Method and apparatus for analyzing abnormal signaling, and readable storage medium

Abstract

The present invention relates to the technical field of networks. Provided are a method and apparatus for analyzing abnormal signaling, and a readable storage medium. The method comprises: acquiring a correspondence between a network user at a fixed position and a network element on which the network user camps (S101); and according to the correspondence between the network user at the fixed position and the network element on which the network user camps, determining whether target signaling is abnormal signaling (S102). The method, apparatus and readable storage medium can solve the problem whereby there is no method for analyzing abnormal signaling that attacks a network user at a fixed position in the prior art.

Description

Abnormal signaling analysis method, device and readable storage medium

[0001] This invention claims priority from a Chinese patent application filed on June 12, 2023, with application number CN202310692558.X and titled “A method, device and readable storage medium for analyzing abnormal signaling attacks.” Technical Field

[0002] The present invention relates to the field of network technology, and in particular to a method and device for analyzing abnormal signaling, and a readable storage medium. Background Art

[0003] Existing 5G network service delivery methods simultaneously move MEC (Mobile Edge Computing) and UPF (User Plane Function) to the user edge, increasing the exposure of the 5G network and making it more vulnerable to attackers. Attackers can use MEC and the edge-side UPF as a springboard to attack the 5G core network and fixed-location network users (such as private network users). If attackers gain access to user information, they can impersonate 5G core network elements or hijack 5G core network elements to send attack messages to private network users, such as logging off, releasing PDU (Protocol Data Unit) and PFCP (Packet Forwarding Control Protocol) connections, thereby impacting the services of private network users. Private network users are often important users in areas such as power grids and industrial manufacturing, and an attack would be severely impacted. Currently, the industry primarily identifies abnormal terminal behavior based on traffic flow, and has not analyzed attacks specifically targeting these private network users.

[0004] Summary of the Invention

[0005] The technical problem to be solved by the present invention is to address the above-mentioned deficiencies in the prior art and provide a method, device and readable storage medium for analyzing abnormal signaling, which can analyze abnormal signaling that attacks fixed-location network users.

[0006] In a first aspect, the present invention provides a method for analyzing abnormal signaling, comprising:

[0007] Obtaining the correspondence between fixed-location network users and their resident network elements;

[0008] Whether the target signaling is abnormal signaling is determined according to the corresponding relationship between the fixed-location network user and the resident network element.

[0009] Optionally, the fixed-location network users include Internet of Things users and / or private network users in the 5G network.

[0010] Optionally, obtaining a correspondence between a fixed-location network user and its resident network element specifically includes:

[0011] Obtaining the correspondence between the user ID of a fixed-location network user and the IP address of the network element where the user resides;

[0012] The user identifier includes at least one of the following: a user permanent identifier SUPI, a protocol data unit PDU session identifier ID, an identifier AMF UE NGAP ID used by the AMF side to distinguish the user equipment UE, an identifier RAN UE NGAP ID used by the base station side to distinguish the UE, and a full session endpoint identifier F-SEID;

[0013] The resident network element includes at least one of the following: a base station, an access and mobility management function AMF, a session management function SMF, and a user plane function UPF.

[0014] Optionally, obtaining the correspondence between the user identifier of the fixed-location network user and the IP address of the network element where the user resides specifically includes:

[0015] Obtain the correspondence between the SUPI, PDU session identifier ID, AMF UE NGAP ID, RAN UE NGAP ID, F-SEID of the fixed location network user and the IP addresses of the base station, AMF, SMF, and UPF.

[0016] Optionally, the determining whether the target signaling is abnormal signaling according to the correspondence between the fixed-location network user and its resident network element specifically includes:

[0017] It is determined whether the IP address of the actual network element corresponding to the fixed-location network user in the key signaling process is consistent with the IP address of the resident network element in the corresponding relationship. If not, the target signaling is determined to be abnormal signaling.

[0018] Optionally, the key signaling process includes: a UE context release process for interacting with the fixed location network user and a Packet Forwarding Control Protocol PFCP session deletion process.

[0019] In a second aspect, the present invention provides an abnormal signaling analysis device, comprising:

[0020] A correspondence acquisition module, used to acquire the correspondence between a fixed-location network user and its resident network element;

[0021] The abnormal signaling judgment module is connected to the corresponding relationship acquisition module and is used to judge whether the target signaling is abnormal signaling according to the corresponding relationship between the fixed-location network user and its resident network element.

