A cross-domain network traffic attribution statistics and cross-validation method and system

Abstract

The application discloses a cross-domain network traffic attribution statistics and cross-verification method and system, and belongs to the technical field of traffic attribution analysis. In view of the problem that the traditional SPI correlation is invalid in the NAT environment and the user identification is not unified, leading to the problem that the traffic cannot be accurately counted, the application proposes the following: a wireless access point AP configured with a signaling analysis module extracts the nonce payload in the IKEv2 SA_INIT message as a NAT session identifier, and generates an anonymous session fingerprint based on the MSK key material of the EAP-AKA SHA-256 hash; the wireless access point AP reports the nonce and the fingerprint to the visiting gateway for correlation matching and generates a candidate bill; an independent verification engine takes the anonymous session fingerprint as the primary key, cross-comparisons and verifies the candidate bill with the standard bill in the home domain, and triggers the dispute processing based on the cryptographic evidence when the two are inconsistent. The application realizes high-reliability cross-NAT correlation and cryptographic-level accurate matching without the cooperation of the home domain, and guarantees the credibility of traffic statistics and the fairness of settlement.

Description

Technical Field

[0001] This invention relates to the field of call attribution analysis technology, specifically to a method and system for cross-domain network call attribution statistics and cross-validation. Background Technology

[0002] In cross-domain roaming scenarios, users connect to their home core network via the visited wireless access network, enjoying seamless voice services and significantly reducing roaming costs. Since such access is typically considered an untrusted domain, a network-layer secure encrypted tunnel must be established between the terminal and the core gateway to ensure secure end-to-end transmission of signaling and media streams. Accurate statistics and effective management of call traffic data are crucial for reducing system costs and improving service quality; however, existing network architectures face significant challenges in handling secure cross-domain access and call traffic statistics.

[0003] Currently, in cross-domain network scenarios, due to the widespread deployment of address translation devices and the overlapping use of encrypted tunnels, visited network operators have long faced two major technical challenges. Firstly, network layer security protocols are designed based on the assumption that both communicating parties have fixed public IP addresses. However, address translation technology modifies the source and destination addresses and ports of data packets, causing the original security association to fail or integrity verification to fail. Traditional methods relying on security parameter indexes as session identifiers are remapped or masked when traversing address translation devices, making it impossible for the visited gateway to accurately associate and track sessions, resulting in a very high association failure rate. Secondly, at the cross-domain settlement level, the call detail records (CDRs) maintained by the home network and the visited network use completely different user identification systems. Furthermore, for security and privacy considerations, the home network often refuses to provide the visited network with identifier mapping relationships. This prevents the visited network from independently and accurately calculating the actual call volume generated locally, making it difficult to achieve reliable call settlement between cross-domain networks, severely restricting the operational efficiency and commercialization of cross-domain voice services. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for cross-domain network traffic attribution statistics and cross-validation to solve the problems mentioned in the background art.

[0005] To address the aforementioned technical problems, this invention provides a cross-domain network traffic attribution statistics and cross-validation method. This method achieves highly reliable session association between the AP and the gateway without relying on location cooperation or decrypting IPSec traffic, maintaining a high association success rate even through NAT devices. Specifically, it includes:

[0006] The wireless access point (AP) parses the IKEv2 SA_INIT message that establishes an IPSec tunnel between the user equipment (UE) and the evolved packet data gateway (ePDG).

[0007] During IPSec tunnel establishment, traditional solutions rely on the SPI as the session identifier. However, when the tunnel traverses a NAT device, the intermediate device may remap the SPI in the ESP header, causing the SPI obtained by the AP packet capture to be inconsistent with the SPI in the tunnel table on the gateway side, resulting in a direct association failure rate of over 30%.

[0008] There has long been a technical bias in the industry that it is impossible to obtain stable and reliable session identifiers from an untrusted AP that lacks decryption capabilities.

[0009] However, the SA_INIT message in the IKEv2 protocol contains a nonce payload transmitted in plaintext. This field is used to resist replay attacks and has the following characteristics:

[0010] Unaffected by NAT: NAT devices do not modify the internal payload of IKEv2 messages.

[0011] Session uniqueness: Each different session generates a different nonce, resulting in a low probability of collision.

[0012] The nonce remains constant throughout the entire lifecycle: from tunnel establishment to release, the nonce value remains the same.

