Information processing system, information processing method, and program

Abstract

To timely acquire a large amount of data required for grasping a communication situation even if the configuration of a core network becomes complicated. [Solution] The system includes an acquisition unit that acquires C-Plane packets and U-Plane packets from a core network, an extraction unit that (i) extracts a source address, a destination address, and a TEID (Tunnel Endpoint Identifier) ​​from the U-Plane packets acquired by the acquisition unit, and (b) extracts a source address, a destination address, and a TEID of a U-Plane packet corresponding to the C-Plane packet from information stored in the payload of the C-Plane packet acquired by the acquisition unit, and a linking unit that links the C-Plane packets and the U-Plane packets based on the source address, destination address, and TEID extracted by the extraction unit.

Description

[Technical field]

[0001] The present invention relates to an information processing system, an information processing method, and a program, and more particularly to an information processing system, an information processing method, and a program that can timely acquire large amounts of data necessary to understand communication conditions even if the core network configuration becomes complex. [Background technology]

[0002] The quality of communication is evaluated by analyzing packets flowing through the network and calculating KPIs, etc. In marketing activities using RTB, packets flowing through the network are also analyzed.

[0003] For example, in LTE, C-Plane packets and U-Plane packets are extracted from reference point S11 relating to the connection between MME and S-GW, and reference point S1-U relating to the connection between eNodeB (a base station) and S-GW, respectively. By linking the extracted C-Plane packets and U-Plane packets, data relating to the communication of the same user can be identified, and information necessary for analyzing the communication status can be obtained.

[0004] In addition, a technology has been proposed in which a packet analysis unit that analyzes received packets refers to flow information to classify the received packets into flows and assigns packets a flow ID, which is an identifier for the flow corresponding to the packets, thereby improving traffic control units and traffic control methods (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2022-090476 Summary of the Invention [Problem to be solved by the invention]

[0006] In the initial release of LTE, the location where packets were taken out from the C-Plane and the U-Plane were taken out were concentrated within a single data center.

[0007] On the other hand, in the CUPS (C·U-Plane Separate) architecture defined in the later release of LTE and 5G (hereinafter, sometimes referred to as "5G compatible and later"), servers that handle network functions such as the UPF related to U-Plane processing have come to be distributed. For example, in order to improve the performance of the core network, servers that function as UPFs are often placed in data centers near base stations.

[0008] For this reason, after the 5G era, the data center that extracts the C-Plane packets and the data center that extracts the U-Plane packets are often different, making it difficult to link data related to the communication of the same user. On the other hand, for example, Cited Document 1 does not take into consideration that the extraction position of the C-Plane packets and the extraction position of the U-Plane packets are located in different data centers.

[0009] In addition, in the past, data related to the same user's communications was linked using a table that associates IDs provisionally assigned to the traffic of each user with unique IDs. For this reason, the processing load of the past linking process was high, and the number of users for which data linking was possible was limited, making it impossible to perform sufficient analysis of, for example, key performance indicators (KPIs).

[0010] One aspect of the present invention aims to realize a technology that can acquire large amounts of data required to understand communication conditions in a timely manner, even if the core network configuration becomes complex. [Means for solving the problem]

[0011] An information processing system according to one embodiment of the present invention includes an acquisition unit that acquires C-Plane packets and U-Plane packets from a core network, (i) an extraction unit that extracts a source address, a destination address, and a TEID (Tunnel Endpoint Identifier) ​​from the U-Plane packets acquired by the acquisition unit, and (ii) an extraction unit that extracts a source address, a destination address, and a TEID of a U-Plane packet corresponding to the C-Plane packet from information stored in the payload of the C-Plane packet acquired by the acquisition unit, and a linking unit that links the C-Plane packets and U-Plane packets based on the source address, destination address, and TEID extracted by the extraction unit.

[0012] An information processing method according to one embodiment of the present invention includes the steps of: (i) acquiring a C-Plane packet and a U-Plane packet from a core network; (i) extracting a source address, a destination address, and a TEID from the acquired U-Plane packet; and (ii) extracting a source address, a destination address, and a TEID of a U-Plane packet corresponding to the C-Plane packet from information stored in the payload of the acquired C-Plane packet; and linking the C-Plane packet and the U-Plane packet based on the extracted source address, destination address, and TEID.

[0013] Each aspect of the present invention may be realized by a computer. In this case, a program that causes a computer to execute each step of the above-described method, and a computer-readable recording medium having the program recorded thereon, also fall within the scope of the present invention. Effect of the Invention

[0014] According to one aspect of the present invention, even if the configuration of the core network becomes complex, it is possible to obtain a large amount of data required to grasp the communication situation in a timely manner. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram illustrating a conventional packet analysis system for analyzing a communication situation. [Diagram 2] 2 is a diagram illustrating an example of a schematic internal configuration of the packet analysis system of FIG. 1. [Diagram 3] FIG. 11 is a diagram showing an example of a table in which IMSIs and TEIDs are associated with each other. [Figure 4] FIG. 1 is a diagram illustrating an example in which a conventional packet analysis system is applied to a 5G core network. [Diagram 5] FIG. 2 is a diagram illustrating an example of components of a U-Plane packet. [Figure 6] FIG. 13 is a diagram illustrating an example of components of a C-Plane packet. [Figure 7] FIG. 13 is a diagram showing another example of components of a C-Plane packet. [Figure 8] A diagram showing yet another example of components of a C-Plane packet. [Figure 9] 11 is a diagram illustrating an example of information required to generate a session index. [Figure 10] FIG. 1 is a diagram for explaining the coding format of F-TEID defined in the standard TS 129 274 8.22. [Figure 11] 1 is a block diagram showing an example of the configuration of a packet analysis system according to a first embodiment. [Figure 12] FIG. 2 is a diagram illustrating an example of a packet acquisition position corresponding to the LTE core network. [Figure 13] FIG. 13 is a diagram showing a list of message types of packets to be supplied to a session identification unit. [Figure 14] FIG. 13 is a diagram showing a list of IEs to be referred to when classifying packets by IE. [Figure 15] A diagram illustrating an example of a packet acquisition position corresponding to a 5G core network. [Figure 16]FIG. 13 is a diagram showing a list of procedure codes of packets to be supplied to a session identification unit. [Figure 17] A diagram illustrating another example of a packet acquisition position corresponding to a 5G core network. [Figure 18] 13 is a flowchart illustrating an example of the flow of a packet analysis process. [Figure 19] FIG. 1 is a diagram illustrating an example of the configuration of a computer that executes instructions of a program, which is software that realizes each function. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. First, problems with the conventional technology will be described.

[0017] Conventionally, communication quality has been evaluated by analyzing packets flowing through a network and calculating KPIs.

[0018] FIG. 1 is a diagram for explaining a conventional packet analysis system for analyzing communication conditions. As shown in the figure, in a fourth generation mobile communication system (LTE), a UE (User Equipment) is connected to an LTE core network 30 via an eNodeB, which is a base station. The core network 30 includes network function units such as an MME (Mobility Management Entity), an S-GW (Serving Gateway), and a P-GW (PDN Gateway). The UE is also connected to an external network such as the Internet via an IP network used to provide carrier services, which is composed of a base station, a core network, and a CGN (Carrier Grade NAT), etc. Networks such as the IP network for carrier services and the Internet may be collectively referred to as a DN (Data Network).

[0019] (Network configuration: LTE) 1 also shows a packet analysis system 50 corresponding to the LTE core network. The packet analysis system 50 extracts C-Plane packets and U-Plane packets from a reference point related to the connection between the MME and the S-GW and a reference point related to the connection between the eNodeB and the S-GW, respectively. That is, C-Plane packets are obtained from S11, which is a reference point related to the connection between the MME and the S-GW, and U-Plane packets are obtained from S1-U, which is a reference point related to the connection between the eNodeB and the S-GW.

[0020] Note that the C-Plane packets are packets related to communication for controlling, for example, which terminal is communicating with which base station, while the U-Plane packets are packets related to communication of data mainly for content itself, such as the website the user is browsing or the voice data during a call.

