm) field information at the Diameter protocol layer) is the address of the local network, and the message is Cat1 signaling, which constitutes illegal signaling. This judgment logic only uses the network element address or host / Realm address information in the SCCP layer or Diameter protocol layer of the signaling message to determine the message flow direction, and then combines the signaling message to determine whether there is a security risk; the existing security risk judgment logic only uses the information contained in the routing layer (SCCP layer or Diameter protocol layer) in combination with the signaling message to make a security risk judgment.

[0034] Regarding the security risk assessment logic described above, in the first scenario—where an attacker tampers with the sending address of signaling messages in the routing layer (SS7 signaling uses the SCCP layer calling party address information, and Diameter signaling uses the Diameter protocol layer source host or source realm field information) and modifies it to the home network address information—the signaling message flow will not meet the characteristics of illegal Cat1 risk signaling, potentially leading to missed interception of potentially risky signaling. In the second scenario—if there are errors, misconfigurations, or test configurations in the internal signaling routing configuration, signaling messages that should be transmitted between network elements within the network are mistakenly sent to an international gateway, the sending and destination addresses of such signaling messages will also be the home network address information. Regarding the second scenario, the Global System for Mobile Communications Association (GSMA), in its recommendations for protecting against security risks associated with international roaming communication, suggests directly discarding signaling messages where both the sending and destination addresses are the home network's address information at international gateways. Strictly adhering to this recommendation and processing signaling messages in both scenarios can prevent the interception of risky signaling messages in the first scenario, but it may also lead to the mistaken interception of legitimate signaling messages in the second scenario. Therefore, current methods for ensuring the security of international communication do not strictly follow this recommendation to mitigate related security risks.

[0035] That is, the existing technology has the following disadvantages: (1) The existing international interoperability communication security protection related systems, equipment, devices or related methods for implementing international interoperability communication security protection rely solely on the information content in the routing layer to identify the direction of the signaling message flow, and then combine the signaling message and related information carried in the message (such as user identifier (IMSI or MSISDN)) to comprehensively judge whether there is a security risk, which is prone to the risk of missing the blocking of risky signaling. (2) If the existing international interoperability communication security protection related systems, equipment, devices or related methods for implementing international interoperability communication security protection strictly follow the GSMA's recommendations on the protection of security risks faced by international roaming interoperability communication (for such signaling messages whose sending address and destination address are both the home network address information that appear at international gateways, they should be directly discarded), there may be cases of mistakenly blocking normal signaling.

[0036] Figure 1 This is a flowchart illustrating existing methods for determining the flow of international communication messages. (Refer to...) Figure 1This demonstrates the logic for determining the flow of international interoperability signaling based on the routing layer. In traditional international interoperability signaling security protection systems, the basis for determining the flow of received signaling messages is usually as follows: Examining the routing layer sending address (for SS7 signaling, the SCCP layer calling party address; for Diameter signaling, the Diameter protocol layer source host or source realm field) and destination address (for SS7 signaling, the SCCP layer called party address; for Diameter signaling, the Diameter protocol layer destination host or destination realm field). If the destination address is the address of a home network (HPLMN, Home Public Land Mobile Network) element, while the sending address is a non-home network (VPLMN, Visited Public Land Mobile Network) element, then... By examining the address information of MobileNetwork (visiting public terrestrial mobile networks), it can be determined that the message is an international inbound signaling message sent from the visited network to the home network. Based on this, security risks are further assessed according to Cat1, 2, and 3 signaling messages and their content.

[0037] The method described above, which only checks the routing layer address information to determine the message flow and thus assess signaling risk, will not be recognized as an international incoming signaling message when the routing layer sending address information is tampered with and changed to the home network element address information. Instead, it will be mistakenly identified as an inter-network communication message between home network elements and will not be included in the subsequent signaling security risk assessment logic. This has the defect of missing relevant risky signaling.