[0013] Choose to extract the plaintext transmission nonce payload, IKE SPI, timestamp, user equipment outer IP and port, and obtain the geographical location of the wireless access point (AP).

[0014] The wireless access point (AP) records the association between the nonce and the local wireless terminal to ensure that subsequent reports can be mapped to the correct physical port.

[0015] The wireless access point (AP) extracts the AUTH parameter from the subsequent IKEv2 SA_AUTH message and obtains the anonymous session fingerprint based on the MSK key material generated during the EAP-AKA authentication process.

[0016] In VoWiFi international roaming, the home standard call detail record (CDR) uses the IMSI as the user identifier, while the visited access point (AP) can only see the MAC address or temporary pseudonym, and the two cannot be directly matched.

[0017] Existing solutions require the home location to proactively provide a mapping table, which presents commercial and privacy obstacles. There is also a bias in this field that holds the view that accurate matching cannot be achieved without the cooperation of the home location.

[0018] Wireless access points (APs) can obtain anonymous session fingerprints through methods including assisted calculation, active calculation, and home location filling.

[0019] In the auxiliary calculation, the wireless access point (AP) reports some of the parsed authentication parameters to the visited gateway (V-GW). The visited gateway (V-GW) obtains the complete fingerprint through a pre-established security auxiliary interface with the home network, and then sends it to the wireless access point (AP) or uses it directly for call detail records (CDRs).

[0020] In the active computing mode, the wireless access point (AP) runs the EAP-AKA client logic to extract authentication parameters from the IKEv2 AUTH payload.

[0021] Based on the key derivation parameters pre-negotiated with the home location, the master session key MSK is calculated using a pseudo-random function, and the first 16 bytes of the master session key MSK are extracted as the MSK feature data segment.

[0022] Anonymous session fingerprints are generated by performing SHA-256 hash operations on the MSK feature data segment. .

[0023] The calculation formula is: .

[0024] This invention utilizes the MSK key material that is inevitably generated during the EAP-AKA authentication process to construct a one-way irreversible anonymous session fingerprint. The first 16 bytes of the MSK are then hashed using SHA-256 to obtain a 32-byte hash value.

[0025] This fingerprint has the following characteristics: uniqueness, irreversibility, and independent computation.

[0026] In the location-filling method, the location-based billing system calculates and fills in the anonymous session fingerprint when generating the standard location-based call detail record (CDR). The wireless access point (AP) does not need to perform calculations and sends the information to the AP via signaling, which then extracts and reports the information.

[0027] It is generally recommended to use a combination of active calculation and home location filling: the wireless access point (AP) should first try to calculate on its own, and if that fails, rely on the fingerprint in the home location call detail record.

[0028] By using cryptographically anonymous session fingerprints, we can achieve accurate matching between candidate call detail records (CDRs) of the visited location and standard CDRs of the home location, without compromising user privacy.

[0029] The wireless access point (AP) reports information including nonce payload, IKE SPI, anonymous session fingerprint, geolocation, timestamp, and user equipment outer IP and port to the visited gateway (V-GW).

[0030] When a wireless access point (AP) detects the following events, it sends a message to the visited gateway (V-GW) via a lightweight UDP protocol:

[0031] Tunnel establishment: Immediately after the IKEv2 SA_INIT message, a BIND message containing the nonce payload, IKE SPI, anonymous session fingerprint, geolocation, timestamp, user equipment outer IP and port is sent.

[0032] Tunnel Release: If an IKEv2 DELETE message is detected or an ESP idle timeout occurs, a RELEASE message carrying the local session ID is sent.

[0033] Heartbeat Keep-alive: Sends a KEEPALIVE heartbeat message containing the local session ID every N minutes.

[0034] The protocol supports retransmission mechanisms and batch reporting to reduce overhead.

[0035] The visited V-GW, acting as a front-end or bypass device for the evolved packet data gateway (ePDG), listens for IKEv2 signaling and maintains a local active IPSec tunnel table. Each record contains:

[0036] nonce payload, SPI, user equipment outer IP and port, setup time fingerprint.

[0037] When the visited gateway (V-GW) receives the BIND message reported by the wireless access point (AP), it executes the following priority matching logic:

[0038] Nonce matching: Query the local active IPSec tunnel table using the nonce payload, user device outer IP address, and port as keys. Because nonces are unique and unaffected by NAT, this step has a success rate >99.7%.

[0039] SPI + Time Window Matching: Use IKE SPI combined with time window query matching only when nonce is missing or matching fails.