[0021] The packet analysis system 50 identifies data related to communication by the same user by linking the acquired C-Plane packets with U-Plane packets, and acquires information necessary for analyzing the communication status, etc. By inputting such information, for example, to a monitor device (not shown) and analyzing the communication status, it becomes possible to calculate, for example, index values ​​related to KPIs, etc.

[0022] (System Overview) Fig. 2 is a diagram showing a schematic internal configuration example of the packet analysis system 50 of Fig. 1. As shown in the figure, C-Plane packets acquired from S11 and U-Plane packets acquired from S1-U are supplied to a packet identifier 51. In this example, C-Plane packets and U-Plane packets related to Sub (representing Subscriber) 1, Sub2, and Sub3, which indicate individual users, are supplied to the packet identifier 51.

[0023] The packet identifier 51 refers to a table described later, links the C-Plane packets and the U-Plane packets, and supplies them to the DPI servers 52-1 to 52-3. For example, the packet identifier 51 links the C-Plane packet "S11(Sub1)" related to the user Sub1 with the U-Plane packet "S1-U(Sub1)" and supplies them to the DPI server 52-1. Similarly, the packet identifier 51 links "S11(Sub2)" and "S1-U(Sub2)" related to the user Sub2 and supplies them to the DPI server 52-2, and links "S11(Sub3)" and "S1-U(Sub3)" related to the user Sub3 and supplies them to the DPI server 52-3.

[0024] At this time, the packet identifier 51 uses a table that associates IMSI (International Mobile Subscriber Identity) with TEID (Tunnel Endpoint Identifier) ​​in order to link C-Plane packets and U-Plane packets related to the same user. Note that IMSI is an ID that is assigned to each user in advance. Also, TEID is an ID used in the tunneling protocol (GTP) and is assigned at the start of communication.

[0025] (Table for linking) Fig. 3 is a diagram showing an example of a table associating IMSIs with TEIDs used in the packet analysis system 50 shown in the figure. In the example shown in the figure, IMSI "44020xxxxxxxxx01" is associated with TEID "teid1", and IMSI "44020xxxxxxxxxx02" is associated with TEID "teid2". In this way, in the table of Fig. 3, each IMSI is associated with a TEID.

[0026] Since the C-Plane packet contains an IMSI, the packet identifier 51 can identify the TEID corresponding to the IMSI by referring to the table in Fig. 3. The packet identifier 51 can then identify the U-Plane packet to be associated with each C-Plane packet by referring to the TEID contained in the U-Plane packet.

[0027] The DPI servers 52-1 to 52-3 analyze data of associated C-Plane packets and U-Plane packets, and generate information necessary for analyzing the communication status, etc. The generated information is supplied to, for example, a traffic monitor (not shown), and the communication status is analyzed.

[0028] (Network configuration: 5G) Such analysis of the communication status of each user needs to continue even if the core network becomes a fifth generation mobile communication system (5G). Fig. 4 is a diagram showing an example of a case where a conventional packet analysis system is applied to a 5G core network. As shown in the figure, the 5G core network 40 includes network function units such as an AUSF (Authentication Server Function), an AMF (Access and Mobility Management Function), an NSSF (Network Slice Selection Function), an SMF (Session Management Function), an UDM (Unified Data Management), a PCF (Policy Control Function), and an UPF (User Plane Function).

[0029] The function of the MME in the LTE core network 30 is mainly allocated to the AMF in the 5G core network 40. The function of the S-GW in the LTE core network 30 is mainly allocated to the SMF and the UPF in the 5G core network 40. For this reason, in the 5G core network 40, packets of the U-Plane may be acquired from N3, which is a reference point relating to the connection between the gNodeB, which is a base station, and the UPF. On the other hand, in the 5G core network 40, packets of the C-Plane may be acquired, for example, from N11, which is a reference point relating to the connection between the AMF to which the gNodeB is connected, and the SMF.

[0030] On the other hand, compared to the initial release of LTE, after 5G support, the network function unit that executes processing related to the C-Plane and the network function unit that executes processing related to the U-Plane are clearly separated. Therefore, after 5G support, it has become possible to place the network function unit that executes processing related to the U-Plane separately from the network function unit that executes processing related to the C-Plane.

[0031] For example, the UPF requires higher processing capabilities than the SMF. Therefore, when providing a low-latency communication service, the UPF functions can be distributed and implemented in multiple devices. In particular, when providing a low-latency communication service, a server on the DN that handles processing related to such a service is located physically close to the user (or UE). Therefore, in order to improve the performance of the connection from the UE to the DN, it is preferable that the UPF is distributed and located near the base station.

[0032] Therefore, in an actual 5G core network, for example, a configuration in which multiple UPFs are arranged corresponding to gNodeBs may be adopted. In this case, for example, the UPF is arranged in a data center different from the data center in which the AUSF, AMF, NSSF, SMF, UDM, PCF, etc. are arranged. As an example, for example, all network function units of the 5G core network 40 are arranged in the Tokyo data center, and the UPFs are arranged in the Sapporo data center, the Nagoya data center, and the Osaka data center.

[0033] In this case, N3, which is a reference point for connecting the base station gNodeB and the UPF, exists in the Tokyo data center, the Sapporo data center, the Nagoya data center, and the Osaka data center. Therefore, in order to link C-Plane packets and U-Plane packets related to the same user, for example, U-Plane packets acquired in the Sapporo data center, the Nagoya data center, and the Osaka data center need to be transferred at high speed to the packet identifier 51 in the Tokyo data center.

[0034] When the packet identifier 51 and the reference point N3 are located in the same data center, for example, by laying a dedicated optical fiber cable, the U-Plane packets acquired at the reference point N3 can be transferred at high speed to the packet identifier 51. However, when the packet identifier 51 and the reference point N3 are located in different data centers, laying a dedicated optical fiber cable is unrealistic.

[0035] 3 is generated to link C-Plane packets and U-Plane packets related to the same user, the table needs to be updated to associate IMSIs with TEIDs each time they are assigned. This increases the load due to the processing involved in updating the table, and high processing power is required for the packet identifier 51. Furthermore, the size of the table that can be stored is limited, so the number of C-Plane packets and U-Plane packets that can be linked is also limited.

[0036] First Embodiment Next, a first embodiment of the present invention will be described. In the first embodiment, a session index is generated to link a C-Plane packet with a U-Plane packet. The session index is generated based on information contained in each of the C-Plane packet and the U-Plane packet, and is assigned to each of the C-Plane packet and the U-Plane packet. By combining the C-Plane packet and the U-Plane packet so that the session indexes match, it becomes possible to link the C-Plane packet and the U-Plane packet related to the same UE. In this case, for example, a table such as that shown in FIG. 3 is not required.

[0037] A method for generating a session index will be described with reference to Fig. 5 to Fig. 9. The session index is identification information that is added to each packet.

[0038] (U-Plane packets) 5 is a diagram showing components of a U-Plane packet. In this example, a U-Plane packet 300 includes an Ethernet header 301, an IP (outer) header 302, a UDP (outer) header 303, a tunneling protocol (GTPv1) header 304, an IP (inner) header 305, a UDP (inner) header 306, and a payload 307.

[0039] In the figure, "(outer)" and "(inner)" are used to distinguish the headers used in the tunneling protocol, with "(inner)" meaning the header of a packet encapsulated by the tunneling protocol, and "(outer)" meaning the header of a packet that stores the encapsulated packet. For example, the "(outer)" header is used for communication within the core network of the encapsulated packet, and the "(inner)" header is used for communication between the UE and DN of the U-Plane packet.

[0040] In the case of U-Plane packets, the tunneling protocol used is, for example, General Packet Radio Service (GPRS) Tunnelling Protocol (GTP) v1.

[0041] (C-Plane packets) 6 is a diagram showing components of a C-Plane packet corresponding to the LTE core network and obtainable at a reference point S11. In this example, a C-Plane packet 330 includes an Ethernet header 331, an IP header 332, a UDP header 333, a tunneling protocol (GTPv2) header 334, and a payload 337. The payload 377 is also called a GTP-C message.

[0042] In the case of C-Plane packets, the tunneling protocol used is, for example, GTPv2.

[0043] The session index is generated based on the source IP (src) address, destination IP (dst) address, and TEID contained in each of the U-Plane packets and the C-Plane packets.

