Signaling processing method, apparatus, device, medium and product for heterogeneous network roaming

Abstract

This disclosure relates to the field of core network technology, and in particular to a signaling processing method, apparatus, device, medium, and product for inter-network roaming. The method includes: receiving signaling sent by a user terminal; identifying whether the signaling is an inter-network roaming service according to a pre-configured roaming mapping table; in response to the signaling being an inter-network roaming service, obtaining a preset shared key between the home operator network and the visited operator network, and generating a security verification code based on the shared key and the content of the signaling; adding roaming relay information to the extended header field of the signaling according to the roaming mapping table to obtain complete signaling; and sending the complete signaling to the second operator network. Generating a security verification code through the preset shared key between the home operator network and the visited operator network and the signaling content ensures the integrity of the signaling. Attackers who do not know the shared key cannot forge the correct security verification code, preventing signaling tampering and ensuring the security of signaling transmission.

Description

Technical Field

[0001] This disclosure relates to the field of core network technology, and in particular to a signaling processing method, apparatus, equipment, medium and product for inter-network roaming. Background Technology

[0002] Signaling processing refers to the process of identifying, parsing, forwarding, and generating signaling in a communication system. Its core is to ensure the correct allocation of network resources and the establishment, maintenance, and release of communication connections. It is widely used in many fields such as telephone switching, mobile communication, data transmission, and network management, and is an important technical foundation for achieving efficient and reliable communication.

[0003] Currently, in the field of signaling processing, especially in cross-network roaming scenarios, signaling may be processed by multiple operators, such as visiting network operators, home network operators, and relay operators. However, because the encryption methods of signaling are still relatively traditional, it is easy to be tampered with during the signaling flow, which seriously affects the security of signaling transmission. Summary of the Invention

[0004] In view of the above problems, this disclosure is made to provide a signaling processing method, apparatus, equipment, medium and product for inter-network roaming.

[0005] According to one aspect of this disclosure, a signaling processing method for inter-network roaming is provided, applied to a first operator's network, comprising: Receive signaling sent by the user terminal; the content of the signaling includes the user terminal's home operator network and the visited operator network that needs to be accessed; Based on the pre-configured roaming mapping table, it is determined whether the signaling is a cross-network roaming service; the roaming mapping table is used to record the signaling roaming processing strategies of various operator networks based on cooperation agreements. In response to the signaling for inter-network roaming service, the system obtains the pre-defined shared key between the home operator network and the visited operator network, and generates a security verification code based on the shared key and the content of the signaling. According to the roaming mapping table, roaming relay information is added to the extended header field of the signaling to obtain complete signaling; wherein, the roaming relay information includes the home operator network, the relay operator network sequence and the security check code, the relay operator network sequence includes the home operator network or at least one relay operator network that the signaling needs to pass through, and the first relay operator network in the relay operator network sequence is the second operator network; Send the complete signaling to the second operator's network.

[0006] The beneficial effects of this solution are as follows: By generating a security check code using the pre-defined shared key and signaling content between the home operator network and the visited operator network, the integrity of the signaling is guaranteed. Attackers who do not know the shared key cannot forge the correct security check code, thus preventing signaling tampering and ensuring the security of signaling transmission. The receiving party (the second operator network) can recalculate the security check code (verification code) using the same shared key and compare it with the received security check code. The authenticity of the signaling can be determined based on whether the two match.

[0007] Furthermore, according to one aspect of the signaling processing method for inter-network roaming, a security verification code is generated based on the shared key and the content of the signaling, including: Adjust the length of the shared key to the specified byte length to obtain the preprocessed key; The preprocessing key is XORed with the first fixed string to obtain the first padding key; wherein the first fixed string is a hexadecimal string with a length of a specified number of bytes; The preprocessing key is XORed with the second fixed string to obtain the second padding key; wherein the second fixed string is a hexadecimal string with a length of a specified number of bytes. The first padding key is concatenated with the signaling content to obtain the concatenated data stream; The concatenated data stream is encrypted and hashed using a hash algorithm to obtain a hash value. The second padding key is concatenated with the hash value to obtain a second concatenated data stream; A hash algorithm is used to perform encrypted hash calculations on the concatenated data stream to generate a security verification code.

[0008] In one or more embodiments, the beneficial effects of this scheme are as follows: When the preprocessing key is XORed with a first fixed string, each bit of the preprocessing key is flipped when XORed with the first fixed string (XORing with 1 flips bits). The same principle applies when XORing the preprocessing key with a second fixed string. Therefore, two new keys completely different from the preprocessing key can be generated: a first padding key and a second padding key, increasing the complexity of the algorithm. The hash algorithm used in this scheme accepts input of arbitrary length and produces a fixed-length (e.g., 256 bits, or 32 bytes) seemingly random output (hash value). Even with minor changes to the input data, the output hash value will undergo significant and unpredictable changes. Therefore, the generation of the security check code heavily depends on the content of the signaling. Even with very small changes to the content, the final calculated security check code will be completely different, further increasing the complexity of the algorithm and helping to further prevent tampering. The hash algorithm performs double encryption calculations on the concatenated data stream and the secondary concatenated data stream, forming an inner and outer two-layer hash structure, which can effectively resist various cryptographic attacks.

[0009] Furthermore, according to the signaling processing method for inter-network roaming according to one aspect of this disclosure, a complete signaling message is sent to the second operator's network, including: The complete signaling is sent to the edge security network element of the first operator's network through an encrypted channel; the edge security network element is used to encapsulate and protect the complete signaling. Send complete signaling to the second operator's network using an edge security gateway.

[0010] In one or more embodiments, the beneficial effects of this solution are as follows: the edge security network element is a Security Edge Protection Proxy (SEPP), the security check code can protect the integrity of the signaling, and the SEPP establishes an end-to-end encrypted channel through Transport Layer Security (TLS), which can prevent man-in-the-middle attacks. The two together constitute inner and outer encryption, which is conducive to further ensuring the integrity of the signaling and preventing tampering.

[0011] Furthermore, the signaling processing method for inter-network roaming according to one aspect of this disclosure also includes: Generate a network element discovery request, which includes roaming transit information; Send a network element discovery request to the network storage function network element of the first operator's network; The network storage function network element sends a network element discovery request to the network storage function network element of the second operator network.

[0012] In one or more embodiments, the beneficial effects of this solution are as follows: Network Repository Function (NRF) network elements can dynamically discover the latest and most accurate network element addresses of the second operator's network, reducing latency to 450ms (a 37.5% reduction) and the failure rate to ≤0.5%. This replaces the original method requiring static IP address configuration, avoiding configuration failures caused by network element expansion or migration. Through the extended protocol between Network Repository Function (NRF) network elements, automatic collaboration between different networks (such as the first operator's network and the second operator's network) can be achieved, breaking down information silos between different networks and eliminating the need for manual intervention to negotiate specific IP addresses. For the first operator's network, it only needs to initiate a request to its own Network Repository Function (NRF) network element, without needing to concern itself with the complex cross-network addressing process, reducing the complexity and modification requirements of core network elements.