[0040] Fingerprint-assisted matching: If the above methods fail, use the fingerprint field for querying.

[0041] After a successful match, the visited V-GW will generate a candidate call detail record (CDR) for the visited location, assign a local session ID to the session, and record the association relationship.

[0042] If a match fails, the BIND message is discarded and an exception log is recorded for subsequent manual verification.

[0043] The candidate call detail records (CDRs) for the visited location include the following fields:

[0044] Local session ID, nonce payload, anonymous session fingerprint, AP geolocation, session start time, session end time, uplink and downlink traffic statistics, and call detail record status.

[0045] Candidate call detail records (CDRs) are stored in the local database of the visited gateway (V-GW) and are periodically exported in batches or pushed to the independent verification engine (I-VE) via API.

[0046] The local billing system H-BS pushes standard call detail records (CDRs) to the independent verification engine I-VE via FTP / SFTP.

[0047] Add an extended field to the standard call detail record (CDR). The value is calculated and filled by the Evolved Packet Data Gateway (ePDG) using the same algorithm SHA-256 (MSK[0..15]).

[0048] The independent verification engine obtains candidate call detail records (CDRs) pushed by the visited gateway (V-GW) and standard CDRs containing anonymous session fingerprints pushed by the home billing system.

[0049] Anonymous session fingerprints of candidate call logs for visited locations Anonymous session fingerprints with home standard call detail records The comparison is performed, and if they are equal, it is considered a match and marked as "verified".

[0050] If enabled when one party's fingerprint is missing or incorrectly formatted, a multidimensional feature score is calculated. If the multidimensional feature score is greater than a preset threshold, it is determined to be a match and marked as "fuzzy verification"; the formula is as follows:

[0051] ;

[0052] In the formula, , and These are preset weighting coefficients; For candidate call detail record time sets With standard call detail record (CDR) time set of coefficient.

[0053] Identify candidate call detail records (CDRs) devices Standard call detail record (CDR) equipment identification The similarity is set to 1 if there are comparable and identical identifiers, otherwise it is set to 0.

[0054] For time difference and traffic difference Comprehensive business characteristic deviation score; when satisfied Seconds and When, substitute into the formula: Calculate the business characteristic deviation score; if it does not meet the requirements... ;in, This is the standard call detail record (CDR) data volume.

[0055] If the independent verification engine finds that the visited candidate call detail record (CDR) has no corresponding home standard CDR, or the home standard CDR has no corresponding visited candidate CDR, then the dispute resolution process will be executed:

[0056] The independent verification engine sends dispute reports to both the home and visited operators, listing the details of any unmatched call detail records (CDRs).

[0057] The originating location is required to provide the original EAP-AKA authentication log or MSK hash proof corresponding to the anonymous session fingerprint within 24 hours. Because the fingerprint is bound to the MSK, the originating location cannot forge or deny it.

[0058] If the home operator is unable to provide valid evidence within the time limit, the candidate call detail record (CDR) of the visited location will be deemed correct by default, and the settlement will be adjusted based on that CDR.

[0059] Finally, the settlement amount for the current period is adjusted based on the judgment results.

[0060] Each dispute resolution result is archived and used to calculate the reputation score of each operator.

[0061] This invention also provides a cross-domain network traffic attribution statistics and cross-validation system, comprising:

[0062] The wireless access point (AP) is used to parse IKEv2 SA_INIT messages to extract the nonce payload and geographic location, and to obtain anonymous session fingerprints based on the MSK key material of EAP-AKA. It will report information including nonce payload and anonymous session fingerprint.

[0063] The visited gateway V-GW is located in the visited core network and has a tunnel association module and a call detail record (CDR) generation module. It can interact with ePDG / N3IWF.

[0064] It is used to maintain the local active IPSec tunnel table, receive information reported by wireless access points (APs), perform association matching with nonce payload, user equipment outer IP and port as keys, and generate visitor candidate call detail records containing anonymous session fingerprints after a successful match.

[0065] The Home-Based Billing System (H-BS), an existing home-based core network call detail record (CDR) generation system, is used to generate home-based standard call detail records (CDRs) containing anonymous session fingerprints.

[0066] The independent verification engine I-VE, deployed on a cloud platform or independent server, is used to obtain candidate call detail records (CDRs) for visited locations and standard CDRs for home locations, and performs cross-verification using anonymous session fingerprints as the primary key.