[0044] FIG. 7 is a diagram showing components of a C-Plane packet corresponding to a 5G core network and obtainable at a reference point N2. NGAP (Next Generation Application Protocol) is used for communication between the gNodeB and the AMF. Details of NGAP are specified in detail in, for example, the 3GPP standard TS.38.412.

[0045] In this example, a C-Plane packet 350 includes an Ethernet header 351, an IP header 352, an SCTP header 353, an NGAP header 354, and a payload 355. The NGAP header 354 and the payload 355 are also referred to as an NGAP Message.

[0046] 8 is a diagram showing components of a C-Plane packet corresponding to a 5G core network and obtainable at a reference point N12. HTTP (Hypertext Transfer Protocol) / 2 is used in communication between the AMF and the AUSF. Details of HTTP / 2 are specified in detail in, for example, the 3GPP standard TS.29.500.

[0047] In this example, a C-Plane packet 370 includes an Ethernet header 371, an IP header 372, a TCP header 373, an HTTP / 2 header 374, and a payload 375. The payload 375 is also referred to as an application.

[0048] (Information required to generate a session index) Fig. 9 is a diagram for explaining an example of information required for generating a session index. In addition, "(uplink)" and "(downlink)" in the figure indicate the direction in which a packet is transmitted. "(uplink)" indicates the upward direction, that is, a packet traveling from a UE or a base station to a core network, and "(downlink)" indicates the downward direction, that is, a packet traveling from a core network to a UE or a base station.

[0049] As shown in the figure, the information required to generate a session index is the source IP address, destination IP address, and TEID in both the U-Plane and the C-Plane. However, the node that assigns the source, destination, and TEID differs depending on the direction in which the packet is sent.

[0050] (U-Plane) As shown in the figure, in the case of a U-Plane (uplink) packet, the source IP address means the IP address of the eNodeB or gNodeB. The destination IP address means the IP address of the S-GW, UPF, or SMF. The TEID means the TEID assigned by the S-GW, UPF, or SMF.

[0051] In addition, in the case of a U-Plane (downlink) packet, the source IP address means the IP address of the S-GW or UPF. The destination IP address means the IP address of the eNodeB or gNodeB. The TEID means the TEID assigned by the eNodeB or gNodeB.

[0052] In the case of a U-Plane packet, the source IP address and destination IP address are stored in the IP (outer) header 302 in FIG. 5, and the TEID is stored in the GTPv1 header 304 in FIG.

[0053] (For C-Plane) In the case of a C-Plane (uplink) packet, as in the case of a U-Plane (uplink) packet, the source IP address means the IP address of the eNodeB or gNodeB. The destination IP address means the IP address of the S-GW, UPF, or SMF. The TEID means the TEID assigned by the S-GW, UPF, or SMF. In other words, the payload of a C-Plane (uplink) packet stores the source IP address and destination IP address of the U-Plane (uplink) packet, as well as the TEID, and a session index is generated using these.

[0054] In addition, in the case of a C-Plane (downlink) packet, as in the case of a U-Plane (downlink) packet, the source IP address means the IP address of the S-GW or UPF. The destination IP address means the IP address of the eNodeB or gNodeB. The TEID means the TEID assigned by the eNodeB or gNodeB. That is, the payload of a C-Plane (downlink) packet stores the source IP address and destination IP address of the U-Plane (downlink) packet, as well as the TEID, and a session index is generated using these.

[0055] (Packets that can be obtained with S11) In the case of a C-Plane packet obtainable at reference point S11, the source IP address, destination IP address, and TEID are stored in the payload 337 in Fig. 6. That is, in the case of a C-Plane packet obtainable at reference point S11, the source IP address, destination IP address, and TEID of the U-Plane packet are stored in the information transmitted by the GTPv2 protocol.

[0056] The source IP address, destination IP address, and TEID are stored in an IE (Information Element) of "Fully Qualified Tunnel Endpoint Identifier" with an IE Type Value of 87 in the payload 337. The storage location of each piece of information in the IE with an IE Type Value of 87 is described in detail in the 3GPP standard TS 129 274 8.22 Fully Qualified TEID (F-TEID).

[0057] Figure 10 is a diagram explaining the coding format of F-TEID defined in the standard TS 129 274 8.22. The source IP address and destination IP address required for generating a session index are stored in "IPv4 address" or "IPv6 address" in Figure 10. Also, the TEID required for generating a session index is stored in "TEID / GRE Key" in Figure 10.

[0058] (Packets available on N2) In the case of a C-Plane packet obtainable at reference point N2, the source IP address, destination IP address, and TEID are stored in the payload 355 in Fig. 7. That is, in the case of a C-Plane packet obtainable at reference point N2, the source IP address, destination IP address, and TEID are stored in the information transmitted by the NGAP protocol.

[0059] (Packets available on N12) In the case of a C-Plane packet obtainable at reference point N12, the source IP address, destination IP address, and TEID are stored in the payload 375 in Fig. 8. That is, in the case of a C-Plane packet obtainable at reference point N12, the source IP address, destination IP address, and TEID are stored in the information transmitted by the HTTP / 2 protocol.

[0060] In addition, in 5G, various security measures are adopted from the viewpoint of countermeasures against security threats. Specifically, for example, SUPI (Subscription Permanent Identifier), which is a subscriber ID in 5G, is transmitted from UE to the network as SUCI (Subscription Concealed Identifier), which is information obtained by encrypting SUPI with a predetermined public key. As a result, in 5G, the subscriber ID is concealed. Therefore, even if a C-Plane packet is acquired from reference point N2, it is not possible to grasp the relationship with the user or UE that transmitted the packet. Therefore, SUCI is acquired from a packet related to authentication processing transmitted and received between AMF and AUSF, which is a C-Plane packet that can be acquired at reference point N12, and SUPI and KSEAF are acquired from a response packet to the request. As a result, for example, in a monitor device, etc., SUPI can be derived from SUCI included in a C-Plane packet.

[0061] The SUPI, SUCI, and KSEAF are stored in the payload of packets sent and received by the HTTP / 2 protocol. For operators who design their networks without performing the above-mentioned encryption, there is no need to derive the SUPI from the SUCI, so for such operators, it is not essential to acquire packets of the C-Plane at the reference point N12.

[0062] (Packet linking by session index) If the communications relate to the same user, the source IP address and destination IP address stored in the IE with an IE Type Value of 87 in the payload 337 of the C-Plane (uplink) packet obtainable at reference point S11 match the source IP address and destination IP address stored in the IP (outer) header 302 of the U-Plane (uplink) packet, respectively. And the TEID stored in the IE with an IE Type Value of 87 in the payload 337 of the C-Plane (uplink) packet matches the TEID stored in the tunneling protocol header 304 of the U-Plane (uplink) packet.

[0063] Similarly, if the communication concerns the same user, the source IP address, destination IP address, and TEID stored in the payload 355 of the C-Plane (uplink) packet obtainable at reference point N2 will match the source IP address and destination IP address stored in the IP (outer) header 302 of the U-Plane (uplink) packet, and the TEID stored in the tunneling protocol header 304, respectively.

[0064] Furthermore, if the communication concerns the same user, the source IP address, destination IP address, and TEID stored in the payload 375 of the C-Plane (uplink) packet obtainable at reference point N12 match the source IP address and destination IP address stored in the IP (outer) header 302 of the U-Plane (uplink) packet, and the TEID stored in the tunneling protocol header 304, respectively.

[0065] Furthermore, if the communications relate to the same user, the source IP address and destination IP address stored in the IE with an IE Type Value of 87 in the payload 337 of the C-Plane (downlink) packet obtainable at reference point S11 match the source IP address and destination IP address stored in the IP (outer) header 302 of the U-Plane (downlink) packet, respectively. And the TEID stored in the IE with an IE Type Value of 87 in the payload 337 of the C-Plane (downlink) packet matches the TEID stored in the tunneling protocol header 304 of the U-Plane (downlink) packet.

[0066] Similarly, if the communication concerns the same user, the source IP address, destination IP address, and TEID stored in the payload 355 of the C-Plane (downlink) packet obtainable at reference point N2 will match the source IP address and destination IP address stored in the IP (outer) header 302 of the U-Plane (downlink) packet, and the TEID stored in the tunneling protocol header 304, respectively.

