Communication system, control device, and communication method

Abstract

To grasp network attacks more broadly and reliably than ever before, and respond appropriately to the attacks.SOLUTION: A communication system provides a communication network to a communication device. The communication system includes a control device. The control device executes a process of receiving threat information related to a threat to the communication device that uses the communication network from an organization external to the communication system, and a defense process of defending the communication device on the basis of the received threat information.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present disclosure relates to a communication system, a control device, and a communication method. [Background technology]

[0002] Today, 5G(5 th Generation), 5G Evolution, and 6G (6 th As exemplified by the IEEE 802.11b Generation, communication systems are expected to become more advanced. However, even if communication systems become more advanced, the impact of external communication signals on the network cannot be ignored. In view of this, for example, a system has been proposed as a conventional technique for determining the feature amount of a normal call flow (normal signal group) including at least one normal communication signal and an abnormal call flow (abnormal signal group) including at least one abnormal communication signal. Here, an abnormal call flow is a known attack call flow including a signal related to an external attack. This system determines whether the call flow to be determined is an unknown call flow (unknown signal group), which is an unknown call flow, based on a learning model (learning data) that has previously learned normal call flows and abnormal call flows and the feature amount of the call flow to be determined extracted by a preprocessing unit. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-025220 A [Patent Document 2] JP 2020-174391 A [Non-patent literature]

[0004] [Non-Patent Document 1] 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System (5GS);Stage 2(Release 18)3GPP(registered trademark) TS 23.502 V18.2.0 (2023-06) [Non-Patent Document 2] 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects;5G System Enhancements for Edge Computing; Stage 2(Release 18) 3GPP(registered trademark) TS 23.548 V18.3.0 (2023-09) Summary of the Invention [Problem to be solved by the invention]

[0005] However, as communication systems become more advanced and the communication networks they provide become more complex, it is not easy for a communication system that manages the communication network alone to identify signals related to attacks on the communication network.

[0006] An object of the embodiments of the present disclosure is to grasp attacks on communication networks more broadly and reliably than ever before, and to respond appropriately to the attacks. [Means for solving the problem]

[0007] An embodiment of the disclosure is exemplified by a communication system that provides a communication network to a communication device. The communication system includes a control device that executes a process of receiving threat information related to a threat to the communication device that uses the communication network from an organization external to the communication system, and a defense process of defending the communication device based on the received threat information. Effect of the Invention

[0008] According to the present communication system, attacks on the communication network provided by the communication system can be identified more broadly and reliably than ever before, and the attacks can be dealt with appropriately. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating components that constitute a fifth generation mobile communication system. [Diagram 2] FIG. 2 is a diagram illustrating an example of the configuration of threat information. [Diagram 3] FIG. 3 is a diagram showing an example of the configuration of the NF, AF, and other information processing devices. [Figure 4] FIG. 4 is a diagram showing an example of the configuration of a terminal as a UE. [Diagram 5] FIG. 5 is a sequence diagram illustrating the reception of threat information and defense processing in the communication system of the first embodiment. [Figure 6] FIG. 6 is a sequence diagram illustrating the reception of threat information and defense processing in the communication system of the first embodiment. [Figure 7] FIG. 7 is a diagram illustrating a format conversion process. [Figure 8] FIG. 8 is a diagram illustrating a process for selecting a defense process to be executed when the security cooperation unit receives threat information in a different format. [Figure 9] FIG. 9 is a sequence diagram illustrating the reception of threat information and defense processing in the communication system according to the second embodiment. [Figure 10] FIG. 10 is a sequence diagram illustrating the reception of threat information and defense processing in the communication system according to the second embodiment. [Figure 11] FIG. 11 is a sequence diagram illustrating the reception of threat information and the honeypot guidance process in the communication system of the third embodiment. [Figure 12]FIG. 12 is a sequence diagram illustrating the reception of threat information and the honeypot guidance process in the communication system of the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, a communication system, a control device, and a communication method according to an embodiment of the present disclosure will be described with reference to the drawings. Each of the following embodiments is merely an example for explanation, and the present disclosure is not limited to the configuration of the embodiment. For example, an example in which the present disclosure is applied to a fifth generation mobile communication system will be described below, but the present disclosure may be applied to a fourth generation or fifth generation or later mobile communication system. The present disclosure may also be applied to a mobile communication system defined by a system other than 3GPP (registered trademark), or to any wireless communication system or wired communication system other than a mobile communication system.

[0011] This communication system provides a communication network to a communication device. This communication system includes a control device that executes a process of receiving threat information on threats to the communication device using the communication network from an organization outside the communication system, and a defense process of defending the communication device based on the received threat information. This communication system also has a function called NEF11e (Network Exposure Function) illustrated in FIG. 1, for example, and performs a process of providing threat information from the communication system to the outside. The NEF 11e exposes functions that can be used to detect and report threats. In addition, the NEF 11e receives information from an external application server or the like to this communication system. The threat information includes information on cyber attacks against the communication network and information on the vulnerability of the communication network. A cyber attack generally refers to an attack on an information processing device or a terminal or the like. In this embodiment, an explanation will be given mainly taking an attack on a communication device (UE2 in FIG. 1) connected to the communication network as an example.

[0012] An organization outside the present communication system, for example, is connected to the present communication system and uses a computer called an application server. The application server provides threat information to the control device, for example, via the above-mentioned NEF 11e, or directly without via the NEF 11e. The control device executes a defense process to defend the communication device based on the received threat information. Here, the threat information includes information for identifying an attacker 90 (see, for example, FIG. 5) against the network. Note that in the following embodiments, an "attacker" refers to an attacker that poses a threat. The threat information refers to a communication device, information processing device, etc. that is the source of the packets or attack traffic. The threat information may also include information that identifies a communication device targeted by the attacker 90, for example, a device called UE2 (User Equipment, see FIG. 1), or information that identifies a mobile unit equipped with a UE2.

[0013] The feature of this communication system is that it can execute a defense process on a communication device (UE2) that uses a communication network based on threat information received from an organization outside the communication system. In other words, this communication system can effectively utilize threat information from external organizations, in addition to information that this communication system has by itself, to defend communication devices that use the communication network provided by this communication system from attacks.

[0014] First embodiment (Configuration of communication system) Hereinafter, a first embodiment will be described with reference to the drawings. FIG. 1 shows components (components) constituting a fifth generation mobile communication system (also called a 5G network or 5GNW (Network)). 1 illustrates an example of a 5G mobile terminal (UE) 2. In FIG. 1, a UE 2 is a terminal of a user (subscriber). A RAN (Radio Access Network) 3 is an access network to a 5G core network (5GC). The RAN 3 is composed of a base station (gNB (next generation Node B)).

[0015] The 5G network has a 5G core network (5GC) and an access network ((R)AN), and a UE 2, a DN (Data Network) 5, and an AF (Application Function) 12 are connected to the 5G network. The 5GC also has NFs 11a to 11k, 11n, which are indicated in bold. Each of the NFs 11a to 11k, 11n is a function realized by one or more computers (information processing devices) executing a program. However, a single computer may realize two or more of the NFs 11a to 11k, 11n. In this embodiment, the components of the 5GC are collectively called NFs 11 (Network Functions). The components of the 5GC are individually called NEFs 11e, etc. In FIG. 1, each component is given an individual symbol in parentheses along with a generic symbol. The 5GC can be said to be an example of a communication system.

