4G signaling analysis and user tracing method and system based on 5G fusion networking

Abstract

The invention provides a 4G signaling analysis and user traceability method and system based on 5G fusion networking. The system comprises a data access identification layer, a signaling analysis layer, a Hash surface layer and a service traceability layer. The data access identification layer receives the message data and identifies the protocol type of the message data; the signaling analysis layer analyzes the signaling data to obtain a hash table; the business traceability layer is used for carrying out traceability association on the user data; the Hash surface layer stores a Hash table; the system identifies the protocol type of the message data after receiving the message data at the data access identification layer, sends the signaling data to the signaling analysis layer for analysis, and establishes or maintains a hash table according to the analysis result; and sending the user data to a business traceability layer to extract data features and query a hash table, and carrying out user identity association and traceability. According to the invention, the problem that the 4G service data cannot be traced after entering the 5G system in the fusion networking is solved, the service traceability and the signaling analysis are decoupled, and the traceability accuracy is improved.

Description

Technical Field

[0001] This application relates to the field of 5G traceability technology, specifically to a method and system for 4G signaling parsing and user traceability based on 5G converged networking. Background Technology

[0002] 5G (5th Generation) is a new generation of broadband mobile communication technology and a core driving force for digital transformation. Compared with the previous generation of 4G technology, 5G technology has made breakthroughs in key technologies such as high-frequency spectrum utilization, network slicing, and massive MIMO, achieving peak speeds at least ten times that of 4G, millisecond-level transmission latency, and hundreds of billions of connections, which can meet the complex communication needs of different users and industries.

[0003] Based on the current history of 5G commercial development, 5G commercial systems can be seen as the product of long-term replacement, upgrades, and iterations of 4G systems. 4G and 5G networks will coexist for a long time. When 5G signal coverage is incomplete, the 4G system will provide communication support to users, ensuring the continuity of communication services. Based on this development background and application needs, the 4G / 5G converged network architecture has been widely adopted by operators across various regions as a practical and efficient solution.

[0004] In the field of 5G traceability, due to the construction of 4G / 5G converged networks, 4G PGW-U network elements and 5G UPF network elements are co-located. Some 4G service data will inevitably enter the 5G traceability system. However, the 5G traceability system usually does not access the S11 interface signaling commonly used for 4G traceability. This results in the lack of corresponding signaling data for the 4G service data entering the 5G traceability system, making it difficult to perform traceability association. In practical application scenarios, 5G traceability work only identifies whether the service data comes from the 4G network. If it comes from the 4G network, it only counts or even discards these service data without performing traceability association. This approach may damage data integrity, affect data traceability work, and fail to achieve full traffic traceability.

[0005] In the prior art, patent document CN112738791B, entitled "User Information Association Backfilling Method, Device, Equipment and Medium Based on 5G Core Network", obtains user information and location information by parsing the N11 interface signaling, forms a first correspondence with the UPF identifier corresponding to the N3 interface, and then associates it with the N3 interface service data. However, this method cannot associate 4G service data that enters the traceability system due to 4G / 5G converged networking.

[0006] In view of the shortcomings of existing technologies and in light of the characteristics of specific applications, this application provides a method and system for 4G signaling parsing and user tracing based on 5G converged networking. Summary of the Invention

[0007] This application addresses one or more technical deficiencies in the prior art by proposing the following technical solution.

[0008] Based on the first aspect of this application, a 4G signaling parsing and user tracing system based on 5G converged networking is proposed, including a data access identification layer, a signaling parsing layer, a hash table layer and a service tracing layer;

[0009] The data access identification layer is used to receive message data and identify the protocol type of the message data;

[0010] The signaling parsing layer is used to parse signaling data of protocol type HTTP2 to obtain a hash table with mapping relationships;

[0011] The business tracing layer is used to trace and associate user data with the protocol type Gypv1;

[0012] The hash table layer is used to store the hash table;

[0013] After receiving message data at the data access identification layer, the system identifies the protocol type of the message data, sends the identified signaling data to the signaling parsing layer for parsing, and establishes or maintains a hash table based on the parsing results; and

[0014] The identified user data is sent to the business tracing layer to extract data features and query the hash table of the hash table layer to perform user identity association and tracing.

[0015] This application solves the problem of the inability to trace 4G service data after it enters the 5G system in converged networking. It decouples service tracing and signaling parsing, thereby improving the accuracy of tracing.