[0022] Optionally, the fixed-location network users include Internet of Things users and / or private network users in the 5G network.

[0023] Optionally, the corresponding relationship acquisition module specifically includes:

[0024] A correspondence obtaining unit, configured to obtain a correspondence between a user identifier of a fixed-location network user and an IP address of a network element where the user resides;

[0025] The user identifier includes at least one of the following: a user permanent identifier SUPI, a protocol data unit PDU session identifier ID, an identifier AMF UE NGAP ID used by the AMF side to distinguish the user equipment UE, an identifier RAN UE NGAP ID used by the base station side to distinguish the UE, and a full session endpoint identifier F-SEID;

[0026] The resident network element includes at least one of the following: a base station, an access and mobility management function AMF, a session management function SMF, and a user plane function UPF.

[0027] Optionally, the corresponding relationship acquiring unit is specifically configured to:

[0028] Obtain the correspondence between the SUPI, PDU session identifier ID, AMF UE NGAP ID, RAN UE NGAP ID, F-SEID of the fixed location network user and the IP addresses of the base station, AMF, SMF, and UPF.

[0029] Optionally, the abnormal signaling judgment module is specifically used to:

[0030] It is determined whether the IP address of the actual network element corresponding to the fixed-location network user in the key signaling process is consistent with the IP address of the resident network element in the corresponding relationship. If not, the target signaling is determined to be abnormal signaling.

[0031] Optionally, the key signaling process includes: a UE context release process for interacting with the fixed location network user and a Packet Forwarding Control Protocol PFCP session deletion process.

[0032] In a third aspect, the present invention provides an abnormal signaling analysis device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the abnormal signaling analysis method described in the first aspect.

[0033] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method for analyzing abnormal signaling described in the first aspect above is implemented.

[0034] The present invention provides an abnormal signaling analysis method, device, and readable storage medium. Based on the characteristics of fixed-location network users in a 5G network, the corresponding relationship between the fixed-location network user and the network element in which it resides is first obtained. Since the location of the fixed-location network user is relatively fixed, the network element in which it resides is also relatively fixed. Therefore, based on the corresponding relationship between the fixed-location network user and the network element in which it resides, it is possible to directly determine whether the target signaling is abnormal signaling. Finally, abnormal signaling that attacks fixed-location network users in the 5G network is analyzed, thereby preventing the user's business from being affected by the attacker, and solving the problem that there is no analysis method for abnormal signaling that attacks fixed-location network users in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] FIG1 is a scenario diagram of a method for analyzing abnormal signaling according to an embodiment of the present invention;

[0036] FIG2 is a flow chart of a method for analyzing abnormal signaling according to Example 1 of the present invention;

[0037] 3 is a schematic diagram of the structure of a data packet corresponding to target signaling according to an embodiment of the present invention;

[0038] FIG4 is a schematic structural diagram of an abnormal signaling analysis device according to Example 2 of the present invention;

[0039] FIG5 is a schematic structural diagram of an abnormal signaling analysis device according to Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further optionally described in detail below with reference to the accompanying drawings.

[0041] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0042] It is understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments may be combined with each other.

[0043] It can be understood that, for the convenience of description, the drawings of the present invention only show parts related to the present invention, while parts unrelated to the present invention are not shown in the drawings.

[0044] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0045] It will be understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0046] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented using a hardware-based system that implements the specified functions, or may be implemented using a combination of hardware and computer instructions.

[0047] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0048] It should be noted that the scenario diagram described in the embodiment of the present application is intended to more clearly illustrate the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided by the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

[0049] As shown in Figure 1, this is a scenario diagram of an abnormal signaling analysis method provided in an embodiment of the present application, wherein fixed-location network users generally refer to users whose locations are fixed within a certain range, including Internet of Things users in 5G networks, private network users (i.e., 5G private network users), etc. A private network refers to a professional network that achieves network signal coverage in a specific area and provides communication services to specific users in organization, command, management, production, scheduling and other aspects. A 5G private network refers to a dedicated 5G network serving specific users. Under normal circumstances, since the locations of IoT users and private network users are relatively fixed, such as the locations of private network users in power grids and industrial manufacturing, they will not move over a large range. Therefore, the base stations accessed by IoT users and private network users and the resident AMF (Access and Mobility Management Function), SMF (Session Management Function), UPF and other network elements are also relatively fixed. As shown in Figure 1, if other base stations, AMF, SMF, or UPF send offline, PDU release, PFCP connection and other signaling to fixed-location network users, it means that such signaling is abnormal signaling, and the network elements sending these signaling may have been attacked or counterfeited.