[0013] According to one aspect of this disclosure, a signaling processing method for inter-network roaming is provided, applied to a second operator network, comprising: receiving complete signaling sent by a first operator network; Parse the complete signaling to obtain the security checksum in the extended header field; The system checks whether the security check code and the verification code match; the verification code is generated based on the shared key and signaling content. In response to the security check code matching the verification code, the complete signaling is processed.

[0014] The beneficial effects of this scheme are as follows: the second operator network can recalculate the verification code (security check code) using the same shared key and compare it with the received security check code. Based on whether the two are consistent, it can be determined whether the complete signaling is legal and genuine. If the complete signaling is confirmed to be legal, then roaming routing processing or response processing can be performed on the complete signaling.

[0015] Furthermore, according to the signaling processing method for inter-network roaming according to one aspect of this disclosure, the complete signaling is processed, including: Confirm that the second operator network is in the relay operator network sequence, delete the second operator network from the relay operator network sequence, and obtain the relay operator network update sequence; Identify whether the relay operator's network update sequence is empty; In response to the relay operator network update sequence being empty, it identifies whether the home operator network is the second operator network; if so, the second operator network responds to the complete signaling; if not, the second operator network is added to the end of the relay operator network update sequence to obtain update signaling, and then the update signaling is sent to the home operator network. In response to the fact that the transit operator network update sequence is not empty, the second operator network is added to the end of the transit operator network update sequence, an update signaling is obtained, and an update signaling is sent to the first transit operator network in the transit operator network update sequence.

[0016] In one or more embodiments, the beneficial effect of this solution is as follows: After deleting the second operator network from the relay operator network sequence, if the relay operator network update sequence is empty, it indicates that the second operator network may be the last relay operator network or the home operator network. Therefore, it is necessary to further identify whether the home operator network is consistent with the identifier of the second operator network, so as to determine the specific identity of the second operator network. If it is the last relay operator network, the update signaling is sent to the final home operator network. If it is the home operator network, the user request in the update signaling is responded to, and the response information is returned to the first operator network according to the same path.

[0017] If the relay operator network update sequence is not empty, it means that the second operator network is not the last relay operator network. The update signaling also needs to be sent to the next relay operator network. At this time, the second operator network is equivalent to the new first operator network, and the next relay operator network is equivalent to the new second operator network. Repeat the above operation until the signaling is sent to the final home operator network.

[0018] By adding the deleted second operator network to the end of the transit operator network update sequence, the position of the second operator network in the transit operator network sequence is changed, indicating that the signaling has passed through the second operator network, forming a complete and tamper-proof path history, which is beneficial to achieving traceability, auditability, and billability of signaling routing.

[0019] According to another aspect of this disclosure, a signaling processing apparatus for inter-network roaming is provided, applied to a first operator network, comprising: The first receiving module is used to receive signaling sent by the user terminal; wherein, the content of the signaling includes the user terminal's home operator network and the visited operator network that needs to be accessed; The identification module is used to identify whether the signaling is a cross-network roaming service based on a pre-configured roaming mapping table; wherein, the roaming mapping table is used to record the signaling roaming processing strategies of various operator networks based on cooperation agreements; The security verification code generation module is used to respond to signaling for inter-network roaming services, obtain the preset shared key between the home operator network and the visited operator network, and generate a security verification code based on the shared key and the content of the signaling. The transit information addition module is used to add roaming transit information to the extended header field of the signaling according to the roaming mapping table to obtain complete signaling. The roaming transit information includes the home operator network, the transit operator network sequence and the security check code. The transit operator network sequence includes the home operator network or at least one transit operator network that the signaling needs to pass through. The first transit operator network in the transit operator network sequence is the second operator network. The sending module is used to send complete signaling to the second operator's network.

[0020] According to another aspect of this disclosure, a signaling processing apparatus for inter-network roaming is provided, applied to a second operator network, comprising: The second receiving module is used to receive complete signaling sent by the first operator's network; The parsing module is used to parse the complete signaling and obtain the security checksum in the extended header field; The verification module is used to identify whether the security verification code and the verification code are consistent; the verification code is generated based on the shared key and signaling content. The processing module is used to process the complete signaling in response to the security check code and the verification code matching.

[0021] According to another aspect of this disclosure, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the method of one aspect above.

[0022] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the method of one aspect above.

[0023] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method of the above-described aspect.

[0024] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0025] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0026] Figure 1This is a system architecture diagram illustrating a signaling processing method for inter-network roaming according to an embodiment of this disclosure.

[0027] Figure 2 This is a flowchart illustrating an application example according to an embodiment of this disclosure.

[0028] Figure 3 This is a flowchart illustrating a signaling processing method for inter-network roaming according to an embodiment of this disclosure.

[0029] Figure 4 This is a schematic diagram illustrating the structure of a signaling processing apparatus for inter-network roaming according to an embodiment of the present disclosure.

[0030] Figure 5 This is a schematic diagram illustrating the structure of a computer device according to an embodiment of the present disclosure.

[0031] Figure 6 This is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0033] Signaling processing refers to the process of identifying, parsing, forwarding, and generating signaling in a communication system. Its core is to ensure the correct allocation of network resources and the establishment, maintenance, and release of communication connections. It is widely used in many fields such as telephone switching, mobile communication, data transmission, and network management, and is an important technical foundation for achieving efficient and reliable communication.

[0034] Currently, in the field of signaling processing, especially in inter-network roaming scenarios, the following problems still exist: (1) Signaling may be processed by multiple operators, such as visiting network operators, home network operators and relay operators. However, since the encryption methods of signaling are still relatively traditional, it is easy to be tampered with during the signaling flow, which seriously affects the security of signaling transmission.

[0035] (2) The service types of cross-network roaming cannot be automatically identified, resulting in insufficient intelligence of signaling routing strategies and a lack of processing mechanism for relay information, making it difficult to achieve secure signaling routing and dynamic network element collaboration in cross-operator and cross-country scenarios.

[0036] (3) There are deficiencies in the automatic classification and identification of cross-network roaming services, which affects the level of intelligence of signaling routing strategies. At the same time, the lack of dynamic configuration capability for signaling paths of transit operator networks limits the efficiency of secure signaling transmission in cross-operator and cross-country scenarios.

[0037] (4) The lack of intelligent identification and optimization mechanism for international roaming transit paths affects the stability and response speed of signaling transmission between multinational operators.

