Method and device for service validation under heterogeneous network architecture

Abstract

Disclosed in the present invention are a method and device for service validation under a heterogeneous network architecture, for use in a fifth-generation communication system. The method comprises: first deploying a user validation function for a control plane network element; then a control plane newly adding a user validation information reporting trigger condition in reporting trigger conditions of a flow detection rule and a flow control rule, and issuing the flow detection rule; a user plane successfully loading the reporting trigger condition, and upon triggering the newly added reporting trigger condition, inserting user validation information into user validation information newly added in a PFCP session report request; the control plane receiving the PFCP session report request of the user plane, detecting whether the report type is a user validation information report, and performing verification; and if a verification result indicates that the verification is successful, allowing a user session service, or otherwise, triggering a session release procedure. According to the present invention, a data network end can effectively improve, without performing security protection upgrade, the level of preventing pseudo users and illegitimate services from attacking a service server, and effective technical supplementation is carried out on a satellite-terrestrial integrated security technology architecture.

Description

A method and device for verifying the legality of services in a heterogeneous network architecture Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and device for verifying the legitimacy of services under a heterogeneous network architecture. Background Art

[0002] Currently, the 3rd Generation Partnership Project (3GPP) has only proposed research on non-terrestrial networks (NTNs) on the Radio Access Network side of the fifth-generation communication system (5G). There are no study items or work items on the 5G core network standardization agenda. Currently, the security of the integrated space and ground network network requires comprehensive consideration from the perspectives of physical security, data security, and network operation security. This includes, but is not limited to, terminal connection security, space-based access network connection security, space-based core network connection security, ground-based access network connection security, ground-based core network connection security, network functional security, user data security, network physical and logical isolation, network management security, network configuration security, and space-based service security. Technical measures that can be adopted include, but are not limited to, anti-destruction technologies, anti-interference technologies, secure access and secure routing technologies, secure transmission, secure storage, and key management technologies to build a space-based network security architecture and ensure the secure operation of the network system.

[0003] In existing technology, unauthorized users use terminals legally registered with the 5G system to launch illegal services and seize the limited hardware processing resources of the satellite core network's user plane, control plane, and user plane used for the 5G relay pipeline. For example, these users can use denial of service (DoS) attacks to reduce the service processing capabilities of the user and control planes. Furthermore, unauthorized users can also launch attacks on the data network (DNN) through the service relay pipeline composed of the satellite core network user plane and the 5G core network user plane in the satellite-ground integrated network.

[0004] As shown in Figure 1, the existing satellite-ground integrated architecture is based on the existing non-roaming 5G architecture. 5G terminals connect to 5G base stations via the air interface. The 5G base station's backhaul network is connected to the remote 5G core network via a satellite relay through the satellite core network service pipe. Users ultimately connect to the data network (DN) through the 5G data pipe relayed by the satellite. The satellite user plane only provides pipe relay functions between the 5G base station and the 5G core network and cannot parse the control plane and user plane (UP) messages of 5G users.

[0005] Currently, the 5G core network only provides terminal authentication. There is no method for authenticating the legitimacy of users using legally registered 5G terminals (using a mobile phone legally registered with the 5G core network and inserted with a legitimate user's SIM card). The authentication of user legitimacy relies on the security protection measures of the data network server itself. As shown in Figure 2, the 5G core network control plane network elements in the present invention include the access mobility management network element (AMF Access and Mobility Management Function), the session management function network element, the unified data management (UDM Unified Data Management) network element, and the policy control network element (PCF Policy Control Function). The 5G core network user plane network elements include the user plane function network element (UPF User Plane Function).

[0006] The method for establishing / modifying / releasing services initiated by existing 5G users is shown in Figure 2.

[0007] 1. After the terminal device accesses the network, it authenticates the 5G core network through the control plane AMF and registers successfully.

[0008] 2. The user initiates a service process using a terminal that has successfully registered with the core network and sends a packet data unit (PDU) session establishment / modification / release request (Session Establishment / Modification / Release Request) message to the 5G core network AMF.

[0009] 3. After receiving the session establishment, modification, and deletion request, AMF sends the corresponding session management context establishment / modification request (Nsmf_PDUSession_Create / UpdateSMContext Request) service to SMF (the packet data unit session establishment request triggers the session management context establishment request, and the packet data unit session modification and deletion request corresponds to the session context modification request), and carries the session establishment, modification, and deletion request triggered by the service received from the terminal.