[0050] Specifically, as shown in Figure 1, the N2 interface between the base station and the AMF uses the NGAP (Next Generation Application Protocol) protocol. NGAP provides two types of services:

[0051] 1) Non-UE (User Equipment) related services: These NGAP services are related to the N2 interface instance between the eNB and the AMF and are used to establish an NGAP signaling connection between the eNB and the AMF, handle certain overload situations and exchange eNB and AMF configuration data;

[0052] 2) UE-related services: These NGAP services are related to the UE and involve signaling related to UE activity processes such as UE activity status, registration; PDU session establishment, deregistration, etc.

[0053] The N4 interface between UPF and SMF is used for interaction between the control plane and the user plane, and provides relevant services to users by establishing a PFCP connection.

[0054] Therefore, if AMF or SMF is controlled or impersonated by an attacker, it is possible that the 5GC (5GCore) network element will send a release NGAP connection or release PFCP connection message when the user needs normal services, resulting in the user being unable to send services normally. IoT users and private network users are mostly important users such as industrial manufacturing and power grids. The inability to send normal services will lead to serious consequences. For example, SMF initiates the PDU release process by sending a PDU SESSION RELEASE COMMAND message to the private network user, wherein the PDU SESSION RELEASE COMMAND message carries the PDU session ID to distinguish the PDU sessions of different users; AMF initiates the UE Context Release process by sending a UE CONTEXT RELEASE COMMAND message to the private network user, wherein the UE CONTEXT RELEASE COMMAND message carries the AMF UE NGAP ID between the AMF and the UE and the RAN UE NGAP ID between the RAN and the UE to distinguish the NGAP connections of different users. If the connection of the corresponding NGAP ID of the private network user is released, the subsequent services of the private network user will be affected; SMF initiates the PFCP Session Deletion process by sending a PFCP Session Deletion Request message to the private network user, wherein the PFCP Session Deletion Request message carries the F-SEID (Full Qualified SEID (full session endpoint identifier) ​​is used to distinguish PFCP connections of different users. If the corresponding PFCP connection of a user is released, the service forwarding of the private network user will be affected.

[0055] In response to the above technical problems, the idea of ​​this application is to provide an analysis method, device and readable storage medium for abnormal signaling, taking advantage of the fact that the locations of fixed-location network users in the 5G network are relatively fixed, and therefore the access base stations, AMF, SMF, UPF and other network elements are also relatively fixed, and through the correspondence between fixed-location network users and their resident network elements, determine whether the target signaling is abnormal signaling, thereby analyzing such abnormal signaling that launches attacks on fixed-location network users.

[0056] Based on the scenario diagram shown in FIG1 , the following introduces relevant embodiments of the abnormal signaling analysis method involved in this application.

[0057] Example 1:

[0058] This embodiment provides a method for analyzing abnormal signaling, as shown in FIG2 , which includes:

[0059] Step S101: Obtain the correspondence between a fixed-location network user and its resident network element.

[0060] Step S102: judging whether the target signaling is abnormal signaling according to the corresponding relationship between the fixed-location network user and its resident network element.

[0061] In this embodiment, fixed-location network users include IoT users and private network users in the 5G network. Since the locations of fixed-location network users are relatively fixed, the network elements in which they reside are also relatively fixed. Therefore, whether the target signaling is abnormal signaling can be determined based on the corresponding relationship between the fixed-location network users and the network elements in which they reside.

[0062] Optionally, obtaining a correspondence between a fixed-location network user and its resident network element specifically includes:

[0063] Obtaining the correspondence between the user ID of a fixed-location network user and the IP address of the network element where the user resides;

[0064] The user identifier includes at least one of the following: SUPI (Subscription Permanent Identifier), protocol data unit PDU session identifier ID, AMF UE NGAP ID used by the AMF side to distinguish the user equipment UE, RAN UE NGAP ID used by the base station side to distinguish the UE, and full session endpoint identifier F-SEID;

[0065] The resident network element includes at least one of the following: a base station, an access and mobility management function AMF, a session management function SMF, and a user plane function UPF.