[0038] The above description, with reference to the accompanying drawings, illustrates a signaling processing method, apparatus, device, medium, and product for inter-network roaming according to embodiments of the present disclosure. By using a pre-defined shared key between the home operator network and the visited operator network, and the content of the signaling, a security verification code is generated. This ensures the integrity of the signaling, preventing attackers without the shared key from forging the correct security verification code, thus preventing signaling tampering and ensuring the security of signaling transmission. The receiving party (the second operator network) can recalculate the security verification code (verification code) using the same shared key and compare it with the received security verification code. The legality and authenticity of the signaling can be determined based on whether the two are consistent.

[0039] To facilitate understanding of this embodiment, a detailed description of the inter-network roaming signaling processing method disclosed in this disclosure is provided first. The executing entity of the inter-network roaming signaling processing method provided in this disclosure is generally a computer device with certain computing capabilities. This computer device may include, for example, a terminal device, a server, or other processing devices. The terminal device may be a user equipment (UE), mobile device, user terminal, terminal, cellular phone, cordless phone, personal digital assistant (PDA), handheld device, computing device, vehicle-mounted device, wearable device, etc. In some possible implementations, this inter-network roaming signaling processing method can be implemented by a processor calling computer-readable instructions stored in memory.

[0040] like Figure 1The diagram shown illustrates the system architecture of the inter-network roaming signaling processing method provided in this embodiment. It includes a first operator network 1 and a second operator network 2. The first operator network 1 includes a network number determination module 11, a message processing module 12, a message sending module 13, and an optional network element discovery and coordination module 14. The second operator network 2 includes an acquisition module 21, a roaming routing module 22, and an optional network element discovery and response module 23. Specifically, the first operator network is the initiator and the initial processor of the signaling throughout the entire signaling interaction process; it is typically the visited operator network (hereinafter referred to as the visited network) that the user terminal currently needs to access. The second operator network, in the entire signaling interaction process, acts as either the receiver or a relay processor. It could be a relay operator network (hereinafter referred to as the relay operator) or the home operator network (hereinafter referred to as the home network). For example, if a Chinese user uses domestic operator network A and needs to access local European operator network B while traveling in Europe, then B is the first operator network. If there is a cooperation agreement between A and B supporting direct signaling, then A is the second operator network. If A and B need to relay signaling through other relay operator networks, then the second operator network is the relay network. The following is a detailed description of each module: First Carrier Network 1: Network number determination module 11: Receives the signaling sent by the user terminal, i.e., the access request, parses the Public Land Mobile Network (PLMN) identifier of the visited network and the PLMN identifier of the home network in the signaling, and identifies whether the signaling is an inter-network roaming service based on the pre-configured roaming mapping table.

[0041] Specifically, a PLMN identifier typically consists of a country code (MCC) and a network code (MNC), for example: China Mobile's PLMN identifier is 46001; The PLMN identifier of a certain foreign operator, Vodafone, is 20801; The PLMN identifier of a certain overseas operator, Orange, is 20802.

[0042] The system analyzes the PLMN identifier of the visited network and the PLMN identifier of the home network. If a discrepancy is found in the country code (e.g., 208 ≠ 460), the signaling is determined to be an inter-network roaming service.

[0043] Regarding the roaming mapping table: The roaming mapping table is a customized data table that each operator independently configures based on cooperation agreements and network planning, and dynamically maintains through the Operations and Maintenance (O&M) system. For example, it may contain the following: Inter-operator cooperation negotiation: Clarify the identification of cooperating operators, the correspondence between MCC and MNC, the types of roaming services supported (such as Data and VoNR), and permissions.

[0044] Network planning and configuration: Based on your own network coverage and relay resource layout, set routing priorities and backup relay schemes.

[0045] Dynamic updates and maintenance: Protocol changes are synchronized in real time through the O&M system, such as adding new partners or adjusting revenue sharing ratios, without the need to restart network elements.

[0046] For ease of understanding, this embodiment uses China Mobile's network as the home network (PLMN denoted as 46001) as an example, and provides a roaming mapping table as shown in Table 1: Table 1 Roaming Map

[0047] The core fields in Table 1 (such as PLMN, roaming type, and supported services) are used for service identification and routing decisions; billing ratios and key identifiers are associated with billing and security verification; and backup relay OP-IDs ensure service continuity and security. In addition to the contents listed in Table 1, the roaming mapping table can also record whether each cooperating operator has signed a direct connection agreement with China Mobile. Cooperating operators with direct connection agreements (such as Vodafone) can directly send signaling to China Mobile. For cooperating operators without direct connection agreements, the roaming mapping table can specify which relay networks are needed for signaling relay. For example, Vodafone in Spain is not directly connected to China Mobile and needs to be relayed through Vodafone in Germany.

[0048] Specifically, in cross-network roaming, especially in international multi-tiered transit scenarios, there are often multiple potential transit partners between one operator and another (such as from Vodafone to China Mobile), and the signaling routing paths are also varied, for example: Vodafone → Intermediate Operator 1 → Intermediate Operator 2 → China Mobile Vodafone → Intermediate Operator 3 → China Mobile Vodafone → Intermediate Operator 4 → China Mobile.

[0049] Therefore, this embodiment provides a dynamic load balancing algorithm, which aims to select a route that can avoid congestion for signaling. The dynamic load balancing algorithm specifically includes: (1) Continuously monitor the real-time performance metrics of each relay operator's links. This includes: Connection count Ci (i represents the i-th relay operator): This represents the number of signaling connections currently established with the relay operator SEPP, reflecting its processing pressure; for example, C1=600, C2=400.

[0050] Average delay Di (i represents the i-th relay operator): The average time for signaling to travel to and from the relay operator, reflecting its path speed; for example, D1=180ms, D2=150ms.

[0051] (2) Set threshold and calculation load.

[0052] For example: the threshold for the number of connections Cmax = 800, and the threshold for the average latency Dmax = 200ms.

[0053] The load of each transit operator is calculated using a weighted formula, and finally the route path with the lowest overall load is selected.

[0054] For example, the weighted formula is: Li = w1×Ci + w2×Di. Where w1 and w2 represent weighting coefficients, assuming w1 = 0.6 and w2 = 0.4, then: L1 =0.6600 + 0.4180 = 432, L2 = 0.6400 + 0.4150 = 300.

[0055] Where L1 represents the load of the first relay operator and L2 represents the load of the second relay operator.

[0056] Message processing module 12: If the network number determination module 11 determines that it is an inter-network roaming service, add roaming relay information to the extended header field of the 5G signaling, including: Transit-OP-ID: 20802 (Transit operator network sequence, 20802 indicates that the next transit operator is Orange); Home-PLMN: 46001 (User's home network); Service-Type: Data (Business Type); Timestamp: Current timestamp (to prevent signaling replay attacks, e.g., validity period ≤ 5 minutes); Billing-ID: Billing identifier, such as RoamCharge:Transit=Orange, Ratio=25%, used for traffic splitting statistics between the home network and the transit operator network; HMAC-Checksum: A security checksum generated using the Hash-Based Message Authentication Code (HMAC) algorithm to ensure the integrity and authenticity of information.