[0010] 4. After receiving the session context establishment / modification request, SMF performs the session operation (establishment / modification / deletion) process between core network elements including UDM, UPF, and PCF.

[0011] 5. SMF executes the session establishment / modification / deletion process between the core network and the terminal.

[0012] 6. After the SMF successfully establishes / modifies the user data pipeline through interaction between control plane network elements, the uplink and downlink service data between the user and the DNN server is forwarded through the UPF. Note that when the session is successfully deleted, the core network service context and data pipeline are deleted, so this step is ignored.

[0013] 7. After the user plane session pipe is established in UPF, the user uses the session pipe for business data transmission. The legitimacy of users using legal terminals registered with 5G and the initiation of services depends on the security protection measures of the data network (DN) server itself.

[0014] In the existing 5G system control plane and user plane separation architecture, the control plane (SMF) uses the Packet Forwarding Control Protocol (PFCP) (3GPP TS29.244) to detect and control the user plane (UPF) service flow. Figure 3 shows the specific steps as follows:

[0015] 1. The control plane session management function (SMF) sends traffic detection and traffic control rules to the user plane function (UPF) through the PFCP session establishment / modification request (PFCP Session Establishment / Modification Request).

[0016] 2. The user plane UPF executes the flow detection and flow control rules issued by the control plane.

[0017] 3. The user plane UPF detects the service flow according to the traffic detection rules, performs traffic control according to the flow control rules, and triggers a PFCP session report request (PFCP Session Report Request) to report the detected service flow.

[0018] 4. The control plane SMF sends updated user plane service flow detection and flow control rules through the PFCP Session Modification Request.

[0019] As shown in Figure 4, the existing 5G air-ground integrated security solution has the following problems:

[0020] Illegal users, using terminals legally registered with the 5G system, can launch illegal services to seize the limited hardware processing resources of the satellite core network's user plane, the 5G core network's control plane, and the user plane used for 5G relay pipes. For example, they can use denial-of-service attacks to reduce the service processing capabilities of the user and control planes. Furthermore, illegal users can also launch attacks on the data network through the service relay pipes formed by the satellite core network's user plane and the 5G core network's user plane in the satellite-ground integrated network.

[0021] 3GPP 5G NTN research has not yet begun core network technology discussions, and there are no specific attack and defense scenarios and technologies.

[0022] As mentioned above, the existing satellite-ground integrated system with 5G networking urgently needs a method to authenticate the legitimacy of users using legitimate terminals to improve network pipeline security, while improving the security protection capabilities of the data network (DN) server.

[0023] Summary of the Invention

[0024] The purpose of the present invention is to provide a method and device for verifying the legitimacy of services in a heterogeneous network architecture, so as to overcome the deficiencies in the prior art.

[0025] To achieve the above objectives, the present invention provides the following technical solution: a method for verifying the legitimacy of services in a heterogeneous network architecture, the method being as follows:

[0026] S1: Deploy user legitimacy verification function on the control plane of the 5G network system core network;

[0027] S2: The control plane adds a user verification information reporting trigger condition to the data packet forwarding control protocol and sends it to the user plane. The user plane loads the received user verification information reporting trigger condition;

[0028] S3: The user plane monitors the control header of the user service flow data packet. The data packet control header carries user verification information. When the user verification information reporting trigger condition is triggered, the user verification information is reported to the control plane. The reporting process is as follows:

[0029] S3.1: The user plane adds a user verification information element structure to the packet forwarding control protocol session report request and sets its report type to the user verification information report type;

[0030] S3.2: The user plane inserts the detected user verification information into the user verification information cell structure newly added in the packet forwarding control protocol session report request. This cell structure adopts the payload container structure type, and the flag bit indicates that the payload type of the current payload container is user verification information.

[0031] S4: The control plane receives the packet forwarding control protocol session report request from the user plane and detects whether the report type is a user verification information report; if so, the user verification information is verified; otherwise, the user verification information is ignored;

[0032] S5: The control plane operates the user session according to the verification result of the user verification information in the packet forwarding control protocol session report request. If the verification result is successful, the user session service is released; otherwise, the user session release process is triggered.