[0016] As mentioned above, 5GC is composed of a set of components with specific functions called NF11. Figure 1 shows the following NF11 that composes 5GC. In Figure 1, they are shown as thick rectangles. UPF(User Plane Function)11a AMF (Access and Mobility Management Function)11b SMF (Session Management Function)11c PCF(Policy Control Function)11d NEF(Network Exposure Function)11e NRF(Network Repository Function)11g NSSF(Network Slice Selection Function)11h AUSF(Authentication Server Function)11i UDM(Unified Data Management)11j NWDAF(Network Data Analytics Function)11k Security Collaboration Department 11n In this embodiment, user plane packets transmitted and received by UE2 are called user packets. UPF11a routes and forwards user packets, inspects packets, and processes QoS. AMF11b is a device for accommodating UE2 in the area in 5GC. AMF11b accommodates RAN3, and performs subscriber authentication control, location (mobility) management of UE2, etc.

[0017] SMF11c manages PDU (Protocol Data Unit) sessions and provides QoS (Quality of Service). The 5GC controls the UPF 11a to implement the PDU (Provision of Service) control and policy control. The PDU session is a virtual communication path for exchanging data between the UE 2 and the DN 5. The DN 5 is a data network (such as the Internet) outside the 5GC.

[0018] The PCF 11d cooperates with the SMF 11c to perform QoS control, policy control, billing control, etc. QoS control involves controlling the quality of communication, such as by prioritizing packet forwarding, while policy control involves controlling communication, such as QoS based on network or subscriber information, whether or not to forward packets, and billing.

[0019] NEF11e plays a role of mediating communication between AF12 or a node outside 5GC and NF11 of 3GPP (registered trademark). For example, NEF11e securely publishes the functions and events of each NF11 to a third party, AF12, edge computer, etc. NEF11e also converts between internal information of 5GC and external information. NEF11e converts, for example, information handled by AF12 and information handled by each NF11 of 5GC. For example, NEF11e converts between a service identifier in AF12 and 5GC internal information.

[0020] AF12 is an element that interacts with 5GC to provide services to users, and is called, for example, an external application server. AF12, which is considered to be trusted by the 5G network operator, can directly access NF11 related to 5GC. AF12, which is not permitted to directly access NF11 related to 5GC, uses an interface exposed externally via NEF11e to access the network functions of 5GC.

[0021] The information source AF12a is one of the AF12. The information source AF12a is, for example, an application server accessible from an organization outside the 5GC. The information source AF12a receives information on cyber attacks against UE2, which is a communication device that uses a communication network, from an organization outside the 5GC, which is a communication system. Organizations outside the 5GC include, for example, a CERT (Computer Emergency Response Team) outside the communication network operator that operates the 5GC, the US NIST (NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY), JPCERT / CC (Japan Computer Emergency Response Team / Coordination Center), the industry ISAC (Information Sharing and Analysis Center), individual terminal manufacturers, mobile Manufacturers, distributors, OEMs (Original Equipment Manufacturers), etc. of moving objects Illustrated.

[0022] The information source AF12a is provided, for example, in an organization outside the 5GC. Alternatively, the information source AF12a is connected to a computer of an organization outside the 5GC so as to be accessible from the organization outside the 5GC. The information source AF12a provides threat information (in a format such as STIX (Structured Threat Information eXpression)) from the organization outside the 5GC to the security cooperation unit 11n.

[0023] In this embodiment, the threat information provided from the information source AF12a to the NEF 11e or the security association unit 11n is provided, for example, in a request / response model. For example, the information source AF12a transmits a request message for providing the threat information to the NEF 11e or the security association unit 11n. Then, when the NEF 11e or the security association unit 11n receives the threat information, it returns a response message to the information source AF12a.

[0024] However, the threat information provided from the information source AF 12a to the NEF 11e or the security association unit 11n may be provided in a subscribe / notify model, for example. That is, the NEF 11e or the security association unit 11n transmits a subscribe message to the information source AF 12a. Then, the information source AF 12a notifies the NEF 11e or the security association unit 11n of the threat information update, etc. When the trigger condition is satisfied, a notification is sent to the NEF 11e or the security cooperation unit 11n, which then accesses the information source AF 12a to obtain threat information.

[0025] In this embodiment, in order to respond to threat information provided by the information source AF12a, the security association unit 11n is provided as one of the NFs 11. However, the security association unit 11n may be provided as one of the AFs 12. The information source AF12a is an example of a control device. For example, when the security association unit 11n receives threat information from a vehicle manufacturer (or a sales company), the security association unit 11n may execute a defense process against an attack on all UEs 2 mounted on vehicles connected to the communication network and manufactured by the manufacturer. In addition, the security association unit 11n may execute a defense process limited to UEs 2 mounted on specific models of vehicles connected to the communication network and manufactured by the manufacturer. Here, the defense process includes, for example, a process of filtering packets or traffic that are threats based on the threat information, a process of mitigating traffic that exceeds a predetermined mitigation value and discarding abnormal packets, and a process of analyzing an attack.

[0026] The security cooperation unit 11n can respond to threats in a unified and rapid manner in the communication network by collectively carrying out defense processing against attacks based on threat information. The security cooperation unit 11n applies blocking or mitigation measures to packets or traffic that pose a threat in the entire communication network, regardless of the manufacturer of the UE2, based on information provided by CERT / NIST. The security cooperation unit 11n also responds to, for example, a vulnerability with a CVSS score of 10, that is, information that indicates that the severity is "urgent." For example, the security cooperation unit 11n selects a UE2 or the like that is equipped with a computer program or the like that is found to be vulnerable, and applies defense processing collectively in the communication network in the UPF 11a to which the UE2 is connected.

[0027] The security coordinating unit 11n is an example of a control device. That is, the present communication system is a communication system that provides a communication network to a communication device, and includes the security coordinating unit 11n as a control device. The security coordinating unit 11n executes a process of receiving threat information on a threat to a communication device (UE2) that uses the communication network from an organization outside the communication system, and a defense process of defending the communication device based on the received threat information. Here, the threat information may include, for example, data called a signature that describes the characteristics of various attacks.

[0028] The NRF 11g stores and manages information on the NFs 11 (for example, the AMF 11b, the SMF 11c, the UPF 11a, etc.) in the 5GC. In response to an inquiry about an NF 11 desired to be used, the NRF 11g can return multiple NF 11 candidates to the inquiry source.

[0029] The NSSF11h has a function of selecting a network slice to be used by a subscriber from among the network slices generated by network slicing. A network slice is a virtual network with specifications according to the application.

[0030] The AUSF 11i is a subscriber authentication server that performs subscriber authentication under the control of the AMF 11b. The UDM 11j holds or manages subscriber-related information. The subscriber-related information can be said to be an example of contract data. The contract data is, for example, data between a user of a communication device (UE2) and a business operator (operator, MNO (Mobile Network Operator)) that manages a communication system. The UDM 11j provides subscriber-related information to each NF 11, and also acquires, registers, deletes, and changes the status of the UE 2.