[0038] Figure 2 This is a schematic diagram illustrating the security risks of achieving a denial-of-service attack by modifying the calling address of SS7 inter-network Cat1 signaling to the address information of the home network element, as provided in the embodiments of this application. Figure 3 This is a schematic diagram illustrating the security risks of achieving a denial-of-service attack by modifying the calling address of SS7 inter-network Cat2 signaling to the address information of the home network element, as provided in the embodiments of this application. Figure 4 This is a schematic diagram illustrating the security risks of achieving a denial-of-service attack by modifying the calling address of SS7 inter-network Cat3 signaling to the address information of the home network element, as provided in the embodiments of this application. Figure 5This is a schematic diagram illustrating the security risks of bypassing existing security protection mechanisms to achieve denial-of-service attacks by modifying the calling address of Diameter inter-network Cat2 signaling to the address information of the home network element. Figure 6 This is a schematic diagram illustrating the security risks of bypassing existing security protection mechanisms to achieve denial-of-service attacks by modifying the calling address of Diameter inter-network Cat3 signaling to the address information of the home network element.

[0039] Reference Figures 2-6 This addresses various security risks that may arise from tampering with the address information sent in signaling messages. Specifically, for SS7 inter-network Cat1, 2, and 3 signaling messages such as ANY TIME MODIFICATION, DELETE SUBSCRIBER DATA, and RESTORE DATA, or Diameter inter-network Cat2 and 3 signaling messages such as Delete Subscriber Data Request and Update Location Request, modifying the sending address information to the home network element address information will prevent them from being identified as international inbound signaling and thus bypassing existing signaling security risk assessment logic, allowing for successful attacks.

[0040] To address the current practice of using only the routing layer signaling message content for signaling security risk assessment and protection, which results in the potential for missed blocking of risky signaling or false blocking of normal signaling, and the inability of existing security protection mechanisms to fully meet the security risk identification requirements in such scenarios, this application's embodiments no longer rely solely on the relevant content in the routing layer of the signaling message to determine the signaling message flow. Instead, it combines relevant information from the link layer of the signaling message to comprehensively determine the signaling message flow, and combines the original signaling message and the relevant information carried within the message to comprehensively determine whether the signaling message poses a security risk. This allows for the accurate identification of risky signaling that bypasses existing security protection measures by tampering with the routing layer address information in the signaling message, providing accurate risk information for subsequent corresponding security protection measures.

[0041] Figure 7 This is a flowchart illustrating the signaling security risk detection method provided in an embodiment of this application. (Refer to...) Figure 7 This application provides a signaling security risk detection method, which may specifically include the following steps: Step 701: Receive signaling message; Step 702: Based on message link layer information and message routing layer information, determine whether the signaling message flow conforms to normal business characteristics, so as to determine whether the signaling message has any security risks.

[0042] It should be noted that the execution subject of the signaling security risk detection method provided in this application embodiment can be an electronic device, a component in the electronic device, an integrated circuit, or a chip. The electronic device can be a mobile electronic device or a non-mobile electronic device. For example, a mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., while a non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not specifically limit the scope of the application.

[0043] It should be noted that the signaling security risk detection method provided in this application embodiment can be applied to international interoperability scenarios such as 5G and 6G.

[0044] In this embodiment of the application, after receiving a signaling message, message link layer information and message routing layer information can be extracted, thereby combining the message link layer information and message routing layer information across layers to jointly determine the direction of the signaling message flow, determine whether the direction of the signaling information flow conforms to normal business characteristics, and then determine the signaling security risk.

[0045] In some embodiments, the message link layer can be an SS7 signaling MTP3 (Message Transfer Part Level 3) / M3UA (MTP3 User Adaptation Layer) / M2UA (MTP2 User Adaptation Layer) link, a Diameter signaling IP link, etc.

[0046] In some embodiments, the message routing layer can be the SS7 signaling SCCP layer or the Diameter signaling Diameter protocol layer.

[0047] This application embodiment determines whether the signaling message flow conforms to normal business characteristics by jointly inspecting the information content of the link layer and routing layer, thereby determining whether there are security risks in the signaling message. It realizes cross-layer joint detection of signaling security risks, which can more accurately identify the security risks in the signaling, greatly reduce the possibility of missing risky signaling, and at the same time prevent the risk of mistakenly blocking normal domestic inter-communication signaling due to simple configuration of protection measures. It solves the problem that the current method of using only the single-layer signaling message content of the routing layer for signaling security risk judgment and security protection has the problem of missing risky signaling or mistakenly blocking normal signaling.

