Flow load balancing method and system of communication server

Abstract

The invention provides a traffic load balancing method and system of a communication server, belongs to the technical field of communication, and realizes load balancing with finer granularity in an intelligent decision mode. The method is applied to a user plane agent deployed in an operator communication network. The method comprises the following steps: the user plane agent receives service data in a service flow from a user; the user plane agent identifies the intention of the user from the service data; and the user plane agent sends the service data to a target communication server suitable for processing the service data in the plurality of communication servers according to the intention of the user, the types of the plurality of communication servers and the loads of the plurality of communication servers, each communication server in the plurality of communication servers is deployed at a multi-access edge computing MEC matched with the position of the user plane agent.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method and system for traffic load balancing of a communication server. Background Technology

[0002] With the rapid development of internet and mobile communication technologies, the demand for network applications and services is constantly increasing. This growth brings huge network traffic, placing higher demands on the processing power and stability of communication servers.

[0003] Software load balancing distributes traffic through software programs. Common software load balancers include Nginx and HAProxy. Nginx is a high-performance HTTP and reverse proxy server that supports various load balancing algorithms. HAProxy is a free and open-source software for high availability, load balancing, and proxying, supporting load balancing for TCP and HTTP applications. The load balancing algorithm determines the traffic distribution strategy. Common load balancing algorithms include Round Robin, Weighted Round Robin, and Least Connections. The Round Robin algorithm distributes requests sequentially to different servers, offering simplicity but lacking the ability to dynamically adjust based on server load. The Weighted Round Robin algorithm assigns different weights to each server based on their processing capacity; servers with higher weights receive more requests, improving overall system performance by distributing load according to server capacity. The Least Connections algorithm distributes requests to the server with the fewest current connections, allowing for dynamic adjustment based on real-time server load and avoiding uneven load distribution.

[0004] However, with the advancement of technology and the development of intelligent systems, the aforementioned load balancing methods have gradually become unable to meet the needs. Summary of the Invention

[0005] This invention provides a traffic load balancing method and system for communication servers, which achieves more granular load balancing through intelligent decision-making.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, a traffic load balancing method for communication servers is provided. This method is applied to a user plane agent deployed in an operator's communication network. The method includes: the user plane agent receiving service data from a user's service flow; the user plane agent identifying the user's intent from the service data; and the user plane agent sending the service data to a target communication server among the multiple communication servers suitable for processing the service data, based on the user's intent, the types of multiple communication servers, and the load of the multiple communication servers. Each of the multiple communication servers is a multi-access edge computing (MEC) deployed at a location matching the location of the user plane agent.

[0007] Optionally, the user plane intelligent agent is co-located with the user plane function UPF on the core network side of the operator's communication network.

[0008] Optionally, the service data includes multiple uplink data packets of the user; the user plane agent identifies the user's intent from the service data, including: if the header of each uplink data packet in the user's multiple uplink data packets can be analyzed, the user plane agent determines the user's intent by analyzing the destination address information in the header of each uplink data packet in the user's multiple uplink data packets, and the user's intent can indicate the operation currently being performed by the user, and the user plane agent does not process the payload portion of each of the user's multiple uplink data packets; or, if the header of each uplink data packet in the user's multiple uplink data packets cannot be analyzed, the user plane agent determines the traffic characteristics of the service data by analyzing the transmission characteristics of the user's multiple uplink data packets, and the traffic characteristics include at least one of the following: packet size distribution, packet transmission interval, or traffic rate; the user plane agent determines the user's intent by analyzing the traffic characteristics, and the user's intent can indicate the operation currently being performed by the user.

[0009] Optionally, there are N communication servers, where N is an integer greater than 1. The user-plane agent, based on the user's intent, the types of the multiple communication servers, and the load of the multiple communication servers, sends the business data to a target communication server suitable for processing the business data, including: For the i-th communication server among N communication servers, where i is an integer from 1 to N; the user-face agent determines the adaptation score of the i-th communication server, and the adaptation score of the i-th communication server satisfies the following relationship: Pi = W1*S1 + W2*RTT + W3*S2 Where Pi represents the adaptation score of the i-th communication server, S1 is the idle level of the i-th communication server determined based on its load, RTT is the round-trip time between the user-plane agent and the i-th communication server, S2 is the degree of adaptation between the type of the i-th communication server and the user's intent, and W1, W2 and W3 are weights with values ​​greater than 0 and less than 1, and W1+W2+W3=1. As i iterates through 1 to N, the user-face agent obtains the adaptation scores of N communication servers; The user-plane agent selects the communication server with the highest adaptation score from among N communication servers as the target communication server; the user-plane agent then sends the business data to the target communication server.