[0031] The NWDAF11k has the function of collecting and analyzing data from each NF11, OAM (Operations, Administration, and Maintenance) terminal, etc. operates, manages and maintains the network (5GC). In other words, NWDAF11k is NF11, which provides analysis information on the network.

[0032] The DN5 is a network outside the communication system, for example, the Internet. The DN5 is connected to the communication network provided by this communication system (5GC) via one of the UPFs 11a. The UPF 11a can have a multi-stage configuration. The final stage UPF 11a connected to the DN5 is called a PSA UPF (PDU Session Anchor User Plane Function). The UPF 11a provided between the RAN3 and the PSA UPF is called an I (Intermediary) UPF.

[0033] In the example of FIG. 1, the DN5 includes a security device 51, a router 52, and an information source EAS (Edge Access Server). A security device 51 is connected to the application server 50. The information source EAS50 is a computer on which a wall is constructed. The information source EAS50 is a computer on the DN5 that notifies the security association unit 11n of the communication system of threat information. However, the security device 51 and the router 52 may be one of the AFs 12. When an application program of the information source EAS50 provides threat information to the NEF 11e or the security association unit 11n, the threat information is provided via one of the AFs 12. Therefore, in the following embodiments, the provision of threat information will be described as being provided by the information source AF12a.

[0034] Fig. 2 illustrates an example of the configuration of threat information. In this embodiment, the threat information has a header and a body. However, the threat information is not limited to the format shown in Fig. 2. The threat information may be described as a character string according to a grammar such as the STIX language. However, the threat information may be data in binary format.

[0035] The header may include at least one of information such as a protocol, a source IP address, a source port number, a destination IP address, a destination port number, a packet direction, etc. The security coordinating unit 11n identifies packets or traffic to be monitored that pose a threat based on the information illustrated in FIG.

[0036] The protocol is a protocol through which packets to be monitored based on threat information are exchanged. The source IP address is the source of the packet, that is, the IP address of the attacker 90. The source port number is the port number from which the packet was sent. The destination IP address and the destination port number are the IP address and port number that specify the destination of the packet. The packet direction is the direction in which the packet to be monitored is sent, and for example, the direction from the source to the destination or the direction from the destination to the source is specified. In addition, each piece of information written in the header can be omitted individually. When any of these pieces of information are omitted, the security cooperation unit 11n may interpret, for example, that "all" is specified for the omitted information. For example, when the destination IP address is omitted, all destinations become the targets of monitoring.

[0037] The body is set with additional information for identifying the attacker 90. The additional information for identifying the attacker 90 includes, for example, at least one of the following: designation of data in a packet, flow state, information for identifying an application of communication, packet header information, and header information of an application (HTTP, etc.). However, any or all of the additional information for identifying the attacker 90 may be omitted.

[0038] The data in the packet is specified, for example, when the data contained in the packet to be monitored is specified. The data included in the monitored packets may be, for example, character string information. The data included in the monitored packets may also be binary data (bit pattern). The binary data (bit pattern) may be specified in hexadecimal, for example.

[0039] The state of a flow is, for example, a TCP (Transmission Control Protocol) connection. The information for identifying the application of the communication is, for example, a protocol of the application layer such as HTTP (Hypertext Transfer Protocol). The header information of the packet is, for example, a fragment bit designation in the IP datagram header. The header information of the application is, for example, a request method in HTTP and a request URI (Uniform Resource Identifier) ​​designated in the method. Further, additional information for identifying the attacker 90 includes the transmission Information indicating the origin domain may also be included.

[0040] In addition, additional information for identifying the communication device that is the target of the attack may be set in the body. The additional information for identifying the communication device that is the target of the attack may be, for example, the model of the communication device (UE2), the type and version of the OS (Operating System), the type and version of the computer program installed in the UE2, information for identifying the mobile body that has the UE2 mounted thereon, etc. The information for identifying the mobile body that has the UE2 mounted thereon may be, for example, the manufacturer (OEM), model, year (year of initial registration), etc., in the case where the mobile body is a vehicle.

[0041] The security coordinating unit 11n may uniformly execute defense processing on all UE2 connected to the communication system. "Uniformly" means that the UE2 to be the target of the defense processing is not limited. However, as shown in FIG. 2, the threat information may have information that identifies a specific communication device (target UE2) that is the target of an attack by a threat. The identifying information may be a destination IP address, a destination port number, additional information that identifies the target UE2 that is the target of the attack, etc. Therefore, the security coordinating unit 11n may execute defense processing on the target UE2 specified in the threat information.

[0042] <Configuration of information processing device and terminal> Fig. 3 is a diagram showing a configuration example of an information processing device 20 capable of operating as each of the NFs 11a to 11k, 11n, AF 12, information source AF 12a, security device 51, router 52, information source EAS 50, etc. In Fig. 3, the information processing device 20 can be configured using a dedicated or general-purpose information processing device (computer) such as a personal computer (PC), a workstation (WS), or a server machine. However, the information processing device 20 may be a collection (cloud) of one or more computers.

[0043] The information processing device 20 includes a processor 21 serving as a processing unit or control unit (controller), a storage device 22, a communication interface 23 (communication IF 23), an input device 24, and a display 25, which are interconnected via a bus 26.

[0044] The storage device 22 includes a main storage device and an auxiliary storage device. The main storage device is used as at least one of a storage area for programs and data, a program development area, a program work area, and a buffer area for communication data. The main storage device is configured with a RAM (Random Access Memory) or a combination of a RAM and a ROM (Read Only Memory). The auxiliary storage device is used as a storage area for data and programs. A non-volatile storage medium is applied to the auxiliary storage device. Examples of the non-volatile storage medium include a hard disk, a Solid State Drive (SSD), a flash memory, and an EEPROM (Electrically Erasable Programmable Read-Only Memory). The storage device 22 may also include a drive device for a disk recording medium.

[0045] The communication IF 23 is a circuit that performs communication processing. For example, the communication IF 23 is a network interface card (NIC). The communication IF 23 also supports wireless communication (5G, wireless LAN (Wi-Fi (registered trademark)), BLE (Bluetooth (registered trademark) Low Energy), etc. The communication IF 23 may be a combination of a circuit that performs wired communication processing and a wireless communication circuit.

[0046] The input device 24 includes keys, buttons, a pointing device, a touch panel, etc., and is used to input information. The display 25 is, for example, a liquid crystal display, an OEL (Organic Electro-Luminescence) display, etc. The display 25 displays information and data.

[0047] The processor 21 performs various processes by executing various programs stored in the storage device 22. By the processor 21 executing the programs stored in the storage device 22, the information processing device 20 can operate as each of the NF 11 (UPF 11a, etc.), the AF 12, the information source AF 12a, the security device 51, the router 52, the information source EAS 50, etc.

[0048] 4 is a diagram showing a configuration example of a terminal 40 operable as a UE 2. The terminal 40 includes a processor 41, a storage device 42, a communication interface 43 (communication IF 43), an input device 44, and a display 45, which are connected to each other via a bus 46. The processor 41, the storage device 42, the communication IF 43, the input device 44, and the display 45 can be similar to the processor 21, the storage device 22, the communication IF 23, the input device 24, and the display 25. Therefore, description thereof will be omitted.

