5g signaling plane traffic screening method, system, device and storage medium based on multi-core processing unit

Abstract

The application relates to a 5G signaling surface flow screening method based on a multi-core processing unit, which comprises the following steps: receiving network mirror flow through a physical interface unit, and screening out transmission control protocol flow; a switching chip unit identifies HTTP / 2 protocol flow from the transmission control protocol flow according to a target port number or an application layer protocol handshake feature, and forwards the HTTP / 2 protocol flow to a multi-core processing unit; a binary framing structure of the HTTP / 2 protocol is parsed, data frames and control frames are distinguished, and an HTTP request header is restored; the HTTP request header is analyzed and decoded, and a uniform resource identifier path pseudo header field in the HTTP request header is extracted; flow filtering rules corresponding to service signaling flow bearing specific network functions are generated; the generated flow filtering rules are issued to the switching chip unit, and specified 5G signaling surface flow is output. The application automatically adapts to the dynamic change of 5G network elements, effectively solves the problem of flow loss or inaccuracy caused by the difficulty in maintaining static work parameter data and the delay in updating.

Description

Technical Field

[0001] This invention relates to the field of communication technology, specifically to a 5G signaling plane traffic filtering method, apparatus, device, and storage medium based on multi-core processing units. Background Technology

[0002] Aggregators and splitters are key devices in communication networks for traffic acquisition, filtering, and distribution. In 5G networks, for network monitoring, security analysis, and performance optimization, it is often necessary to acquire core network signaling plane traffic through optical splitting or port mirroring, and then have the aggregation and splitter filter the traffic to extract signaling data from specific interfaces for use by backend systems.

[0003] The 5G core network (5GC) adopts a service-based architecture (SBA) and network function virtualization (NFV) technology. Compared with 4G networks, 5G network elements are generally deployed in a software-defined and virtualized manner, making the network topology more dynamic. A prominent feature is that multiple external service interfaces of the same network function (NF) (e.g., the N7, N10, and N11 interfaces of SMF) may share the same IP address. This change exposes a series of serious defects and shortcomings in 5G networks, making traffic filtering methods based on "network element parameter data" (i.e., pre-configured static parameters such as IP addresses and interface types of each network element) commonly used and effective in the 4G era.

[0004] First, the accuracy of signaling interface filtering based on network element parameter data is poor. Since multiple interfaces share IP addresses, filtering based solely on the network element address on one side of the interface (such as the SMF's IP address) will simultaneously capture traffic from all related interfaces of that network element (such as N7, N10, N11, and N16), making it impossible to accurately separate the signaling from the target interface (such as interface N11). Attempting precise matching based on the network element addresses on both sides of the interface (such as the AMF and SMF addresses) will generate a massive number of filtering rules, significantly increasing configuration complexity and device processing burden. Especially in roaming scenarios, the SMF and other network elements belonging to the accessing user are located in other provinces or even overseas, making their parameter data unavailable, rendering precise filtering methods based on both addresses completely ineffective.

[0005] Secondly, filtering methods based on static operating parameter data involve a huge maintenance workload and are difficult to adapt to dynamic network changes. The 5G core network involves numerous network elements, and frequent expansions, reductions, or adjustments are made during network operation and maintenance. Once a network element's IP address changes or a new network element is added, the operating parameter data is difficult to update in a timely manner, leading to missing or incorrect signaling traffic output by the aggregation and splitter, affecting the effectiveness of the backend analysis system. This mode, which relies on manual maintenance of static configurations, cannot meet the needs of rapid and elastic scaling of 5G networks.

[0006] Therefore, existing 5G signaling plane traffic filtering methods that rely on static technical parameter data have inherent drawbacks such as inaccurate filtering, high maintenance costs, inability to adapt to dynamic network changes, and failure in roaming scenarios. There is an urgent need for a new method that can dynamically identify and accurately filter 5G signaling plane traffic, especially traffic from specific service interfaces (such as N11 and N16), to solve the many problems caused by static technical parameter filtering. Summary of the Invention

[0007] The purpose of this invention is to provide a 5G signaling plane traffic filtering method based on multi-core processing units, so as to solve the problem that existing 5G signaling plane traffic filtering relies on static engineering parameter data.