[0067] Furthermore, if the communication concerns the same user, the source IP address, destination IP address, and TEID stored in the payload 375 of the C-Plane (downlink) packet obtainable at reference point N12 match the source IP address and destination IP address stored in the IP (outer) header 302 of the U-Plane (downlink) packet, and the TEID stored in the tunneling protocol header 304, respectively.

[0068] Therefore, for example, by extracting the source IP address, destination IP address, and TEID from each packet and using their hash value as the session index of the packet, it is possible to identify packets of communication related to the same user. In other words, by identifying a C-Plane packet having the same session index as the session index of a U-Plane packet, it is possible to link the C-Plane packet and the U-Plane packet related to the same user.

[0069] By analyzing the information stored in the payload 307 of the U-Plane packet, it is possible to identify the data transmitted and received between the UE and the DN. Then, by analyzing the information stored in the payload 337, payload 355, and payload 375 of the C-Plane packet linked to the U-Plane packet, it is possible to identify the UE and the behavior of the UE (e.g., handover, etc.). In this way, if the content of communication of each user can be identified, it becomes possible to perform a detailed analysis of the communication situation.

[0070] Here, an example has been described in which the hash value of the source IP address, destination IP address, and TEID stored in each packet is calculated to be the session index of the packet, but the session index may be generated by a different calculation. That is, the session index may be generated by performing a predetermined calculation on the source IP address, destination IP address, and TEID stored in each packet. Specifically, for example, the session index may be a value obtained by adding up the values ​​of the source IP address, destination IP address, and TEID.

[0071] (Example of packet analysis system configuration) 11 is a block diagram showing a configuration example of a packet analysis system 200 according to this embodiment. The packet analysis system 200 shown in the figure is a system that acquires packets in a core network and analyzes the communication status. As shown in the figure, the packet analysis system 200 has an analysis device 201A and an analysis device 201B.

[0072] (Analysis equipment) For example, analysis device 201A and analysis device 201B may be arranged in different data centers. Also, the connection between analysis device 201A and analysis device 201B may be made using a dedicated line provided by a telecommunications carrier.

[0073] The analysis device 201A is a device that mainly executes processing related to packets of the C-Plane. The analysis device 201A includes an acquisition unit 221A, a session identification unit 222A, and a linking unit 223A.

[0074] The analysis device 201B is a device that mainly executes processes related to packets of the U-Plane. The analysis device 201B includes an acquisition unit 221B and a session identification unit 222B.

[0075] The acquisition unit 221A and the session identification unit 222A may be functional blocks having the same configuration as the acquisition unit 221B and the session identification unit 222B. For example, when the acquisition unit of a certain analysis device is connected to a reference point for acquiring packets of C-plane, it may function as the acquisition unit 221A for acquiring packets of C-plane, and the session identification unit of the analysis device may function as the session identification unit 222A. Also, when a certain analysis device is connected to a reference point for acquiring packets of U-plane, it may function as the acquisition unit 221B for acquiring packets of U-plane, and the session identification unit of the analysis device may function as the session identification unit 222B.

[0076] Hereinafter, unless there is a particular need to distinguish between them, acquiring units 221A and 221B will be collectively referred to as acquiring unit 221, session identifying units 222A and 222B will be collectively referred to as session identifying unit 222, and linking unit 223A will be referred to as linking unit 223. Similarly, unless there is a particular need to distinguish between them, analyzing device 201A and analyzing device 201B will be collectively referred to as analyzing device 201.

[0077] (Acquisition Department) The acquisition unit 221 acquires packets of the C-Plane and packets of the U-Plane at a position corresponding to a predetermined reference point in the core network. The packets acquired by the acquisition unit 221 are supplied to the session identification unit 222.

[0078] (Session Identification Part) The session identification unit 222 extracts the source address, destination address, and TEID from the C-Plane packet and the U-Plane packet acquired by the acquisition unit 221, and extracts the source address, destination address, and TEID of the U-Plane packet from the information stored in the payload of the C-Plane packet acquired by the acquisition unit 221. Then, the session identification unit 222 generates identification information for identifying packets related to communication by each of multiple users based on the extracted source address, destination address, and TEID. Here, the identification information generated by the session identification unit 222 may be the above-mentioned session index.

[0079] The session index may be generated by performing a predetermined calculation on the source IP address, destination IP address, and TEID stored in each packet. As an example, a session index may be generated that includes a hash value of the source IP address, destination IP address, and TEID.

[0080] That is, the session identification unit 222A of the analysis device 201A extracts the source address, destination address, and TEID from the payload 227 in Fig. 6 in the C-Plane packet acquired by the acquisition unit 221A to generate a session index. Also, the session identification unit 222B of the analysis device 201B extracts the source IP address and destination IP address from the IP (outer) header 302 in Fig. 5 in the U-Plane packet acquired by the acquisition unit 221B, and extracts the TEID from the tunneling protocol header 304 to generate a session index.

[0081] The session identifying unit 222 assigns the generated identification information (session index) to the C-Plane packets and the U-Plane packets acquired by the acquiring unit 221, and supplies them to the linking unit 223, for example.

[0082] Here, depending on the operation status of the core network and the packet analysis system 200, U-Plane packets that cannot be associated with C-Plane packets may occur. Specifically, for example, a period during which C-Plane packets cannot be acquired may occur due to maintenance of the analysis device 201A. In such a case, the core network is operating normally and the UE can establish a connection with the DN, so that the acquisition unit 221B of the analysis device 201B acquires U-Plane packets as usual. In such a case, since no C-Plane packets exist on the packet analysis system 200, U-Plane packets that cannot be associated with C-Plane packets occur.

[0083] For example, if there are no C-Plane packets (that is, a session index cannot be generated), the analysis device 201B may be configured not to transmit the U-Plane packets acquired by the acquisition unit 221B to the analysis device 201A.

[0084] In the example of FIG. 11, the information output from session identification section 222B of analysis device 201B is configured to be supplied to linking section 223A of analysis device 201A together with the information output from session identification section 222A of analysis device 201A.

[0085] (Linking section) The linking unit 223 links the C-Plane packet and the U-Plane packet based on the session index. That is, the linking unit 223 links the session index given to the C-Plane packet with the U-Plane to which the same session index is given. This makes it possible to identify data related to communication of the same UE and obtain information necessary for analyzing the communication status.

[0086] As described later, the recording device 202 records order information in association with each pair of a C-Plane packet and a U-Plane packet associated by the association unit 223. The order information may be, for example, the transmission time or reception time of the packet, or the sequence number of the packet. In short, it is sufficient that information for identifying the order in which packets are transmitted and received is associated with each pair of a C-Plane packet and a U-Plane packet.

[0087] The monitor device 203 performs detailed analysis of the communication status by referring to each pair of C-Plane packets and U-Plane packets associated with sequence information. This allows calculation of, for example, index values ​​related to KPIs and index values ​​related to the degree of improvement in user satisfaction.

[0088] Incidentally, the recording device 202 may be configured, for example, integrally with the analysis device 201A, or may be configured integrally with the monitor device 203.

[0089] In the above example, the session identifying unit 222 generates a session index based on the extracted source address, destination address, and TEID, but the session identifying unit 222 may not generate a session index. In this case, the session identifying unit 222 may supply the C-Plane packets and U-Plane packets acquired by the acquiring unit 221 to the linking unit 223 together with the source address, destination address, and TEID. Then, the linking unit 223 may link the C-Plane packets and the U-Plane packets based on the source address, destination address, and TEID.

[0090] . Here, when linking packets of the C-Plane and packets of the U-Plane, there may be cases where the source address, destination address, and TEID of packets acquired from different UEs overlap. More specifically, for example, when packets collected over a certain period of time are linked at once, there may be cases where the source address, destination address, and TEID of packets acquired from different UEs overlap. According to the provisions of the 3GPP standard, in one network function (NE), TEIDs are processed so as not to overlap. However, when a user or UE that used one TEID ends communication, the TEID may be reused by another user or UE. Therefore, when linking packets collected over a certain period of time at once, it is possible to determine whether the packets are packets of the same user or packets of different users by referring to the order information in addition to the source address, destination address, and TEID.