[0049] The processors 21 and 41 are, for example, Central Processing Units (CPUs). The U is also called a Microprocessor Unit (MPU). Processors 21 and 41 are a single processor. The processors 21 and 41 may have a single processor configuration or a multiprocessor configuration. Also, a single physical CPU connected via a single socket may have a multicore configuration. The processors 21 and 41 may include arithmetic devices of various circuit configurations, such as a Digital Signal Processor (DSP) or a Graphics Processing Unit (GPU). Also, the processors 21 and 41 may have a configuration in which they cooperate with at least one of an integrated circuit (IC), other digital circuits, and analog circuits. Integrated circuits include LSIs, application specific integrated circuits (ASICs), programmable logic devices (PLDs), and the like. PLDs The processors 21 and 4 include, for example, a field-programmable gate array (FPGA). 1 also includes, for example, what is called a microcontroller (MCU), SoC (System-on-a-chip), system LSI, or chip set.

[0050] (Example of processing) 5 and 6 are sequence diagrams illustrating an example of threat information reception and defense processing in this communication system. Moreover, FIG. 5 and FIG. 6 are connected by terminals indicated by A1 to H1. In this processing, first, the information source AF12a notifies the NEF11e of the threat information (S1). The notification of the threat information can also be called a notification of defense information. For example, as illustrated in FIG. 2, the threat information can include information for identifying the attacker 90 and information for identifying the target UE 2 that is the target of the attack. The NEF11e receives the threat information as an example of a reception processing.

[0051] Then, the NEF 11e further notifies the security coordinating unit 11n of the threat information (defense information) (S2). In a situation where the information source AF 12a is trusted by the MNO of the communication system, the information source AF 12a can notify the security coordinating unit 11n of the threat information (defense information) directly without going through the NEF 11e (S1A). The security coordinating unit 11n accepts the threat information as an example of a reception process.

[0052] Next, the security association unit 11n acquires information for identifying the target UE 2 that is the target of the attack in the threat information from the notified threat information. Then, the security association unit 11n transmits a message to the UDM 11j requesting a search for the target UE 2 or UPF information to which the target UE 2 is connected (S3). The message requesting the search includes information for identifying the target UE 2. The information for identifying the target UE 2 is exemplified in FIG. 2. Examples of the information include a destination IP address, a destination port number, the model of the target UE 2, the type and version of the OS, the type and version of the installed computer program, and information for identifying the mobile body equipped with the target UE 2 (vehicle type), etc.

[0053] Then, the UDM 11j responds to the security association unit 11n with information about the target UE 2, such as a unique identifier in 5GC or UPF information to which the target UE 2 is connected (S4). Here, the UPF information is an identifier that can uniquely identify any UPF in 5GC, such as an IP address or a URI.

[0054] However, in response to a search request (S3) for information on the target UE 2 from the security coordinating unit 11n, the UDM 11j may obtain whether or not the defense process can be executed or whether or not it is necessary to execute the defense process from the contract data in the subscriber-related information, and respond to the security coordinating unit 11n (S4). The security coordinating unit 11n may execute the defense process only for the UE 2 for which the execution of the defense process is set in the contract data. Also, the security coordinating unit 11n may execute the defense process only for the UE 2 of the user for which the execution of the defense process is specified in the contract data.

[0055] When the security coordinator 11n receives a response including information on the target UE 2 or information on the UPF to which the target UE 2 is connected, the security coordinator 11n implements a defense setting against the threat for the corresponding UPF 11a to which the target UE 2 is connected (S5). Here, the defense setting is, for example, a setting for blocking, filtering, or mitigating packets or traffic from the attacker 90 for the corresponding UPF 11a. The packets or traffic from the attacker 90 are identified by the header of the threat information exemplified in FIG. 2 and additional information identifying the attacker 90.

[0056] With this defense setting, the security coordinating unit 11n can block packets or traffic from the attacker 90 at least in the UPF 11a with which the target UE 2 has established a UDP session. The security coordinating unit 11n may set defense settings for all UPFs 11a including the UPF 11a other than the UPF 11a connected to the target UE 2. With the defense setting for all UPFs 11a, the security coordinating unit 11n can uniformly defend against attacks throughout the entire communication network managed by this communication system.

[0057] Similarly, the security association unit 11n, with the UPF 11a connected to the target UE 2 as the anchor, executes defense settings against threats for the external security device 51, router 52, etc. connected via the DN 5 (S6). As already mentioned in FIG. 1, the final stage UPF 11a connected to the DN 5 is called the PSA UPF. Also, the UPF 11a provided between the RAN 3 and the PSA UPF is called the I UPF. The above defense settings may be performed in either the PSA UPF or the I UPF.

[0058] However, the security device 51 and the router 52 may be one of the AFs 12. When the security device 51, the router 52, etc. are one of the AFs 12, the security coordinating unit 11n may request the security device 51, the router 52, etc. to notify the threat information and set the defense processing according to a request / response model for the threat information. Also, when the security device 51, the router 52, etc. are one of the AFs 12, the security coordinating unit 11n may request the security device 51, the router 52, etc. to notify the threat information and set the defense processing according to a request / response model for the threat information. According to the subscribe / notify model, the security cooperation unit 11n may provide the security device 51, the router 52, etc. with information for setting up a defense process together with the threat information. In the case of the subscribe / notify model, when the security cooperation unit 11n receives a notification of the threat information as a trigger condition, it notifies the security device 51, the router 52, etc. of the occurrence of the threat information. Then, when the security cooperation unit 51, the router 52, etc. are notified of the occurrence of the threat information, they may obtain the threat information and information for setting up a defense process from the security cooperation unit 11n and set up the defense process. By the above-mentioned defense setting, packets or traffic from the attacker 90 are blocked or the like at least in the security device 51, the router 52, etc. to which the target UE 2 is connected and a connection is established.

[0059] When the defensive setting is performed by the process of S5 or S6, the target UE 2 is blocked from communicating with the attacker 90 (S7-1). Furthermore, the target UE 2 is blocked from communicating with the attacker 90 by the security device 51, the router 52, etc. to which it is connected (S7-2). The security coordinator 11n may notify the target UE 2 of threat information via the AMF 11b, and cause the target UE 2 itself to execute defensive setting against the threat. Next, the explanation will be continued with reference to FIG. 6.

[0060] 5, the UPF 11a blocks attacks from the attacker 90 to the target UE 2 (S8). Also, the security device 51 and the router 52 block attacks from the attacker 90 to the target UE 2 (S9).

[0061] After that, when the threat of the attacker 90 disappears, the information source AF12a receives a setting from an organization external to the communication system that the threat has disappeared. Then, the information source AF12a notifies the NEF 11e of a message requesting the suspension of defense (S10). Furthermore, the NEF 11e notifies the security coordinating unit 11n of a message requesting the suspension of defense (S11). Note that in a situation where the information source AF12a is trusted by the MNO of the communication system, the information source AF12a can notify the security coordinating unit 11n of a message requesting the suspension of defense directly without going through the NEF 11e (S10A).