[0010] Optionally, before the user-plane agent sends the service data to the target communication server, the user-plane agent sends the service data to a default communication server. Sending the service data to the target communication server includes: if the degree of compatibility between the default communication server and the user's intent differs from the degree of compatibility between the target communication server and the user's intent, the user-plane agent hard switches the service data from being sent to the default communication server to being sent to the target communication server, and instructs the target communication server not to establish a session for the service data with the default communication server; or, if the degree of compatibility between the default communication server and the user's intent is the same as the degree of compatibility between the target communication server and the user's intent, the user-plane agent soft switches the service data from being sent to the default communication server to being sent to the target communication server, and instructs the target communication server to establish a session for the service data with the default communication server.

[0011] Optionally, the user-plane agent hard switches the transmission of business data from the default communication server to the target communication server, and instructs the target communication server not to establish a session for the business data with the default communication server. This includes: the user-plane agent negotiating a first security context with the target communication server, the first security context being suitable for security protection of the communication between the user-plane agent and the target communication server; the user-plane agent securely protecting the business data through the first security context before sending it to the target communication server; and the user-plane agent also securely protecting a first indication message through the first security context before sending it to the target communication server, the first indication message instructing the target communication server to refuse to establish a session for the business data with the default communication server.

[0012] Optionally, the user plane agent negotiates a first security context with the target communication server, including: the user plane agent and the target communication server negotiating a first security protection algorithm; the user plane agent derives a temporary intermediate public key and a temporary intermediate private key pair by using the user's NAS key as a long-term key, and derives a first temporary shared key based on the temporary intermediate private key, the privacy information of the target communication server, and the preset public key of the network where the user plane agent resides; the user plane agent sends the temporary intermediate public key to the target communication server; wherein the target communication server is configured to derive the first temporary shared key based on the temporary intermediate public key, the privacy information of the target communication server, and the preset private key of the network where the user plane agent resides; wherein the first security context includes the first security protection algorithm and the first temporary shared key.

[0013] Optionally, the user-plane agent soft-switches the transmission of business data from the default communication server to the target communication server, and instructs the target communication server to establish a business data session with the default communication server, including: The user-plane agent securely protects the business data through a second security context before sending it to the target communication server. The first security context is a security context negotiated in advance between the user-plane agent and the default communication server, and is applicable to securely protect the communication between the user-plane agent and the default communication server. Furthermore, the user-plane agent also directly sends a second instruction to the target communication server, which instructs the target communication server to establish a session with the default communication server for the business data. The target communication server is configured to respond to the second instruction, establish a session with the default communication server for the business data, and synchronize the second security context from the default communication server through the session. If the target communication server is unable to process the business data protected by the second security context due to its own load, the target communication server will send the business data protected by the second security context to the default communication server through the session.

[0014] Optionally, the user-plane agent negotiates a second security protection algorithm with the default communication server, including: the user-plane agent negotiating the second security protection algorithm with the default communication server; the user-plane agent derives a temporary intermediate public key and a temporary intermediate private key pair by using the user's NAS key as a long-term key, and derives a second temporary shared key based on the temporary intermediate private key, the privacy information of the default communication server, and the preset public key of the network where the user-plane agent resides; the user-plane agent sends the temporary intermediate public key to the default communication server; wherein the default communication server is configured to derive the second temporary shared key based on the temporary intermediate public key, the privacy information of the default communication server, and the preset private key of the network where the user-plane agent resides; wherein the second security context includes the second security protection algorithm and the second temporary shared key.

[0015] Secondly, a traffic load balancing system for communication servers is provided. The system includes a user plane agent deployed in an operator's communication network. The system is configured such that: the user plane agent receives service data from a user's service flow; the user plane agent identifies the user's intent from the service data; and the user plane agent sends the service data to a target communication server among the multiple communication servers suitable for processing the service data, based on the user's intent, the types of multiple communication servers, and the load of the multiple communication servers. Each of the multiple communication servers is a multi-access edge computing (MEC) deployed at a location matching the location of the user plane agent.

[0016] Optionally, the user plane intelligent agent is co-located with the user plane function UPF on the core network side of the operator's communication network.

[0017] Optionally, the service data includes multiple uplink data packets of the user; the user plane agent identifies the user's intent from the service data, including: if the header of each uplink data packet in the user's multiple uplink data packets can be analyzed, the user plane agent determines the user's intent by analyzing the destination address information in the header of each uplink data packet in the user's multiple uplink data packets, and the user's intent can indicate the operation currently being performed by the user, and the user plane agent does not process the payload portion of each of the user's multiple uplink data packets; or, if the header of each uplink data packet in the user's multiple uplink data packets cannot be analyzed, the user plane agent determines the traffic characteristics of the service data by analyzing the transmission characteristics of the user's multiple uplink data packets, and the traffic characteristics include at least one of the following: packet size distribution, packet transmission interval, or traffic rate; the user plane agent determines the user's intent by analyzing the traffic characteristics, and the user's intent can indicate the operation currently being performed by the user.