[0066] In this embodiment, the correspondence between the user identifiers of the fixed-location network user, such as the SUPI, PDU session identifier ID, AMF UE NGAP ID, RAN UE NGAP ID, and F-SEID, and the IP addresses of the resident network elements, such as the base station, AMF, SMF, and UPF, can be obtained. For example, the correspondence between the user identifier of the fixed-location network user and the IP address of the resident network element can be as shown in Table 1.

[0067] Table 1: Correspondence between user IDs of fixed-location network users and IP addresses of resident network elements

[0068] In this embodiment, after a fixed-location network user accesses the network, it resides in a certain base station. At the same time, corresponding AMF, SMF, and UPF network elements will interact with it to provide services for it. Therefore, the resident network element includes at least one of the following: base station, AMF, SMF, and UPF. However, obtaining the correspondence between the user identity of a fixed-location network user and the IP address of its resident network element is not limited to the following three methods:

[0069] (1) The SUPI and location information of the fixed-location network user are known. Based on the SUPI and location information, the base station, AMF, SMF, and UPF network element information to which the fixed-location network user will connect are inferred, thereby obtaining the correspondence between the user ID of the fixed-location network user and the IP address of the network element where the user resides.

[0070] (2) Identify the relevant signaling of the fixed-location network user accessing the 5G network (such as a 5G private network) from the traffic of the N1 / N2 / N4 interface, and identify the relevant information of the fixed-location network user from the signaling message, so as to obtain the correspondence between the user identification of the fixed-location network user and the IP address of the network element where the user resides.

[0071] Optionally, before determining whether the target signaling is abnormal signaling based on the correspondence between the fixed-location network user and its resident network element, the method further includes:

[0072] Collect signaling traffic from N1 / N2 / N4 interfaces in the private network;

[0073] The signaling traffic is parsed to obtain the target signaling.

[0074] In this embodiment, since attackers typically use network elements on the downlink side as a springboard to attack the 5G core network or fixed-location network users, by monitoring and analyzing the signaling traffic on the N1, N2, and N4 interfaces on the downlink side, it is possible to analyze abnormal signaling that attacks fixed-location network users. Specifically, N1 / N2 / N4 interface signaling traffic is collected from the 5G network using traffic mirroring or other methods, including but not limited to relevant mirrored traffic obtained from the switch. After traffic collection, the traffic on the N1 / N2 / N4 interfaces is parsed based on the protocol type to restore the signaling information of the private network users, such as messages for signaling processes such as the N1 interface PDU session release procedure and NAS transport procedure; messages for signaling processes such as the N2 interface PDU Session Management Procedures and UE Context Management Procedures; and messages for signaling processes such as the N4 interface PFCP Association Setup Procedure, PFCP Association Update Procedure, and PFCP Association Release Procedure.

[0075] Optionally, the determining whether the target signaling is abnormal signaling according to the correspondence between the fixed-location network user and its resident network element specifically includes:

[0076] It is determined whether the IP address of the actual network element corresponding to the fixed-location network user in the key signaling process is consistent with the IP address of the resident network element in the corresponding relationship. If not, the target signaling is determined to be abnormal signaling.

[0077] In this embodiment, the core network can determine whether the target signaling is the signaling sent by the resident network element of the fixed-location network user based on the corresponding relationship between the fixed-location network user and its resident network element; if so, the target signaling is determined to be normal signaling; otherwise, the target signaling is determined to be abnormal signaling.

[0078] Specifically, the core network can first obtain the target user identifier in the target signaling; then search for the target IP address of the target resident network element corresponding to the target user identifier in the correspondence between the fixed-location network user and its resident network element; then determine whether the target IP address is consistent with the IP address in the target signaling packet header; if they are consistent, it is determined that the target signaling is the signaling sent by the resident network element of the fixed-location network user, that is, the target signaling is normal signaling; otherwise, it is determined that the target signaling is not the signaling sent by the resident network element of the fixed-location network user, that is, the target signaling is abnormal signaling.