[0008] A first aspect of the present invention provides a 5G signaling plane traffic filtering method based on a multi-core processing unit, comprising:

[0009] The network mirror traffic is received through the physical interface unit, and the switching chip unit performs preliminary filtering and scheduling on the network mirror traffic based on the basic header information of the link layer, network layer and transport layer to filter out the transmission control protocol traffic.

[0010] The switching chip unit identifies HTTP / 2 protocol traffic from the transmission control protocol traffic based on the target port number or application layer protocol handshake characteristics, and forwards it to the multi-core processing unit.

[0011] In the multi-core processing unit, the binary frame structure of the HTTP / 2 protocol is parsed to distinguish between data frames and control frames, and the header metadata encoded by the HPACK compression algorithm in the HEADERS frame is decoded to restore the HTTP request header.

[0012] The HTTP request header is analyzed and decoded, and the pseudo-header field of the Uniform Resource Identifier path is extracted. The pseudo-header field is then matched with the 5G service architecture interface feature library pre-set in the pseudo-header field to identify the service signaling traffic carrying a specific network function.

[0013] Generate traffic filtering rules corresponding to the service signaling traffic carrying specific network functions. The traffic filtering rules include network layer address, transport layer port and application layer identification information.

[0014] The generated traffic filtering rules are sent to the switching chip unit, which then filters the input network mirror traffic in real time according to the sent traffic filtering rules and outputs the specified 5G signaling plane traffic.

[0015] In one possible implementation, decoding the header metadata encoded using the HPACK compression algorithm in the HEADERS frame to restore the HTTP request header includes:

[0016] The HTTP / 2 HEADERS frame is decoded, and the header fields compressed using the HPACK algorithm are decompressed in real time by maintaining a dynamic index table to reconstruct the complete key-value pair HTTP request header.

[0017] In one possible implementation, the real-time decompression of header fields compressed using the HPACK algorithm by maintaining a dynamic index table includes:

[0018] Establish and maintain a dynamic decoding context for each independent HTTP / 2 stream;

[0019] Parse the payload of the HEADERS frame and distinguish whether the header fields are indexed, literal, or dynamic table indexed.

[0020] Based on the dynamic table index representation, query the HPACK static table or the dynamic table maintained in the dynamic decoding context to obtain the corresponding first header field;

[0021] For the second header field represented by the literal value, perform Huffman decoding to obtain the plaintext string.

[0022] In one possible implementation, the step of matching the pseudo-header field with a pre-built 5G service-oriented architecture interface feature library to identify service signaling traffic carrying specific network functions also includes an auxiliary verification mechanism, which includes:

[0023] Verify that the method pseudo-header field in the HTTP request header is POST or GET;

[0024] Verify that the protocol scheme pseudo-header field in the HTTP request header is https;

[0025] Analyze specific flags in PRIORITY or HEADERS frames to confirm that the priority of the filtered data streams conforms to control plane signaling characteristics.

[0026] In one possible implementation, the pre-built 5G service-oriented architecture interface feature library includes path pattern matching rules based on the names of 5G core network function services, used to identify signaling traffic corresponding to service-oriented interfaces N11 and N16.

[0027] In one possible implementation, the multi-core processing unit performs deep parsing of message forwarding control protocol messages in the identified N11 or N16 interface signaling traffic;

[0028] Extract the Internet Protocol address, tunnel endpoint identifier, and Quality of Service flow identifier of the user plane function network element;

[0029] Based on the extracted information, an information mapping table of active user plane network elements and tunnels in the current network environment is constructed.

[0030] In one possible implementation, the preliminary filtering and scheduling of the network mirror traffic by the switching chip unit based on basic header information of the link layer, network layer, and transport layer, to filter out Transmission Control Protocol (TCP) traffic, includes:

[0031] Traffic is divided into different logical data streams based on the virtual LAN identifier or physical port number;

[0032] For each of the logical data streams, an independent pre-configured rule set is applied for filtering. The rule set includes allow or deny policies based on Internet Protocol address segments and transport layer port ranges.

[0033] A second aspect of the present invention provides a 5G signaling plane traffic filtering system based on a multi-core processing unit, comprising:

[0034] The initial filtering and scheduling of the network mirror traffic by the switching chip unit based on the basic header information of the link layer, network layer, and transport layer, to filter out Transmission Control Protocol (TCP) traffic, includes:

[0035] Traffic is divided into different logical data streams based on the virtual LAN identifier or physical port number;

[0036] For each of the logical data streams, an independent pre-configured rule set is applied for filtering. The rule set includes allow or deny policies based on Internet Protocol address segments and transport layer port ranges.