[0091] (Arrangement of analysis equipment) 11, one analysis device 201B is provided for one analysis device 201A, but in reality, multiple analysis devices 201B may be provided for one analysis device 201A. That is, for a combination of an acquisition unit 221A and a session identification unit 222A related to packets in the C-Plane, multiple combinations of an acquisition unit 221B and a session identification unit 222B related to packets in the U-Plane may be provided.

[0092] For example, in a 5G core network, when providing a low latency communication service, the UPF function may be distributed and implemented in multiple devices. In particular, when providing a low latency communication service, it is preferable that the UPF is distributed and disposed near the base station in order to improve the performance of the connection from the UE to the DN. Depending on the network operation form and the service provision form, the UPF may be disposed near the server on the DN.

[0093] Therefore, in an actual 5G core network, for example, a configuration in which multiple UPFs are arranged corresponding to gNodeBs or servers on DNs may be adopted. For example, the UPFs may be arranged in a data center different from the data center in which the AUSF, AMF, NSSF, SMF, UDM, PCF, etc. are arranged.

[0094] In this case, analysis device 201A may be arranged in a data center where AUSF, AMF, NSSF, SMF, UDM, PCF, etc. are arranged, and analysis device 201B may be arranged in a data center where UPF is arranged.

[0095] Then, as described above, when multiple UPFs are arranged corresponding to the gNodeBs or servers on the DN, multiple data centers are prepared near the multiple gNodeBs (base stations) or servers on the DN, and the analysis device 201B is arranged in the multiple data centers together with the UPFs. That is, the acquisition unit 221B and the session identification unit 222B related to the packets of the U-Plane may be arranged in the vicinity of the base station.

[0096] On the other hand, for example, when the packet analysis system 200 according to the present embodiment is used in an LTE core network, if the MME and the S-GW are arranged in the same data center, the analysis device 201A and the analysis device 201B may be arranged in the same data center. Similarly, even when the packet analysis system 200 according to the present embodiment is used in a 5G core network, if the UPF is also arranged in a data center where the AUSF, AMF, NSSF, SMF, UDM, PCF, etc. are arranged, the analysis device 201A and the analysis device 201B may be arranged in the same data center.

[0097] When analysis device 201A and analysis device 201B are located in the same data center, the connection between analysis device 201A and analysis device 201B may be made, for example, by an optical fiber cable (it is not necessary to use a dedicated line provided by a telecommunications carrier).

[0098] (Packet acquisition location: LTE) 12 is a diagram for explaining an example of a packet acquisition position of a C-Plane corresponding to an LTE core network and a packet acquisition position of a U-Plane in this embodiment. In the figure, each network function unit and base station of the core network are displayed by a rectangle, and a reference point related to the packet acquisition position is displayed as a character and a number surrounded by a circle.

[0099] In the example of Fig. 12, a packet of the C-Plane is acquired by the analysis device 201A at the reference point S11 between the MME and the S-GW. Also, a packet of the U-Plane is acquired by the analysis device 201B at the reference point S1-U between the eNodeB and the S-GW.

[0100] That is, when the core network is a core network in an LTE communication network, the acquisition unit 221 acquires packets of the C-Plane from the reference point S11, and acquires packets of the U-Plane from the reference point S1-U.

[0101] In FIG. 12, analysis device 201A and analysis device 201B may be arranged, for example, in a centralized manner in the same data center, or may be arranged, for example, in a distributed manner in separate data centers.

[0102] (Classification of packets by message type) Of the packets acquired at reference point S11, only those that satisfy a predetermined condition may be supplied to session identification unit 222. For example, by referring to the message type of C-Plane packets that can be acquired at reference point S11, only packets of a predetermined message type may be supplied to session identification unit 222. The message type is information stored in tunneling protocol header 334.

[0103] 13 is a diagram showing a list of message types of packets to be supplied to session identification unit 222. In the diagram, message type numbers and message types corresponding to the message type numbers are shown. The message type is information indicating the behavior of the UE (e.g., handover, etc.), and by referring to the message type, it is possible to classify packets into those necessary for analyzing the communication status in downstream monitoring device 203 and those that are not necessary.

[0104] 13, packets whose message type number stored in tunneling protocol header 334 is any one of 32, 33, 34, . . . 171, 176, and 177 are classified as packets necessary for analysis of the communication status in downstream monitoring device 203. On the other hand, packets whose message type number stored in tunneling protocol header 334 is any one of the message type numbers shown in FIG. 13 are classified as packets unnecessary for analysis of the communication status in downstream monitoring device 203.

[0105] In this way, the acquisition unit 221 may refer to the message type of the C-Plane packets acquired from the reference point S11 and classify them into a first type of packets (packets necessary for analyzing the communication status) and a second type of packets (unnecessary packets), and supply only packets classified as the first type to the session identification unit 222.

[0106] (Classification of packets by IE) Packets of any of the message types shown in Fig. 13 may be further classified into necessary packets and unnecessary packets by referring to an IE in payload 337. Fig. 14 is a diagram showing a list of IEs to be referred to at this time. In the diagram, an IE Type Value and an IE (Information Element) corresponding to the IE Type Value are shown.

[0107] For example, a list of values ​​(or ranges) to be compared with the values ​​stored in the IEs corresponding to IE Type Values ​​1, 2, 3, . . . 87, 93, 97 is created in advance. For example, a value to be compared with the value stored in the IE of IE Type Value 1 is set in advance, and if it matches the value stored in the IE of IE Type Value 1, the packet is treated as a necessary packet and subsequent processing is performed, and if it does not match, the packet is treated as an unnecessary packet and is not subject to subsequent processing. Note that a flag indicating whether it is necessary or unnecessary may be assigned to each packet, or only necessary packets may be stored, and unnecessary packets may be discarded.

[0108] In addition, a range of values ​​to be compared with the value stored in the IE of IE Type Value 2 is set in advance, and if the value stored in the IE of IE Type Value 1 is within this range, the packet is treated as a necessary packet and subsequent processing is performed; if the value is outside the range, the packet is treated as an unnecessary packet and is not subject to subsequent processing.

[0109] The same process is executed for IE Type Values ​​3, . . . 87, 93, and 97, and it is determined whether the packet is necessary for the downstream monitor device 203 to analyze the communication status or not.

[0110] In this way, acquiring unit 221 may supply only packets that satisfy a predetermined condition among packets acquired at reference point S11 to session identifying unit 222. That is, acquiring unit 221 may refer to a value of a predetermined IE (Information Element) stored in a packet classified into the first type with reference to the message type as described above, to further classify the packets into a third type packet and a fourth type packet, and supply only packets classified into the third type to session identifying unit 222.

[0111] Alternatively, acquisition unit 221 may extract values ​​stored in the IEs corresponding to IE Type Values ​​1, 2, 3, . . . 87, 93, 97 from a packet of any of the message types shown in Fig. 13, and supply them to session identification unit 222 together with the packet. That is, each of the IEs shown in Fig. 14 may be supplied to subsequent session identification unit 222 and monitor device 203 as information required for analyzing the communication status. In this case, there is no need to further classify a packet classified as a packet required for analyzing the communication status with reference to the message type.

[0112] (Packet acquisition location: 5G) 15 is a diagram for explaining an example of the acquisition position of a packet in the C-Plane corresponding to the 5G core network and the acquisition position of a packet in the U-Plane in this embodiment. In the figure, each network function unit and base station of the core network are displayed by a rectangle, and a reference point related to the acquisition position of the packet is displayed as a character and a number surrounded by a circle.

[0113] In the example of Fig. 15, a packet of the C-Plane is acquired by the analysis device 201A at the reference point N2 between the gNodeB and the AMF, and at the reference point N12 between the AMF and the AUSF. Also, a packet of the U-Plane is acquired by the analysis device 201B at the reference point N3 between the gNodeB and the UPF.

[0114] In the case of a 5G core network, it is also possible to obtain a C-Plane packet at the reference point N11 between the AMF and the SMF. However, in the case of a 5G core network, a header compression method called HPACK is adopted for communication between the AMF and the SMF.