[0067] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0068] Construct a complete and trustworthy chain of session evidence: Simultaneously extract session random numbers and anonymous fingerprints at the access point and actively report them to the visited gateway when the tunnel is established and released. Combine this with a two-factor association mechanism to generate candidate call detail records containing location and time information, ensuring the integrity and traceability of session evidence.

[0069] Achieving closed-loop cross-verification and dispute resolution: The independent verification engine uses hash fingerprints as the primary key for accurate matching of dual-source call detail records (CDRs). For cases where fingerprints are missing, multi-dimensional features are used to assist in matching. When inconsistencies in CDRs are detected, a dispute resolution process based on cryptographic evidence is automatically triggered, providing unforgeable audit evidence for cross-domain settlement.

[0070] Overcoming technical biases to achieve highly reliable association: Utilizing the random number transmitted in plaintext in the initial interaction message as a stable session fingerprint across address translation devices, this overcomes the long-standing technical bias in the industry that access points cannot obtain reliable session identifiers, improves the session association success rate in complex network environments, and solves the problem of association failure caused by address translation remapping of traditional identifiers.

[0071] Achieving anonymous and strongly bound identity matching: Using key materials derived from the authentication process to generate irreversible hash fingerprints as unique anonymous identifiers for cross-domain call detail records, this approach protects user privacy while achieving cryptographically binding sessions that cannot be denied by the home location, freeing users from dependence on home location identifier mapping relationships and breaking the business deadlock in cross-domain settlement.

[0072] Low-cost deployment without deep core network modification: Innovative functions are centrally deployed on the access point side and independent verification engine. The home location only needs to add optional fields to the standard call detail records to achieve compatibility, which has minimal impact on the existing network architecture and greatly reduces the deployment and modification costs of cross-domain settlement solutions.

[0073] High scalability supporting cross-domain settlement in multiple scenarios: This solution is not only applicable to specific voice communication scenarios, but can also be smoothly extended to various ubiquitous access scenarios that require cross-domain trusted settlement, such as non-public networks, satellite backhaul, and enterprise private networks, demonstrating strong applicability and expansion potential. Attached Figure Description

[0074] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0075] Figure 1 This is an architecture diagram of a cross-domain network traffic attribution statistics and cross-validation system according to the present invention. Detailed Implementation

[0076] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0077] This invention provides a method for cross-domain network traffic attribution statistics and cross-validation. It achieves highly reliable session association between the access point (AP) and the gateway without relying on location coordination or decrypting IPSec traffic, maintaining a high association success rate even through NAT devices. Specifically, it includes:

[0078] The wireless access point (AP) parses the IKEv2 SA_INIT message that establishes an IPSec tunnel between the user equipment (UE) and the evolved packet data gateway (ePDG).

[0079] During IPSec tunnel establishment, traditional solutions rely on the Security Parameter Index (SPI) as the session identifier. However, when the tunnel traverses a NAT device, the intermediate device may remap the SPI in the ESP header, causing the SPI obtained by the AP packet capture to be inconsistent with the SPI in the tunnel table on the gateway side, resulting in a direct association failure rate of over 30%.

[0080] There has long been a technical bias in the industry that it is impossible to obtain stable and reliable session identifiers from an untrusted AP that lacks decryption capabilities.

[0081] However, the SA_INIT message in the IKEv2 protocol contains a plaintext nonce payload (random number, 16-64 bytes in length). This field is used to resist replay attacks and has the following characteristics:

[0082] Unaffected by NAT: NAT devices do not modify the internal payload of IKEv2 messages.

[0083] Session uniqueness: Each different session generates a different nonce, resulting in a low probability of collision.

[0084] The nonce remains constant throughout the entire lifecycle: from tunnel establishment to release, the nonce value remains the same.

[0085] Choose to extract the plaintext transmission nonce payload, IKE SPI, timestamp, user equipment outer IP and port, and obtain the wireless access point's own geographical location (pre-configured or GPS).

[0086] The wireless access point (AP) records the association between the nonce and the local wireless terminal (via MAC address or association ID) to ensure that subsequent reports can be mapped to the correct physical port.

[0087] The wireless access point (AP) extracts the AUTH parameter from the subsequent IKEv2 SA_AUTH message and obtains the anonymous session fingerprint based on the MSK key material generated during the EAP-AKA authentication process.