[0018] Optionally, there are N communication servers, where N is an integer greater than 1. The user-plane agent, based on the user's intent, the types of the multiple communication servers, and the load of the multiple communication servers, sends the business data to a target communication server suitable for processing the business data, including: For the i-th communication server among N communication servers, where i is an integer from 1 to N; the user-face agent determines the adaptation score of the i-th communication server, and the adaptation score of the i-th communication server satisfies the following relationship: Pi = W1*S1 + W2*RTT + W3*S2 Where Pi represents the adaptation score of the i-th communication server, S1 is the idle level of the i-th communication server determined based on its load, RTT is the round-trip time between the user-plane agent and the i-th communication server, S2 is the degree of adaptation between the type of the i-th communication server and the user's intent, and W1, W2 and W3 are weights with values ​​greater than 0 and less than 1, and W1+W2+W3=1. As i iterates through 1 to N, the user-face agent obtains the adaptation scores of N communication servers; The user-facing agent selects the communication server with the highest adaptation score from among N communication servers as the target communication server. The user-facing agent sends business data to the target communication server.

[0019] Optionally, before the user-plane agent sends the service data to the target communication server, the user-plane agent sends the service data to a default communication server. Sending the service data to the target communication server includes: if the degree of compatibility between the default communication server and the user's intent differs from the degree of compatibility between the target communication server and the user's intent, the user-plane agent hard switches the service data from being sent to the default communication server to being sent to the target communication server, and instructs the target communication server not to establish a session for the service data with the default communication server; or, if the degree of compatibility between the default communication server and the user's intent is the same as the degree of compatibility between the target communication server and the user's intent, the user-plane agent soft switches the service data from being sent to the default communication server to being sent to the target communication server, and instructs the target communication server to establish a session for the service data with the default communication server.

[0020] Optionally, the user-plane agent hard switches the transmission of business data from the default communication server to the target communication server, and instructs the target communication server not to establish a session for the business data with the default communication server. This includes: the user-plane agent negotiating a first security context with the target communication server, the first security context being suitable for security protection of the communication between the user-plane agent and the target communication server; the user-plane agent securely protecting the business data through the first security context before sending it to the target communication server; and the user-plane agent also securely protecting a first indication message through the first security context before sending it to the target communication server, the first indication message instructing the target communication server to refuse to establish a session for the business data with the default communication server.

[0021] Optionally, the user plane agent negotiates a first security context with the target communication server, including: the user plane agent and the target communication server negotiating a first security protection algorithm; the user plane agent derives a temporary intermediate public key and a temporary intermediate private key pair by using the user's NAS key as a long-term key, and derives a first temporary shared key based on the temporary intermediate private key, the privacy information of the target communication server, and the preset public key of the network where the user plane agent resides; the user plane agent sends the temporary intermediate public key to the target communication server; wherein the target communication server is configured to derive the first temporary shared key based on the temporary intermediate public key, the privacy information of the target communication server, and the preset private key of the network where the user plane agent resides; wherein the first security context includes the first security protection algorithm and the first temporary shared key.

[0022] Optionally, the user-plane agent soft-switches the transmission of business data from the default communication server to the target communication server, and instructs the target communication server to establish a business data session with the default communication server, including: The user-plane agent securely protects the business data through a second security context before sending it to the target communication server. The first security context is a security context negotiated in advance between the user-plane agent and the default communication server, and is applicable to securely protect the communication between the user-plane agent and the default communication server. Furthermore, the user-plane agent also directly sends a second instruction to the target communication server, which instructs the target communication server to establish a session with the default communication server for the business data. The target communication server is configured to respond to the second instruction, establish a session with the default communication server for the business data, and synchronize the second security context from the default communication server through the session. If the target communication server is unable to process the business data protected by the second security context due to its own load, the target communication server will send the business data protected by the second security context to the default communication server through the session.

[0023] Optionally, the user-plane agent negotiates a second security protection algorithm with the default communication server, including: the user-plane agent negotiating the second security protection algorithm with the default communication server; the user-plane agent derives a temporary intermediate public key and a temporary intermediate private key pair by using the user's NAS key as a long-term key, and derives a second temporary shared key based on the temporary intermediate private key, the privacy information of the default communication server, and the preset public key of the network where the user-plane agent resides; the user-plane agent sends the temporary intermediate public key to the default communication server; wherein the default communication server is configured to derive the second temporary shared key based on the temporary intermediate public key, the privacy information of the default communication server, and the preset private key of the network where the user-plane agent resides; wherein the second security context includes the second security protection algorithm and the second temporary shared key.

[0024] Thirdly, an electronic device is provided, comprising: a processor and a memory; the memory is used to store a computer program, which, when executed by the processor, causes the electronic device to perform the method described in the first aspect.

[0025] In one possible design, the electronic device described in the third aspect may further include a transceiver. This transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the electronic device described in the third aspect and other electronic devices.

[0026] In the embodiments of the present invention, the electronic device described in the third aspect may be a terminal, or a chip (system) or other component or assembly disposed in the terminal, or a system containing the terminal.

[0027] Fourthly, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer causes the computer to perform the method described in the first aspect.