[0016] Furthermore, the signaling data is sent to the signaling parsing layer for parsing, and a hash table is built based on the parsing results, including:

[0017] A PDU session is created through the N11 interface, and a mapping relationship between the user identification code IMSI and user information is established based on the N11 interface signaling data to obtain the first hash table;

[0018] Establish the mapping relationship between the user identification code IMSI and the session identifier smContextRef to obtain the second hash table; and

[0019] A mapping relationship is established between the tunnel endpoint identifier (TEID) and the IP address combination and the user identification code (IMSI) to obtain a third hash table.

[0020] This step constructs a complete mapping system from three dimensions: user identity, session context, and user plane tunnel, laying a solid data foundation for rapid and accurate user identity association in subsequent network switching or roaming scenarios.

[0021] Furthermore, the signaling data is sent to the signaling parsing layer for parsing, and a hash table is maintained based on the parsing results, including:

[0022] When a user switches from a 5G network to a 4G network, the user identification code IMSI is obtained by querying the second hash table through the session identifier smContextRef. The ueEpsPdnConnection field in the signaling data is parsed to obtain the first 4G core network tunnel information, including APN, UE IP and tunnel endpoint identifier S5-U PGW F-TEID. The first 4G core network tunnel information is added to the first hash table according to the retrieved user identification code IMSI, and the third hash table is updated according to the tunnel endpoint identifier S5-U PGW F-TEID.

[0023] This step actively extracts the 4G core network tunnel information S5-U PGW F-TEID and updates the hash table in real time during the 5G to 4G signaling process, enabling the system to have the ability to trace the subsequent 4G service data of users in real time the moment they switch to the 4G network, thus achieving continuity of traceability.

[0024] Furthermore, sending signaling data to the signaling parsing layer for parsing and maintaining a hash table based on the parsing results also includes:

[0025] When a user switches from a 4G network to a 5G network, the user identification code IMSI is obtained by querying the second hash table through the session identifier smContextRef. The ueEpsPdnConnection field in the signaling data is parsed to obtain the second 4G core network tunnel information, including APN, UE IP, and tunnel endpoint identifiers S5-U PGW F-TEID and S1-U SGW F-TEID. The second 4G core network tunnel information is added to the first hash table according to the obtained user identification code IMSI, and the third hash table is updated according to the tunnel endpoint identifiers S5-U PGW F-TEID and S1-U SGW F-TEID.

[0026] This step captures the 4G core network tunnel information (S5-U PGW F-TEID and S1-U SGW F-TEID) used by the user before the 4G to 5G handover signaling process and updates the hash table, enabling the system to perform "post-association" tracing of historical 4G service data that has already occurred, filling the gap in historical data tracing during the handover process.

[0027] Furthermore, the signaling data is sent to the signaling parsing layer for parsing, and a hash table is maintained based on the parsing results. This also includes:

[0028] When a user is roaming and moving across service areas, a PDU session is created through the N16 interface. The cnTunnel Info field and pgwS8uFteid field of the N16 interface signaling data are parsed to obtain the 5G tunnel endpoint identifier N9 UPF F-TEID and the 4G tunnel endpoint identifier S8-UPGW F-TEID.

[0029] The user identifier IMSI is obtained by querying the second hash table using the session identifier smContextRef. Based on the retrieved user identifier IMSI, the 5G tunnel endpoint identifier N9 UPF F-TEID and the 4G tunnel endpoint identifier S8-UPGW F-TEID are added to the third hash table, and the user information in the first hash table is updated at the same time.

[0030] This step enables the system to clearly identify and trace the 4G roaming traffic generated by the user on other operators' networks, achieving effective coverage of complex roaming scenarios.

[0031] Furthermore, the business tracing layer extracts the data features of the user data and looks up the hash table, adds the user information associated with the hash table to the end of the message data, and performs user association and tracing based on the user information;

[0032] The data characteristics include the destination IP and the TEID in the GTP message header.

[0033] A second aspect of this application also proposes a method for 4G signaling parsing and user tracing based on the system described in any of the above claims, comprising:

[0034] S1: The 5G traceability and association device receives message data at the data access identification layer and determines the protocol type of the message data;

[0035] S2: If the protocol type of the message data is HTTP2, then the message data is signaling data. Different signaling data are processed according to the URL, user actions are analyzed and the signaling data is parsed, and the hash table is updated based on the parsing results.