[0088] In VoWiFi international roaming, the home standard call detail record (CDR) uses the IMSI as the user identifier, while the visited access point (AP) can only see the MAC address or temporary pseudonym, and the two cannot be directly matched.

[0089] Existing solutions require the home location to proactively provide a mapping table, which presents commercial and privacy obstacles. There is also a bias in this field that holds the view that accurate matching cannot be achieved without the cooperation of the home location.

[0090] Wireless access points (APs) can obtain anonymous session fingerprints through methods including assisted calculation, active calculation, and home location filling.

[0091] In the auxiliary calculation, the wireless access point (AP) reports some of the authentication parameters (such as the AUTH payload field) to the visited gateway (V-GW). The visited gateway (V-GW) obtains the complete fingerprint through a pre-established security auxiliary interface with the home network (which only transmits the fingerprint calculation results and does not expose the IMSI), and then sends it to the wireless access point (AP) or uses it directly for call detail records (CDRs).

[0092] In the active computing mode, the wireless access point (AP) runs the EAP-AKA client logic to extract authentication parameters from the IKEv2 AUTH payload.

[0093] Based on the key derivation parameters pre-negotiated with the home location, the master session key MSK is calculated using a pseudo-random function, and the first 16 bytes of the master session key MSK are extracted as the MSK feature data segment.

[0094] Anonymous session fingerprints are generated by performing SHA-256 hash operations on the MSK feature data segment. .

[0095] The calculation formula is: .

[0096] This invention utilizes the MSK (Master Session Key, 64 bytes) key material that is inevitably generated during the EAP-AKA authentication process to construct a one-way irreversible anonymous session fingerprint. The first 16 bytes of the MSK are then hashed using SHA-256 to obtain a 32-byte hash value.

[0097] The fingerprint has the following characteristics: uniqueness (MSK is different for different sessions), irreversibility (IMSI cannot be deduced), and independent computation capability (MSK is known in the home ePDG, and the AP can obtain it through auxiliary means).

[0098] In the location-filling method, the location-based billing system calculates and fills in the anonymous session fingerprint when generating the standard location-based call detail record (CDR). The wireless access point (AP) does not need to perform calculations and sends the information to the AP via signaling, which then extracts and reports the information.

[0099] It is generally recommended to use a combination of active calculation and home location filling: the wireless access point (AP) should first try to calculate on its own, and if that fails, rely on the fingerprint in the home location call detail record.

[0100] By using cryptographically anonymous session fingerprints, we can achieve accurate matching between candidate call detail records (CDRs) of the visited location and standard CDRs of the home location, without compromising user privacy.

[0101] The wireless access point (AP) reports information including nonce payload, IKE SPI, anonymous session fingerprint, geolocation, timestamp, and user equipment outer IP and port to the visited gateway (V-GW).

[0102] When a wireless access point (AP) detects the following events, it sends a message to the visited gateway (V-GW) via a lightweight UDP protocol:

[0103] Tunnel establishment: Immediately after the IKEv2 SA_INIT message, a BIND message containing the nonce payload, IKE SPI, anonymous session fingerprint (if any), geolocation, timestamp, user equipment outer IP and port is sent.

[0104] Tunnel Release: If an IKEv2 DELETE message is detected or an ESP idle timeout occurs, a RELEASE message carrying the local session ID is sent.

[0105] Heartbeat Keep-alive: Sends a KEEPALIVE heartbeat message containing the local session ID every N minutes.

[0106] The protocol supports retransmission mechanisms (exponential backoff) and batch reporting (merging multiple BIND packets into a single UDP packet) to reduce overhead.

[0107] The visited V-GW, acting as a front-end or bypass device for the evolved packet data gateway (ePDG), listens for IKEv2 signaling and maintains a local active IPSec tunnel table. Each record contains:

[0108] The nonce payload (extracted from SA_INIT), SPI (IKE_SA SPI), user equipment outer IP (possibly via NAT) and port, and establishment time fingerprint (can be obtained from the home auxiliary interface or filled in after the AP reports).

[0109] When the visited gateway (V-GW) receives the BIND message reported by the wireless access point (AP), it executes the following priority matching logic:

[0110] Nonce matching: Query the local active IPSec tunnel table using the nonce payload, user device outer IP address, and port as keys. Because nonces are unique and unaffected by NAT, this step has a success rate >99.7%.