[0079] In this embodiment, as shown in Figure 3, the data packet corresponding to the target signaling generally includes a source address, a destination address, a data part, etc. The source address is the address of the signaling sender, and the destination address is the address of the signaling receiver. The data part generally includes a user identifier. For example, the data part may include fields such as PDU session ID or AMF UE NGAP ID or RAN UE NGAP ID or F-SEID. The content of the data part may include different fields for different signaling. For example, the data part of the PDU SESSION RELEASE COMMAND signaling message includes the PDU session ID field, and the data part of the UE CONTEXT RELEASE COMMAND signaling message includes the AMF UE NGAP ID and RAN UE NGAP ID fields; the data part in the PFCP Session Deletion Request signaling message includes the F-SEID field.

[0080] In this embodiment, after obtaining the target user identifier in the target signaling, the target IP address of the target resident network element corresponding to the target user identifier is searched in the correspondence between the fixed-location network user and the IP address of the resident network element shown in Table 1; the target resident network element can be the signaling sender or the signaling receiver, and the IP address of the target resident network element is compared with the source address or destination address in the packet header of the target signaling to see if they are consistent. If they are consistent, it is the signaling sent by the resident network element of the fixed-location network user; otherwise, it is not the signaling sent by the resident network element of the fixed-location network user. For example, if the target signaling is UE CONTEXT RELEASE REQUEST (message direction is NG-RAN node→AMF), the source address is the base station IP, the destination address is the AMF IP, and the user identifier is the AMF UE NGAP ID and the RAN UE NGAP ID. If you want to determine whether the base station is under attack or is a counterfeit network element, you can look up the base station IP corresponding to the resident base station in Table 1 based on the AMF UE NGAP ID and the RAN UE NGAP ID, and compare the base station IP with the source address in the UE CONTEXT RELEASE REQUEST to see if they are consistent. If they are inconsistent, it is determined to be abnormal signaling. Correspondingly, if you want to determine whether the AMF is under attack or is a counterfeit network element, you can look up the AMF IP corresponding to the resident AMF in Table 1 based on the AMF UE NGAP ID and the RAN UE NGAP ID, and compare the AMF IP with the destination address in the UE CONTEXT RELEASE REQUEST to see if they are consistent. If they are inconsistent, it is determined to be abnormal signaling.

[0081] Optionally, the target IP address includes a target source IP address and a target destination IP address, and determining whether the target IP address is consistent with the IP address in the target signaling packet header specifically includes:

[0082] Determine whether the target source IP address and the target destination IP address are consistent with the source address and the destination address in the target signaling packet header, respectively.

[0083] In this embodiment, since both the signaling sender and the signaling receiver are vulnerable to attacks, the target resident network element includes the signaling sender and the signaling receiver, and the target IP address of the target resident network element includes the IP address corresponding to the signaling sender, that is, the target source IP address, and also includes the IP address corresponding to the signaling receiver, that is, the target destination IP address. For example, taking the target signaling as UE CONTEXT RELEASE COMMAND as an example, the message direction is AMF→NG-RAN node, the source address is AMF IP, the destination address is base station IP, and the user identifier is AMF UE NGAP ID and RAN UE NGAP ID. The IP corresponding to the resident base station and the resident AMF in Table 1 can be searched according to the AMF UE NGAP ID and RAN UE NGAP ID, and the found AMF IP is compared with the source address in the target signaling, and the found base station IP is compared with the destination address in the target signaling to see whether they are consistent. If they are inconsistent, it is judged as abnormal signaling.

[0084] Optionally, the key signaling process includes: a UE context release process for interacting with the fixed location network user and a Packet Forwarding Control Protocol PFCP session deletion process.

[0085] In this embodiment, key signaling processes may include UE context release procedure (UE Context Release procedure), UE context management procedure (UE Context Management Procedures), PFCP session deletion procedure (PFCP Session Deletion Request), PFCP setup procedure (PFCP Association Setup Procedure), PFCP update procedure (PFCP Association Update Procedure), PFCP release procedure (PFCP Association Release Procedure), PDU session release procedure (PDU session release procedure), PDU session management procedure (PDU Session Management Procedures), NAS transport procedure (NAS transport procedure), etc. It should be noted that since there are many signaling processes, it is impossible to list them one by one. The above signaling process is only an example. This embodiment may also include other signaling processes.