[0028] In summary, for multi-access edge computing scenarios, when the user plane agent receives business data from the user's business flow, the user plane agent uses artificial intelligence to identify the user's intent from the business data. Based on the user's intent, the types of multiple communication servers, and the load of multiple communication servers, the agent sends the business data to the target communication server suitable for processing the business data. In other words, it achieves more granular load balancing through intelligent decision-making while still meeting the user's intent requirements. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the architecture of a communication system provided in an embodiment of the present invention; Figure 2 A flowchart illustrating a traffic load balancing method for a communication server provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0030] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0031] In this embodiment of the invention, "instruction" can include direct and indirect instructions, as well as explicit and implicit instructions. The information indicated by a certain piece of information is called the information to be instructed. In specific implementation, there are many ways to instruct the information to be instructed, such as, but not limited to, directly instructing the information to be instructed, such as the information to be instructed itself or its index. It can also indirectly instruct the information to be instructed by instructing other information, where there is a correlation between the other information and the information to be instructed. It can also instruct only a part of the information to be instructed, while the other parts are known or pre-agreed upon. For example, the instruction of specific information can be achieved by using a pre-agreed (e.g., protocol-defined) arrangement of various pieces of information, thereby reducing instruction overhead to some extent. Simultaneously, common parts of various pieces of information can be identified and uniformly indicated to reduce the instruction overhead caused by individually indicating the same information.

[0032] Furthermore, the specific indication method can also be any existing indication method, such as, but not limited to, the above-mentioned indication methods and their various combinations. Specific details of various indication methods can be found in existing technologies, and will not be elaborated upon here. As described above, for example, when multiple pieces of information of the same type need to be indicated, the indication methods for different pieces of information may differ. In specific implementation, the required indication method can be selected according to specific needs. This embodiment of the invention does not limit the selected indication method; therefore, the indication methods involved in this embodiment of the invention should be understood to cover various methods that enable the party to be indicated to obtain the information to be indicated.

[0033] It should be understood that the information to be indicated can be sent as a whole or divided into multiple sub-information messages sent separately, and the sending period and / or timing of these sub-information messages can be the same or different. The specific sending method is not limited in this embodiment of the invention. The sending period and / or timing of these sub-information messages can be predefined, for example, according to a protocol, or configured by the sending device by sending configuration information to the receiving device.

[0034] "Predefined" or "pre-configured" can be achieved by pre-saving corresponding codes, tables, or other means that can be used to indicate relevant information in the device. This embodiment of the invention does not limit the specific implementation method. "Saving" can refer to saving in one or more memories. These memories can be separate installations or integrated into the encoder, decoder, processor, or electronic device. Alternatively, some memories can be separately installed, while others are integrated into the decoder, processor, or electronic device. The type of memory can be any form of storage medium, and this embodiment of the invention does not limit this.

[0035] In the embodiments of this invention, "protocol" may refer to a protocol family in the field of communication, a standard protocol with a similar protocol family frame structure, or a related protocol to be applied in future systems. The embodiments of this invention do not specifically limit this.

[0036] In this embodiment of the invention, descriptions such as "when," "under the circumstances," "if," and "if" all refer to the device making corresponding processing under certain objective circumstances, and are not limited to a specific time. They do not require the device to make a judgment action during implementation, nor do they imply any other limitations.

[0037] In the description of the embodiments of the present invention, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can represent A or B. "And / or" in the embodiments of the present invention is merely a description of the relationship between the related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone, where A and B can be singular or plural. Furthermore, in the description of the embodiments of the present invention, unless otherwise stated, "multiple" refers to two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. Additionally, to facilitate a clear description of the technical solutions of the embodiments of the present invention, the terms "first" and "second" are used in the embodiments of the present invention to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or order of execution, and that "first," "second," etc., are not necessarily different. Furthermore, in the embodiments of this invention, words such as "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this invention should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner for ease of understanding.

[0038] The network architecture and business scenarios described in the embodiments of this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0039] To facilitate understanding of the embodiments of the present invention, firstly, let's take... Figure 1 The communication system shown in the figure is an example, Figure 1 This is a schematic diagram of the architecture of a communication system to which a traffic load balancing method for a communication server provided in an embodiment of the present invention is applicable.

[0040] like Figure 1 As shown, the communication system may include: a user-plane intelligent agent and multiple communication servers.

[0041] User plane intelligent agents can be deployed in the operator's communication network. The operator's communication network can be a core network (CN). The network function (NF) in the core network that supports artificial intelligence (AI) technology or intelligent agent technology can be called A-NF (AI-AF / AS / agentic-NF). In this case, the user plane intelligent agent is co-located with the user port function (UPF) on the core network side of the operator's communication network, and the user plane intelligent agent can also be called A-UPF.