[0057] Regarding the transit operator network sequence, if the visited network and the home network can be directly signaled to each other without transit, then the Transit-OP-ID only includes the PLMN identifier of the visited network.

[0058] Specifically, the process of generating a security check code includes the following steps: Step 1: Obtain the preset shared key and signaling information between the home network and the visited network.

[0059] Assuming the shared key K is processed into 256 bits, or 32 bytes, the signaling content M is, for example: UE IMSI + service type + timestamp.

[0060] Step 2: Adjust the length of the shared key to the specified byte length to obtain the preprocessed key.

[0061] Assuming the specified byte length is 64 bytes, if the length of K is less than 64 bytes, then zero bytes (0x00) are padded to the right of K until its length equals 64 bytes; if the length of K is greater than 64 bytes, then SHA-256 hash calculation is performed on K first to obtain a 32-byte digest, and then zero bytes (0x00) are padded to this digest to 64 bytes; if the length of K is 64 bytes, it can be used directly.

[0062] For example: Shared key K = [byte 1, byte 2, ..., byte 32], Preprocessing key K' = [byte 1, byte 2 ... byte 32, 0x00, 0x00 ... 0x00] (64 bytes in total).

[0063] Step 3: Perform an XOR operation on the preprocessing key based on the first fixed string to obtain the first padding key.

[0064] The first fixed string is a hexadecimal string with a length of a specified number of bytes. Specifically, it can be the inner pad string (abbreviated as ipad), where ipad is a 64-byte fixed string formed by repeating the hexadecimal value 0x36 64 times.

[0065] The formula for calculating the first padding key K1 is: K1 = K' ⊕ ipad, Here, ⊕ represents "exclusive OR", which performs a bitwise XOR operation between ipad and K'. If the two bits are the same, the result is 0; if they are different, the result is 1.

[0066] For example, the binary representation of 0x36 is 0011 0110. When each byte of K' is XORed with each byte of iPad (which is also 0x36), each bit of K' is "flipped" (because XORing with 1 flips bits), resulting in the first padding key K1.

[0067] Step 4: Perform an XOR operation on the preprocessed key based on the second fixed string to obtain the second padding key.

[0068] The second fixed string is a hexadecimal string with a length of a specified number of bytes. Specifically, it can be an outer pad string (abbreviated as opad), where opad is a 64-byte fixed string formed by repeating the hexadecimal value 0x5c 64 times.

[0069] The formula for calculating the second padding key K2 is: K2 = K' ⊕ opad, Here, ⊕ represents "exclusive OR," which performs a bitwise XOR operation between opad and K'. If the two bits are the same, the result is 0; if they are different, the result is 1. The calculation process for the second padding key K2 is similar to that of K1, and will not be repeated in this embodiment.

[0070] Step 5: Concatenate the first padding key K1 with the signaling content M to obtain a concatenated data stream. Use a hash algorithm to perform encrypted hash calculation on the concatenated data stream to obtain the hash value.

[0071] The formula for calculating the hash value H1 is: H1 = SHA-256(K1 ∥ M), Where ∥ represents concatenation, (K1 ∥ M) represents concatenating data streams. SHA-256 is a standard and very powerful cryptographic hash function that accepts input of arbitrary length and produces a fixed-length (256 bits, or 32 bytes) seemingly random output (hash value). Even if the input data is slightly modified, the output hash value will undergo huge and unpredictable changes.

[0072] The hash value H1 can be considered as the fingerprint of M encrypted with K1.

[0073] Step 6: Concatenate the second padding key K2 with the hash value H1 to obtain a secondary concatenated data stream; use a hash algorithm to perform encrypted hash calculation on the secondary concatenated data stream to generate a security verification code.

[0074] The formula for calculating the security check code H2 is: H2 = SHA-256(K2 ∥ H1) Here, ∥ represents concatenation, and (K2 ∥ H1) represents a secondary concatenation of the data stream. This step involves further "encryption" and "hashing" of H1 obtained in step 5. The final H2 is the security checksum (HMAC-Checksum), which is a 256-bit (32-byte) hexadecimal string.

[0075] It should be noted that steps 1-6 are the calculation process that the first operator network (i.e., the visited network) needs to perform. When the second operator network receives the signaling, it needs to verify the security check code in the extended header field. The verification method is as follows: the second operator network regenerates a security check code (i.e., verification code) according to steps 1-6, and compares whether the two security check codes are consistent. If they are consistent, the verification is passed; if they are inconsistent, an anomaly is triggered.

[0076] Message sending module 13: Sends the complete signaling carrying roaming relay information to the edge security network element of the first operator's network, namely the Security Edge Protection Proxy (SEPP), triggering cross-operator security signaling routing.

[0077] Specifically, the complete signaling message with the X-Roam-Transit extended header field added is sent to the first operator network's own SEPP through a TLS 1.3 encrypted channel. The SEPP, as a security gateway at the network boundary, will perform the necessary standard encapsulation and protection on the signaling message, and then forward the complete signaling message to the second operator network's SEPP through the N32 interface between the operator networks.

[0078] Network element discovery and coordination module 14: It can generate network element discovery requests containing roaming and transit information, and dynamically locate the target access and mobility management function (AMF) or session management function (SMF) of the second operator network through the network repository function (NRF) of the first operator network.

[0079] The network element discovery and collaboration module 14 is the key to realizing "dynamic network element collaboration" in the whole system. Its core task is to dynamically find the service network element (such as AMF or SMF) in the home network for visiting users in the scenario of cross-network roaming.

[0080] The network element discovery and coordination module 14 is not triggered by all signaling, but is selectively invoked within specific processes. For example, its trigger points include: (1) User registration process: When a user’s access request is received by the AMF of the visited network, if it is determined to be a cross-network roaming service and the AMF of the visited network is unsure which AMF of the home network the user should register with, this module will be triggered to discover the AMF of the home network.

[0081] (2) Session establishment process: When a roaming user needs to establish a data session (such as internet access), the visiting network's AMF needs to find the home network's SMF to manage the session. This will also trigger this module to discover the home network's SMF.

[0082] This embodiment assumes that a China Mobile (46001) user X initiates an access request on a Vodafone (20801) server in Germany. The functional flow of the network element discovery and coordination module 14 is described in detail in this scenario, specifically including the following steps: Step 1: Obtain key context information from the network number determination module 11 and the message processing module 12. This includes: Roaming determination result: Confirmed as cross-network roaming service; and roaming relay information.

[0083] Step 2: Construct a network element discovery request.