[0033] Furthermore, the deployment user legitimacy verification function is specifically as follows:

[0034] The 5G network system core network includes: a 5G core network or a heterogeneous network core network networked with the 5G system; in the 5G core network or the heterogeneous network core network networked with the 5G system, the legitimacy authentication of 5G terminal access to the network follows the existing registration process of the 5G core network, and the user legitimacy verification function that successfully registers with the 5G system terminal is deployed in the control plane network element of the 5G network system core network.

[0035] Furthermore, the user verification information reporting trigger condition newly added in S2 is located in the creation / update usage reporting rule included in the data packet forwarding control protocol session creation / modification request.

[0036] Furthermore, in said S2, the control plane adds a new user verification information reporting trigger condition specifically by adding a bit corresponding to the user verification information indication in the cell structure of the reporting trigger condition of the data packet forwarding control protocol.

[0037] Furthermore, in the above S3, the user validity verification information is carried by inserting it only into the data packet control header, thereby avoiding leakage of information about the user service load part in the user plane data.

[0038] Furthermore, in said S3, setting the report type to the user verification information type specifically comprises: adding a bit corresponding to the user verification information indication in the report type in the user verification information cell structure.

[0039] Furthermore, the user verification information is verified in S4, specifically: verifying whether the newly added cell structure is a load container marked with the user verification information.

[0040] Furthermore, in said S4, the user verification information includes the user's access method, service type, access time, network access method, network access time, network access location, duration, and a digital certificate issued by a third-party organization.

[0041] In second aspect, the present invention provides a device for verifying the legitimacy of services under a heterogeneous network architecture, comprising a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the steps of the method for verifying the legitimacy of services under a heterogeneous network architecture.

[0042] In a third aspect, the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps of the method for verifying the legitimacy of services under a heterogeneous network architecture.

[0043] Beneficial effects of the present invention:

[0044] This invention proposes a method for verifying the legitimacy of terminal users and initiated services, based on the deployment of verification functions in satellite pipeline control plane network elements. This effectively enhances the data network's defenses against attacks by spoofed users and illegal services, without requiring security upgrades. Furthermore, the newly proposed process and signaling structure further enhance the scenarios and requirements for 3GPP satellite-ground integration and effectively complement the CCSA's proposed satellite-ground integrated security technology architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] FIG1 is an exemplary embodiment of an existing satellite-ground integrated architecture based on the existing 5G non-roaming architecture;

[0046] FIG2 is a flow chart of a method for establishing / modifying / releasing a service initiated by an existing 5G user, provided by an exemplary embodiment;

[0047] FIG3 is a flow chart of a packet forwarding protocol used for detection and control of user plane traffic flows by the control plane in an existing 5G system control plane and user plane separation architecture, provided by an exemplary embodiment;

[0048] FIG4 is a diagram showing a control structure for user plane service flows in an existing 5G system control plane and user plane separation architecture provided by an exemplary embodiment;

[0049] FIG5 is a diagram illustrating a deployment architecture of a 5G core network user plane verification function according to an exemplary embodiment;

[0050] FIG6 is a flow chart of a method for verifying the legitimacy of a service in a heterogeneous network architecture provided by an exemplary embodiment;

[0051] FIG7 is a structural diagram of a device for verifying the legitimacy of services under a heterogeneous network architecture proposed in the present invention. DETAILED DESCRIPTION

[0052] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0053] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0054] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0055] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms "a," "an," "the," and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0056] It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when..." or "when..." or "in response to determining."

[0057] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0058] To facilitate understanding of the embodiments of the present invention, a method for verifying the legitimacy of services in a heterogeneous network architecture of a 5G networked satellite-ground integrated system in the prior art is described as follows:

[0059] The existing satellite-ground integrated system with 5G networking urgently needs a method to authenticate the legitimacy of users using legitimate terminals to improve network pipeline security and at the same time improve the security protection capabilities of the data network server.

[0060] The present invention relates to session-related signaling parsing and interaction system processes under the 5G control plane and user plane separation architecture, which are defined by the 3GPP TS29.244 data flow control protocol. The control plane network elements involved in the present invention are the session management function network element and the user plane function network element UPF.