[0042] In a multi-access edge computing (MEC) architecture, each communication server is deployed in a location matching the location of the user plane agent. This can also be understood as multiple communication servers deployed near the user plane agent, such as in a shared data center, campus, or administrative region (e.g., district, county, city). The communication servers can take the form of terminal devices. Terminal devices can be subscriber units, user stations, mobile stations (MS), mobile stations, remote stations, remote terminals, mobile devices, user terminals, terminals, wireless communication equipment, user agents, or user devices. The terminals in the embodiments of this application may be mobile phones, cellular phones, smartphones, tablets, wireless data cards, personal digital assistants (PDAs), wireless modems, handsets, laptop computers, machine-type communication (MTC) terminals, computers with wireless transceiver capabilities, virtual reality (VR) terminals, augmented reality (AR) terminals, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical care, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, vehicle-mounted terminals, roadside units (RSUs) with terminal functions, etc. The terminal in this application may also be an on-board module, on-board unit, on-board component, on-board chip, or on-board unit that is built into the vehicle as one or more components or units. Alternatively, the terminal may also be customer-premises equipment (CPE).

[0043] Figure 2 This is a flowchart illustrating the method provided in an embodiment of the present invention. This traffic load balancing method for a communication server is applicable to the aforementioned communication system and involves the interaction between devices within the communication system. The specific process is as follows: S201, The user-face intelligent agent receives business data from the user's business flow.

[0044] The user plane agent can receive service data through the user plane tunnel, which includes the connection between the user's terminal and the access network device, and the connection between the access network device and the user plane agent. The service data refers to data continuously received by the user plane agent. In this embodiment, the service data does not refer to the service data received by the user plane agent at a single moment, but rather to the service data continuously received by the user plane agent. For each step in this embodiment (such as S202, S203), the service data mentioned during the execution of that step refers to the service data received by the user plane agent during the execution of that step.

[0045] Business data can consist of data packets, such as multiple uplink data packets including a user's data.

[0046] For S201, since S202-S203 have not yet been executed when S201 is executed, the user plane agent sends the business data to the default communication server among multiple communication servers, which can also be understood as sending it to the pre-configured communication server.

[0047] S202, the user-face intelligent agent identifies the user's intent from business data.

[0048] If the header of each uplink data packet in a user's multiple uplink data packets can be analyzed—that is, if the user-plane agent supports the corresponding protocol layer to obtain the corresponding data from the header of each uplink data packet—then the user-plane agent can determine the user's intent by analyzing the destination address information in the header of each uplink data packet. During this process, the user-plane agent does not process the payload portion of each of the user's multiple uplink data packets to avoid stealing the user's privacy information. This user intent indicates the action the user is currently performing, such as playing a game, watching a video, or chatting.

[0049] Alternatively, if the headers of each uplink data packet in a user's multiple uplink data packets cannot be analyzed—meaning the user-plane agent does not support the corresponding protocol layer and cannot obtain the corresponding data from the headers of each uplink data packet—then the user-plane agent can determine the traffic characteristics of the service data by analyzing the transmission characteristics of the user's multiple uplink data packets. These traffic characteristics include at least one of the following: packet size distribution, packet sending interval, or traffic rate—data that does not require unpacking. Therefore, by analyzing these traffic characteristics, the user-plane agent can determine the user's intent, which indicates the user's current action, such as playing a game, watching a video, or chatting.

[0050] S203, the user-plane intelligent agent sends business data to the target communication server suitable for processing the business data among the multiple communication servers, based on the user's intent, the types of multiple communication servers, and the load of the multiple communication servers.

[0051] Here, there are N communication servers, where N is an integer greater than 1. For the i-th communication server among the N communication servers, i is an integer from 1 to N. The user-face agent can determine the adaptation score of the i-th communication server, and the adaptation score of the i-th communication server satisfies the following relationship: Pi = W1*S1 + W2*RTT + W3*S2; Where Pi represents the adaptation score of the i-th communication server, S1 is the idle level of the i-th communication server determined based on its load, RTT is the round-trip time between the user-plane agent and the i-th communication server, S2 is the degree of adaptation between the type of the i-th communication server and the user's intent, and W1, W2 and W3 are weights with values ​​greater than 0 and less than 1, and W1+W2+W3=1. As i iterates through 1 to N, the user-face agent obtains the adaptation scores of N communication servers; Therefore, the user-plane agent selects the communication server with the highest adaptation score from among N communication servers as the target communication server; the user-plane agent then sends the business data to the target communication server.

[0052] The following section details how the user-faced intelligent agent sends business data to the target communication server.

[0053] Scenario 1: If the compatibility between the default communication server and the user's intent differs from the compatibility between the target communication server and the user's intent, the user-plane agent will hard-switch the service data from being sent to the default communication server to being sent to the target communication server, and instruct the target communication server not to establish a service data session with the default communication server. Hard switching can be understood as establishing a new connection, such as between the user-plane agent and the target communication server, whereby the service data is no longer processed by the original default communication service.