[0062] When the security coordinating unit 11n is notified of the request to stop defense, the security coordinating unit 11n transmits a message to the UPF 11a requesting deletion of the threat defense setting (S12).The security coordinating unit 11n also transmits a message to the security device 51, the router 52, etc. requesting deletion of the threat defense setting (S13).

[0063] Fig. 7 is a diagram illustrating a format conversion process executed by the security coordinating unit 11n or the like after the process of S2 or S1A in Fig. 5. Threat information provided from the information source AF12a is, for example, illustrated in Fig. 2. However, there may be cases where the format of the threat information that can be processed by the NF11 of the present communication system is different from the format of the threat information provided by the information source AF12a. In such a case, for example, the security coordinating unit 11n converts the threat information provided from the information source AF12a into a format of threat information that can be processed by the NF11 of the present communication system.

[0064] This process is started when, for example, the security coordinating unit 11n receives threat information in a format different from the format supported by the FN 11 of the communication system (S101). The security coordinating unit 11n receives threat information in a format different from the format supported by the FN 11 of the communication system (referred to as a different format) from, for example, an API (Application Programming Interface) dedicated to the different format (S101). Therefore, when the security coordinating unit 11n receives threat information in a format supported by the FN 11 of this communication system, the process of FIG. 7 is not executed.

[0065] Then, the security coordinating unit 11n converts the format of the threat information received from the API dedicated to different formats into a format supported by the FN 11 of the communication system (S102). For example, the security coordinating unit 11n converts the different format components such as the header and body illustrated in FIG. 2 into a threat information format that can be processed by the NF 11 of the communication system.

[0066] Then, the security coordinating unit 11n transmits the format-converted threat information to the next NF 11 in this communication system (S103). For example, in the process of S2 or S1A in Fig. 5, the next NF 11 is, for example, UDM 11j. Furthermore, in the process of S6 in Fig. 5, the security coordinating unit 11n may select a defense method that can be set for the external security device 51, the router 52, etc., based on the format-converted threat information. Note that Fig. 7 illustrates a process in which the security coordinating unit 11n performs format conversion. However, such format conversion may be performed in another FN 11, for example, NEF 11e, UDM 11j, etc.

[0067] 8 is a diagram illustrating a process of selecting a defense process executed when the security cooperation unit 11n receives threat information in a different format. That is, when the security cooperation unit 11n receives threat information in a different format (S111), instead of converting the format, the security cooperation unit 11n may select a defense process corresponding to the threat information in the different format (S112). The security cooperation unit 11n may request the selected defense process from the next FN 11. The next FN 11 is, for example, the UDM 11j, the UPF 11a, or the like in the process of S2 or S1A in FIG. 5. However, the security cooperation unit 11n may select a defense process to be set for the security device 51 or the router 52 in S112 in the process of S6 in FIG. 5. Then, the security cooperation unit 11n may set the selected defense process for the security device 51, the router 52, or the like (S113). That is, the security coordinating unit 11n may select a defense process that can be requested to be set by the UDM 11j, the UPF 11a, the security device 51, or the router 52, based on threat information in different formats.

[0068] (Effects of the first embodiment) As described above, the security coordinating unit 11n, as an example of a control device, executes a process of receiving threat information on UE2, which is a communication device that uses the communication network, from an organization outside the communication system. The security coordinating unit 11n also executes a defense process of defending UE2 based on the received threat information. Therefore, this communication system can quickly defend against attacks on UE2 that uses the communication network by a unified process within the communication network.

[0069] In this case, the security coordinator 11n may uniformly execute defense processing for the UE 2 connected to the communication system in each of the connected UPFs 11a. Therefore, all of the UE 2 connected to the communication system can be defended without exception. The security coordinator 11n may also uniformly execute defense processing for all of the UPFs 11a in the communication system. In this case, the entire communication system can respond to threat information.

[0070] However, the information source AF12a can include information for identifying a specific communication device (target UE2) that is the target of the attack in the threat information. In this case, the security coordinator 11n can execute a defense process against the specific communication device. Therefore, the security coordinator 11n can execute the defense process while minimizing the impact on the processing of the communication system that provides the communication network.

[0071] If the target communication device is a mobile device, for example, a device mounted on a vehicle, The information source AF12a can include information such as the manufacturer, model, and year of the vehicle in which the specific communication device is installed in the threat information. The information source AF12a can then request a search from the UDM11j based on information such as the model, and identify the target UE2 that is the target of the attack.

[0072] In addition, the security coordinating unit 11n receives threat information using the NEF 11e provided in the 5GC. Therefore, the security coordinating unit 11n can receive threat information and set and cancel defense settings against threats through processing consistent with the 5GC standard.

[0073] Furthermore, the security coordinating unit 11n receives threat information directly, not via the NEF 11e. Therefore, if the information source AF 12a is a reliable application server, the security coordinating unit 11n can quickly receive threat information and set or cancel defense settings against threats.

[0074] Furthermore, the security coordinating unit 11n executes defense processing for the security device 51, the router 52, etc. connected to the communication network via the DN5. Furthermore, the security coordinating unit 11n executes defense processing for the security device 51, the router 52, etc. connected to this communication system (5GC, etc.) as one of the AFs 12. That is, the security coordinating unit 11n can execute defense settings against threats in the security device 51, the router 52, etc. on the communication network provided by this communication system, based on threat information provided from an organization outside this communication system via the information source AF12a.

[0075] Furthermore, the NFs 11, such as the security coordinating unit 11n, the NEF 11e, and the UDM 11j, convert threat information in a different format not supported by the present communication system into a format supported by the FN 11 of the present communication system. Furthermore, the security coordinating unit 11n identifies and selects a defense process that can be performed by the FN 11 in response to threat information in a different format not supported by the FN 11 of the present communication system. Then, the FN 11 of the present communication system, such as the security coordinating unit 11n, can perform the identified defense process in the present communication system. Furthermore, the security coordinating unit 11n identifies a defense process that can be requested in the security device 51 or the router 52 in response to threat information in a different format not supported by the present communication system. Then, the security coordinating unit 11n can set the identified defense process in the security device 51 or the router 52.

[0076] The above-mentioned UDM 11j also holds subscriber-related information. The subscriber-related information can be said to be an example of contract data. That is, the present communication system has a storage device (e.g., a Unified Data Repository (UDR)) that stores contract data based on a contract between a user of the UE 2 and a carrier (MNO) that manages the present communication system. The security coordination unit 11 The security coordinator 11n identifies or determines, among multiple UE2, a target to which the protection process is to be applied based on the contract data held or managed by the UDM 11j. Therefore, the present communication system can execute the protection process by effectively utilizing the contract data. For example, as subscriber information, it is sufficient that the security coordinator 11n can store in the UDR whether or not the protection process is executable or whether or not it is necessary to execute the protection process. Therefore, the present communication system can identify or limit the UE2 to which the protection process is to be applied based on the contract between the user and the MNO.