[0061] The present invention uses the existing registration process (TS 23.502) of the 5G core network for the legitimacy authentication of the 5G terminal UE (User Equipment). As shown in Figure 5, the user legitimacy verification function for successfully registering with the 5G system terminal is deployed in the control plane of the satellite core network of the 5G satellite-ground integrated architecture. In the satellite core network, the control plane session management function network element (S-SMF) and the user plane network element (S-UPF) use the existing 5G session management function network element SMF and user plane network element UPF network architecture and protocol (PFCP TS29.244), and enhance the PFCP protocol so that the control plane S-SMF can send the trigger conditions for reporting user verification information to the user plane S-UPF, and after the user verification information trigger conditions are met, the user verification information can be reported from the user plane S-UPF to the control plane S-SMF for user legitimacy verification. At the same time, since the S-UPF uses different forwarding channels (distinguished by network addresses and / or port numbers) for 5G control plane and user plane messages, the information carried in the user plane message for user legitimacy verification (including user spatiotemporal feature information, service time, access location, user identity, access network type, service type, mobile speed, and user digital certificate) is inserted only in the control header part, thereby avoiding information leakage of the user service load part in the user plane message.

[0062] As shown in Figure 6, the present invention provides a method for verifying the legitimacy of services under a heterogeneous network architecture. Through the user legitimacy verification function deployed on the satellite core network control plane S-SMF, the S-SMF sends a new user verification information report trigger condition to the user plane. After the user and service trigger the reporting condition, the S-UPF can report the user verification information used for user and service legitimacy verification to the control plane by the enhanced PFCP session reporting request. The user verification information used for user and service legitimacy verification is carried by the user service flow transmitted on the user plane, and after reporting, it is verified by the user legitimacy verification function deployed on the control plane S-SMF. The session management process of the control plane is triggered according to the verification result, thereby realizing the authentication of 5G user services and user legitimacy by the satellite relay pipeline, and effectively improving the security protection of 5G network pipelines and data network terminals due to illegal users initiating services. The specific steps are as follows:

[0063] S1: Deploy the user legitimacy verification function in the control plane network elements of the heterogeneous network core network (such as the satellite network) or the 5G core network, and enable the user legitimacy verification function on the user plane. The 5G core network or the heterogeneous network connected to the 5G system will use the existing registration process of the 5G core network to authenticate the legitimacy of 5G terminal access to the network. The user legitimacy verification function for terminals that have successfully registered with the 5G system will be deployed in the control plane network elements of the satellite core network.

[0064] S2: The satellite core network or 5G core network control plane reports the trigger condition by adding user verification information in the "PFCP session establishment / update request". It is sent to the user plane, and the user plane successfully loads the reporting trigger condition received from the control plane;

[0065] This step is the core step of the present invention, and the specific process is as follows:

[0066] The satellite core network or 5G core network control plane enables the user to detect the user verification information carried in the control header of the user service flow data packet and report the detected user verification information by adding a "User Verification Information Reporting Trigger Condition ("UAI" = "1")" to the "Reporting Triggers" in the "Create / Update URR" of the "PFCP Session Establishment / Update Request".

[0067] The satellite core network or 5G core network control plane network element sends a "PFCP session establishment or modification request" to the user plane network element.

[0068] The user plane receives the "PFCP session establishment / update request" "Create / Update URR" in the "Report Trigger Condition" and the newly added "User Verification Information Report Trigger Condition UAI" is set to "1", and the user plane loads the user verification information report trigger condition.

[0069] S3: The user plane monitors the control header of the user service flow data packet, which carries user verification information, and reports the user verification information to the control plane after the reporting condition "user verification information reporting trigger condition" is triggered.

[0070] This step is the core step of the present invention, and the specific process is as follows:

[0071] S3.1: The user plane sets the "Report Type" in the newly added "User Validation Information" in the "PFCP Session Report Request" information element structure to "User Validation Information Report" = "1", indicating that the type of the "PFCP Session Report Request" is "User Validation Information Report".

[0072] S3.2: The user plane places the user verification information detected from the control header of the user service flow data packet into the user verification information cell structure newly added in the PFCP session report request and sets the "payload container type" to "1101".