[0036] S3: If the protocol type of the message data is Gypv1 protocol, then the message data is user data. The service tracing layer extracts the destination IP and TEID of the GTP message header of the message data, looks up the hash table, adds the associated hash table user information to the end of the message data, and performs user association and tracing based on the user information.

[0037] Based on a third aspect of this application, a computer program product is also proposed, having one or more computer programs thereon that, when executed by a computer processor, perform the method as described in any of the above.

[0038] The technical advantages of this application are as follows: By decoupling 4G user data and signaling data, parsing the signaling data, and dynamically maintaining the mapping relationship in the hash table, this application provides an operable and efficient solution for 4G user tracing in a 5G converged network environment. It solves the problem that 4G service data cannot be traced after accessing the 5G system in a converged network, and improves the tracing efficiency and accuracy of the system. Attached Figure Description

[0039] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.

[0040] Figure 1 This is an architecture diagram of a 4G signaling parsing and user tracing system based on 5G converged networking, provided according to an embodiment of this application.

[0041] Figure 2 This is a schematic diagram illustrating the extraction of N11 PDU session creation process related information by a 4G signaling parsing and user tracing system based on 5G converged networking, according to an embodiment of this application.

[0042] Figure 3 This is a schematic diagram illustrating a 4G signaling parsing and user tracing system based on 5G converged networking, according to an embodiment of this application, which extracts tunnel information of the 4G core network based on the N11 5G 4G switching process.

[0043] Figure 4 This is a schematic diagram illustrating a 4G signaling parsing and user tracing system based on 5G converged networking, according to an embodiment of this application, which extracts tunnel information of the 4G core network based on the N114G to 5G switching process.

[0044] Figure 5 This is a schematic diagram illustrating a 4G signaling parsing and user tracing system based on 5G converged networking, according to an embodiment of this application, which extracts tunnel information of the 4G core network based on the N16 PDU session creation process.

[0045] Figure 6 This is a flowchart of a 4G signaling parsing and user tracing method based on 5G converged networking, according to an embodiment of this application.

[0046] Figure 7 This is a schematic diagram of a computer system structure suitable for implementing the electronic devices of the embodiments of this application. Detailed Implementation

[0047] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0048] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0049] Figure 1 The present application illustrates a 4G signaling parsing and user tracing system based on 5G converged networking, comprising a data access identification layer a, a signaling parsing layer b, a hash table layer c, and a service tracing layer d.

[0050] In a specific embodiment, the data access identification layer a is used to receive message data and identify the protocol type of the message data;

[0051] The signaling parsing layer b is used to parse signaling data of protocol type HTTP2 to obtain a hash table with mapping relationship;

[0052] The hash table layer c is used to store the hash table;

[0053] The business tracing layer d is used to trace and associate user data with the protocol type Gypv1.

[0054] After receiving message data at the data access identification layer a, the system identifies the protocol type of the message data, sends the identified signaling data to the signaling parsing layer b for parsing, and establishes or maintains a hash table based on the parsing result of the signaling parsing layer b; and

[0055] The identified user data is sent to the business tracing layer d to extract data features and query the hash table of the hash table layer c to perform user identity association and tracing.

[0056] It should be noted that this application solves the problem of the inability to trace 4G service data after it enters the 5G system in converged networking, decoupling service tracing and signaling parsing, and improving the accuracy of tracing.

[0057] It should be noted that the signaling data is sent to the signaling parsing layer for parsing, and a hash table is built based on the parsing results, including:

[0058] A PDU session is created through the N11 interface, and a mapping relationship between the user identification code IMSI and user information is established based on the N11 interface signaling data to obtain the first hash table;

[0059] Establish the mapping relationship between the user identification code IMSI and the session identifier smContextRef to obtain the second hash table; and

[0060] A mapping relationship is established between the tunnel endpoint identifier (TEID) and the IP address combination and the user identification code (IMSI) to obtain a third hash table.

[0061] It should be noted that this step constructs a complete mapping system from three dimensions: user identity, session context, and user plane tunnel, laying a solid data foundation for rapid and accurate user identity association in subsequent network switching or roaming scenarios.

[0062] It should be noted that the signaling data is sent to the signaling parsing layer for parsing, and a hash table is maintained based on the parsing results, including:

[0063] When a user switches from a 5G network to a 4G network, the user identification code IMSI is obtained by querying the second hash table through the session identifier smContextRef. The ueEpsPdnConnection field in the signaling data is parsed to obtain the first 4G core network tunnel information, including APN, UE IP and tunnel endpoint identifier S5-U PGW F-TEID. The first 4G core network tunnel information is added to the first hash table according to the retrieved user identification code IMSI, and the third hash table is updated according to the tunnel endpoint identifier S5-U PGW F-TEID.