[0084] Generate a standard Network Function Discovery Request (NF Discovery Request) and encapsulate roaming transit information into the NF Discovery Request. This is a request conforming to 3GPP specifications, which essentially asks: "User X, whose home network is 46001, needs a service Y (such as SMF). Please tell me the address of the responsible network element?" Step 3: Send a network element discovery request to the NRF of this network (Vodafone).

[0085] The network element discovery coordination module 14 does not directly contact user X's home network. Instead, it sends the network element discovery request, which carries roaming transit information, to the visited network's (Vodafone) own NRF. This aligns with the design of the 5G architecture, where all network element discovery is performed through the local network's NRF.

[0086] Step 4: After Vodafone's NRF receives the network element discovery request, it recognizes that this is a request that requires cross-network service (because the home network is 46001), and forwards this network element discovery request to the second operator network through the interface between NRFs (such as N28).

[0087] The second operator network can be either a relay operator network or the home network, depending on the roaming mapping table. In this embodiment, it is assumed that the second operator network is a relay operator network (such as Orange France, 20802), and the network element discovery request is forwarded to Orange's NRF. It should be noted that this forwarding process is similar to the forwarding of signaling between SEPPs and may also pass through the NRFs of multiple relay operator networks.

[0088] Step 5: Each secondary operator's network's NRF may integrate a network element discovery and response module. The function of this module is: Receive network element discovery requests from the previous operator's network; Analyze and verify the roaming transit information; Delete routing information pointing to this operator's network; The network element discovery request will be forwarded to the NRF of the next transit operator network or the NRF of the final home network (China Mobile's NRF).

[0089] Step 6: After receiving the network element discovery request, the home network's NRF finds one or more target SMFs (or AMFs) that can serve the user in its service registry based on the user identifier (SUPI) and the requested service type (NF-Type: such as SMF). Then, it generates an NF Discovery Response, which contains the address information of the target network element.

[0090] The network function discovery response is transmitted back along the path of the network element discovery request: China Mobile NRF → relay network NRF → Vodafone NRF → Vodafone's network element discovery coordination module 14.

[0091] Step 7: After receiving the network function discovery response, the network element discovery and coordination module 14 parses out the address information of the target network element (such as SMF) and delivers it to Vodafone's AMF (or SMF). At this point, the task is complete. Vodafone's AMF can directly establish a connection with the target network element SMF to perform subsequent session management procedures.

[0092] The network element discovery and collaboration module 14 can query the user's home network in real time to obtain the latest and most accurate address of the target network element, replacing the need for static IP address configuration and avoiding configuration failures caused by network element expansion or migration. Through standard NRF interfaces and extended protocols, it achieves automatic collaboration with other networks (even multi-level relay networks), breaking down information silos between operators and eliminating the need for manual intervention to negotiate the target network element's IP address. It intelligently binds roaming routing information with network element discovery requests, ensuring that the network element discovery request is delivered to the home network along the correct signaling relay path. For network elements (AMF / SMF) visiting the network, they only need to initiate a network element discovery request to their local NRF, without needing to worry about the complex cross-network addressing process, reducing the complexity and modification requirements of core network elements.

[0093] Second operator network 2: Acquisition module 21: Receives complete signaling carrying roaming relay information from message sending module 13.

[0094] Specifically, the acquisition operation can be performed by the SEPP (or AMF / SMF) within the second operator network 2, and then the extended header field of the complete signaling can be parsed to verify whether the security check code is consistent with the verification code. The generation process of the verification code can be referred to the security check code, which will not be elaborated here.

[0095] If the signaling is confirmed to be consistent, the roaming routing module 22 will then process the complete signaling.

[0096] Roaming routing module 22: Determines the routing strategy for complete signaling based on whether the second operator network 2 is a transit operator network or the home network.

[0097] Specifically, the routing policy decision-making process includes: S1: Confirm that the second operator network 2 is in the relay operator network sequence, parse and delete the PLMN identifier pointing to this network (second operator network 2) in the relay operator network sequence, and obtain the relay operator network update sequence.

[0098] S2: Identify whether the relay operator's network update sequence is empty; For example: If the transit operator network sequence (Transit-OP-ID) is

[20802] , and 20802 is the PLMN identifier of the second operator network 2, then the transit operator network update sequence is [] (empty value), proceed to step 3; For example: If the transit operator network sequence (Transit-OP-ID) is [20802, 20803], then the transit operator network update sequence is

[20803] , proceed to step 4; S3: In response to the transit operator network update sequence being empty, identify whether the home network is the second operator network 2.

[0099] Specifically, this can be identified based on the (Home-PLMN) field in the roaming transit information. For example, based on [Home-PLMN: 46001] in the roaming transit information, it can be known that the user's home network is 46001 (China Mobile). If the PLMN identifier of the second operator network 2 is equal to 46001, it indicates that the second operator network 2 is the final home network for the signaling, and the second operator network 2 will handle the signaling response. Specifically, for example, the extended header field in the signaling is deleted, restoring the most original, standard access request signaling. This signaling is then sent to the home network's own NRF or AMF for processing, including authentication and authorization. Finally, the generated response information is returned to the visited network in the opposite direction to the signaling path.

[0100] If the PLMN identifier of the second operator network 2 is not equal to 46001, it indicates that the second operator network 2 is a relay operator network, and since the relay operator network update sequence is empty, it indicates that the second operator network 2 is the last relay operator network. At this time, the second operator network 2 is added to the end of the relay operator network update sequence to obtain update signaling, and the update signaling is forwarded to the SEPP or NRF of the home network.

[0101] It should be noted that the transit operator network update sequence is changed to

[20802] again, but its meaning is not the same as the transit operator network sequence. Adding it back to the end indicates that the signaling has passed through the second operator network (20802), which is used to characterize the historical routing path of the signaling.

[0102] S4: In response to the transit operator network update sequence not being empty, add the second operator network to the end of the transit operator network update sequence, obtain update signaling, and forward the update signaling to the SEPP or NRF of the first transit operator network in the transit operator network update sequence.

[0103] Specifically, the relay operator network sequence is [20802, 20803]; The transit operator's network update sequence is

[20803] ; The relay operator network update sequence for updating signaling is [20803, 20802]. Here, 20803 is the first relay operator network in the relay operator network update sequence, indicating the next hop for the signaling to be relayed. Although the relay operator network update sequence still includes 20802, the order and meaning are different. By adding the deleted 20802 to the end of the relay operator network update sequence, the position of 20802 in the relay operator network sequence is changed, indicating that the signaling has passed through 20802, forming a complete and tamper-proof path history, which is beneficial for achieving traceability, auditability, and billability of signaling routing.

[0104] In addition, in international multi-level transit scenarios, this embodiment supports recursively adding transit information to achieve chained routing. That is, each transit operator network repeatedly executes S1-S4. Finally, when the signaling reaches the home network, the transit operator network update sequence completely records the routing path of the signaling, which is crucial for billing (who provided the transit service) and problem localization (where the error occurred).