[0073] S4: After the control plane receives the user plane PFCP session report request, it checks whether the "Report Type" is set to "User Verification Information Report" = "1", triggering the user legitimacy verification function deployed on the control plane, verifying the content of the "User Verification Information" element with the newly added payload container type of "1101", and controlling the verification user service pipeline.

[0074] S5: The control plane operates the user session according to the verification result of the "user verification information" in the PFCP session reporting request. If the verification fails, the "user session release process" is performed; if the verification succeeds, the user plane releases the user session service.

[0075] The embodiments of the present invention in combination with the cell structure are as follows:

[0076] The satellite core network control plane S-SMF deploys a legitimacy verification function for users using 5G terminals. As shown in Tables 1 and 2, this verification function enhances the IE Information Element structure of the Reporting Triggers in the Create / Update URR Usage Reporting Rule message in the PFCP Session Establishment / Modification Request sent by the control plane (S-SMF), enabling the user plane S-UPF to report the detected user verification information to the control plane S-SMF. In this way, the user legitimacy verification function deployed on the control plane S-SMF can verify the user legitimacy based on the user verification information reported by the user plane, and trigger user session management based on the results of the user legitimacy verification.

[0077] Table 1: Create / Update Reporting Rule Info Element in PFCP Session Create / Modify Request

[0078] Table 2. New trigger conditions in the trigger condition reporting cell

[0079] As shown in Table 2, by adding the trigger condition "User Authentication Information (UAI)" to the reporting trigger condition information element, when the user plane S-UPF detects that the service flow data packet control header carries user verification information, the process of reporting the PFCP session request to the control plane is triggered.

[0080] When the "UAI" of the second bit of the seventh octet of the information element of the reporting trigger condition in Table 2 is set to "1", it indicates that the reporting triggered by the user plane user verification information is enabled. The other octets and bits in Table 2 are not related to this implementation.

[0081] When the user plane receives a "PFCP session create / modify request" and the "UAI" of the second bit (Bit) of the 7th octet (Octet) in the "Report Trigger Condition" information element in the "Create / Update Reporting Rule (Create / Update URR)" information element is set to "1" (Table 2), and when the user plane S-UPF detects that the corresponding user service flow starts and carries user verification information, the user verification information carried in the user service flow control header (header) is triggered to be reported to the control plane.

[0082] As shown in Table 3, the "user verification information" newly added by the user plane S-UPF in the PFCP session reporting request message is used to carry the user verification information carried in the user service flow data packet control header, and the newly added "User Verification Information Report (UVIR: User Validation Information Report)" type in Table 4 is used to indicate that the report content type carried in the current PFCP session report request is user verification information.

[0083] When the 8th bit "UVIR" of the newly added 5th octet in the report type is set to "1", the newly added "User Verification Information" must appear in the PFCP session report request.

[0084] Table 3. Newly added element structure of PFCP session report request

[0085] Table 4. New reporting types

[0086] The new "User Validation Information" cell structure in the "PFCP Session Report Request" in Table 4 follows the existing payload container cell structure in TS 24.501, and the new payload container type "User Validation Information" in Tables 5 and 6 is used to indicate that the information carried by the current payload container is user validation information:

[0087] Table 5: Payload Container Type Cell Structure

[0088] Table 6: Payload container type attribute values

[0089] User verification information includes the user's access method, service type, access time, network access method, network access time, network access location, duration, and digital certificates issued by third-party organizations.

[0090] Referring to Figure 7, an embodiment of the present invention provides a device for verifying the legitimacy of services under a heterogeneous network architecture, including a memory and one or more processors. The memory stores executable code, and when the processor executes the executable code, it is used to implement the blockchain block synchronization method based on zero-knowledge proof in the above embodiment.

[0091] The embodiment of the device for verifying the legitimacy of services under the heterogeneous network architecture of the present invention can be applied to any device with data processing capabilities, and the any device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, as shown in Figure 7, it is a hardware structure diagram of any device with data processing capabilities where the device for verifying the legitimacy of services under the heterogeneous network architecture of the present invention is located. In addition to the processor, memory, network interface, and non-volatile memory shown in Figure 7, the any device with data processing capabilities where the device in the embodiment is located can also include other hardware according to the actual function of the device with data processing capabilities, which will not be described in detail.

[0092] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0093] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present invention. A person of ordinary skill in the art can understand and implement the present invention without inventive work.