[0077] That is, in response to a search request from the security coordinating unit 11n for information on the target UE 2, the UDM 11j acquires from the UDR whether or not the defense process can be executed or whether or not it is actually necessary, and responds to the security coordinating unit 11n. Therefore, the security coordinating unit 11n only needs to execute the defense process for UE 2 for which the contract data sets it as possible or necessary to execute the defense process.

[0078] As described above, the information source AF12a is an AF connected to the 5GC as a communication system. 12. Therefore, the information source AF12a can obtain threat information from an organization outside the communication system while cooperating with the FN11 of the 5GC. As illustrated in FIG. 1, the information source AF12a may be provided in the EAS connected to the DN5. The information source AF12a may also be provided in the UE2.

[0079] Second embodiment (Example of processing) A communication system, a control device, and a communication method according to the second embodiment will be described with reference to FIG. 9. In the first embodiment, the security coordinating unit 11n executes a defense setting against a threat in the UPF 11a based on threat information received via the NEF 11e or directly from the information source AF 12a, and blocks communication to the attacker 90, for example. However, instead of such a process, the security coordinating unit 11n may request the PCF 11d to set a policy for the defense setting. The PCF 11d may set a policy requested for setting, and further perform a defense setting in the UPF 11a via the SMF 11c or directly without the SMF 11c according to the set policy.

[0080] In this embodiment, the processes other than the following (1) and (2) are the same as those in the first embodiment. (1) A process in which the security coordinator 11n sets a policy for defense settings against threats in the PCF 11d. (2) A process in which the PCF 11d sets defense settings in the UPF 11a via the SMF 11c, or directly without the SMF 11c. Therefore, a description of the same processes as in the first embodiment will be omitted. Also, the processes in the first embodiment other than the processes by the PCF 11d and the SMF 11c are executed as they are in this embodiment.

[0081] Figures 9 and 10 are sequence diagrams illustrating defense processing in this communication system. Note that the processing of S1, S2, and S1A in Figure 5 is assumed to be executed before Figure 9. The processing of Figure 9 is continued to Figure 10 by terminals B1, K1, L1, C1, D1, and E1. In Figure 9, the processing of S3 and S6 is the same as in Figure 5, so the description thereof will be omitted.

[0082] FIG. 9 shows the process of the security coordinating unit 11n after receiving a response such as information on the target UE 2 or information on the UPF to which the target UE 2 is connected (S4). In this embodiment, the security coordinating unit 11n requests the PCF 11d to set a policy for implementing a defense setting against a threat for the corresponding UPF 11a to which the target UE 2 is connected (S51). Then, the PCF 11d sets a policy for implementing a defense setting against a threat. Then, the PCF 11d requests the SMF 11c to implement a defense setting for the corresponding UPF 11a to which the target UE 2 is connected according to the set policy (S52). Then, the SMF 11c implements a defense setting for the corresponding UPF 11a to which the target UE 2 is connected (S53). Note that the PCF 11d may implement a defense setting for the corresponding UPF 11a directly without going through the SMF 11c according to the set policy (S54). Thereafter, in FIG. 9, the process of S6 is executed as in FIG. 5. Furthermore, communication is cut off in the same manner as in S7-1 and S7-2.

[0083] Next, the description will be continued with reference to FIG. 10. Here, like FIG. 6, the processes from S8 to S11 and S10A are executed, but the description thereof will be omitted. Also, in FIG. 10, these processes are omitted. In FIG. 10, when the security coordinating unit 11n is notified of defense suspension (S11, S10A in FIG. 6), it requests the PCF 11d to cancel the policy for implementing defense settings against threats (S121). Then, the PCF 11d cancels the policy for implementing defense settings. Then, the PCF 11d requests the SMF 11c to stop defense against threats (S122). Then, the SMF 11c stops defense (S123). Note that the PCF 11d cancels the policy for implementing defense settings. Alternatively, the policy may be released and the protection may be stopped directly for the UPF 11a without going through the SMF 11c (S124). After that, in FIG. 10, the process of S13 is executed as in FIG.

[0084] In this embodiment, a format conversion process similar to the process described in Fig. 7 of the first embodiment may be executed. That is, the FN 11 of the communication system such as the security cooperation unit 11n may convert threat information in a different format into a format of threat information that can be processed by the NF 11 of the communication system. Similarly to the process described in Fig. 8, when the security cooperation unit 11n receives threat information in a different format, the security cooperation unit 11n may specify and select a defense process corresponding to the received threat information.

[0085] (Effects of the second embodiment) As described above, the security coordinator 11n requests the PCF 11d to set a policy for defense processing, and executes the defense processing in the UPF 11a via the PCF 11d. The PCF 11d also sets defense settings for the UPF 11a via the SMF 11c, or directly without the SMF 11c. Therefore, the security coordinator 11n can execute defense processing corresponding to threat information in a unified manner in the communication network.

[0086] Similarly to the process of FIG. 7 in the first embodiment, the security coordinating unit 11n executes a process when the format of the threat information is different from the format for performing the defense process in the FN 11 of the communication system. That is, the security coordinating unit 11n converts the format of the threat information into a format for performing the defense process in the FN 11. Similarly to the process of FIG. 8 in the first embodiment, the security coordinating unit 11n specifies and selects a defense process to be performed in the UPF 11a, the security device 51, the router 52, etc. in response to the threat information when the format of the threat information is different from the format for performing the defense process. Furthermore, the security coordinating unit 11n executes the specified defense process in the UPF 11a, the security device 51, the router 52, etc. Therefore, the present communication system can execute a defense process based on threat information in various formats from outside the present communication system.

[0087] <Third embodiment> (Example of processing) A communication system according to a third embodiment will be described with reference to Fig. 11 and Fig. 12. In the first embodiment, a communication system in which a defense process is set based on threat information is exemplified. In the second embodiment, in addition to the process of the first embodiment, a process in which the security cooperation unit 11n requests the PCF 11d to set a policy for threat defense setting is exemplified. Also, a process in which the PCF 11d sets threat defense setting in the UPF 11a via the SMF 11c or directly without the SMF 11c according to the requested policy is exemplified.

[0088] In this embodiment, a process is exemplified in which traffic from an attacker 90 is guided to a honeypot constructed in a multi-access edge computing (MEC) based on threat information. A honeypot is a computer constructed on the MEC platform 55 to which traffic from an attacker 90 is directed. In the honeypot, an application that responds to the traffic from the attacker 90 is executed. A system that provides MEC by applying virtual technology to multiple computers, network equipment, etc. is called an MEC platform 55.

[0089] Moreover, the processing of this embodiment can be implemented independently of the processing of embodiment 1 and the processing of embodiment 2. Therefore, the present communication system can freely select and implement the processing of embodiment 1, the processing of embodiment 2, or the processing of embodiment 3.

[0090] 11 and 12 are sequence diagrams illustrating the reception of threat information and the honeypot induction process in this communication system. In this process, first, the information source AF 12a notifies the NEF 11e of a request to start honeypot induction together with threat information (S21).

[0091] Then, the NEF 11e further notifies the security coordinating unit 11n of the threat information and a request to start honeypot guidance (S22). Note that in a situation where the information source AF 12a is trusted by the MNO of the communication system, the information source AF 12a can notify the security coordinating unit 11n of the threat information and the request to start honeypot guidance directly without going through the NEF 11e (S21A).