[0054] For example, the user plane agent negotiates a first security context with the target communication server. This first security context is suitable for providing security protection for the communication between the user plane agent and the target communication server. Specifically, the user plane agent and the target communication server negotiate a first security protection algorithm, that is, they determine that both the user plane agent and the target communication server support the first security protection algorithm. This algorithm can be AES or ZUC, etc., without restriction. The user plane agent can use the user's Non-Access Stratum (NAS) key as a long-term key (or root key, i.e., the source key for derived keys) to derive (e.g., through elliptic curve cryptography) a temporary intermediate public key and a temporary intermediate private key pair. Based on the temporary intermediate private key, the target communication server's privacy information, and the preset public key of the network where the user plane agent resides, a first temporary shared key is derived. Alternatively, the temporary intermediate private key, the target communication server's privacy information, and the preset public key of the network where the user plane agent resides can be used as input parameters, and the input parameters can be calculated using a Key Derivation Divination (KDF) algorithm to obtain the first temporary shared key. The NAS key can be a key used by the user for communication at the NAS layer, such as the key Kamf corresponding to the Access and Mobility Management Function (AMF), or a key used by the UPF network element to communicate with the user based on the key Kamf, such as the key Kupf. In this case, the UPF network element can also be considered to belong to the NAS layer. The user plane agent sends a temporary intermediate public key to the target communication server, whereby the target communication server is configured to derive a first temporary shared key based on the temporary intermediate public key, the target communication server's privacy information, and the preset private key of the network where the user plane agent resides. Thus, the first security context includes a first security protection algorithm and a first temporary shared key.

[0055] It can be seen that the first temporary shared key is dynamically derived from the NAS key, that is, it reuses the security mechanism of the UE on the operator network side, thereby further improving the security of passage. In addition, it also achieves the compatibility of security mechanisms. That is, when the UPF network element interacts with the communication server to exchange user service data, its security reuse is implemented by the security mechanism of the user and the operator network, so that the security mechanisms of different systems or different domains can evolve synchronously.

[0056] Therefore, the user-plane agent securely protects the business data through the first security context before sending it to the target communication server; and the user-plane agent also securely protects the first instruction information through the first security context before sending it to the target communication server. The first instruction information instructs the target communication server to refuse to establish a session for business data with the default communication server.

[0057] Scenario 2: If the degree of compatibility between the default communication server and the user's intent is the same as the degree of compatibility between the target communication server and the user's intent, then the user-face agent will soft switch the business data from being sent to the default communication server to being sent to the target communication server, and instruct the target communication server to establish a session for the business data with the default communication server.

[0058] For example, the user-plane agent securely protects the business data using a second security context before sending it to the target communication server. The first security context is a security context negotiated in advance between the user-plane agent and the default communication server, applicable to secure communication between the user-plane agent and the default communication server. Furthermore, the user-plane agent directly sends a second instruction to the target communication server, instructing the target communication server to establish a session with the default communication server for the business data. The target communication server is configured to respond to the second instruction, establish a session with the default communication server for the business data, and synchronize the second security context from the default communication server through the session. If the target communication server is unable to process the business data protected by the second security context due to its own load, it will send the business data protected by the second security context to the default communication server through the session. In other words, because the communication between the target communication server and the user-plane agent reuses the second security context, if the target communication server is unable to process the business data due to reaching its load limit, it can directly forward the business data so that the default communication server can directly process it.

[0059] It should be understood that the negotiation of the second security protection algorithm between the user plane agent and the default communication server includes: the user plane agent negotiating the second security protection algorithm with the default communication server; the user plane agent deriving a temporary intermediate public key and a temporary intermediate private key pair by using the user's NAS key as a long-term key, and deriving a second temporary shared key based on the temporary intermediate private key, the privacy information of the default communication server, and the preset public key of the network where the user plane agent resides; the user plane agent sending the temporary intermediate public key to the default communication server; wherein, the default communication server is configured to derive the second temporary shared key based on the temporary intermediate public key, the privacy information of the default communication server, and the preset private key of the network where the user plane agent resides; wherein, the second security context includes the second security protection algorithm and the second temporary shared key. The above implementation can also refer to the relevant description in Case 1, and will not be repeated here.

[0060] In summary, for multi-access edge computing scenarios, when the user plane agent receives business data from the user's business flow, the user plane agent uses artificial intelligence to identify the user's intent from the business data. Based on the user's intent, the types of multiple communication servers, and the load of multiple communication servers, the agent sends the business data to the target communication server suitable for processing the business data. In other words, it achieves more granular load balancing through intelligent decision-making while still meeting the user's intent requirements.

[0061] The above combination Figure 2 The method provided by the embodiments of the present invention is described in detail below. The following describes in detail a traffic load balancing system for a communication server used to perform the method provided by the embodiments of the present invention. This system includes a user plane agent deployed in an operator's communication network. The system is configured to: the user plane agent receive service data from a user's service flow; the user plane agent identify the user's intent from the service data; and the user plane agent, based on the user's intent, the types of multiple communication servers, and the load of the multiple communication servers, send the service data to a target communication server among the multiple communication servers suitable for processing the service data, wherein each of the multiple communication servers is a multi-access edge computing (MEC) deployed at a location matching the location of the user plane agent.