[0094] An embodiment of the present invention also provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the method for verifying the legitimacy of a service under a heterogeneous network architecture in the above embodiment is implemented.

[0095] The computer-readable storage medium may be an internal storage unit of any device with data processing capabilities described in any of the aforementioned embodiments, such as a hard disk or memory. The computer-readable storage medium may also be an external storage device of any device with data processing capabilities, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capabilities. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and may also be used to temporarily store data that has been output or is to be output.

[0096] The above description is merely a preferred embodiment of one or more embodiments of this specification and is not intended to limit one or more embodiments of this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of this specification shall be included in the scope of protection of one or more embodiments of this specification.

Claims

1. A method for verifying the legitimacy of services in a heterogeneous network architecture, characterized in that: The method is as follows: S1: Deploy user legitimacy verification function on the control plane of the 5G network system core network; S2: The control plane adds a user verification information reporting trigger condition to the data packet forwarding control protocol and sends it to the user plane, and the user plane loads the received user verification information reporting trigger condition; S3: The user plane monitors the control header of the user service flow data packet. The control header of the data packet carries the user verification information. After the user verification information reporting trigger condition is triggered, the user verification information is reported to the control plane. The reporting process is as follows: S3.1: The user plane adds a user verification information cell structure in the packet forwarding control protocol session report request, and sets its report type to the user verification information report type; S3.2: The user plane inserts the detected user verification information into the user verification information cell structure newly added in the packet forwarding control protocol session report request. The cell structure adopts the load container structure type, and the identification bit indicates that the load type of the current load container is user verification information; S4: The control plane receives the packet forwarding control protocol session report request from the user plane and detects whether the report type is a user verification information report; if yes, the user verification information is verified, otherwise the user verification information is ignored; S5: The control plane operates the user session according to the verification result of the user verification information in the packet forwarding control protocol session reporting request. If the verification result is successful, the user session service is released, otherwise the user session release process is triggered.

2. The method for verifying the legality of services in a heterogeneous network architecture according to claim 1, characterized in that: The deployment user legitimacy verification function is specifically as follows: The 5G network system core network includes: a 5G core network or a heterogeneous network core network networked with the 5G system; in the 5G core network or a heterogeneous network core network networked with the 5G system, the legitimacy authentication of 5G terminal access to the network follows the existing registration process of the 5G core network, and the user legitimacy verification function that has successfully registered with the 5G system terminal is deployed in the control plane network element of the 5G network system core network.

3. The method for verifying the legality of services in a heterogeneous network architecture according to claim 1, characterized in that: The newly added user verification information reporting trigger condition in S2 is located in the create / update usage reporting rule included in the data packet forwarding control protocol session create / modify request.

4. The method for verifying the legality of services in a heterogeneous network architecture according to claim 1, characterized in that: In S2, the control plane adds a user verification information reporting trigger condition specifically by adding a bit corresponding to the user verification information indication in the cell structure of the reporting trigger condition of the data packet forwarding control protocol.

5. The method for verifying the legality of services in a heterogeneous network architecture according to claim 1, characterized in that: In S3, the user legitimacy verification information is carried by inserting it only in the data packet control header, thereby avoiding leakage of information on the user service load part in the user plane data.

6. The method for verifying the legality of services in a heterogeneous network architecture according to claim 1, characterized in that: In the S3, the report type is set to the user verification information type specifically by adding a bit corresponding to the user verification information indication in the report type in the user verification information cell structure.

7. The method for verifying the legality of services in a heterogeneous network architecture according to claim 1, characterized in that: The user verification information is verified in S4, specifically: verifying whether the newly added cell structure is a load container marked with the user verification information.

8. The method for verifying the legality of services in a heterogeneous network architecture according to claim 1, characterized in that: In S4, the user verification information includes the user's access method, service type, access time, network access method, network access time, network access location, duration, and a digital certificate issued by a third-party organization.

9. A device for verifying the legitimacy of a service in a heterogeneous network architecture, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that When the one or more processors execute the executable code, they are used to implement the steps of the method for verifying the legitimacy of services under a heterogeneous network architecture as described in any one of claims 1-8.

10. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method for verifying the legality of services under a heterogeneous network architecture described in any one of claims 1 to 8 are implemented.

Images