[0111] SPI + Time Window Matching (Rollback): Only when nonce is missing (a very few old implementations) or matching fails, use IKE SPI combined with a time window (±2 seconds) to query for a match.

[0112] Fingerprint-assisted matching (backup): If the above fails, use the fingerprint field to query (applicable to situations where the wireless access point AP reports a fingerprint but the nonce is inconsistent due to some anomalies).

[0113] After a successful match, the visited V-GW will generate a candidate call detail record (CDR) for the visited location, assign a Local Session ID (LSID) to the session, and record the association relationship.

[0114] If a match fails, the BIND message is discarded and an exception log is recorded for subsequent manual verification.

[0115] The candidate call detail records (CDRs) for the visited location include the following fields:

[0116] Local session ID (LSID), nonce payload (fill in as much as possible for traceability), anonymous session fingerprint (must be filled in; if the AP does not report, obtain it from the tunnel table or query the home location through the auxiliary interface), AP geographical location (latitude and longitude or BSSID), session start time (timestamp in the BIND message), session end time (fill in after receiving the RELEASE message or after timeout), uplink and downlink traffic statistics (approximately obtainable from tunnel statistics), and call detail record status (in progress / closed).

[0117] Candidate call detail records (CDRs) are stored in the local database of the visited gateway (V-GW) and are periodically exported in batches or pushed to the independent verification engine (I-VE) via API.

[0118] The local billing system H-BS pushes standard call detail records (CDRs) to the independent verification engine I-VE via FTP / SFTP.

[0119] Add an extended field to the standard call detail record (CDR). (32-byte hexadecimal string), calculated and filled by the Evolved Packet Data Gateway (ePDG) using the same SHA-256 algorithm (MSK[0..15]).

[0120] The independent verification engine obtains candidate call detail records (CDRs) pushed by the visited gateway (V-GW) and standard CDRs containing anonymous session fingerprints pushed by the home billing system.

[0121] Anonymous session fingerprints of candidate call logs for visited locations Anonymous session fingerprints with home standard call detail records The comparison is performed, and if they are equal, it is considered a match and marked as "verified".

[0122] If enabled when one party's fingerprint is missing or incorrectly formatted, a multidimensional feature score is calculated. If the multidimensional feature score is greater than a preset threshold (e.g., 0.85), it is determined to be a match and marked as "fuzzy verification"; the formula is as follows:

[0123] ;

[0124] In the formula, , and These are preset weighting coefficients; For candidate call detail record time sets With standard call detail record (CDR) time set of coefficient.

[0125] Identify candidate call detail records (CDRs) devices Standard call detail record (CDR) equipment identification The similarity is set to 1 if there are comparable and identical identifiers, otherwise it is set to 0.

[0126] For time difference and traffic difference Comprehensive business characteristic deviation score; when satisfied Seconds and When, substitute into the formula: Calculate the business characteristic deviation score; if it does not meet the requirements... ;in, This is the standard call detail record (CDR) data volume.

[0127] If the independent verification engine finds that the visited candidate call detail record (CDR) has no corresponding home standard CDR, or the home standard CDR has no corresponding visited candidate CDR, then the dispute resolution process will be executed:

[0128] The independent verification engine sends dispute reports to both the home and visited operators, listing the details of the unmatched call detail records (including fingerprints, time, location, and tunnel identifiers).

[0129] The originating location is required to provide the original EAP-AKA authentication log or MSK hash proof corresponding to the anonymous session fingerprint within 24 hours. Because the fingerprint is bound to the MSK, the originating location cannot forge or deny it.

[0130] If the home operator is unable to provide valid evidence within the time limit, the candidate call detail record (CDR) of the visited location will be deemed correct by default, and the settlement will be adjusted based on that CDR (the payment will be made to the visited location).

[0131] Finally, the settlement amount for the current period is adjusted based on the judgment results.

[0132] Each dispute resolution result is archived and used to calculate the credit score of each operator (high-credit operators can reduce the frequency of future spot checks, while low-credit operators will have increased audit intensity).

[0133] Please see Figure 1 The present invention also provides a cross-domain network traffic attribution statistics and cross-validation system, comprising:

[0134] The wireless access point (AP) is used to parse IKEv2 SA_INIT messages to extract the nonce payload and geographic location, and to obtain anonymous session fingerprints based on the MSK key material of EAP-AKA. It will report information including nonce payload and anonymous session fingerprint.