[0115] In the case of communication using HPACK, even if retransmission occurs due to, for example, packet loss, the index number changes. Since nodes other than the node that requested retransmission cannot determine which packet is being retransmitted, there is a possibility that the header cannot be correctly restored when the header compressed by HPACK is restored according to the index number. In other words, since the analysis device 201A is not the node that requested retransmission, the header compressed by HPACK may not be correctly restored. For this reason, in this embodiment, the acquisition unit 221 does not acquire the C-Plane packet at the reference point N11, but acquires the C-Plane packet at the reference point N2.

[0116] In addition, in a 5G core network in which HPACK is not adopted, a C-Plane packet may be acquired at reference point N11. In this case, it is not necessary to acquire a C-Plane packet at reference point N2.

[0117] In addition, in the case of a 5G core network, the IMSI in a C-Plane packet is encrypted, and the encrypted IMSI needs to be decrypted in order to analyze the communication status in the downstream monitor device 203. For this reason, in this embodiment, the acquisition unit 221 acquires a C-Plane packet at a reference point N12 between the AMF and the AUSF. At the reference point N12, the acquisition unit 221 acquires packets corresponding to scheme 2, scheme 7, scheme 12, and scheme 14 among the schemes defined in / nausf-auth / v1 / ue-authentications.

[0118] In this way, when the core network is a core network in a 5G communication network, the acquisition unit 221 acquires C-Plane packets from reference point N2 and reference point N12, and acquires U-Plane packets from reference point N3.

[0119] In FIG. 15, analysis device 201A and analysis device 201B may be arranged, for example, in a centralized manner in the same data center, or may be arranged, for example, in a distributed manner in separate data centers.

[0120] (Packet classification by procedure code) Of the packets acquired at reference point N2, only those that satisfy a predetermined condition may be supplied to session identification unit 222. For example, by referring to the procedure code of C-Plane packets that can be acquired at N2, only packets with a predetermined procedure code may be acquired. The procedure code is information stored in payload 355 in FIG. 7.

[0121] Fig. 16 is a diagram showing a list of procedure codes of packets to be supplied to the session identification unit 222. The diagram shows procedure codes and code names corresponding to the procedure codes. The procedure codes are information indicating the behavior of the UE, similar to the message types in Fig. 13, and by referring to the procedure codes, it is possible to classify packets into those necessary for analyzing the communication status in the downstream monitoring device 203 and those that are not necessary.

[0122] 16, packets whose Procedure Code is any one of 4, 11, 12, . . . 41, 42, and 46 are classified as packets necessary for analysis of the communication status in the downstream monitoring device 203. On the other hand, packets whose Procedure Code is other than those shown in FIG. 16 are classified as packets not necessary for analysis of the communication status in the downstream monitoring device 203.

[0123] In this way, the acquisition unit 221 may refer to the Procedure Code of the C-Plane packets acquired from reference point N2 and classify the packets into a first type of packets (packets necessary for analyzing the communication status) and a second type of packets (unnecessary packets), and supply only packets classified as the first type to the session identification unit 222.

[0124] (Packet acquisition location: 5G interworking) 17 is a diagram illustrating another example of the packet acquisition position of the C-Plane corresponding to the 5G core network and the packet acquisition position of the U-Plane in this embodiment. In the figure, each network function unit and base station of the core network are displayed by a rectangle, and the reference point related to the packet acquisition position is displayed as a character and a number surrounded by a circle.

[0125] In the case of Figure 17, unlike the example of Figure 15, an acquisition position related to a 5G core network having an interworking function between 5GC and EPC (Evolved Packet Core) is described. Such a configuration of a 5G core network is shown in the 3GPP standard TS 123 501 4.3 "Interworking with EPC".

[0126] In the example of Figure 17, in addition to the configuration of Figure 15, an MME and an eNodeB are included. In addition, in the case of a 5G core network having an interworking function between 5GC and EPC, the functions of the S-GW and P-GW are implemented in a server that has the functions of the SMF or UPF. In the example of Figure 17, it is assumed that the functions of the S-GW are implemented in a server that has the functions of the UPF.

[0127] In the example of FIG. 17, the analysis device 201A acquires C-Plane packets at the reference point N2 between the gNodeB and the AMF, the reference point N12 between the AMF and the AUSF, and further at the reference point N26 between the MME and the AMF. Furthermore, the analysis device 201A acquires C-Plane packets at the reference point S11 between the MME and the UPF. Note that the UPF described in FIG. 17 is a server that performs the functions of the UPF and implements the functions of the S-GW. Therefore, it can be said that the reference point S11 related to the acquisition of C-Plane packets is actually a reference point between the MME and the S-GW.

[0128] 17, a packet of the U-Plane is acquired by the analysis device 201B at the reference point N3 between the gNodeB and the UPF. Furthermore, a packet of the U-Plane is acquired by the analysis device 201B at the reference point S1-U between the eNodeB and the UPF (actually, the S-GW).

[0129] The reference points S11 and S1-U are the same as those described above with reference to Fig. 12. The reference points N2, N12, and N3 are the same as those described above with reference to Fig. 15.

[0130] In mobile communications such as LTE and 5G, information is encrypted during communication. For example, consider a case where a UE is connected to a gNodeB, then handed over to an eNodeB, and then handed over again to connect to the gNodeB. In this case, the encryption key changes due to the connection to the eNodeB, so when the UE is reconnected to the gNodeB, the encryption key used immediately before must be obtained from the MME. For this reason, it is necessary to obtain packets of the C-Plane by the analysis device 201A at the reference point N26.

[0131] In FIG. 17, analysis device 201A and analysis device 201B may be arranged, for example, in a centralized manner in the same data center, or may be arranged, for example, in a distributed manner in separate data centers.

[0132] (Packet analysis processing) Next, a description will be given of an example of packet analysis processing by the packet analysis system 200 of Fig. 11. Fig. 18 is a flowchart illustrating an example of the flow of packet analysis processing.

[0133] In step S101, the acquisition unit 221A of the analysis device 201A acquires a C-Plane packet. At this time, when the core network is a core network in an LTE communication network, the C-Plane packet is acquired at the reference point S11 between the MME and the S-GW, as described above with reference to FIG.

[0134] Also, when the core network is a core network in a 5G communication network, packets of the C-Plane are acquired from reference point N2 and reference point N12 between the gNodeB and the AMF as described above with reference to Fig. 15. At reference point N12, packets corresponding to scheme 2, scheme 7, scheme 12, and scheme 14 among the schemes defined in / nausf-auth / v1 / ue-authentications are acquired by the acquisition unit 221.

[0135] Furthermore, when the core network is a core network in a 5G communication network and has an interworking function between the 5GC and the EPC, the C-Plane packets are acquired at the reference point N2, the reference point N12, and the reference point N26 between the MME and the AMF, as described above with reference to Figure 17. Furthermore, the C-Plane packets are acquired at the reference point S11 between the MME and the UPF (actually the S-GW).

[0136] The packet acquired by the acquisition unit 221 in step S 101 is supplied to the session identification unit 222 .

[0137] 13, only packets that satisfy a predetermined condition among packets acquired at reference point S11 may be supplied to session identification unit 222. For example, by referring to the Message Type of C-Plane packets that can be acquired at S11, only packets of a predetermined message type may be supplied to session identification unit 222. Furthermore, as described above with reference to FIG. 14, packets may be further classified by referring to an IE in payload 337, and only packets that satisfy a predetermined condition among packets acquired at reference point S11 may be supplied to session identification unit 222.

[0138] 16, only packets that satisfy a predetermined condition among packets acquired at reference point N2 may be supplied to session identifying unit 222. For example, by referring to the procedure code of C-Plane packets that can be acquired at N2, only packets with a predetermined procedure code may be supplied to session identifying unit 222.

[0139] In step S102, the acquisition unit 221B of the analysis device 201B acquires a packet of the U-Plane. At this time, when the core network is a core network in the LTE communication network, the packet of the U-Plane is acquired at the reference point S1-U between the eNodeB and the S-GW as described above with reference to FIG.

[0140] Also, when the core network is a core network in a 5G communication network, as described above with reference to Figure 15, packets of the U-Plane are acquired by the acquisition unit 221B of the analysis device 201B at reference point N3 between the gNodeB and the UPF.