[0037] A third aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the 5G signaling plane traffic filtering method based on a multi-core processing unit as described in the first aspect of the present invention.

[0038] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the 5G signaling plane traffic filtering method based on a multi-core processing unit as described in the first aspect of the present invention.

[0039] Compared with the prior art, the beneficial effects of the present invention are:

[0040] By deeply analyzing the characteristics of the HTTP / 2 protocol for identification, it replaces the traditional IP address filtering and can automatically adapt to the dynamic changes of 5G network elements, effectively solving the problems of traffic loss or inaccuracy caused by the difficulty in maintaining static engineering parameter data and untimely updates.

[0041] By adopting an architecture that combines front-end coarse screening of the switching chip with parallel deep analysis of multiple core units, real-time and efficient processing of high-concurrency 5G signaling traffic is achieved, meeting the requirements of high traffic and low latency.

[0042] The end-to-end automation capability, from traffic identification and automatic rule generation to expired rule cleanup, significantly reduces manual intervention and lowers operation and maintenance costs and complexity. Attached Figure Description

[0043] Figure 1 This is a flowchart illustrating the 5G signaling plane traffic filtering method based on a multi-core processing unit according to the present invention.

[0044] Figure 2 This is a schematic diagram of the architecture of the 5G signaling plane traffic filtering system based on a multi-core processing unit according to the present invention.

[0045] Figure 3 This is a schematic diagram of a computer device according to an embodiment of the present invention. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0047] It should be noted that the serial numbers assigned to the components in the embodiments of the present invention, such as "first" and "second", are only used to distinguish the described objects and have no sequential or technical meaning.

[0048] The following is combined Figure 1 This invention describes a 5G signaling plane traffic filtering method based on a multi-core processing unit.

[0049] A 5G signaling plane traffic filtering method based on multi-core processing units includes:

[0050] S1. Traffic reception and preprocessing: The network mirror traffic is received through the physical interface unit, and the switching chip unit performs preliminary filtering and scheduling on the network mirror traffic based on the basic header information of the link layer, network layer and transport layer to filter out the transmission control protocol traffic.

[0051] Network mirroring traffic enters the system through physical interfaces such as SFP+ / QSFP28 and then enters the switching chip unit (e.g., a high-performance Ethernet switching chip). This switching chip unit first performs basic filtering and scheduling. Specifically, it parses the Ethernet frame header, IP header (IPv4 / IPv6), and TCP / UDP header, filtering out broadcast / multicast packets, IP fragment packets, and invalid traffic with checksum errors. Subsequently, it loads preset basic traffic distribution policies, such as retaining only TCP traffic destined for common web service ports like 80, 443, and 8080, or filtering traffic from specific core network areas based on VLAN ID. This step aims to reduce the burden on subsequent deep processing.

[0052] S2. Protocol Identification and Forwarding: The switching chip unit identifies HTTP / 2 protocol traffic from the transmission control protocol traffic based on the target port number or application layer protocol handshake characteristics, and forwards it to the multi-core processing unit.

[0053] The switching chip unit performs deep inspection on the initially screened TCP traffic. In addition to simple matching based on the destination port number (e.g., 443), a more precise method is to check if the beginning of the TCP payload data contains an HTTP / 2 connection preamble (PRI * HTTP / 2.0\r\n\r\n SM\r\n\r\n, i.e., the byte sequence 0x505249202a20485454502f322e300d0a0d0a534d0d0a0d0a). Once identified as HTTP / 2 traffic, the switching chip forwards it to a multi-core processing unit (such as a network processor based on a multi-core ARM or x86 architecture) via an internal high-speed bus (e.g., a PCIe interface).

[0054] S3. Parsing and Decoding: In the multi-core processing unit, the binary frame structure of the HTTP / 2 protocol is parsed to distinguish between data frames and control frames, and the header metadata encoded by the HPACK compression algorithm in the HEADERS frame is decoded to restore the HTTP request header.