[0135] The visited gateway V-GW is located in the visited core network and has a tunnel association module and a call detail record (CDR) generation module. It can interact with ePDG / N3IWF.

[0136] It is used to maintain the local active IPSec tunnel table, receive information reported by wireless access points (APs), perform association matching with nonce payload, user equipment outer IP and port as keys, and generate visitor candidate call detail records containing anonymous session fingerprints after a successful match.

[0137] The Home-Based Billing System (H-BS), an existing home-based core network call detail record (CDR) generation system, is used to generate home-based standard call detail records (CDRs) containing anonymous session fingerprints.

[0138] The independent verification engine I-VE, deployed on a cloud platform or independent server, is used to obtain candidate call detail records (CDRs) for visited locations and standard CDRs for home locations, and performs cross-verification using anonymous session fingerprints as the primary key.

[0139] Example 1:

[0140] A user of XX Telecom roamed in the United States and initiated a VoWiFi call using the hotel's Wi-Fi.

[0141] Hotel AP is retrieving IKEv2 messages:

[0142] The SPI=0x12345678, timestamp T1, UE pseudonym "user@chinatelecom", and AP coordinates (40.7128°N, 74.0060°W) are reported to the US visited gateway V-GW via BIND message.

[0143] The visited V-GW associates with the local tunnel table, matches tunnels with the same SPI, and generates candidate call detail records (CDRs).

[0144] Meanwhile, XX Telecom's local billing system H-BS generates a standard CDR.

[0145] An independent verification engine, I-VE (e.g., deployed in the AWS US East Region), pulls call detail records from both parties daily. If a match is found between the time (T1±2 seconds) and the pseudonym mapping (IMSI46001xxxxxxxx obtained from the table), it is confirmed that the call belongs to the US visited location.

[0146] During settlement, the US operator charged XX Telecom the local access fee based on the candidate call detail records, thus avoiding any loss.

[0147] Example 2:

[0148] If the local operator maliciously deletes a call detail record (CDR), the standard CDR will be missing.

[0149] The independent verification engine I-VE detects that the candidate call detail record (CDR) cannot be matched and automatically triggers the dispute process:

[0150] Notifications were sent to both parties, and the US operator submitted raw signaling packet captures from the AP side (including SPI and the complete IKEv2 header), to which XX Telecom was unable to provide a valid rebuttal.

[0151] The default rule takes effect, and the settlement system will automatically increase the revenue corresponding to the candidate call detail record (CDR) and deduct 0.5 from XX Telecom's credit score.

[0152] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0153] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for cross-domain network traffic attribution statistics and cross-validation, characterized in that: The method includes: Step 1: The wireless access point (AP) parses the IKEv2SA_INIT message that establishes an IPSec tunnel between the user equipment and the evolved packet data gateway, extracts the plaintext nonce payload, IKE SPI, timestamp, user equipment outer IP and port, and obtains the geographical location of the wireless access point itself. Step 2: The wireless access point (AP) extracts the AUTH parameter from the IKEv2 SA_AUTH message and obtains the anonymous session fingerprint based on the MSK key material generated during the EAP-AKA authentication process. Step 3: The wireless access point (AP) reports information including the nonce payload, the IKE SPI, the anonymous session fingerprint, the geographic location, the timestamp, and the user equipment's outer IP and port to the visited gateway. Step 4: The visited gateway listens to IKEv2 signaling to maintain a local active IPSec tunnel table. After receiving the information reported by the wireless access point (AP), it queries the local active IPSec tunnel table using the nonce payload, the user equipment outer IP, and the port as keys for association matching. If the match is successful, a candidate call detail record (CDR) for the visited location containing the anonymous session fingerprint and the geographical location is generated. Step 5: The independent verification engine obtains the candidate call detail records (CDRs) pushed by the visited gateway and the standard call detail records (CDRs) of the home location that contain the anonymous session fingerprint pushed by the home location billing system. The anonymous session fingerprint of the candidate CDR is compared with the anonymous session fingerprint of the standard CDR. If they are equal, it is determined to be a match and the call attribution statistics are completed.