[0064] It should be noted that this step actively extracts the 4G core network tunnel information S5-U PGW F-TEID and updates the hash table in real time during the 5G to 4G signaling process, enabling the system to have the ability to trace the subsequent 4G service data of users in real time the moment they switch to the 4G network, thus achieving continuity of traceability.

[0065] It should be noted that sending signaling data to the signaling parsing layer for parsing and maintaining a hash table based on the parsing results also includes:

[0066] When a user switches from a 4G network to a 5G network, the user identification code IMSI is obtained by querying the second hash table through the session identifier smContextRef. The ueEpsPdnConnection field in the signaling data is parsed to obtain the second 4G core network tunnel information, including APN, UE IP, and tunnel endpoint identifiers S5-U PGW F-TEID and S1-U SGW F-TEID. The second 4G core network tunnel information is added to the first hash table according to the obtained user identification code IMSI, and the third hash table is updated according to the tunnel endpoint identifiers S5-U PGW F-TEID and S1-U SGW F-TEID.

[0067] It should be noted that this step captures the 4G core network tunnel information (S5-U PGW F-TEID and S1-U SGW F-TEID) used by the user before the handover and updates the hash table during the 4G to 5G signaling process, enabling the system to perform "post-association" tracing of historical 4G service data that has already occurred, filling the gap in historical data tracing during the handover process.

[0068] It should be noted that sending signaling data to the signaling parsing layer for parsing and maintaining a hash table based on the parsing results also includes:

[0069] When a user is roaming and moving across service areas, a PDU session is created through the N16 interface. The cnTunnel Info field and pgwS8uFteid field of the N16 interface signaling data are parsed to obtain the 5G tunnel endpoint identifier N9 UPF F-TEID and the 4G tunnel endpoint identifier S8-UPGW F-TEID.

[0070] The user identifier IMSI is obtained by querying the second hash table using the session identifier smContextRef. Based on the retrieved user identifier IMSI, the 5G tunnel endpoint identifier N9 UPF F-TEID and the 4G tunnel endpoint identifier S8-UPGW F-TEID are added to the third hash table, and the user information in the first hash table is updated at the same time.

[0071] It should be noted that this step enables the system to clearly identify and trace the 4G roaming traffic generated by the user on other operators' networks, achieving effective coverage of complex roaming scenarios.

[0072] It should be noted that the business tracing layer extracts the data features of the user data and looks up the hash table, adds the user information associated with the hash table to the end of the message data, and performs user association and tracing based on the user information;

[0073] The data characteristics include the destination IP and the TEID in the GTP message header.

[0074] In a specific embodiment, a schematic diagram illustrating the N11 PDU session creation process is extracted, as shown below. Figure 2 As shown in Table 1, when a user creates a PDU session on a 5G network, an entry is created for the user information, a hash table is maintained, and the N11 PDU session mapping relationship is created.

[0075] Table 1. Mapping Relationships for Creating N11 PDU Sessions

[0076] Mapping relationship key value Imsi->User Information Imsi User information (three-code information, location information) {smContextRef}->Imsi {smContextRef} Imsi TEID+IP->Imsi TEID+IP Imsi

[0077] When a user switches to 4G based on the N115G, supplementary tunnel information of the user in the 4G core network is provided, such as... Figure 3 As shown, in the construction of 4G / 5G converged networks, the 4G PGW-C network element and the 5G SMF network element are co-located. When a user switches from the 5G network to the 4G network, the SMF network element needs to handle two tasks simultaneously: going online on the 4G network and going offline on the 5G network. Based on the requirements of ensuring session continuity, synchronizing the core network context, synchronizing policies and billing rules, the SMF network element needs to send various parameters (such as APN, QoS configuration, IP address and tunnel information) allocated by the user in the 4G network to the AMF network element for session management through the N11 interface. These parameter information is reflected in the ueEpsPdnConnection field of Nsmf_PDUSession_Context Response.