[0086] Optionally, if the target signaling is signaling related to a PDU session or signaling related to non-access stratum NAS transmission, the user identifier is the PDU session identifier ID; if the target signaling is signaling related to the UE context, the user identifier is the AMF UE NGAP ID and the RAN UE NGAP ID; if the target signaling is signaling related to the packet forwarding control protocol PFCP, the user identifier is the F-SEID.

[0087] In a specific embodiment, taking the fixed-location network user as a private network user of a 5G network as an example, the abnormal signaling analysis method may include the following steps:

[0088] (1) Obtain the correspondence between private network users and 5G resident network elements.

[0089] After a private network user accesses the network, it resides in a base station. At the same time, corresponding AMF, SMF, and UPF network elements interact with the private network user to provide services. The correspondence between private network users and their resident network elements is shown in Table 1. It should be noted that the information related to private network users in Table 1 only lists four user identifiers: PDU session ID, AMF UE NGAP ID, RAN UE NGAP ID, and F-SEID. Depending on the signaling to be analyzed, other user-related identifiers may also be present. These identifiers depend on the implementation and are not listed here.

[0090] Depending on the specific implementation, there are multiple ways to obtain the corresponding relationship shown in Table 1, including but not limited to the following three methods:

[0091] First, the SUPI and location information of the private network user are known. The information of the base station, AMF, SMF, and UPF network elements to be connected can also be inferred based on the location information. This information is stored in advance to form a table as shown in Table 1.

[0092] Second, from the traffic of the N1 / N2 / N4 interface, identify the signaling messages related to the private network user accessing the network, identify the information related to the private network user from the signaling messages and store it to form a table as shown in Table 1.

[0093] (2) Collect and analyze the signaling traffic of the N1 / N2 / N4 interfaces of the 5G private network.

[0094] Collect N1 / N2 / N4 interface signaling traffic from the 5G network through traffic mirroring or other means, including but not limited to obtaining relevant mirrored traffic from the switch. After traffic collection, parse the traffic based on the protocol type on the N1 / N2 / N4 interface to restore the signaling information of the private network users, such as messages related to signaling processes such as the N1 interface PDU session release procedure and NAS transport procedure; messages related to signaling processes such as the N2 interface PDU Session Management Procedures and UE Context Management Procedures; and messages related to signaling processes such as the N4 interface PFCP Association Setup Procedure, PFCP Association Update Procedure, and PFCP Association Release Procedure.

[0095] (3) Analyze the signaling and determine whether it is abnormal signaling based on the signaling attack analysis model.

[0096] The data packet format of the signaling is shown in Figure 3. The IP addresses of the sender and receiver of the data packet can be obtained by parsing the data packet. Based on the correspondence between the private network user and the 5G resident network element, it can be determined whether the network element sending this signaling message is the resident network element of the private network user. If not, it is an abnormal attack signaling.

[0097] The signaling attack analysis model specifically includes:

[0098] The first step is to parse the signaling process related to the target process. For example, the signaling related to the PDU session release procedure on the N1 interface, including signaling messages such as PDU SESSION RELEASE COMMAND, the signaling related to the UE Context Release procedure on the N2 interface, including signaling messages such as UE CONTEXT RELEASE COMMAND, and the signaling related to the PFCP Session Deletion procedure on the N4 interface, including signaling messages such as PFCP Session Deletion Request.

[0099] The second step is to obtain the key fields required for analysis, such as the PDU session ID field in the PDU SESSION RELEASE COMMAND signaling message; the AMF UE NGAP ID and RAN UE NGAP ID fields in the UE CONTEXT RELEASE COMMAND signaling message; and the F-SEID field in the PFCP Session Deletion Request signaling message.

[0100] The third step is to determine whether the message is sent by the private network user's resident network element. Using the above-mentioned correspondence table between private network users and 5G resident network elements, search for the user corresponding to the PDU session ID, AMF UE NGAP ID or RAN UE NGAP ID or F-SEID and the network element where the user should reside. Compare the IP address of the network element where the user should reside with the IP address in the UE CONTEXT RELEASE COMMAND signaling message or the PFCP Session Deletion Request signaling message header to see if they are consistent. If they are consistent, the message is sent by the private network user's resident network element; otherwise, the message is not sent by the private network user's resident network element.