[0055] When decoding the HEADERS frames of the HTTP / 2 protocol, a dynamic index table is maintained, and the header fields compressed using the HPACK algorithm are decompressed in real time to reconstruct the complete key-value pair header information.

[0056] Specifically, it can be done in the following ways:

[0057] Establish and maintain a dynamic decoding context for each independent HTTP / 2 stream;

[0058] Parse the payload of the HEADERS frame and distinguish whether the header fields are indexed, literal, or dynamic table indexed.

[0059] Based on the dynamic table index representation, query the HPACK static table (such as the 61 commonly used header fields defined in Appendix A of RFC 7541) or the dynamic table maintained in the dynamic decoding context (the FIFO queue dynamically built during the lifetime of the connection) to obtain the corresponding first header field;

[0060] For the second header field represented by the literal value, perform Huffman decoding to obtain the plaintext string.

[0061] Establishing and maintaining a dynamic decoding context for each independent HTTP / 2 stream is crucial for parallel processing. When parsing the HEADERS frame payload, for any encountered index number, if it falls within the static table range (e.g., less than or equal to 61), the static table is directly looked up; if it is greater than 61, its position in the dynamic table (index value - static table length) is calculated and then retrieved. For header fields represented by literals, whether with or without index increments, Huffman decoding is required. Dynamic table management strictly adheres to the FIFO principle and the SETTINGS_HEADER_TABLE_SIZE setting. When adding new entries causes the table size to exceed the limit, the oldest entry is evicted. This mechanism ensures controllable memory usage under high concurrency.

[0062] S4. Interface Feature Matching: Analyze and decode the HTTP request header, extract the pseudo-header field of the Uniform Resource Identifier path, and match it with the 5G service architecture interface feature library pre-set in the pseudo-header field to identify the service signaling traffic carrying specific network functions.

[0063] After obtaining the decoded complete HTTP request header, key pseudo-header fields are extracted, especially the `path` field. The value of this field is then matched against a pre-built 5G service architecture interface feature library in memory. This feature library contains a series of rules for identifying different Network Functions (NF) services. For example, the regular expression ` / nudm-.* / v[0-9]+ / .*` is used to match N10 interface traffic, ` / namf-.* / v[0-9]+ / .*` is used to match N11 interface traffic, and ` / nsmf-pdusession / v1 / pdu-sessions` is used to precisely match PDU session creation requests for the N11 interface.

[0064] When performing interface feature matching, auxiliary verification methods can also be used to confirm that the priority of the data stream conforms to the control plane signaling features.

[0065] Specifically, it verifies that the method pseudo-header field in the HTTP request header is POST or GET, because the 5G SBI interface mainly uses RESTful style CRUD operations.

[0066] Verify that the protocol scheme pseudo-header field in the HTTP request header is https, because internal service communication in the 5G core network typically requires the use of TLS encryption;

[0067] Analyze specific flags in PRIORITY or HEADERS frames to confirm that the priority of the filtered data streams conforms to control plane signaling characteristics. Additionally, the number of HEADERS frames per unit time can be counted; signaling plane session control messages exhibit burstiness and frequency characteristics different from user plane data.

[0068] The pre-built 5G service-oriented architecture interface feature library contains path pattern matching rules based on the names of 5G core network function services, used to identify signaling traffic corresponding to service-oriented interfaces N11 and N16. In the multi-core processing unit, packet forwarding control protocol messages in the identified N11 or N16 interface signaling traffic are deeply parsed; the Internet Protocol addresses, tunnel endpoint identifiers, and Quality of Service (QoS) flow identifiers of user plane function network elements are extracted; and based on the extracted information, an information mapping table of active user plane network elements and tunnels in the current network environment is constructed.

[0069] After successfully filtering out signaling traffic (such as PFCP messages) from the N11 / N16 interfaces, the multi-core processing unit can perform in-depth analysis. For example, the PFCP session establishment information contained in the PDU Session Create Response message (whose content is carried over HTTP / 2) sent from the SMF to the AMF on the N11 interface can be used to extract the UPF's IP address and assigned TEID. Similarly, UPF information across PLMNs can be obtained from the signaling interactions between SMFs on the N16 interface. This information is integrated into a dynamic "UPF network element information mapping table," which can be used to generate filtering rules for user plane traffic (N3 / N9 interfaces), enabling the linkage between signaling plane analysis and user plane filtering.