[0092] Next, the security coordinating unit 11n acquires information for identifying the target UE 2 that is the target of attack in the threat information from the notified threat information and the request to start honeypot guidance. Then, the security coordinating unit 11n transmits a message to the UDM 11j requesting to search for the target UE 2 or UPF information to which the target UE 2 is connected (S23).

[0093] Then, the UDM 11j responds to the security association unit 11n with information about the target UE 2, such as a unique identifier in 5GC or UPF information to which the target UE 2 is connected (S24). Here, the UPF information is an identifier that can uniquely identify any UPF in 5GC, such as an IP address or a URI.

[0094] However, in response to a search request (S3) for information on the target UE 2 from the security coordinating unit 11n, the UDM 11j may obtain information on whether or not the honeypot induction process can be executed or whether or not it is necessary from the UDR or the like, and respond to the security coordinating unit 11n (S24). The security coordinating unit 11n may execute the honeypot induction process only for UE 2 for which the contract data sets it as possible to execute the honeypot induction process or as necessary to execute the honeypot induction process.

[0095] When the security association unit 11n receives a response including information on the target UE 2 or information on the UPF to which the target UE 2 is connected, the security association unit 11n starts one or more honeypots in the MEC that can be accessed with the UPF 11a to which the target UE 2 is connected as an anchor (S25). However, the honeypot is not limited to one that uses the UPF 11a to which the target UE 2 is connected as an anchor. In short, the security coordinating unit 11n may guide packets or traffic from the attacker 90 to the honeypot via multiple UPFs 11a. The honeypot to be started is started, for example, by execution of an application of a type corresponding to the threat information. The honeypot to be started is started, for example, by setting parameters corresponding to the threat information in the application. The type or setting corresponding to the threat information means, for example, a protocol of communication from the attacker 90, a source domain, a destination IP address, a destination port number, a type of the source application, or additional information that identifies the attacker. The MEC base 55 then returns a response indicating that the launch of the honeypot has been completed to the security coordinating unit 11n (S26).

[0096] Here, the MEC base 55 is an example of an information processing environment connected to the outside of the communication system in the DN5 connected to the anchor PSA UPF. Therefore, starting the honeypot is an example of creating a simulated receiving system that imitates the environment in a communication device or a mobile body equipped with a communication device. The environment in the mobile body means, for example, that the honeypot executes an OS, an application, etc. installed in the UE2 in the mobile body.

[0097] Then, the security coordinator 11n sets the UPF 11a to which the target UE 2 is connected so as to guide the traffic to a honeypot in the MEC base station 55 (S27). Note that the guidance may be via multiple UPFs 11a. The security coordinating unit 11n and the associated NF 11 may execute a procedure similar to the process described in the embodiment 2. That is, the security coordinating unit 11n may guide the relevant traffic to a honeypot of the MEC base station 55 by setting a policy in the PCF 11d and sending a guidance request from the PCF 11d to the SMF 11c for the relevant UPF 11a.

[0098] At this time, the PCF 11d may direct the traffic to the honeypot of the MEC board 55 by setting traffic direction directly to the UPF 11a, without going through the SMF 11c.

[0099] The specific steps for directing attacker traffic to a honeypot are exemplified below. For example, in section 6.3 Edge Relocation of 3GPP (registered trademark) TS 23.548 V18.3.0 (2023-09), Procedure for relocating EAS (Edge Application Server) on DN5 that UE2 accesses The procedure for relocating the PSA UPF to which the EAS is connected is described in Section 6.3 above. Also, the PSA UPF is responsible for the traffic related to the application using the EAS. It is described that the IP address and port number of the EAS are replaced for the PSA in the EAS. Also, the request from the AF12 to the communication system (5GC) to simultaneously connect to both the source PSA and the target PSA at the time of EAS transfer, and the processing thereof are described. Here, the source PSA refers to the PSA to which the UE2 was connected before the EAS transfer, and the target PSA refers to the PSA to which the UE2 was connected after the EAS transfer. These standards are related to the processing of replacing the EAS and PSA UPF to which the UE2 is accessed. In this embodiment, the procedures of these standards are applied by modifying them into the procedures of the security linking unit 11n that guides attack packets or traffic to a honeypot.

[0100] In addition, the specific procedure for directing attacker traffic to a honeypot involves applying the NAT (Network Address Translation) procedure at a gateway on a conventional network. The procedure is illustrated as follows:

[0101] (1) In the UPF 11a, the security association unit 11n associates a pair of a target destination address and a target destination port number with a pair of a source destination address and a source destination port number directly or via the PCF 11d and the SMF 11c. Then, the security association unit 11n sets the association between the source and the target in an address translation table for guidance. Here, the source destination address and the source destination port number refer to the destination address and the destination port number before the address conversion, and are the destination of the packet or traffic by the attacker 90. Also, the target destination address and the target destination port number refer to the destination address and the destination port number after the address conversion, and are the destination address and the destination port number to the honeypot.

[0102] (2) The security coordinating unit 11n instructs the UPF 11a to perform address translation processing using the address translation table for guidance described in (1) above for packets or traffic from a source having the characteristics illustrated in Fig. 2. The security coordinating unit 11n instructs the UPF 11a to perform address translation processing directly or via the PCF 11d and SMF 11c.

[0103] After (3), the UPF 11a guides the attacker's packets to the honeypot. The session between the UE 2 and the attacker 90 is terminated, for example, by a timeout. As already mentioned, the UPF 11a may have a multi-stage configuration between the RAN 3 and the DN 5. The settings of (1) and (2) above can be made for either the PSA UPF or the I UPF.

[0104] Next, the explanation will be continued with reference to FIG. 12. Here, the security cooperation unit 11n detects the above attack. Directing packets or traffic of the attacker 90 to the honeypot of the MEC platform 55 is an example of directing attacks from inside and outside the communication network provided by the communication system to the simulated receiving system. Assumed attacks from within the communication network are attacks from other UEs in the MNO to which the UE2 is connected or from a 5GC function hijacked by the attacker 90. Assumed attacks are attacks from outside, such as DoS (Denial of Service Attack) / DDoS (Distributed Denial of Service Attack) or attacks exploiting various vulnerabilities. Here, DoS refers to a cyber attack that maliciously sends a large amount of data to an information processing device such as a server by taking advantage of the congestion of processing of a server due to concentrated access. Also, DDoS refers to an act of disrupting normal processing of a server by sending a large amount of packets from multiple computers to the information processing device such as a server.

[0105] As in S27, the security coordinator 11n may set the external router 52 etc. connected to the PSA UPF to which the target UE 2 is connected via the DN5 to guide the traffic to a honeypot in the MEC base station 55 (S28). The external router 52 etc. may be connected to the communication system as one of the AFs 12. With this traffic guidance setting, at least in the router 52 etc. to which the target UE 2 is connected and a connection is established, the traffic from the attacker 90 does not reach the target UE 2, but is received by the honeypot (S29).