[0101] In the fourth step, if the message is sent by the private network user's resident network element, it is normal signaling; otherwise, it is abnormal signaling.

[0102] The fifth step is to determine that an attack has been launched on the target user based on the abnormal signaling, and at the same time warn that the network element sending this signaling may be hijacked or controlled or is a counterfeit network element.

[0103] The abnormal signaling analysis method provided by the embodiment of the present invention first obtains the corresponding relationship between the fixed-position network user and the network element in which it resides, based on the characteristics of the fixed-position network user in the 5G network. Since the position of the fixed-position network user is relatively fixed, the network element in which it resides is also relatively fixed. Therefore, according to the corresponding relationship between the fixed-position network user and the network element in which it resides, it is possible to directly judge whether the target signaling is abnormal signaling, and finally analyze the abnormal signaling that attacks the fixed-position network user in the 5G network, thereby avoiding the user's business from being affected by the attacker, and solving the problem that there is no analysis method for abnormal signaling that attacks the fixed-position network user in the prior art.

[0104] Example 2:

[0105] As shown in FIG4 , this embodiment provides an abnormal signaling analysis device, which is used to execute the above abnormal signaling analysis method, including:

[0106] A correspondence relationship acquisition module 11 is used to obtain a correspondence relationship between a fixed-location network user and its resident network element;

[0107] The abnormal signaling judgment module 12 is connected to the corresponding relationship acquisition module 11 and is used to judge whether the target signaling is abnormal signaling according to the corresponding relationship between the fixed-location network user and its resident network element.

[0108] Optionally, the fixed-location network users include Internet of Things users and / or private network users in the 5G network.

[0109] Optionally, the corresponding relationship acquisition module 11 specifically includes:

[0110] A correspondence obtaining unit, configured to obtain a correspondence between a user identifier of a fixed-location network user and an IP address of a network element where the user resides;

[0111] The user identifier includes at least one of the following: a user permanent identifier SUPI, a protocol data unit PDU session identifier ID, an identifier AMF UE NGAP ID used by the AMF side to distinguish the user equipment UE, an identifier RAN UE NGAP ID used by the base station side to distinguish the UE, and a full session endpoint identifier F-SEID;

[0112] The resident network element includes at least one of the following: a base station, an access and mobility management function AMF, a session management function SMF, and a user plane function UPF.

[0113] Optionally, the corresponding relationship acquiring unit is specifically configured to:

[0114] Obtain the correspondence between the SUPI, PDU session identifier ID, AMF UE NGAP ID, RAN UE NGAP ID, F-SEID of the fixed location network user and the IP addresses of the base station, AMF, SMF, and UPF.

[0115] Optionally, the abnormal signaling judgment module 12 is specifically configured to:

[0116] It is determined whether the IP address of the actual network element corresponding to the fixed-location network user in the key signaling process is consistent with the IP address of the resident network element in the corresponding relationship. If not, the target signaling is determined to be abnormal signaling.

[0117] Optionally, the key signaling process includes: a UE context release process for interacting with the fixed location network user and a Packet Forwarding Control Protocol PFCP session deletion process.

[0118] Example 3:

[0119] 5 , this embodiment provides an abnormal signaling analysis device, including a memory 21 and a processor 22 . The memory 21 stores a computer program, and the processor 22 is configured to run the computer program to execute the abnormal signaling analysis method in Example 1.

[0120] The memory 21 is connected to the processor 22 . The memory 21 may be a flash memory, a read-only memory, or other memory. The processor 22 may be a central processing unit or a single-chip microcomputer.

[0121] Example 4:

[0122] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the abnormal signaling analysis method in the above-mentioned embodiment 1 is implemented.

[0123] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0124] To sum up, the abnormal signaling analysis device and readable storage medium provided by the embodiments of the present invention, based on the characteristics of fixed-position network users in the 5G network, first obtain the corresponding relationship between the fixed-position network users and their resident network elements. Since the positions of the fixed-position network users are relatively fixed, the resident network elements are also relatively fixed. Therefore, according to the corresponding relationship between the fixed-position network users and their resident network elements, it is possible to directly judge whether the target signaling is abnormal signaling, and finally analyze such abnormal signaling that attacks the fixed-position network users in the 5G network, thereby avoiding the user's business being affected by the attacker, and solving the problem that there is no analysis method for abnormal signaling that attacks the fixed-position network users in the prior art.