[0070] The core rules of the pre-built 5G service-oriented architecture interface feature library are based on network function service names (such as Namf, Nsmf, Nudm, Nnrf, Npcf) and their API templates defined in standard documents such as 3GPP TS 29.501. Matching rules can be precise string matching or more flexible regular expression matching. For example, a rule for identifying the N11 interface (between AMF and SMF) can be configured to match URIs whose paths contain / nsmf-pdusession / or conform to the pattern / namf-.* / v[0-9]+ / .*. These rule libraries can be updated via configuration files or management interfaces to adapt to the evolution of 3GPP standards.

[0071] S5. Dynamic filtering rule generation: Generate traffic filtering rules corresponding to the service signaling traffic carrying specific network functions. The traffic filtering rules include network layer address, transport layer port and application layer identification information.

[0072] Once traffic is successfully identified as service signaling traffic carrying a specific network function (such as N11 interface traffic), the system will automatically generate a corresponding whitelist filtering rule. This rule is typically a precise matching rule based on the IP 5-tuple (source IP, destination IP, protocol number, source port, destination port). For example, the rule format could be "Allow TCP traffic from IP_A port_X to IP_B port_Y". Another example is "Extract IP addresses from the UPF information mapping table, aggregate them into CIDR format (such as 10.0.0.0 / 24), and set priority rules based on TEID and QFI".

[0073] When applying the corresponding traffic filtering rules, the following methods can be used:

[0074] Traffic is divided into different logical data streams based on the virtual LAN identifier or physical port number;

[0075] For each of the logical data streams, an independent pre-configured rule set is applied for filtering. The rule set includes allow or deny policies based on Internet Protocol address segments and transport layer port ranges.

[0076] S6. Traffic Filtering and Output: The generated traffic filtering rules are sent to the switching chip unit. The switching chip unit filters the input network mirror traffic in real time according to the sent traffic filtering rules and outputs the specified 5G signaling plane traffic.

[0077] The generated traffic filtering rules are immediately distributed to the policy execution module (such as TCAM or high-performance ACL module) of the switching chip unit via a control channel (e.g., coordinated by the CPU control unit via an Ethernet connection, or directly distributed by the multi-core processing unit via a message queue). Subsequently, the switching chip unit can perform high-speed hardware-level matching and filtering of mirrored traffic passing at line speed based on these rules, mirroring only the matched, clean target 5G signaling plane traffic (such as N11 / N16 interface traffic) from the designated output physical interface for use by the backend analysis system.

[0078] like Figure 2 As shown, the present invention also provides a 5G signaling plane traffic filtering system based on a multi-core processing unit, comprising:

[0079] Physical interface unit 10 is used to receive network mirror traffic. The physical interface unit adopts an SFP+ / QSFP28 physical interface, which can connect to 10G, 25G, 40G and 100G optical modules. The original link mirror data traffic is input to the switching chip unit through the input end, and the processed user plane / signaling plane traffic is output from the output end.

[0080] The switching chip unit 20 is connected to the physical interface unit and is used to perform preliminary filtering and scheduling on the received network mirror traffic based on the basic header information of the link layer, network layer and transport layer, filter out the transmission control protocol traffic, and identify the HTTP / 2 protocol traffic based on the target port number or application layer protocol handshake characteristics.

[0081] The multi-core processing unit 30 is connected to the switching chip unit and is used to parse the binary frame structure of the HTTP / 2 protocol, distinguish between data frames and control frames, and decode the header metadata encoded by the HPACK compression algorithm in the HEADERS frame to restore the HTTP request header.

[0082] The HTTP request header is analyzed and decoded, and the pseudo-header field of the Uniform Resource Identifier path is extracted. The pseudo-header field is then matched with the 5G service architecture interface feature library pre-set in the pseudo-header field to identify the service signaling traffic carrying a specific network function.

[0083] Generate traffic filtering rules corresponding to the service signaling traffic carrying specific network functions. The traffic filtering rules include network layer address, transport layer port and application layer identification information.

[0084] The generated traffic filtering rules are sent to the switching chip unit, which then filters the input network mirror traffic in real time according to the sent traffic filtering rules and outputs the specified 5G signaling plane traffic.