[0105] Network element discovery response module 23: It is responsible for processing network element discovery requests sent from network element discovery coordination module 14, deleting the relay information and forwarding it to the NRF of the second operator network 2, obtaining the information of the target network element and sending it back to network element discovery coordination module 14.

[0106] For example, the network element discovery and coordination module 14 and the network element discovery and response module 23 are modules that are selectively called in a specific process. They are used to coordinate with the network element discovery and coordination module 14 of the "previous node" to quickly locate the target network element of the second operator network 2.

[0107] Optionally, both the first operator network 1 and the second operator network 2 are equipped with an anomaly handling module 31, the function of which is: (1) If a security checksum error is detected at any stage, such as an HMAC value mismatch, the exception handling module is triggered, the error code "500 Invalid Transit Checksum" is returned, and an attempt is made to retry or fall back to the 4G network; (2) If a signaling timeout is detected (e.g., no response within 500ms), a backup switch is triggered, and another backup relay operator network (e.g., Deutsche Telekom) is selected according to the roaming mapping table. Based on the above embodiments, this embodiment provides an application example. Assume user A uses a China Mobile (MCC=460) SIM card and accesses the Vodafone (MCC=208) 5G network in Germany, requiring cross-carrier signaling routing for registration and session establishment requests. For example... Figure 2 As shown, it includes S201~S206: S201: Client access request.

[0108] User A's terminal initiates a registration request (i.e., signaling) to access the Vodafone network. The signaling includes the visited network PLMN=20801 (Vodafone Germany) and the home network PLMN=46001 (China Mobile).

[0109] S202: Analyze the visiting network PLMN and the home network PLMN.

[0110] Vodafone's network identification module in Germany analyzes the visited network PLMN and the home network PLMN and finds that the MCC is inconsistent (208 ≠ 460), which determines it to be an international transit roaming.

[0111] The pre-configured roaming mapping table was queried, confirming that Vodafone Germany is an international partner operator of China Mobile and supports transit routing.

[0112] S203: Add roaming transit information to the extended header field of the registration request. Roaming transit information includes: Relay operator network identifier: 20801 Home network identifier: 46001 Business type: Data Billing identifier: RoamCharge:Transit=Orange, Ratio=25%, Security check code: Calculated using the HMAC algorithm and generated using a shared key.

[0113] S204: Vodafone Germany sends a registration request carrying roaming transit information to its SEPP network, triggering cross-carrier signaling routing.

[0114] S205: Vodafone's SEPP in Germany receives the registration request and parses the roaming transit information.

[0115] Specifically, analysis revealed that the transit operator's network was Vodafone in Germany, requiring forwarding to China Mobile's SEPP. The route identifier pointing to Vodafone in Germany was removed; therefore, the roaming transit information includes: Relay operator network identifier: Home network identifier: 46001 Business type: Data Billing identifier: RoamCharge:Transit=Orange, Ratio=25%, Security check code: Calculated using the HMAC algorithm and generated using a shared key.

[0116] Finally, the registration request is forwarded to China Mobile's SEPP.

[0117] S206: China Mobile SEPP receives the registration request and parses the roaming transit information within it.

[0118] Analysis revealed that the home network is 46001, which belongs to China Mobile. The request needs to be forwarded to China Mobile's NRF for response processing.

[0119] Based on the above embodiments, this embodiment also provides a signaling processing method for inter-network roaming, such as... Figure 3 The diagram shows a flowchart of the signaling processing method for inter-network roaming, including S301-S309, where S301-S305 are applied to the first operator's network and S306-S309 are applied to the second operator's network. S301: Receive signaling sent by the user terminal.

[0120] The signaling content includes the user's home operator network and the visited operator network that needs to be accessed.

[0121] S302: Based on the pre-configured roaming mapping table, identify whether the signaling is an inter-network roaming service.

[0122] The roaming mapping table is used to record the signaling roaming processing strategies of various operator networks based on cooperation agreements.

[0123] S303: In response to the signaling for inter-network roaming service, obtain the preset shared key between the home operator network and the visited operator network, and generate a security verification code based on the shared key and the content of the signaling.

[0124] S304: Based on the roaming mapping table, add roaming relay information to the extended header field of the signaling to obtain complete signaling.

[0125] The roaming transit information includes the home operator network, the transit operator network sequence, and the security check code. The transit operator network sequence includes the home operator network or at least one transit operator network through which the signaling needs to pass. The first transit operator network in the transit operator network sequence is the second operator network.

[0126] S305: Send complete signaling to the second operator's network.

[0127] S306: Receive complete signaling sent by the first operator's network.

[0128] S307: Parse the complete signaling to obtain the security check code in the extended header field.

[0129] S308: Verify whether the security check code and the verification code are consistent.

[0130] The verification code is generated based on the shared key and signaling content; S309: In response to the security check code and verification code matching, process the complete signaling.

[0131] In one or more embodiments, S303 generates a security verification code, including: The shared key is adjusted to a specified byte length to obtain a preprocessed key; the preprocessed key is XORed with a first fixed string to obtain a first padding key; the first fixed string is a hexadecimal string of a specified byte length; the preprocessed key is XORed with a second fixed string to obtain a second padding key; the second fixed string is a hexadecimal string of a specified byte length; the first padding key is concatenated with the signaling content to obtain a concatenated data stream; a hash algorithm is used to perform an encrypted hash calculation on the concatenated data stream to obtain a hash value; the second padding key is concatenated with the hash value to obtain a secondary concatenated data stream; a hash algorithm is used to perform an encrypted hash calculation on the secondary concatenated data stream to generate a security check code.

[0132] Specifically, the process of generating a security check code includes the following steps: Step 1: Obtain the preset shared key and signaling information between the home network and the visited network.

[0133] Assuming the shared key K is processed into 256 bits, or 32 bytes, the signaling content M is, for example: UE IMSI + service type + timestamp.

[0134] Step 2: Adjust the length of the shared key to the specified byte length to obtain the preprocessed key.

[0135] Assuming the specified byte length is 64 bytes, if the length of K is less than 64 bytes, then zero bytes (0x00) are padded to the right of K until its length equals 64 bytes; if the length of K is greater than 64 bytes, then SHA-256 hash calculation is performed on K first to obtain a 32-byte digest, and then zero bytes (0x00) are padded to this digest to 64 bytes; if the length of K is 64 bytes, it can be used directly.

[0136] For example: Shared key K = [byte 1, byte 2, ..., byte 32], Preprocessing key K' = [byte 1, byte 2 ... byte 32, 0x00, 0x00 ... 0x00] (64 bytes in total).

[0137] Step 3: Perform an XOR operation on the preprocessing key based on the first fixed string to obtain the first padding key.