[0141] Furthermore, when the core network is a core network in a 5G communication network and has an interworking function between 5GC and EPC, as described above with reference to Figure 17, U-Plane packets are acquired by analysis device 201B at reference point N3 and reference point S1-U.

[0142] In step S103, the session identifying unit 222 extracts the source address, the destination address, and the TEID from the C-Plane packet and the U-Plane packet acquired by the acquiring unit 221.

[0143] That is, the session identifying unit 222A of the analysis device 201A extracts the source address, the destination address, and the TEID from the C-Plane packet acquired by the acquiring unit 221A.

[0144] At this time, when the acquisition unit 221A acquires a C-Plane packet from reference point S11, the source IP address, destination IP address, and TEID are extracted from the IE with an IE Type Value of 87 in the payload 337 in Fig. 6. Also, when the acquisition unit 221A acquires a C-Plane packet from reference point N2, the source IP address, destination IP address, and TEID stored in the payload 355 in Fig. 7 are extracted. Furthermore, when the acquisition unit 221A acquires a C-Plane packet from reference point N12, the source IP address, destination IP address, and TEID stored in the payload 375 in Fig. 8 are extracted.

[0145] In addition, the session identification unit 222B of the analysis device 201B extracts the source address, destination address, and TEID from the U-Plane packet acquired by the acquisition unit 221B. At this time, as described above, the source IP address and destination IP address are extracted from the IP (outer) header 302 in Fig. 5, and the TEID is extracted from the tunneling protocol header 304.

[0146] In step S104, the session identification unit 222 generates a session index, which is identification information for identifying packets related to communication by each of multiple users, based on the source address, destination address, and TEID extracted in the process of step S103. That is, the session identification unit 222A of the analysis device 201A generates a session index for the C-Plane packets acquired by the acquisition unit 221A, and the session identification unit 222B of the analysis device 201B generates a session index for the U-Plane packets acquired by the acquisition unit 221B.

[0147] The session index may be generated by performing a predetermined calculation on the source IP address, destination IP address, and TEID stored in each packet. As an example, a session index including a hash value of the source IP address, destination IP address, and TEID is generated.

[0148] The session identification unit 222 supplies the C-Plane packets and the U-Plane packets acquired by the acquisition unit 221 to the linking unit 223 together with the generated session index.

[0149] In step S105, the linking unit 223 links the C-Plane packets and the U-Plane packets based on the session index.

[0150] At this time, for example, the session index of the C-Plane packet supplied from the session identification unit 222A of the analysis device 201A is compared with the session index of the U-Plane packet supplied from the session identification unit 222B of the analysis device 201B. Then, the U-Plane packet having the same session index as the C-Plane packet is linked to the C-Plane packet. This makes it possible to identify data related to communication of the same user and obtain information necessary for analyzing the communication status.

[0151] In step S106, the recording device 202 records sequence information in association with each pair of the C-Plane packet and the U-Plane packet associated with each other by the process of step S105. The sequence information may be, for example, the transmission time or reception time of the packet, or the sequence number of the packet.

[0152] In step S107, the monitoring device 203 performs a detailed analysis of the communication status by referring to each pair of the C-Plane packet and the U-Plane packet whose sequence information is associated with each other by the process of step S106. This allows calculation of, for example, index values ​​related to KPIs.

[0153] In this manner, the packet analysis process is carried out.

[0154] (Effects of the embodiment) According to this embodiment, even if a configuration is adopted in which multiple UPFs are deployed corresponding to a base station, gNodeB, for example, information necessary for analyzing communication conditions can be efficiently obtained.

[0155] In this embodiment, as described above, the C-Plane packet and the U-Plane packet are linked by the session index. Therefore, even if N3, which is a reference point related to the connection between the gNodeB and the UPF, is distributed in different data centers, there is no need to lay a dedicated optical fiber cable for transferring the U-Plane packet acquired by N3 at high speed.

[0156] In addition, in this embodiment, for example, a table for associating TEID with IMSI is not required, so that the processing load of the device can be reduced. Furthermore, the number of C-Plane packets and U-Plane packets that can be linked is not limited by the size of the table, so that the communication status can be analyzed using a large amount of data.

[0157] As described above, according to this embodiment, even if the configuration of the core network becomes complicated, it is possible to timely acquire a large amount of data required to grasp the communication situation.

[0158] Second Embodiment 11, a configuration has been described in which analysis device 201A has acquisition unit 221A, session identification unit 222A, and linking unit 223A, and analysis device 201B has acquisition unit 221B and session identification unit 222B. However, analysis device 201A and analysis device 201B may be devices with the same configuration.

[0159] For example, analysis device 201B may include linking unit 223B, which is a functional block having the same configuration as linking unit 223A. In other words, a plurality of analysis devices 201 having the same configuration may be prepared, and one of them may be used as analysis device 201A and the others may be used as analysis device 201B.

[0160] In this case, the linking unit 223B of the analysis device 201B is not operated, and the C-Plane packets and the U-Plane packets are linked in the linking unit 223A of the analysis device 201A. <Third embodiment>

[0161] In the above-described embodiment, it has been described that the linking between the C-Plane packet and the U-Plane packet is performed in the linking unit 223A of the analysis device 201A. This is because the maintainability of the entire packet analysis system 200 can be improved by linking in the analysis device 201A that is arranged in a concentrated manner, rather than in the analysis device 201B that may be arranged in a distributed manner.

[0162] However, the tying unit 223B in the analysis device 201B may be configured to tie packets of the C-Plane and packets of the U-Plane. For example, the tying unit 223B of the analysis device 201B may be operated, and the tying unit 223A of the analysis device 201A may not be operated. Alternatively, only the analysis device 201B may have the tying unit B, and the analysis device 201A may not be provided with a tying unit.

[0163] Since C-Plane packets are packets related to the control of UE on the network, and U-Plane packets are packets including websites viewed by users and voice data during calls, U-Plane packets generally have a larger data size than C-Plane packets. Here, if the linking is performed in analysis device 201B, it is sufficient to transfer C-Plane packets, which have a relatively small data size, from analysis device 201A to analysis device 201B, and the communication load between analysis device 201A and analysis device 201B can be reduced. <Other embodiments> In the above-mentioned embodiment, an example in which one analysis device 201B is installed for one analysis device 201A, and an example in which many analysis devices 201B are installed for one analysis device 201A have been described, but the present invention is not limited to these. For example, it is also possible to install many analysis devices 201A for one analysis device 201B.

[0164] <Example of software implementation> The above-mentioned analysis device 201 is a program for causing a computer to function, and can be realized by a program for causing a computer to function as the analysis device 201. In this case, the analysis device 201 includes a computer having at least one control device (e.g., a processor) and at least one storage device (e.g., a memory) as hardware for executing the above-mentioned program. An example of such a computer is shown in FIG. 19.

[0165] Computer 500 includes at least one processor 501 and at least one memory 502. Memory 502 stores program 520 for causing computer 500 to operate as analysis device 201. In computer 500, processor 501 reads program 520 from memory 502 and executes it to realize each function of analysis device 201.

[0166] The processor 501 may be, for example, a CPU (Central Processing Unit), a GPU (Graphic Processing Unit), a DSP (Digital Signal Processor), an MPU (Micro Processing Unit), an FPU (Floating point number Processing Unit), a PPU (Physics Processing Unit), a microcontroller, or a combination of these.

[0167] As the memory 502, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or a combination of these can be used.

[0168] The computer 500 may further include a RAM (Random Access Memory) for expanding the program 520 during execution and for temporarily storing various data. The computer 500 may further include a communication interface for transmitting and receiving data to and from other devices. The computer 500 may further include an input / output interface for connecting input / output devices such as a keyboard, a mouse, a display, and a printer.

[0169] Furthermore, the program 520 for causing the computer 500 to operate as the analysis device 201 can be recorded on a non-transitory tangible recording medium 530 that is readable by the computer 500. For example, a tape, a disk, a card, a semiconductor memory, or a programmable logic circuit can be used as such a recording medium 530. The computer 500 can obtain the program 520 via such a recording medium 530.