[0048] In an optional embodiment, the message routing layer information includes routing layer sending address information and routing layer destination address information, and the message link layer information includes link layer sending address information and link layer destination address information; when both the routing layer sending address information and the routing layer destination address information are home network address information, determining whether the signaling message flow conforms to normal service characteristics based on the message link layer information and the message routing layer information, in order to determine whether the signaling message has a security risk, may specifically include: Step S11: Extract the link layer transmit address information and link layer destination address information; Step S12: If the address information sent at the link layer is a non-home network address, determine that the signaling message flow does not conform to normal service characteristics and determine that the signaling message has a security risk. Step S13: If the link layer sending address information is the home network address information, determine whether the signaling message flow conforms to normal service characteristics based on the link layer destination address information, and determine whether the signaling message has security risks.

[0049] Figure 8 This is a flowchart illustrating the logic for determining the international communication flow direction based on the routing layer and link layer, as provided in an embodiment of this application. (Refer to...) Figure 8 This application embodiment, based on the traditional routing layer-based international communication flow determination logic, can further extract message link layer address information (for SS7 signaling links, the MTP (Message Transfer Part) portion can be determined; for Diameter signaling links, the IP (Internet Protocol) portion can be determined)). The message link layer address information can include link layer sending address information and link layer destination address information.

[0050] In some embodiments, it can be first determined whether the message link layer sending address is a home network address. When the link layer sending address is a home network address, it can be further determined whether the message link layer destination address is a home network address, thereby determining whether the signaling message flow conforms to normal service characteristics and whether the signaling message poses a security risk. When the link layer sending address is a non-home network address, it can be determined that the signaling message flow does not conform to normal service characteristics, that the signaling message poses a security risk, and that it needs to be intercepted.

[0051] This application's embodiment modifies the existing routing layer-based international communication signal flow determination logic to a routing layer + link layer-based logic. By further combining the link layer sending address information and the link destination address information for determination, it can effectively avoid the current misjudgment of normal signaling and risky signaling when both the routing layer sending address information and the destination address information are the home network HPLMN element address information, based on the single-layer information content of the routing layer. This is conducive to more accurately determining whether such signaling has security risks.

[0052] In an optional embodiment, determining whether the signaling message flow conforms to normal service characteristics and whether the signaling message poses a security risk based on the link layer destination address information may specifically include: Step S131: If the destination address information at the link layer is a non-home network address, determine that the signaling message flow does not conform to normal service characteristics and determine that the signaling message has a security risk. Step S132: If the destination address information at the link layer is the home network address information, determine that the signaling message flow conforms to normal service characteristics and determine that the signaling message does not pose a security risk.

[0053] Please continue to refer to Figure 8 In this embodiment, when both the link layer sending address information and the link layer destination address information are home network address information, it can be determined that the signaling message flow conforms to normal service characteristics, the signaling message does not pose a security risk, and the signaling message is an internal communication signal within the home network, thus allowing the signaling message to proceed. When it is determined that the link layer sending address information is a non-home network address information, it can be determined that the signaling message flow does not conform to normal service characteristics, the signaling message poses a security risk, and the signaling message is a risky signaling message, thus intercepting the signaling message. When it is determined that the link layer sending address information is a home network address information, and further determined that the link layer destination address information is a non-home network address information, it can be determined that the signaling message flow does not conform to normal service characteristics, the signaling message poses a security risk, and the signaling message is a risky signaling message, thus intercepting the signaling message.

[0054] This application's embodiment changes the existing routing layer-based international communication signal flow determination logic to a routing layer + link layer-based logic. By combining the link layer's sending address information and the link destination address information to determine whether they are home network address information, it can effectively avoid the current misjudgment of normal signaling and risky signaling based on the single-layer information content of the routing layer when both the sending address information and the destination address information are home network HPLMN element address information. It can more accurately determine whether such signaling has security risks.

[0055] In one optional embodiment, the signaling message is international interoperability SS7 signaling, and the link layer sending address information is source signaling point code (OPC) address information. Specifically, determining that the signaling message flow does not conform to normal service characteristics and that the signaling message poses a security risk when the link layer sending address information is not a home network address, may include: determining that the signaling message flow does not conform to normal service characteristics and that the signaling message poses a security risk when the OPC address information is a non-current home country address in the global SS7 international signaling point code table, or when the OPC address information is not a source point code address configured to the home network's SS7 signaling link source address.

[0056] In this embodiment of the application, the core judgment logic for cross-layer security risks of SS7 signaling flow in international interconnection is as follows: when the routing layer sending address information and destination address information in the received signaling message are both home network HPLMN address information, the OPC (Originating Point Code) and DPC (Destination Point Code) address information of the SS7 signaling MTP link layer are extracted, and it is determined whether the OPC address information is home network address information.