[0062] The specific implementation of this system can also refer to the above method embodiments, and will not be repeated here.

[0063] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Exemplarily, the electronic device may be a network device, or a chip (system) or other component or assembly that can be disposed in a network device. Figure 3 As shown, the electronic device 400 may include a processor 401. Optionally, the electronic device 400 may also include a memory 402 and / or a transceiver 403. The processor 401 is coupled to the memory 402 and the transceiver 403, for example, via a communication bus.

[0064] The following is combined with Figure 3 A detailed description of each component of the electronic device 400 is provided below: The processor 401 is the control center of the electronic device 400. It can be a single processor or a collective term for multiple processing elements. For example, the processor 401 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0065] Optionally, the processor 401 can perform various functions of the electronic device 400 by running or executing software programs stored in the memory 402 and calling data stored in the memory 402, such as performing the aforementioned functions. Figure 2 This illustrates a traffic load balancing method for a communication server.

[0066] In a specific implementation, as one example, processor 401 may include one or more CPUs, for example... Figure 3 CPU0 and CPU1 are shown in the diagram.

[0067] In a specific implementation, as one example, the electronic device 400 may also include multiple processors. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, a processor may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0068] The memory 402 is used to store the software program that executes the solution of the present invention, and is controlled by the processor 401 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0069] Optionally, the memory 402 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 402 may be integrated with the processor 401 or exist independently, and may be accessed through the interface circuit of the electronic device 400. Figure 3 (Not shown in the image) is coupled to processor 401, and this embodiment of the invention does not specifically limit this.

[0070] Transceiver 403 is used for communication with other electronic devices. For example, if electronic device 400 is a terminal, transceiver 403 can be used to communicate with a network device or with another terminal device. As another example, if electronic device 400 is a network device, transceiver 403 can be used to communicate with a terminal or with another network device.

[0071] Alternatively, transceiver 403 may include a receiver and a transmitter. Figure 3 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the transmitting function.

[0072] Alternatively, the transceiver 403 can be integrated with the processor 401, or it can exist independently and be connected via the interface circuit of the electronic device 400. Figure 3 (Not shown in the image) is coupled to processor 401, and this embodiment of the invention does not specifically limit this.

[0073] Understandable Figure 3 The structure of the electronic device 400 shown does not constitute a limitation on the electronic device. Actual electronic devices may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0074] Furthermore, the technical effects of the electronic device 400 can be referred to the technical effects of the methods described in the above method embodiments, and will not be repeated here.

[0075] It should be understood that the processor in the embodiments of the present invention can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0076] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0077] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0078] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0079] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0080] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0081] In the embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0082] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0083] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0084] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0085] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A traffic load balancing method of a communication server, characterized by, The method is applied to a user plane intelligent agent deployed in an operator communication network, and the method comprises: The user plane intelligent agent receives service data in a service flow from a user; The user plane intelligent agent identifies an intention of the user from the service data; The user plane intelligent agent sends the service data to a target communication server suitable for processing the service data among a plurality of communication servers according to the intention of the user, types of the plurality of communication servers, and loads of the plurality of communication servers, wherein each communication server in the plurality of communication servers is deployed in a multi-access edge computing (MEC) matching a location where the user plane intelligent agent is located.

2. The method of claim 1, wherein, The user plane intelligent agent is collocated with a user plane function (UPF) on a core network side in the operator communication network.

3. The method of claim 1, wherein, The service data comprises a plurality of uplink data packets of the user; The user plane intelligent agent identifies the intention of the user from the service data, comprising: In a case that a packet header of each uplink data packet in the plurality of uplink data packets of the user can be analyzed, the user plane intelligent agent determines the intention of the user by analyzing destination address information in the packet header of each uplink data packet in the plurality of uplink data packets of the user, the intention of the user being indicative of an operation currently performed by the user, and the user plane intelligent agent not processing a payload part of each of the plurality of uplink data packets of the user; Or, In a case that the packet header of each uplink data packet in the plurality of uplink data packets of the user cannot be analyzed, the user plane intelligent agent determines a traffic feature of the service data by analyzing transmission characteristics of the plurality of uplink data packets of the user, the traffic feature comprising at least one of a packet size distribution, a packet sending interval, or a traffic rate; The user plane intelligent agent determines the intention of the user by analyzing the traffic feature, the intention of the user being indicative of the operation currently performed by the user.