[0170] Furthermore, the program 520 for operating the computer 500 as the analysis device 201 can be transmitted via a transmission medium. For example, a communication network or a broadcast wave can be used as such a transmission medium. The computer 500 can also obtain the program 520 via such a transmission medium.

[0171] Also, some or all of the functions of analysis device 201 can be realized by logic circuits. For example, an integrated circuit in which a logic circuit that functions as each of the above control blocks is formed is also included in the scope of the present invention. In addition, the functions of each of the above control blocks can be realized by, for example, a quantum computer.

[0172] According to each aspect of the present invention described above, by achieving the above-mentioned effects, it is possible to contribute to the achievement of Goal 9 of the Sustainable Development Goals (SDGs), "Build resilient infrastructure, promote inclusive and sustainable industrialization and innovation."

[0173] The present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the claims. Embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present invention.

[0174] 〔summary〕 The information processing system according to aspect 1 of the present invention includes an acquisition unit that acquires C-Plane packets and U-Plane packets from a core network, an extraction unit that extracts a source address, a destination address, and a TEID (Tunnel Endpoint Identifier) ​​from the U-Plane packets acquired by the acquisition unit, and extracts the source address, destination address, and TEID of the U-Plane packets from information stored in the payload of the C-Plane packets acquired by the acquisition unit, and a linking unit that links the C-Plane packets and U-Plane packets based on the source address, destination address, and TEID extracted by the extraction unit.

[0175] In an information processing system according to aspect 2 of the present invention, in aspect 1 above, the core network is a core network in a 5G communications network, and the acquisition unit acquires C-Plane packets from reference point N2 and reference point N12, and acquires U-Plane packets from reference point N3.

[0176] In the information processing system according to a third aspect of the present invention, in the above-mentioned second aspect, the acquisition unit further acquires packets of the C-Plane from a reference point N26.

[0177] In the information processing system of aspect 4 of the present invention, in aspect 2 or 3 above, the acquisition unit classifies C-Plane packets acquired from reference point N2 into a first type packet and a second type packet by referring to the Procedure Code of the packets, and supplies only packets classified as the first type to the extraction unit.

[0178] In an information processing system according to aspect 5 of the present invention, in aspect 1 above, the core network is a core network in an LTE communication network, and the acquisition unit acquires C-Plane packets from reference point S11 and U-Plane packets from reference point S1-U.

[0179] In the information processing system of aspect 6 of the present invention, in aspect 5 above, the acquisition unit classifies C-Plane packets acquired from reference point S11 into a first type of packet and a second type of packet by referring to the message type of the packet, and supplies only packets classified as the first type to the extraction unit.

[0180] In the information processing system of aspect 7 of the present invention, in aspect 6 above, the acquisition unit further classifies packets classified into the first type into packets of a third type and packets of a fourth type by referring to the value of a predetermined IE (Information Element) stored in the packets, and supplies only packets classified into the third type to the extraction unit.

[0181] In the information processing system of aspect 8 of the present invention, in aspects 1 to 7 above, the extraction unit generates identification information for identifying packets related to communications by each of a plurality of users based on the extracted source address, destination address, and TEID, and the linking unit links the C-Plane packets and U-Plane packets based on the identification information.

[0182] An information processing system according to a ninth aspect of the present invention is based on the above eighth aspect, wherein the identification information includes a hash value of the source address, the destination address, and the TEID.

[0183] An information processing system according to aspect 10 of the present invention, in accordance with aspects 1 to 9 above, has a first acquisition unit and a first extraction unit for packets of the C-Plane, and a second acquisition unit and a second extraction unit for packets of the U-Plane, and for one combination of the first acquisition unit and the first extraction unit, there are multiple combinations of the second acquisition unit and the second extraction unit, and the second acquisition unit and the second extraction unit are arranged in the vicinity of a base station.

[0184] An information processing method according to aspect 11 of the present invention includes the steps of acquiring a C-Plane packet and a U-Plane packet from a core network, extracting a source address, a destination address, and a TEID from the acquired U-Plane packet, and extracting the source address, destination address, and TEID of the U-Plane packet from information stored in the payload of the acquired C-Plane packet, and linking the C-Plane packet and the U-Plane packet based on the extracted source address, destination address, and TEID.

[0185] A program according to aspect 12 of the present invention causes a computer to execute information processing including the steps of acquiring C-Plane packets and U-Plane packets from a core network, extracting a source address, destination address, and TEID from the acquired U-Plane packets, and extracting the source address, destination address, and TEID of the U-Plane packets from information stored in the payload of the acquired C-Plane packets, and linking the C-Plane packets and U-Plane packets based on the extracted source address, destination address, and TEID. [Explanation of symbols]

[0186] 200 Packet Analysis System 201 Analysis equipment 202 Recording Device 203 Monitor Device 221 Acquisition Department 222 Session Identification Part 223 Binding Department

Claims

1. an acquisition unit that acquires packets of a C-Plane and packets of a U-Plane from a core network; (a) extracting a source address, a destination address, and a TEID (Tunnel Endpoint Identifier) ​​from the U-Plane packet acquired by the acquisition unit, and (b) extracting a source address, a destination address, and a TEID of a U-Plane packet corresponding to the C-Plane packet from information stored in a payload of the C-Plane packet acquired by the acquisition unit; a linking unit that links the C-Plane packet with the U-Plane packet based on the source address, destination address, and TEID extracted by the extraction unit; An information processing system comprising:

2. The core network is a core network in a 5G communication network, The acquisition unit acquires packets of the C-Plane from reference point N2 and reference point N12, and acquires packets of the U-Plane from reference point N3. The information processing system according to claim 1 .

3. The acquisition unit further acquires packets of the C-Plane from a reference point N26. The information processing system according to claim 2 .

4. The acquisition unit classifies C-Plane packets acquired from the reference point N2 into first type packets and second type packets by referring to the procedure code of the packets, and supplies only the packets classified into the first type to the extraction unit. The information processing system according to claim 2 .

5. The core network is a core network in an LTE communication network, The acquisition unit acquires packets in the C-Plane from the reference point S11, and acquires packets in the U-Plane from the reference point S1-U. The information processing system according to claim 1 .

6. The acquisition unit classifies C-Plane packets acquired from the reference point S11 into a first type packet and a second type packet by referring to the message type of the packet, and supplies only the packets classified into the first type to the extraction unit.

6. The information processing system according to claim 5.

7. The acquisition unit further classifies the packets classified into the first type into packets of a third type and packets of a fourth type by referring to a value of a predetermined IE (Information Element) stored in the packets, and supplies only the packets classified into the third type to the extraction unit.

7. The information processing system according to claim 6.

8. the extraction unit generates identification information for identifying packets related to communications by each of a plurality of users, based on the extracted source address, destination address, and TEID; The linking unit links the packets of the C-Plane and the packets of the U-Plane based on the identification information. The information processing system according to claim 1 .

9. The identification information includes a hash value of the source address, the destination address, and the TEID. The information processing system according to claim 8.

10. A first acquisition unit and a first extraction unit related to packets of the C-Plane; A second acquisition unit and a second extraction unit related to packets of the U-Plane, For one combination of the first acquisition unit and the first extraction unit, a plurality of combinations of the second acquisition unit and the second extraction unit are provided. The information processing system according to claim 7.

11. acquiring packets of a C-Plane and packets of a U-Plane from a core network; (a) extracting a source address, a destination address, and a TEID from the acquired U-Plane packet; and (b) extracting a source address, a destination address, and a TEID of a U-Plane packet corresponding to the C-Plane packet from information stored in the payload of the acquired C-Plane packet. linking the C-Plane packet with the U-Plane packet based on the extracted source address, destination address, and TEID; An information processing method comprising:

12. On the computer, acquiring packets of a C-Plane and packets of a U-Plane from a core network; (a) extracting a source address, a destination address, and a TEID from the acquired U-Plane packet; and (b) extracting a source address, a destination address, and a TEID of a U-Plane packet corresponding to the C-Plane packet from information stored in the payload of the acquired C-Plane packet. and executing information processing including a step of linking the C-Plane packet with the U-Plane packet based on the extracted source address, destination address, and TEID. program.

Images