[0078] The ueEpsPdnConnection field describes the connection information for the UE to establish an EPS bearer context within the N26 interface. It is a string byte stream obtained by base64 encoding the ueEpsPdnConnection IE. Some useful information contained in this field is shown in Table 2:

[0079] Table 2 shows the information about the ueEpsPdnConnection field in the Nsmf_PDUSession_Context Response.

[0080] IEType IE Name describe 71 APN APN 74 UEIP The user's IP address may be IPv4 or IPv6. 93 Bearing context S5-UPGWF-TEID 99 PDN type ①IPv4; ②IPv6; ③IPv4v6

[0081] For the aforementioned session identifier smContextRef and tunnel endpoint identifier PGW-U F-TEID: the user identifier IMSI is obtained by querying the hash table mapping relationship through the session identifier smContextRef; then, user information is maintained using the tunnel endpoint identifier S5-U PGW F-TEID as the key. The mapping relationship used for 5G to 4G conversion is shown in Table 3.

[0082] Table 3.5G to 4G Switching Mapping Relationship Table

[0083] Mapping relationship key value {smContextRef}->Imsi {smContextRef} Imsi TEID+IP->Imsi TEID+IP Imsi Imsi->User Information Imsi User information (APN, UEIP)

[0084] When users switch from 4G to 5G networks, such as Figure 4 As shown, based on the need to ensure session continuity, synchronize core network context, synchronize policies and billing rules, the AMF network element will inform the SMF network element of various parameters of the user in the 4G network (such as APN, QoS configuration, IP address and tunnel information). The various parameter information is reflected in the ueEpsPdnConnection field of Nsmf_PDUSession_CreateSMContext Request.

[0085] The ueEpsPdnConnection field describes the connection information for the UE to establish an EPS bearer context within the N26 interface. It is a string byte stream obtained by base64 encoding the ueEpsPdnConnection IE. Some useful information contained in this field is shown in Table 4:

[0086] Table 4 shows the information about the ueEpsPdnConnection field in the Nsmf_PDUSession_CreateSMContext Request.

[0087]

[0088]

[0089] When the signaling occurs, the user has already switched from the 4G network to the 5G network, and the 4G service data stream has ended, making real-time tracing and association impossible. However, the tunnel endpoint identifiers S5-U PGW F-TEID and S1-U SGW F-TEID obtained above can be used to perform post-association on the already occurred 4G service data through database storage and subsequent association. The mapping relationship of the 4G to 5G conversion process is shown in Table 5.

[0090] Table 54G to 5G Mapping Relationship Table

[0091] Mapping relationship key value Imsi->User Information Imsi User information (three-code information, location information) TEID+IP->Imsi TEID+IP Imsi

[0092] When a user is moving (or roaming) across service areas, the N16 PDU session creation process is triggered, such as... Figure 5As shown, the I-SMF network element (or V-SMF network element) initiates an N16 PDU session creation request to the SMF network element (or H-SMF network element). At this time, the SMF network element (or H-SMF network element) returns the 5G network resources and 4G network resources allocated to the user in this service area to the I-SMF network element (or V-SMF network element), which contains the tunnel information under the 5G network (reflected in the cnTunnel Info field, i.e., N9 UPFF-TEID) and the tunnel information under the 4G network (reflected in the pgwS8uFteid field, i.e., S8-U PGW F-TEID).

[0093] The tunnel endpoint identifier S8-U PGW F-TEID is a string byte stream obtained by base64 encoding the F-TEID IE. The information obtained after decoding this field is shown in Table 6:

[0094] Table 6S8-U PGW F-TEID Information Table

[0095] IEType IE Name describe 87 F-TEID S8-UPGWF-TEID

[0096] Table 7 shows the N16 session mapping relationship table.

[0097]

[0098]

[0099] At this point, table entries are established between the N9 UPF F-TEID and S8-U PGW F-TEID and the user information parsed by the user when the PDU session is created. The maintained mapping relationship is shown in Table 7.

[0100] The following is for reference. Figure 6 , Figure 6 A method for 4G signaling parsing and user tracing based on any of the systems described above is shown, comprising:

[0101] S1: The 5G traceability and association device receives message data at the data access identification layer and determines the protocol type of the message data;

[0102] S2: If the protocol type of the message data is HTTP2, then the message data is signaling data. Different signaling data are processed according to the URL, user actions are analyzed and the signaling data is parsed, and the hash table is updated based on the parsing results.

[0103] S3: If the protocol type of the message data is Gypv1 protocol, then the message data is user data. The service tracing layer extracts the destination IP and TEID of the GTP message header of the message data, looks up the hash table, adds the associated hash table user information to the end of the message data, and performs user association and tracing based on the user information.