2. The method for cross-domain network traffic attribution statistics and cross-validation according to claim 1, characterized in that: In step 2, the methods by which the wireless access point (AP) obtains the anonymous session fingerprint include at least the active calculation method and the home location filling method. In the active computing method, the wireless access point (AP) runs the EAP-AKA client logic to extract the authentication parameters from the IKEv2 AUTH payload; Based on the key derivation parameters pre-negotiated with the home location, the master session key MSK is calculated using a pseudo-random function, and the first 16 bytes of the master session key MSK are extracted as the MSK feature data segment. The anonymous session fingerprint is generated by performing a SHA-256 hash operation on the MSK feature data segment. ; The calculation formula is: ; In the aforementioned location filling method, the location billing system calculates and fills in the anonymous session fingerprint when generating the location standard call detail record (CDR). The signal is sent to the wireless access point (AP) via signaling, and the AP retrieves and reports the signal.

3. The method for cross-domain network traffic attribution statistics and cross-validation according to claim 1, characterized in that: In step 3, the wireless access point (AP) sends a message to the visited gateway via the UDP protocol. When an IKEv2 SA_INIT message is detected, a BIND message containing the nonce payload, the IKE SPI, the anonymous session fingerprint, the geolocation, the timestamp, the user equipment outer IP and port is sent. When an IKEv2 DELETE message or ESP idle timeout is detected, a RELEASE message carrying the local session ID is sent; and a KEEPALIVE heartbeat message containing only the local session ID is sent at preset time intervals.

4. The method for cross-domain network traffic attribution statistics and cross-validation according to claim 1, characterized in that: The association matching in step 4 uses priority logic: Prioritize using the nonce payload, user equipment outer IP, and port for query matching; If the nonce payload is missing or a match fails, the process will fall back to using IKE SPI in conjunction with a time window for query matching. If all of the above fail, the anonymous session fingerprint will be used for backup query matching; After a successful match, the visited gateway assigns a local session ID to the session and records the association.

5. The method for cross-domain network traffic attribution statistics and cross-validation according to claim 1, characterized in that: In step 4, the candidate call detail records (CDRs) for the visited location include the following fields: local session ID, nonce payload, anonymous session fingerprint, AP geographic location, session start time, session end time, uplink and downlink traffic statistics, and CDR status.

6. The method for cross-domain network traffic attribution statistics and cross-validation according to claim 1, characterized in that: In step 5, when the independent verification engine performs the comparison, if the anonymous session fingerprint is missing in the candidate call detail records of the visited location or the standard call detail records of the home location, then auxiliary matching is enabled: Calculate multidimensional feature scores If the multidimensional feature score is greater than a preset threshold, it is determined to be a match and marked as fuzzy verification; the formula is as follows: ； In the formula, , and These are preset weighting coefficients; For candidate call detail record time sets With standard call detail record (CDR) time set of coefficient; Identify candidate call detail records (CDRs) Standard call detail record (CDR) equipment identification Similarity; For time difference and traffic difference Comprehensive business characteristic deviation score; when satisfied Seconds and When, substitute into the formula: Calculate the business characteristic deviation score; if it does not meet the requirements... ;in, This is the standard call detail record (CDR) data volume.

7. The method for cross-domain network traffic attribution statistics and cross-validation according to claim 1, characterized in that: In step 5, if the independent verification engine finds that the visited candidate call detail record (CDR) has no corresponding home standard CDR, or the home standard CDR has no corresponding visited candidate CDR, then the dispute resolution process is executed: The independent verification engine sends dispute reports to both the home and visited operators. The home operator is required to provide a hash proof of the original EAP-AKA authentication log or MSK corresponding to the anonymous session fingerprint; If the home operator does not provide the data, the settlement will be adjusted based on the candidate call detail records of the visited location.

8. A cross-domain network traffic attribution statistics and cross-validation system, characterized in that: The system, applied to the cross-domain network traffic attribution statistics and cross-validation method as described in any one of claims 1-7, comprises: The wireless access point (AP) is used to parse IKEv2 SA_INIT messages to extract the nonce payload and geographic location, and to obtain anonymous session fingerprints based on the MSK key material of EAP-AKA. The information containing the nonce payload and the anonymous session fingerprint will be reported. The visited gateway is used to maintain a local active IPSec tunnel table, receive information reported by the wireless access point (AP), perform association matching using the nonce payload, user equipment outer IP and port as keys, and generate a visited candidate call detail record containing the anonymous session fingerprint after a successful match. A location-based billing system is used to generate location-based standard call detail records (CDRs) containing the anonymous session fingerprint. An independent verification engine is used to obtain the candidate call detail records (CDRs) of the visited location and the standard CDRs of the home location, and to perform cross-comparison verification using the anonymous session fingerprint as the primary key.

Images