[0138] The first fixed string is a hexadecimal string with a length of a specified number of bytes. Specifically, it can be the inner pad string (abbreviated as ipad), where ipad is a 64-byte fixed string formed by repeating the hexadecimal value 0x36 64 times.

[0139] The formula for calculating the first padding key K1 is: K1 = K' ⊕ ipad, Here, ⊕ represents "exclusive OR", which performs a bitwise XOR operation between ipad and K'. If the two bits are the same, the result is 0; if they are different, the result is 1.

[0140] For example, the binary representation of 0x36 is 0011 0110. When each byte of K' is XORed with each byte of iPad (which is also 0x36), each bit of K' is "flipped" (because XORing with 1 flips bits), resulting in the first padding key K1.

[0141] Step 4: Perform an XOR operation on the preprocessed key based on the second fixed string to obtain the second padding key.

[0142] The second fixed string is a hexadecimal string with a length of a specified number of bytes. Specifically, it can be an outer pad string (abbreviated as opad), where opad is a 64-byte fixed string formed by repeating the hexadecimal value 0x5c 64 times.

[0143] The formula for calculating the second padding key K2 is: K2 = K' ⊕ opad, Here, ⊕ represents "exclusive OR," which performs a bitwise XOR operation between opad and K'. If the two bits are the same, the result is 0; if they are different, the result is 1. The calculation process for the second padding key K2 is similar to that of K1, and will not be repeated in this embodiment.

[0144] Step 5: Concatenate the first padding key K1 with the signaling content M to obtain a concatenated data stream. Use a hash algorithm to perform encrypted hash calculation on the concatenated data stream to obtain the hash value.

[0145] The formula for calculating the hash value H1 is: H1 = SHA-256(K1 ∥ M), Where ∥ represents concatenation, (K1 ∥ M) represents concatenating data streams. SHA-256 is a standard and very powerful cryptographic hash function that accepts input of arbitrary length and produces a fixed-length (256 bits, or 32 bytes) seemingly random output (hash value). Even if the input data is slightly modified, the output hash value will undergo huge and unpredictable changes.

[0146] The hash value H1 can be considered as the fingerprint of M encrypted with K1.

[0147] Step 6: Concatenate the second padding key K2 with the hash value H1 to obtain a secondary concatenated data stream; use a hash algorithm to perform encrypted hash calculation on the secondary concatenated data stream to generate a security verification code.

[0148] The formula for calculating the security check code H2 is: H2 = SHA-256(K2 ∥ H1) Here, ∥ represents concatenation, and (K2 ∥ H1) represents a secondary concatenation of the data stream. This step involves further "encryption" and "hashing" of H1 obtained in step 5. The final H2 is the security checksum (HMAC-Checksum), which is a 256-bit (32-byte) hexadecimal string.

[0149] In one or more embodiments, it further includes: Generate a network element discovery request, which includes roaming transit information; send the network element discovery request to the network storage function network element of the first operator's network; and use the network storage function network element to send the network element discovery request to the network storage function network element of the second operator's network.

[0150] Specifically, a Network Element Discovery Request (NF Discovery Request) is made, encapsulating roaming transit information within the NF Discovery Request. This is a request conforming to 3GPP specifications, essentially asking: "User X, whose home network is 46001, needs a service Y (such as SMF). Please tell me the address of the responsible network element?" In one or more embodiments, S309 further includes: Confirm that the second operator network is in the relay operator network sequence, delete the second operator network from the relay operator network sequence, and obtain the relay operator network update sequence; identify whether the relay operator network update sequence is empty; in response to the relay operator network update sequence being empty, identify whether the home operator network is the second operator network; if so, the second operator network responds to the complete signaling; if not, add the second operator network to the end of the relay operator network update sequence, obtain update signaling, and send update signaling to the home operator network; in response to the relay operator network update sequence not being empty, add the second operator network to the end of the relay operator network update sequence, obtain update signaling, and send update signaling to the first relay operator network in the relay operator network update sequence.

[0151] After deleting the second operator network from the relay operator network sequence, if the relay operator network update sequence is empty, it means that the second operator network may be the last relay operator network or the home operator network. Therefore, it is necessary to further identify whether the home operator network is consistent with the identifier of the second operator network to determine the specific identity of the second operator network. If it is the last relay operator network, the update signaling is sent to the final home operator network. If it is the home operator network, the user request in the update signaling is responded to, and the response information is returned to the first operator network according to the same path.

[0152] If the relay operator network update sequence is not empty, it means that the second operator network is not the last relay operator network. The update signaling also needs to be sent to the next relay operator network. At this time, the second operator network is equivalent to the new first operator network, and the next relay operator network is equivalent to the new second operator network. Repeat the above operation until the signaling is sent to the final home operator network.

[0153] By adding the deleted second operator network to the end of the transit operator network update sequence, the position of the second operator network in the transit operator network sequence is changed, indicating that the signaling has passed through the second operator network, forming a complete and tamper-proof path history, which is beneficial to achieving traceability, auditability, and billability of signaling routing.

[0154] According to another aspect of the embodiments of this disclosure, a signaling processing apparatus for inter-network roaming is provided, such as... Figure 4 As shown, 401-405 are deployed in the first operator's network, and 406-409 are deployed in the second operator's network. The device specifically includes: The first receiving module 401 is used to receive signaling sent by the user terminal; wherein, the content of the signaling includes the home operator network of the user terminal and the visited operator network that needs to be accessed. The identification module 402 is used to identify whether the signaling is a cross-network roaming service according to the pre-configured roaming mapping table; wherein, the roaming mapping table is used to record the signaling roaming processing strategies of various operator networks based on cooperation agreements. The security verification code generation module 403 is used to respond to the signaling for inter-network roaming service, obtain the preset shared key between the home operator network and the visited operator network, and generate a security verification code based on the shared key and the content of the signaling. The transit information adding module 404 is used to add roaming transit information to the extended header field of the signaling according to the roaming mapping table to obtain complete signaling; wherein, the roaming transit information includes the home operator network, the transit operator network sequence and the security check code, the transit operator network sequence includes the home operator network or at least one transit operator network that the signaling needs to pass through, and the first transit operator network in the transit operator network sequence is the second operator network; The sending module 405 is used to send complete signaling to the second operator network.

[0155] The second receiving module 406 is used to receive complete signaling sent by the first operator network; The parsing module 407 is used to parse the complete signaling and obtain the security check code in the extended header field; The verification module 408 is used to identify whether the security verification code and the verification code are consistent; wherein, the verification code is generated based on the shared key and the content of the signaling. Processing module 409 is used to process the complete signaling in response to the security check code and verification code matching.