[0104] It should be noted that different signaling data are processed based on the URL, and user actions are analyzed and the signaling data is parsed, including:

[0105] During the N11 PDU session creation phase:

[0106] The Nsmf_PDUSession_CreateSMContext Request extracts user information from message data and establishes a mapping relationship between the user identification code IMSI and user information.

[0107] The Nsmf_PDUSession_CreateSMContext Response extracts the session identifier smContextRef from the message data, obtains the user identifier IMSI from the HTTP / 2 stream, and establishes a mapping relationship between the session identifier smContextRef and the user identifier IMSI.

[0108] Namf_Communication_N1N2MessageTransfer extracts the user identifier IMSI and N3UPF F-TEID from the message data and establishes a mapping relationship between the TEID+IP combination and the user identifier IMSI.

[0109] The Nsmf_PDUSession_UpdateSMContext Request extracts the session identifier smContextRef and N3 GNB F-TEID from the message data, finds the user identifier IMSI based on the session identifier smContextRef, and establishes a mapping relationship between the TEID+IP combination and the user identifier IMSI.

[0110] During the N115G 4G transition phase:

[0111] The Nsmf_PDUSession_Context Request extracts the session identifier smContextRef from the message data and finds the user identifier IMSI based on the session identifier smContextRef;

[0112] The Nsmf_PDUSession_Context Response extracts the ueEpsPdnConnection field from the message data, parses it to obtain the APN, UE IP, and tunnel endpoint identifier S5-U PGW F-TEID; obtains the user identifier IMSI based on the HTTP / 2 stream, maintains the mapping relationship between the user identifier IMSI and user information, and establishes the mapping relationship between the S5-U TEID+IP combination and the user identifier IMSI.

[0113] During the N114G to 5G transition phase:

[0114] The Nsmf_PDUSession_CreateSMContext Request extracts user information from the packet data, parses the ueEpsPdnConnection field to obtain the APN, UE IP, tunnel endpoint identifiers S5-U PGW F-TEID and S1-USGW F-TEID, establishes a mapping relationship between the user identifier IMSI and the user information, and stores the tunnel endpoint identifiers S5-UPGW F-TEID and S1-U SGW F-TEID in the database. It also establishes a mapping relationship between the TEID+IP combination and the user identifier IMSI, and subsequently uses a "post-association" method to backtrack the association.

[0115] During the N16 PDU session creation phase:

[0116] Nsmf_PDUSession_Create Request extracts user information and N9 UPF F-TEID from the message data, establishes the user identifier IMSI and user information, and the mapping relationship between TEID+IP and user identifier IMSI;

[0117] The Nsmf_PDUSession_Create Response extracts the N9 UPF F-TEID and pgwS8uFteid fields from the message data and parses them to obtain the tunnel endpoint identifier S8-U PGW F-TEID; it obtains the user identifier IMSI based on the HTTP / 2 stream and establishes a mapping relationship between the TEID+IP combination and the user identifier IMSI.

[0118] The following is for reference. Figure 7 It shows a schematic diagram of the structure of a computer system 700 suitable for implementing electronic devices according to embodiments of the present application. Figure 7 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0119] like Figure 7As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0120] The following components are connected to I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a liquid crystal display (LCD) and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card and a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 710 as needed so that computer programs read from it can be installed into storage section 708 as needed.

[0121] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined in the methods of this application. It should be noted that the computer-readable storage medium of this application can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0122] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0123] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0124] The modules described in the embodiments of this application can be implemented in software or in hardware.

[0125] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: include a data access identification layer, a signaling parsing layer, a hash table layer, and a service tracing layer; the data access identification layer receives message data and identifies the protocol type of the message data; the signaling parsing layer parses the signaling data to obtain a hash table; the service tracing layer is used to trace and associate user data; the hash table layer stores the hash table; after receiving message data at the data access identification layer, the system identifies the protocol type of the message data, sends the signaling data to the signaling parsing layer for parsing, and the hash table layer establishes or maintains the hash table based on the parsing result of the signaling parsing layer; and sends user data to the service tracing layer to extract data features and query the hash table for user identity association and tracing.