[0106] After that, when the threat of the attacker 90 disappears, the information source AF12a receives a setting from an organization outside the communication system that the threat has disappeared. Then, the information source AF12a notifies the NEF11e to stop guiding to the honeypot (S30). Furthermore, the NEF11e requests the security coordinating unit 11n to stop defense (S31). Note that in a situation where the information source AF12a is trusted by the MNO of the communication system, the information source AF12a can directly notify the security coordinating unit 11n to stop guiding to the honeypot without going through the NEF11e (S30A).

[0107] Then, when the security coordinating unit 11n is notified of the defense stop, it instructs the UPF 11a to stop guiding to the honeypot. Here, the stopping of the settings includes, for example, clearing or deleting the address translation table for the above-mentioned guidance. The security coordinating unit 11n also transmits a message to the MEC infrastructure 55 requesting the stopping of the honeypot and the deletion of various settings (S32). When the MEC infrastructure 55 has completed the stopping of the honeypot and the deletion of various settings, it responds by notifying the security coordinating unit 11n of the fact (S33).

[0108] (Effects of the Third Embodiment) As described above, by the above traffic guidance, at least the traffic from the attacker 90 to the target UE 2 does not reach the target UE 2, but is received by the honeypot. Therefore, the communication system and NF 11 of this embodiment can effectively defend against attacks from outside the communication system. In addition, the communication system and NF 11 of this embodiment can buy time before taking further action against attacks from outside the communication system.

[0109] <Effects of the First to Third Embodiments> Manufacturers, OEMs, vendors, etc. who manufacture and sell UE2 or mobile devices equipped with UE2 can defend against cyber attacks with communication networks and reduce damage from attacks. For example, it becomes possible to buy time until a patch to fix an OS or application is prepared. Meanwhile, MNOs that manage communication networks and provide them to users can protect users. In addition, MNOs can obtain a means of billing the above manufacturers, OEMs, vendors, Over The Top (OTT), OS, terminal vendors, etc. that provide media content to users.

[0110] <Other embodiments> The above embodiment is merely an example, and the present disclosure may be modified as appropriate without departing from the spirit and scope of the present disclosure. Furthermore, the processes and means described in the present disclosure may be freely combined and implemented as long as no technical contradiction occurs.

[0111] Furthermore, a process described as being performed by one device may be shared and executed by multiple devices. Alternatively, a process described as being performed by different devices may be executed by one device. In a computer system, the hardware configuration (server configuration) by which each function is realized can be flexibly changed.

[0112] The present disclosure can also be realized by supplying a computer program implementing the functions described in the above embodiments to a computer, and having one or more processors of the computer read and execute the program. Such a computer program may be provided to the computer by a non-transitory computer-readable storage medium connectable to the system bus of the computer, or may be provided to the computer via a network. The non-transitory computer-readable storage medium includes any type of medium suitable for storing electronic instructions, such as, for example, a magnetic disk (e.g., a floppy disk, a hard disk drive (HDD), etc.), an optical disk (e.g., a CD-ROM, a DVD disk, a Blu-ray disk, etc.), a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic card, a flash memory, or an optical card. [Explanation of symbols]

[0113] 2. UE 3. RAN 5DN 11 FN 12AF 12A Source AF 20 Information processing device 40 Terminals 50 Source EAS 51 Security Device 52 Router

Claims

1. A communication system for providing a communication network to a communication device, comprising: a receiving process for receiving threat information relating to a threat to the communication device using the communication network from an organization external to the communication system; A communication system including a control device that executes a defense process for defending the communication device based on the received threat information.

2. The communication system according to claim 1 , wherein the control device uniformly executes the protection process on all of the communication devices currently connected to the communication system.

3. the threat information includes information for identifying a specific communication device that is a target of an attack by the threat, The communication system according to claim 1 , wherein the control device executes the defense process against the specific communication device.

4. the specific communication device is a device mounted on a vehicle, The communication system according to claim 3 , wherein the identifying information includes information identifying the vehicle.

5. The communication network includes a 5G core network; The control device is a Network Exposure Function (NEF) provided in the 5G core network. The communication system of claim 1 , further comprising: a network effect filter (NEF) for receiving said threat information regarding said threat.

6. The communication network includes a 5G core network; The control device is a Network Exposure Function (NEF) provided in the 5G core network. The communication system according to claim 1 , wherein the threat information on the threat is received directly without going through a NEF.

7. The control device is a Policy Control Function ( A request to execute the protection process in the User Plane Function (UPF) through the PCF The communication system according to claim 5.

8. The control device, when the format of the threat information is different from a format for executing the defense processing, converts the format of the threat information into a format for executing the defense processing, or specifies the defense processing to be executed in the UPF in response to the threat information; The communication system according to claim 7 , further comprising: executing, in the UPF, the defense process corresponding to the threat information in the converted format or the identified defense process.

9. The communication system according to claim 1 , wherein the control device executes the defense process on a router connected to the communication network or a security device connected to the communication network.

10. the control device, when the format of the threat information is different from a format for executing the defense processing, converts the format of the threat information into a format for executing the defense processing, or specifies the defense processing to be executed in the router or the security device in response to the threat information; The communication system according to claim 9 , further comprising: executing the defense process corresponding to the threat information in the converted format or the identified defense process in the router or the security device.

11. a storage device for storing contract data based on a contract between a user of the communication device and a business operator managing the communication system; The communication system according to claim 1 , wherein the control device determines, from among the plurality of communication devices, the communication device to which the protection process is to be applied based on the contract data.

12. The communication system described in claim 1, wherein the control device creates a simulated receiving system that mimics the environment of the communication device or the environment inside a mobile vehicle equipped with the communication device in an information processing environment connected outside the communication system, and guides attacks from inside and outside the communication network provided by the communication system to the simulated receiving system.

13. The communication network includes a 5G core network; The communication system according to claim 1 , wherein the control device is provided in the 5G core network.

14. The communication network includes a 5G core network; The communication system according to claim 1 , wherein the control device is provided as an Application Function (AF) connected to the 5G core network.

15. A control device of a communication system that provides a communication network to a communication device, a receiving process for receiving threat information relating to a threat to the communication device using the communication network from an organization external to the communication system; and a control device that executes a defense process for defending the communication device based on the received threat information.

16. A communication method in a communication system that provides a communication network to a communication device, comprising: a receiving process for receiving threat information relating to a threat to the communication device using the communication network from an organization external to the communication system; A communication method for executing a defense process to defend the communication device based on the received threat information.

17. the threat information includes information for identifying a specific communication device that is a target of an attack by the threat, The communication method according to claim 16 , further comprising the step of executing the protection process against the specific communication device.

18. the specific communication device is a device mounted on a vehicle, The communication method according to claim 17 , wherein the identifying information includes information identifying the vehicle.

19. The communication network includes a 5G core network; The method according to claim 16, wherein the reception process receives the threat information regarding the threat by using a Network Exposure Function (NEF) provided in the 5G core network. The communication methods listed.

20. The communication method according to claim 16, further comprising creating a simulated receiving system that mimics the environment of the communication device or the environment inside a mobile vehicle equipped with the communication device in an information processing environment connected outside the communication system, and directing attacks from inside and outside the communication network provided by the communication system to the simulated receiving system.

Images