[0057] Figure 9 This is a flowchart illustrating the logic for determining cross-layer security risks in SS7 signaling flow for international interoperability, as provided in an embodiment of this application. (Refer to...) Figure 9In some embodiments, the OPC sending address information can be compared with the information in the global SS7 international signaling point code table published by ITU-T (International Telecommunication Union-Telecommunication Standardization Sector), i.e., the ISPC (Interconnection Signalling Point Controller) ITU-T database report table, which can be obtained from the ITU website and records the signaling point codes of international gateway offices registered with the ITU by various countries around the world.

[0058] When the OPC address information matches any record in the non-current HPLMN home PC (Personal Computer) address list (i.e., the OPC address information is a non-current home country address in the global SS7 international signaling point code table), it can be determined that the signaling message is a signaling message sent from a non-HPLMN network PC address related link, containing an SCCP routing layer sending address as the home network address. This does not conform to the flow characteristics of normal and legitimate signaling messages sent from a non-HPLMN to an HPLMN international visit signaling message, and it can be determined that the signaling message has a security risk.

[0059] When the OPC address information cannot be matched with any record in the non-current HPLMN home PC address (i.e., the OPC address information is not a non-current home country address in the global SS7 international signaling point code table), it can be further compared with the source point code table of the home network SS7 signaling link configured to the ISTP (Inter-Working Signalling Transfer Point).

[0060] When the OPC address information cannot be matched with any record in the source point code table of the SS7 signaling link configured by the ISTP in the home network, it can be determined that the signaling message does not meet the flow characteristics of a normal and legitimate signaling message sent from outside the HPLMN to the HPLMN international visit signaling message. At the same time, it can also be determined that the signaling message does not meet the flow characteristics of a normal and legitimate inter-network signaling message sent from the ISTP to the HPLMN network. Therefore, it can be determined that the signaling message is risky. When the OPC address information can be matched with any record in the source point code table of the SS7 signaling link configured by the ISTP in the HPLMN network, it can be further determined whether the DPC destination address information in the signaling message can be matched with any record in the destination point code table of the SS7 signaling link configured by the ISTP in the HPLMN network.

[0061] In one optional embodiment, the signaling message is international interoperability SS7 signaling, and the link layer destination address information is destination signaling point code (DPC) address information. Specifically, determining that the signaling message flow does not conform to normal service characteristics and that the signaling message poses a security risk when the link layer destination address information is not a home network address can include: determining that the signaling message flow does not conform to normal service characteristics and that the signaling message poses a security risk when the DPC address information is not configured to the home network SS7 signaling link destination point code address.

[0062] Please continue to refer to Figure 9 In some embodiments, when the DPC destination address information corresponds to any record in the destination point code table of the SS7 signaling link configured by the ISTP to the HPLMN network (i.e., the DPC address information is the destination point code address configured to the home network's SS7 signaling link), it can be determined that the signaling message meets the characteristics of a legitimate signaling message flow within the home network, and thus can be determined that the signaling message is a normal signaling message. When the DPC destination address information does not correspond to any record in the destination point code table of the SS7 signaling link configured by the ISTP to the HPLMN network (i.e., the DPC address information is not the destination point code address configured to the home network's SS7 signaling link), it can be determined that the signaling message does not meet the characteristics of a legitimate signaling message flow within the home network, and thus can be determined that the message is a risky and illegal signaling message.

[0063] This application embodiment uses a logic based on the routing layer and link layer to determine the international interconnection signaling flow direction for security risk assessment. When both the routing layer sending address information and the destination address information are the address information of the home network HPLMN, the link layer address information of the message is further determined. For the SS7 signaling link determination MTP part, this can effectively avoid the current misjudgment of normal signaling and risky signaling based on the single-layer information content of the routing layer when both the routing layer sending address information and the destination address information are the address information of the home network HPLMN. This allows for a more accurate determination of whether such signaling poses a security risk.

[0064] In one optional embodiment, the signaling message is an international interoperability Diameter signaling message, and the link layer sending address information is link layer sending IP address information. Specifically, determining that the signaling message flow does not conform to normal service characteristics and that the signaling message poses a security risk when the link layer sending IP address information is a non-home network address, or when the link layer sending IP address information is not a home network domestic signaling link address, may include: determining that the signaling message flow does not conform to normal service characteristics and that the signaling message poses a security risk when the link layer sending IP address information is configured to the peer address of a non-home network international signaling link, or when the link layer sending IP address information is not configured to the local address of a home network domestic signaling link.