[0126] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A 4G signaling parsing and user tracing system based on 5G converged networking, characterized in that, It includes a data access identification layer, a signaling parsing layer, a hash table layer, and a business tracing layer; The data access identification layer is used to receive message data and identify the protocol type of the message data; The signaling parsing layer is used to parse signaling data of protocol type HTTP2 to obtain a hash table with mapping relationships; The business tracing layer is used to trace and associate user data with the protocol type Gypv1; The hash table layer is used to store the hash table; After receiving message data at the data access identification layer, the system identifies the protocol type of the message data, sends the identified signaling data to the signaling parsing layer for parsing, and establishes or maintains a hash table based on the parsing results. as well as The identified user data is sent to the business tracing layer to extract data features and query the hash table of the hash table layer to perform user identity association and tracing.

2. The system according to claim 1, characterized in that, The signaling data is sent to the signaling parsing layer for parsing, and a hash table is built based on the parsing results, including: A PDU session is created through the N11 interface, and a mapping relationship between the user identification code IMSI and user information is established based on the N11 interface signaling data to obtain the first hash table; Establish the mapping relationship between the user identification code IMSI and the session identifier smContextRef to obtain the second hash table; and A mapping relationship is established between the tunnel endpoint identifier (TEID) and the IP address combination and the user identification code (IMSI) to obtain a third hash table.

3. The system according to claim 2, characterized in that, The signaling data is sent to the signaling parsing layer for parsing, and a hash table is maintained based on the parsing results, including: When a user switches from a 5G network to a 4G network, the user identification code IMSI is obtained by querying the second hash table through the session identifier smContextRef. The ueEpsPdnConnection field in the signaling data is parsed to obtain the first 4G core network tunnel information, including APN, UE IP and tunnel endpoint identifier S5-U PGW F-TEID. The first 4G core network tunnel information is added to the first hash table according to the retrieved user identification code IMSI, and the third hash table is updated according to the tunnel endpoint identifier S5-U PGW F-TEID.

4. The system according to claim 2, characterized in that, Sending signaling data to the signaling parsing layer for parsing and maintaining a hash table based on the parsing results also includes: When a user switches from a 4G network to a 5G network, the user identification code IMSI is obtained by querying the second hash table through the session identifier smContextRef. The ueEpsPdnConnection field in the signaling data is parsed to obtain the second 4G core network tunnel information, including APN, UE IP, and tunnel endpoint identifiers S5-U PGW F-TEID and S1-U SGW F-TEID. The second 4G core network tunnel information is added to the first hash table according to the obtained user identification code IMSI, and the third hash table is updated according to the tunnel endpoint identifiers S5-U PGW F-TEID and S1-U SGW F-TEID.

5. The system according to claim 2, characterized in that, The signaling data is sent to the signaling parsing layer for parsing, and a hash table is maintained based on the parsing results. This also includes: When a user is roaming and moving across service areas, a PDU session is created through the N16 interface. The cnTunnel Info field and pgwS8uFteid field of the N16 interface signaling data are parsed to obtain the 5G tunnel endpoint identifier N9 UPF F-TEID and the 4G tunnel endpoint identifier S8-UPGW F-TEID. The user identifier IMSI is obtained by querying the second hash table using the session identifier smContextRef. Based on the retrieved user identifier IMSI, the 5G tunnel endpoint identifier N9 UPF F-TEID and the 4G tunnel endpoint identifier S8-UPGW F-TEID are added to the third hash table, and the user information in the first hash table is updated.

6. The system according to claim 1, characterized in that, The business tracing layer extracts the data features of the user data and looks up the hash table. It then adds the user information associated with the hash table to the end of the message data and performs user association and tracing based on the user information. The data characteristics include the destination IP and the TEID in the GTP message header.

7. A method for 4G signaling parsing and user tracing according to the system as described in any one of claims 1-6, characterized in that, include: S1: The 5G traceability and association device receives message data at the data access identification layer and determines the protocol type of the message data; S2: If the protocol type of the message data is HTTP2, then the message data is signaling data. Different signaling data are processed according to the URL, user actions are analyzed and the signaling data is parsed, and the hash table is updated based on the parsing results. S3: If the protocol type of the message data is Gypv1 protocol, then the message data is user data. The service tracing layer extracts the destination IP and TEID of the GTP message header of the message data, looks up the hash table, adds the associated hash table user information to the end of the message data, and performs user association and tracing based on the user information.

8. A computer program product having one or more computer programs thereon, characterized in that, The method of claim 7 is performed when the computer program is executed by a computer processor.

Images