[0085] The multi-core processing unit collects all 5G user plane traffic, performs deep analysis and protocol identification on the traffic, and filters N3 / N9 interface user plane traffic based on GTPv1 protocol traffic characteristics (Version=001, PT=0, Message Type=0xFF, Extension Header (including PDU Session Container)). This filtering further filters S1-U and S5 / S8 interface traffic from 4G / 5G converged network elements. SIP traffic is removed based on SIP protocol traffic characteristics (SIP headers contain specific fields INVITE, ACK, BYE, REGISTER), achieving filtering of SIP voice, SMS, and 5G message traffic on the N3 interface. Deep analysis is performed through SIP SDP (Session Description Protocol) negotiation to obtain the addresses and ports of dynamically allocated media plane RTP and RTCP traffic. Based on the obtained addresses and ports, IP 5-tuple rules are dynamically generated to further filter N3 interface traffic, removing RTP and RTCP traffic. When network elements such as UPF are adjusted, the system can automatically identify the adjusted N3 / N9 interface traffic without requiring additional configuration adjustments.

[0086] The 5G UPF network element in the multi-core processing unit can output the address of the 5G user plane network element (UPF) or user plane traffic tunnel information within the current core network through dynamic analysis of the N11 / N16 interface. This information is converted into whitelist filtering rules to allow 5G traffic and filter out non-5G traffic. Using the whitelist filtering mode, based on the analyzed 5G UPF network element information, 5G traffic is filtered out from the traffic (4G is filtered out). The final output traffic, while including N11 / N16, will be filtered to remove 5G voice / SMS and non-5G related traffic.

[0087] In one embodiment, the system further includes a CPU control unit 40, which is connected to the switching chip unit via PCIe for rule-based control operations. It is also connected to the multi-core processing unit via Ethernet for parameter adjustment and data exchange. This allows for remote control, reducing local load.

[0088] In one embodiment, such as Figure 3 As shown, a computer device 50 is provided, including a memory 52, a processor 51, and a computer program 53 stored in the memory 52 and executable on the processor 51. When the processor 51 executes the computer program 53, it implements the steps in the data processing method of the above embodiments. To avoid repetition, these steps will not be described again here. Alternatively, when the processor 51 executes the computer program 53, it implements the functions of each module in the above embodiments of the 5G signaling plane traffic filtering system based on multi-core processing units. To avoid repetition, these steps will not be described again here.

[0089] In one embodiment, a readable storage medium is provided, which stores a computer program 53. When the computer program 53 is executed by the processor 51, it implements the steps in the data processing method of the above embodiments. To avoid repetition, these steps will not be repeated here. Alternatively, when the processor 51 executes the computer program 53, it implements the functions of each module in the above data processing device embodiments. To avoid repetition, these functions will not be repeated here.

[0090] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM) and programmable ROM.

[0091] (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0092] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional modules, sub-modules, and units as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A 5G signaling plane traffic filtering method based on multi-core processing units, characterized in that, include: The network mirror traffic is received through the physical interface unit, and the switching chip unit performs preliminary filtering and scheduling on the network mirror traffic based on the basic header information of the link layer, network layer and transport layer to filter out the transmission control protocol traffic. The switching chip unit identifies HTTP / 2 protocol traffic from the transmission control protocol traffic based on the target port number or application layer protocol handshake characteristics, and forwards it to the multi-core processing unit. In the multi-core processing unit, the binary frame structure of the HTTP / 2 protocol is parsed to distinguish between data frames and control frames, and the header metadata encoded by the HPACK compression algorithm in the HEADERS frame is decoded to restore the HTTP request header. The HTTP request header is analyzed and decoded, and the pseudo-header field of the Uniform Resource Identifier path is extracted. The pseudo-header field is then matched with a pre-set 5G service architecture interface feature library to identify the service signaling traffic carrying specific network functions. Generate traffic filtering rules corresponding to the service signaling traffic carrying specific network functions. The traffic filtering rules include network layer address, transport layer port and application layer identification information. The generated traffic filtering rules are sent to the switching chip unit, which then filters the input network mirror traffic in real time according to the sent traffic filtering rules and outputs the specified 5G signaling plane traffic.