[0065] In this embodiment of the application, the core judgment logic for cross-layer security risks of Diameter signaling flow in international interconnection is as follows: when the source host sending address information and the destination host destination address information in the received signaling message are both home network HPLMN address information, the Diameter signaling IP link layer sending IP address and destination IP address information can be extracted to determine whether the link layer sending IP address information is the non-HPLMN international signaling link peer address configured by IDRA.

[0066] Figure 10 This is a flowchart illustrating the logic for determining cross-layer security risks in international interoperability Diameter signaling flow, as provided in an embodiment of this application. (Refer to...) Figure 10 In some embodiments, if the IP address information sent by the link layer is the address of the peer of the non-HPLMN international signaling link configured by the IDRA, it can be determined that the signaling message is a signaling message sent from a non-HPLMN network-related link containing a routing layer source host with the home network address. This does not conform to the flow characteristics of a normal and legitimate signaling message sent from a non-HPLMN to an HPLMN international visitor, and it can be determined that the signaling message has a security risk.

[0067] If the IP address information sent by the link layer is not the peer address of the non-HPLMN international signaling link configured by IDRA, it can be further determined whether the IP address information sent by the link layer is the local address of the HPLMN domestic signaling link configured by IDRA.

[0068] If the IP address information sent by the link layer is not the local address of the domestic signaling link configured by the IDRA to the HPLMN, it can be determined that the signaling message does not meet the flow characteristics of a normal and legitimate signaling message sent from outside the HPLMN to the HPLMN international access signaling message. It can also be determined that the signaling message does not meet the flow characteristics of a normal and legitimate inter-network signaling message sent from the IDRA to the HPLMN, thus indicating a security risk. If the IP address information sent by the link layer is the local address of the domestic signaling link configured by the IDRA to the HPLMN, it can be further determined whether the destination IP address information in the signaling message is the peer address of the domestic signaling link configured by the IDRA to the HPLMN.

[0069] In one optional embodiment, the signaling message is an international interoperability diameter signaling message, and the link layer destination address information is a link layer destination IP address information; the step of determining that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk when the link layer destination IP address information is not configured to the domestic signaling link peer address of the home network can specifically include: determining that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk when the link layer destination IP address information is not configured to the domestic signaling link peer address of the home network.

[0070] Please continue to refer to Figure 10 In some embodiments, if the destination IP address information at the link layer is the address of the domestic signaling link peer configured by the IDRA to the HPLMN, it can be determined that the signaling message meets the characteristics of a legitimate signaling message flow within the home network and can be determined as a normal signaling message.

[0071] If the destination IP address is not the peer address of the domestic signaling link configured by IDRA to HPLMN, it can be determined that the signaling message does not meet the characteristics of a legitimate signaling message flow within the home network, and therefore the signaling message is an illegal signaling message with security risks and needs to be intercepted.

[0072] In summary, unlike traditional signaling security risk assessment logic which relies solely on routing layer information to determine the flow characteristics of signaling messages and thus identify security risks, this application's embodiments jointly examine link layer and routing layer information to determine whether the signaling message flow conforms to normal business characteristics, thereby determining whether the signaling message carries a risk. Compared to existing technologies, the signaling security risk detection method provided in this application's embodiments can more accurately identify security risks in signaling, significantly reducing the possibility of missing risky signaling; it also prevents the risk of mistakenly blocking normal domestic interoperable signaling due to simple configuration of protective measures.

[0073] The signaling security risk detection device provided in the embodiments of this application is described below. The signaling security risk detection device described below can be referred to in correspondence with the signaling security risk detection method described above.

[0074] Figure 11 This is a schematic diagram of the signaling security risk detection device provided in an embodiment of this application. (Refer to...) Figure 11 This application provides a signaling security risk detection device, which may specifically include the following modules: Signaling receiving module 1110 is used to receive signaling messages; The risk detection module 1120 is used to determine whether the signaling message flow conforms to normal business characteristics based on message link layer information and message routing layer information, so as to determine whether the signaling message has security risks.