4. The method according to any one of claims 1 to 3, characterized in that, The plurality of communication servers are N communication servers, N being an integer greater than 1, and the user plane intelligent agent sends the service data to the target communication server suitable for processing the service data among the plurality of communication servers according to the intention of the user, types of the plurality of communication servers, and loads of the plurality of communication servers, comprising: For an i-th communication server in the N communication servers, i being an integer taking values from 1 to N; The user plane intelligent agent determines an adaptation score of the i-th communication server, the adaptation score of the i-th communication server satisfying a relationship: Pi = W1 * S1 + W2 * RTT + W3 * S2 wherein Pi represents the adaptation score of the i-th communication server, S1 is a degree of idleness of the i-th communication server determined according to a load of the i-th communication server, RTT is a transmission round-trip time delay between the user plane intelligent agent and the i-th communication server, S2 is a degree of adaptation of a type of the i-th communication server to the intention of the user, W1, W2, and W3 are weight values respectively taking values greater than 0 and less than 1, and W1 + W2 + W3 = 1. In a case that i is iterated from 1 to N, the user plane agent obtains the adaptation scores of the N communication servers; The user plane agent selects a communication server with a highest adaptation score from the adaptation scores of the N communication servers as the target communication server; The user plane agent sends the service data to the target communication server.

5. The method of claim 4, wherein, Before the user plane agent sends the service data to the target communication server, the user plane agent sends the service data to a default communication server, and the user plane agent sending the service data to the target communication server comprises: If the adaptation degree of the default communication server to the user's intention is different from the adaptation degree of the target communication server to the user's intention, the user plane agent hard switches the service data from being sent to the default communication server to being sent to the target communication server, and instructs not to establish a session for the service data between the target communication server and the default communication server; or, If the adaptation degree of the default communication server to the user's intention is same as the adaptation degree of the target communication server to the user's intention, the user plane agent soft switches the service data from being sent to the default communication server to being sent to the target communication server, and instructs to establish a session for the service data between the target communication server and the default communication server.

6. The method of claim 5, wherein, The user plane agent hard switches the service data from being sent to the default communication server to being sent to the target communication server, and instructs not to establish a session for the service data between the target communication server and the default communication server, comprising: The user plane agent negotiates a first security context with the target communication server, and the first security context is applicable to security protection of communication between the user plane agent and the target communication server; The user plane agent sends the service data to the target communication server after security protection by the first security context; and The user plane agent also sends first indication information to the target communication server after security protection by the first security context, and the first indication information indicates that the target communication server needs to reject establishment of a session for the service data with the default communication server.

7. The method of claim 6, wherein, The user plane agent negotiates a first security context with the target communication server, comprising: The user plane agent negotiates a first security protection algorithm with the target communication server; The user plane agent derives a temporary intermediate public key and a temporary intermediate private key pair by taking a NAS key of the user as a long-term key, and derives a first temporary shared key according to the temporary intermediate private key, private information of the target communication server, and a preset public key of a network in which the user plane agent is located; The user plane agent sends the temporary intermediate public key to the target communication server; and The user plane agent derives a first temporary shared key according to the temporary intermediate private key, private information of the target communication server, and a preset public key of a network in which the user plane agent is located. The target communication server is configured to derive the first temporary shared key according to the temporary intermediate public key, privacy information of the target communication server, and a preset private key of a network in which the user plane agent is located. The first security context includes the first security protection algorithm and the first temporary shared key.

8. The method of claim 5, wherein, The user plane agent switches the sending of the service data from the default communication server to the target communication server, and instructs the target communication server to establish a session for the service data with the default communication server, including: The user plane agent sends the service data to the target communication server after security protection by a second security context; the first security context is a security context previously negotiated by the user plane agent with the default communication server, and the first security context is applicable to security protection of communication between the user plane agent and the default communication server; and The user plane agent also sends second instruction information directly to the target communication server, and the second instruction information indicates that the target communication server needs to establish a session for the service data with the default communication server; The target communication server is configured to establish a session for the service data with the default communication server in response to the second instruction information, and synchronize the second security context from the default communication server through the session; and if the target communication server cannot process the service data secured by the second security context due to its own load, the target communication server sends the service data secured by the second security context to the default communication server through the session.

9. The method of claim 8, wherein, The user plane agent negotiates the second security protection algorithm with the default communication server, including: The user plane agent negotiates a second security protection algorithm with the default communication server; The user plane agent derives a pair of temporary intermediate public key and temporary intermediate private key by taking the NAS key of the user as a long-term key, and derives a second temporary shared key according to the temporary intermediate private key, privacy information of the default communication server, and a preset public key of a network in which the user plane agent is located; The user plane agent sends the temporary intermediate public key to the default communication server; The default communication server is configured to derive the second temporary shared key according to the temporary intermediate public key, privacy information of the default communication server, and a preset private key of a network in which the user plane agent is located. The second security context includes the second security protection algorithm and the second temporary shared key.

10. A traffic load balancing system of a communication server, characterized by, The system includes a user plane agent deployed in an operator communication network, and the system is configured to: The user plane agent receives service data in a service flow from a user; The user plane agent identifies an intention of the user from the service data; The user plane agent receives service data in a service flow from a user; The user plane intelligent agent sends the service data to a target communication server suitable for processing the service data among the plurality of communication servers according to the intention of the user, the types of the plurality of communication servers, and the loads of the plurality of communication servers, wherein each communication server in the plurality of communication servers is a multi-access edge computing (MEC) deployed in a location matched with the user plane intelligent agent.

Images