2. The 5G signaling plane traffic filtering method based on multi-core processing units according to claim 1, characterized in that, The process of decoding the header metadata encoded using the HPACK compression algorithm in the HEADERS frame to restore the HTTP request header includes: The HTTP / 2 HEADERS frame is decoded, and the header fields compressed using the HPACK algorithm are decompressed in real time by maintaining a dynamic index table to reconstruct the complete key-value pair HTTP request header.

3. The 5G signaling plane traffic filtering method based on a multi-core processing unit according to claim 2, characterized in that, The method of maintaining a dynamic index table to decompress header fields compressed using the HPACK algorithm in real time includes: Establish and maintain a dynamic decoding context for each independent HTTP / 2 stream; Parse the payload of the HEADERS frame and distinguish whether the header fields are indexed, literal, or dynamic table indexed. Based on the dynamic table index representation, query the HPACK static table or the dynamic table maintained in the dynamic decoding context to obtain the corresponding first header field; For the second header field represented by the literal value, perform Huffman decoding to obtain the plaintext string.

4. The 5G signaling plane traffic filtering method based on multi-core processing units according to claim 1, characterized in that, The method of matching the pseudo-header field with a pre-set 5G service-oriented architecture interface feature library to identify service signaling traffic carrying specific network functions also includes an auxiliary verification mechanism, which includes: Verify that the method pseudo-header field in the HTTP request header is POST or GET; Verify that the protocol scheme pseudo-header field in the HTTP request header is https; Analyze specific flags in PRIORITY or HEADERS frames to confirm that the priority of the filtered data streams conforms to control plane signaling characteristics.

5. The 5G signaling plane traffic filtering method based on multi-core processing units according to claim 1, characterized in that, The pre-built 5G service-oriented architecture interface feature library contains path pattern matching rules based on the names of 5G core network function services, which are used to identify signaling traffic corresponding to service-oriented interfaces N11 and N16.

6. The 5G signaling plane traffic filtering method based on a multi-core processing unit according to claim 5, characterized in that, Also includes: In the multi-core processing unit, message forwarding control protocol messages in the identified N11 or N16 interface signaling traffic are deeply parsed; Extract the Internet Protocol address, tunnel endpoint identifier, and Quality of Service flow identifier of the user plane function network element; Based on the extracted information, an information mapping table of active user plane network elements and tunnels in the current network environment is constructed.

7. The 5G signaling plane traffic filtering method based on multi-core processing units according to claim 1, characterized in that, The initial filtering and scheduling of the network mirror traffic by the switching chip unit based on the basic header information of the link layer, network layer, and transport layer, to filter out Transmission Control Protocol (TCP) traffic, includes: Traffic is divided into different logical data streams based on the virtual LAN identifier or physical port number; For each of the logical data streams, an independent pre-configured rule set is applied for filtering. The rule set includes allow or deny policies based on Internet Protocol address segments and transport layer port ranges.

8. A 5G signaling plane traffic filtering system based on a multi-core processing unit, comprising: The physical interface unit is used to receive network mirrored traffic; The switching chip unit, connected to the physical interface unit, is used to perform preliminary filtering and scheduling on the received network mirror traffic based on the basic header information of the link layer, network layer and transport layer, to filter out the transmission control protocol traffic, and to identify the HTTP / 2 protocol traffic based on the target port number or application layer protocol handshake characteristics. A multi-core processing unit, connected to the switching chip unit, is used to parse the binary frame structure of the HTTP / 2 protocol, distinguish between data frames and control frames, and decode the header metadata encoded by the HPACK compression algorithm in the HEADERS frame to restore the HTTP request header. The HTTP request header is analyzed and decoded, and the pseudo-header field of the Uniform Resource Identifier path is extracted. The pseudo-header field is then matched with a pre-set 5G service architecture interface feature library to identify the service signaling traffic carrying specific network functions. Generate traffic filtering rules corresponding to the service signaling traffic carrying specific network functions. The traffic filtering rules include network layer address, transport layer port and application layer identification information. The generated traffic filtering rules are sent to the switching chip unit, which then filters the input network mirror traffic in real time according to the sent traffic filtering rules and outputs the specified 5G signaling plane traffic.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the 5G signaling plane traffic filtering method based on a multi-core processing unit as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the 5G signaling plane traffic filtering method based on a multi-core processing unit as described in any one of claims 1-7.

Images