[0075] In an optional embodiment, the message routing layer information includes routing layer sending address information and routing layer destination address information, and the message link layer information includes link layer sending address information and link layer destination address information; when both the routing layer sending address information and the routing layer destination address information are home network address information, the risk detection module includes: The information extraction submodule is used to extract the link layer send address information and the link layer destination address information; The first risk determination submodule is used to determine that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk when the address information sent by the link layer is a non-home network address. The second risk determination submodule is used to determine whether the signaling message flow conforms to normal service characteristics and whether the signaling message has security risks, based on the link layer destination address information when the link layer sending address information is home network address information.

[0076] In an optional embodiment, the step of determining the second risk determination submodule based on the link-layer destination address information includes: The risk assessment unit is used to determine that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk when the destination address information at the link layer is a non-home network address. The risk absence determination unit is used to determine that the signaling message flow conforms to normal service characteristics and that the signaling message does not pose a security risk when the destination address information at the link layer is the home network address information.

[0077] In an optional embodiment, the signaling message is international interoperability SS7 signaling, and the link layer sending address information is source signaling point code (OPC) address information; the first risk determination submodule includes: The OPC address information detection unit is used to determine that the signaling message flow does not conform to normal business characteristics and that the signaling message has a security risk when the OPC address information is a non-current home country address in the global SS7 international signaling point code table, or the OPC address information is not the source point code address configured to the home network SS7 signaling link.

[0078] In one optional embodiment, the signaling message is international interoperability SS7 signaling, and the link layer destination address information is destination signaling point code (DPC) address information; the risk existence determination unit includes: The DPC address information detection subunit is used to determine that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk when the DPC address information is not configured to the destination point code address of the home network SS7 signaling link.

[0079] In an optional embodiment, the signaling message is an international interoperability Diameter signaling message, and the link layer sending address information is link layer sending IP address information; the first risk determination submodule includes: The IP address information detection unit is used to determine that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk when the IP address information sent at the link layer is configured to the peer address of the international signaling link of the non-home network, or the IP address information sent at the link layer is not configured to the local address of the domestic signaling link of the home network.

[0080] In one optional embodiment, the signaling message is an international interoperability Diameter signaling message, and the link-layer destination address information is link-layer destination IP address information; the risk existence determination unit includes: The destination IP address information detection subunit is used to determine that the signaling message flow does not conform to normal service characteristics and that the signaling message has a security risk when the destination IP address message at the link layer is not configured to the address of the domestic signaling link peer in the home network.

[0081] This application embodiment determines whether the signaling message flow conforms to normal business characteristics by jointly inspecting the information content of the link layer and routing layer, thereby determining whether there are security risks in the signaling message. It realizes cross-layer joint detection of signaling security risks, which can more accurately identify the security risks in the signaling, greatly reduce the possibility of missing risky signaling, and at the same time prevent the risk of mistakenly blocking normal domestic inter-communication signaling due to simple configuration of protection measures. It solves the problem that the current method of using only the single-layer signaling message content of the routing layer for signaling security risk judgment and security protection has the problem of missing risky signaling or mistakenly blocking normal signaling.

[0082] Figure 12 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 12 As shown, the electronic device may include: a processor 1210, a communication interface 1220, a memory 1230, and a communication bus 1240, wherein the processor 1210, the communication interface 1220, and the memory 1230 communicate with each other via the communication bus 1240. The processor 1210 can call a computer program in the memory 1230 to execute the steps of the signaling security risk detection method, such as including: Receive signaling messages; Based on message link layer information and message routing layer information, it is determined whether the signaling message flow conforms to normal business characteristics, so as to determine whether the signaling message has any security risks.

[0083] Furthermore, the logical instructions in the aforementioned memory 1230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0084] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the steps of the signaling security risk detection method provided in the above embodiments, such as including: Receive signaling messages; Based on message link layer information and message routing layer information, it is determined whether the signaling message flow conforms to normal business characteristics, so as to determine whether the signaling message has any security risks.

[0085] On the other hand, embodiments of this application also provide a processor-readable storage medium storing a computer program, the computer program being used to cause a processor to execute the steps of the signaling security risk detection method provided in the above embodiments, such as including: Receive signaling messages; Based on message link layer information and message routing layer information, it is determined whether the signaling message flow conforms to normal business characteristics, so as to determine whether the signaling message has any security risks.