[0156] The signaling processing device for inter-network roaming provided in this disclosure and the signaling processing method for inter-network roaming provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0157] This disclosure also provides a computer device for performing the above-described signaling processing method for inter-network roaming. Please refer to... Figure 5 It illustrates a schematic diagram of a computer device provided by some embodiments of this disclosure. For example... Figure 5 As shown, the computer device 5 includes: a processor 500, a memory 501, a bus 502, and a communication interface 503. The processor 500, the communication interface 503, and the memory 501 are connected via the bus 502. The memory 501 stores a computer program that can run on the processor 500. When the processor 500 runs the computer program, it executes the signaling processing method for inter-network roaming provided in any of the foregoing embodiments of this disclosure.

[0158] The memory 501 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this device network element and at least one other network element is achieved through at least one communication interface 503 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc.

[0159] Bus 502 can be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. The memory 501 is used to store programs. After receiving an execution instruction, the processor 500 executes the program. The inter-network roaming signaling processing method disclosed in any of the foregoing embodiments of this disclosure can be applied to the processor 500, or implemented by the processor 500.

[0160] The processor 500 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 500 or by instructions in software form. The processor 500 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPTA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 501. The processor 500 reads the information in memory 501 and, in conjunction with its hardware, completes the steps of the above method.

[0161] The computer device provided in this disclosure and the signaling processing method for inter-network roaming provided in this disclosure are based on the same inventive concept and have the same beneficial effects as the methods they adopt, operate or implement.

[0162] This disclosure also provides a computer-readable storage medium corresponding to the inter-network roaming signaling processing method provided in the foregoing embodiments. The computer-readable storage medium is an optical disc, on which a computer program (i.e., a computer program product) is stored. When the computer program is run by a processor, it executes the inter-network roaming signaling processing method provided in any of the foregoing embodiments.

[0163] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical and magnetic storage media, which will not be elaborated here.

[0164] The computer-readable storage medium provided in the above embodiments of this disclosure and the signaling processing method for inter-network roaming provided in the embodiments of this disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the applications stored therein.

[0165] This disclosure also provides a computer program product; please refer to [reference needed]. Figure 6 The computer program product 600 carries program code, namely computer program 601. The instructions included in the computer program 601 can be used to execute the steps of the signaling processing method for inter-network roaming described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0166] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0167] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0168] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0169] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0170] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0171] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0172] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0173] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A signaling processing method for inter-network roaming, applied to a first operator's network, characterized in that, include: Receive signaling sent by the user terminal; wherein the content of the signaling includes the home operator network of the user terminal and the visited operator network to be accessed; Based on a pre-configured roaming mapping table, it is determined whether the signaling is an inter-network roaming service; wherein, the roaming mapping table is used to record the signaling roaming processing strategies of various operator networks based on cooperation agreements; In response to the signaling being an inter-network roaming service, a preset shared key between the home operator network and the visited operator network is obtained, and a security verification code is generated based on the shared key and the content of the signaling. According to the roaming mapping table, roaming relay information is added to the extended header field of the signaling to obtain complete signaling; wherein, the roaming relay information includes the home operator network, the relay operator network sequence and the security check code, the relay operator network sequence includes the home operator network or at least one relay operator network that the signaling needs to pass through, and the first relay operator network in the relay operator network sequence is the second operator network; The complete signaling is sent to the second operator's network.

2. The signaling processing method for inter-network roaming as described in claim 1, characterized in that, Based on the shared key and the content of the signaling, a security verification code is generated, including: Adjust the length of the shared key to a specified byte length to obtain the preprocessed key; The preprocessed key is XORed with the first fixed string to obtain the first padding key; wherein the first fixed string is a hexadecimal string with a length of the specified number of bytes; The preprocessed key is XORed with the second fixed string to obtain the second padding key; wherein the second fixed string is a hexadecimal string with a length of the specified number of bytes; The first padding key is concatenated with the content of the signaling to obtain a concatenated data stream; The concatenated data stream is encrypted and hashed using a hash algorithm to obtain a hash value. The second padding key is concatenated with the hash value to obtain a secondary concatenated data stream; The concatenated data stream is encrypted using a hash algorithm to generate a security verification code.

3. The signaling processing method for inter-network roaming as described in claim 1, characterized in that, Also includes: Generate a network element discovery request, the network element discovery request including the roaming transit information; Send the network element discovery request to the network storage function network element of the first operator's network; The network storage function network element sends the network element discovery request to the network storage function network element of the second operator network.

4. A signaling processing method for inter-network roaming, applied to a second operator's network, characterized in that, include: Receive complete signaling sent from the first operator's network; The complete signaling is parsed to obtain the security check code in the extended header field; The system identifies whether the security check code and the verification code are consistent; wherein the verification code is generated based on the shared key and signaling content. In response to the security check code matching the verification code, the complete signaling is processed.

5. The signaling processing method for inter-network roaming as described in claim 4, characterized in that, Processing the complete signaling includes: Confirm that the second operator network is in the relay operator network sequence, delete the second operator network from the relay operator network sequence, and obtain the relay operator network update sequence; Identify whether the relay operator network update sequence is empty; In response to the relay operator network update sequence being empty, it is determined whether the home operator network is the second operator network; if so, the second operator network responds to the complete signaling; if not, the second operator network is added to the end of the relay operator network update sequence to obtain update signaling, and the update signaling is sent to the home operator network. In response to the fact that the relay operator network update sequence is not empty, the second operator network is added to the end of the relay operator network update sequence, an update signaling is obtained, and the update signaling is sent to the first relay operator network in the relay operator network update sequence.

6. A signaling processing device for inter-network roaming, applied to a first operator's network, characterized in that, include: The first receiving module is used to receive signaling sent by the user terminal; wherein, the content of the signaling includes the home operator network of the user terminal and the visited operator network to be accessed; The identification module is used to identify whether the signaling is an inter-network roaming service according to a pre-configured roaming mapping table; wherein, the roaming mapping table is used to record the signaling roaming processing strategies of various operator networks based on cooperation agreements. The security verification code generation module is used to respond to the signaling as an inter-network roaming service, obtain a preset shared key between the home operator network and the visited operator network, and generate a security verification code based on the shared key and the content of the signaling. The transit information adding module is used to add roaming transit information to the extended header field of the signaling according to the roaming mapping table to obtain complete signaling; wherein, the roaming transit information includes the home operator network, the transit operator network sequence and the security check code, the transit operator network sequence includes the home operator network or at least one transit operator network that the signaling needs to pass through, and the first transit operator network in the transit operator network sequence is the second operator network; The sending module is used to send the complete signaling to the second operator network.

7. A signaling processing device for inter-network roaming, applied to a second operator's network, characterized in that, include: The second receiving module is used to receive complete signaling sent by the first operator's network; The parsing module parses the complete signaling to obtain the security check code in the extended header field; A verification module is used to identify whether the security verification code and the verification code are consistent; wherein, the verification code is generated based on the shared key and the content of the signaling. The processing module is used to process the complete signaling in response to the security check code matching the verification code.

8. A computer embedded device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 5.

Images