[0125] It will be understood that the above embodiments are merely exemplary embodiments for illustrating the principles of the present invention, and the present invention is not limited thereto. Those skilled in the art will appreciate that various modifications and improvements can be made without departing from the spirit and substance of the present invention, and such modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for analyzing abnormal signaling, characterized in that: include: Obtaining the correspondence between fixed-location network users and their resident network elements; Whether the target signaling is abnormal signaling is determined according to the corresponding relationship between the fixed-location network user and the resident network element.

2. The method according to claim 1, characterized in that The fixed-location network users include Internet of Things users and / or private network users in the 5G network.

3. The method according to claim 1, characterized in that The obtaining of the correspondence between the fixed-location network user and the resident network element thereof specifically includes: Obtaining the correspondence between the user ID of a fixed-location network user and the IP address of the network element where the user resides; The user identifier includes at least one of the following: a user permanent identifier SUPI, a protocol data unit PDU session identifier ID, an identifier AMF UE NGAP ID used by the AMF side to distinguish the user equipment UE, an identifier RAN UE NGAP ID used by the base station side to distinguish the UE, and a full session endpoint identifier F-SEID; The resident network element includes at least one of the following: a base station, an access and mobility management function AMF, a session management function SMF, and a user plane function UPF.

4. The method according to claim 3, characterized in that The obtaining of the correspondence between the user identification of the fixed-location network user and the IP address of the network element where the user resides specifically includes: Obtain the correspondence between the SUPI, PDU session identifier ID, AMF UE NGAP ID, RAN UE NGAP ID, F-SEID of the fixed location network user and the IP addresses of the base station, AMF, SMF, and UPF.

5. The method according to claim 1, wherein The determining whether the target signaling is abnormal signaling according to the correspondence between the fixed-location network user and its resident network element specifically includes: It is determined whether the IP address of the actual network element corresponding to the fixed-location network user in the key signaling process is consistent with the IP address of the resident network element in the corresponding relationship. If not, the target signaling is determined to be abnormal signaling.

6. The method according to claim 5, characterized in that The key signaling process includes: a UE context release process interacting with the fixed location network user and a Packet Forwarding Control Protocol PFCP session deletion process.

7. An abnormal signaling analysis device, characterized in that: include: A correspondence acquisition module, used to acquire the correspondence between a fixed-location network user and its resident network element; The abnormal signaling judgment module is connected to the corresponding relationship acquisition module and is used to judge whether the target signaling is abnormal signaling according to the corresponding relationship between the fixed-location network user and its resident network element.

8. The device according to claim 7, characterized in that The fixed-location network users include Internet of Things users and / or private network users in the 5G network.

9. The device according to claim 7, characterized in that The corresponding relationship acquisition module specifically includes: A correspondence obtaining unit, configured to obtain a correspondence between a user identifier of a fixed-location network user and an IP address of a network element where the user resides; The user identifier includes at least one of the following: a user permanent identifier SUPI, a protocol data unit PDU session identifier ID, an identifier AMF UE NGAP ID used by the AMF side to distinguish the user equipment UE, an identifier RAN UE NGAP ID used by the base station side to distinguish the UE, and a full session endpoint identifier F-SEID; The resident network element includes at least one of the following: a base station, an access and mobility management function AMF, a session management function SMF, and a user plane function UPF.

10. The device according to claim 9, characterized in that The corresponding relationship acquisition unit is specifically used to: Obtain the correspondence between the SUPI, PDU session identifier ID, AMF UE NGAP ID, RAN UE NGAP ID, F-SEID of the fixed location network user and the IP addresses of the base station, AMF, SMF, and UPF.

11. The device according to claim 7, characterized in that The abnormal signaling judgment module is specifically used to: It is determined whether the IP address of the actual network element corresponding to the fixed-location network user in the key signaling process is consistent with the IP address of the resident network element in the corresponding relationship. If not, the target signaling is determined to be abnormal signaling.

12. The device according to claim 11, characterized in that The key signaling process includes: a UE context release process interacting with the fixed location network user and a Packet Forwarding Control Protocol PFCP session deletion process.

13. An abnormal signaling analysis device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the abnormal signaling analysis method according to any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the abnormal signaling analysis method according to any one of claims 1 to 6.

Images