[0086] The processor-readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0087] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0088] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0089] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method of signaling security risk detection, the method comprising: The method comprises: receiving a signaling message; determining whether a signaling message flow direction conforms to normal service characteristics based on message link layer information and message routing layer information to determine whether the signaling message has a security risk.

2. The signaling security risk detection method of claim 1, wherein, The message routing layer information comprises routing layer sending address information and routing layer destination address information, and the message link layer information comprises link layer sending address information and link layer destination address information; in the case that the routing layer sending address information and the routing layer destination address information are both home network address information, the determination of whether the signaling message flow direction conforms to normal service characteristics based on message link layer information and message routing layer information to determine whether the signaling message has a security risk comprises: extracting the link layer sending address information and the link layer destination address information; in the case that the link layer sending address information is non-home network address information, determining that the signaling message flow direction does not conform to normal service characteristics and that the signaling message has a security risk; in the case that the link layer sending address information is home network address information, determining whether the signaling message flow direction conforms to normal service characteristics based on the link layer destination address information to determine whether the signaling message has a security risk.

3. The signaling security risk detection method of claim 2, wherein, The determination of whether the signaling message flow direction conforms to normal service characteristics based on the link layer destination address information to determine whether the signaling message has a security risk comprises: in the case that the link layer destination address information is non-home network address information, determining that the signaling message flow direction does not conform to normal service characteristics and that the signaling message has a security risk; in the case that the link layer destination address information is home network address information, determining that the signaling message flow direction conforms to normal service characteristics and that the signaling message does not have a security risk.

4. The signaling security risk detection method of claim 2, wherein, The signaling message is international interworking SS7 signaling, and the link layer sending address information is source signaling point code (OPC) address information; the determination of whether the signaling message flow direction conforms to normal service characteristics based on the link layer sending address information to determine whether the signaling message has a security risk in the case that the link layer sending address information is non-home network address information comprises: in the case that the OPC address information is a non-current home country address in a global SS7 international signaling point code table or the OPC address information is not a source point code address configured to a home network SS7 signaling link, determining that the signaling message flow direction does not conform to normal service characteristics and that the signaling message has a security risk.

5. The signaling security risk detection method of claim 3, wherein, The signaling message is international interworking SS7 signaling, and the link layer destination address information is destination signaling point code (DPC) address information; the determination of whether the signaling message flow direction conforms to normal service characteristics based on the link layer destination address information to determine whether the signaling message has a security risk in the case that the link layer destination address information is non-home network address information comprises: in the case that the DPC address information is not a destination point code address configured to a home network SS7 signaling link, determining that the signaling message flow direction does not conform to normal service characteristics and that the signaling message has a security risk.

6. The signaling security risk detection method of claim 2, wherein, The signaling message is international interworking Diameter signaling, and the link layer sending address information is link layer sending IP address information; in the case that the link layer sending address information is non-homeland network address information, it is determined that the signaling message flow direction does not conform to normal service characteristics, and it is determined that the signaling message has security risks, including: In the case that the link layer sending IP address information is configured to non-homeland network international signaling link opposite end address, or the link layer sending IP address information is not configured to homeland network domestic signaling link local end address, it is determined that the signaling message flow direction does not conform to normal service characteristics, and it is determined that the signaling message has security risks.

7. The signaling security risk detection method of claim 3, wherein, The signaling message is international interworking Diameter signaling, and the link layer destination address information is link layer destination IP address information; in the case that the link layer destination address information is non-homeland network address information, it is determined that the signaling message flow direction does not conform to normal service characteristics, and it is determined that the signaling message has security risks, including: In the case that the link layer destination IP address information is not configured to homeland network domestic signaling link opposite end address, it is determined that the signaling message flow direction does not conform to normal service characteristics, and it is determined that the signaling message has security risks.

8. A signaling security risk detection apparatus, characterized by, The signaling receiving module is configured to receive a signaling message. The risk detection module is configured to determine whether a signaling message flow direction conforms to normal service characteristics based on message link layer information and message routing layer information, to determine whether the signaling message has security risks. The processor executes the computer program to implement the steps of the signaling security risk detection method in any one of claims 1 to 7.

9. An electronic device comprising a processor and a memory having a computer program stored therein, characterized in that, The computer program is executed by the processor to implement the signaling security risk detection method in any one of claims 1 to 7. 10.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the signaling security risk detection method in any one of claims 1 to 7.

11. A computer program product comprising a computer program, characterized in that, ​

Images