Communication processing method and apparatus

Abstract

The present disclosure relates to the technical field of communications. Provided are a communication processing method and apparatus. The method comprises: a first network element used for providing a data information acquisition function sending first information of a terminal device to a second network element, the first information being used to analyze the behavior of the terminal device, and the second network element being used for providing a data calculation and processing function. By means of applying the technical solution of the present disclosure, effective monitoring of the behavior of the terminal device can be performed on the basis of network data analysis, so as to, for example, be able to detect abnormal behavior of the terminal device, such that security risks can be effectively detected, thereby achieving prompt risk avoidance and ensuring network security.

Description

Communication processing method and device Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a communication processing method and device. Background Art

[0002] With the development of big data and artificial intelligence, the value of data continues to increase, and more and more terminal devices (such as smart cars, smart phones, etc.) are at risk of being abused and hijacked.

[0003] Summary of the Invention

[0004] The present disclosure proposes a communication processing method and apparatus, which can effectively monitor the behavior of terminal devices based on network data analysis.

[0005] An embodiment of the first aspect of the present disclosure provides a communication processing method, which is executed by a first network element, wherein the first network element is used to provide a data information collection function. The method includes: sending first information of a terminal device to a second network element; wherein the first information is used to perform behavior analysis of the terminal device, and the second network element is used to provide data calculation and processing functions.

[0006] In some embodiments of the present disclosure, the first information includes at least one of the following:

[0007] The location information report of the terminal device; the historical behavior analysis report of the terminal device; and the expected behavior parameters of the terminal device.

[0008] In some embodiments of the present disclosure, the method further includes:

[0009] Sending a behavior monitoring request of the terminal device to an access and mobility management function (AMF) network element or a session management function (SMF) network element through a network exposure function (NEF) network element, and receiving the location information report sent by the AMF network element or the SMF network element;

[0010] Among them, the location information report is obtained by the AMF network element or SMF network element requesting the access network device.

[0011] In some embodiments of the present disclosure, the location information report includes at least one of the following:

[0012] Identification of the monitoring event; location information of the monitored terminal device; identity information of the terminal device; monitoring result of whether the terminal device exists in the area of ​​interest (AoI) of the access network device; monitoring time information.

[0013] In some embodiments of the present disclosure, the method further includes: requesting a historical behavior analysis report of the terminal device from a third network element; receiving the historical behavior analysis report sent by the third network element; wherein the third network element is used to provide a data information storage function.

[0014] In some embodiments of the present disclosure, the method further includes: receiving a first subscription message for the behavior analysis of the terminal device sent by an AMF network element or an SMF network element, wherein the first subscription message includes expected behavior parameters of the terminal device.

[0015] In some embodiments of the present disclosure, the expected behavior parameter includes at least one of the following:

[0016] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0017] In some embodiments of the present disclosure, the method further includes: receiving a second subscription message for the behavior analysis of the terminal device sent by a Policy Control Function (PCF) network element.

[0018] The second aspect embodiment of the present disclosure provides a communication processing method, which is executed by a second network element, and the second network element is used to provide data calculation and processing functions. The method includes: receiving first information of a terminal device sent by a first network element; performing behavioral analysis on the terminal device based on the first information; wherein the first network element is used to provide data information collection functions.

[0019] In some embodiments of the present disclosure, the first information includes at least one of the following:

[0020] The location information report of the terminal device; the historical behavior analysis report of the terminal device; and the expected behavior parameters of the terminal device.

[0021] In some embodiments of the present disclosure, the location information report includes at least one of the following:

[0022] The identification of the monitoring event; the location information of the monitored terminal device; the identity identification information of the terminal device; the monitoring result of whether the terminal device exists in the AoI of the access network device; and the monitoring time information.

[0023] In some embodiments of the present disclosure, the expected behavior parameter includes at least one of the following:

[0024] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0025] In some embodiments of the present disclosure, after performing behavior analysis on the terminal device based on the first information, the method further includes: sending a behavior analysis report of the terminal device to a fourth network element; wherein the fourth network element is used to provide a data information opening function.

[0026] An embodiment of the third aspect of the present disclosure provides a communication processing method, which is executed by a third network element, and the third network element is used to provide a data information storage function. The method includes: receiving a request for obtaining a historical behavior analysis report for a terminal device sent by a first network element; sending the historical behavior analysis report to the first network element; wherein the first network element is used to provide a data information collection function, and the historical behavior analysis report is used as the first information to perform behavior analysis on the terminal device.

[0027] In some embodiments of the present disclosure, the first information further includes at least one of the following:

[0028] The location information report of the terminal device; the expected behavior parameters of the terminal device.

[0029] In some embodiments of the present disclosure, the location information report includes at least one of the following:

[0030] The identification of the monitoring event; the location information of the monitored terminal device; the identity identification information of the terminal device; the monitoring result of whether the terminal device exists in the AoI of the access network device; and the monitoring time information.

[0031] In some embodiments of the present disclosure, the expected behavior parameter includes at least one of the following:

[0032] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0033] The fourth aspect embodiment of the present disclosure provides a communication processing method, which is executed by a fourth network element, and the fourth network element is used to provide a data information opening function. The method includes: receiving a behavior analysis report of a terminal device sent by a second network element; wherein the second network element is used to provide data calculation and processing functions, and the behavior analysis report is obtained based on the analysis and calculation of the first information of the terminal device.

[0034] In some embodiments of the present disclosure, the method further includes: sending an abnormal behavior analysis notification of the terminal device to a PCF network element based on the behavior analysis report.

[0035] In some embodiments of the present disclosure, the first information includes at least one of the following:

[0036] The location information report of the terminal device; the historical behavior analysis report of the terminal device; and the expected behavior parameters of the terminal device.

[0037] In some embodiments of the present disclosure, the location information report includes at least one of the following:

[0038] The identification of the monitoring event; the location information of the monitored terminal device; the identity identification information of the terminal device; the monitoring result of whether the terminal device exists in the AoI of the access network device; and the monitoring time information.

[0039] In some embodiments of the present disclosure, the expected behavior parameter includes at least one of the following:

[0040] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0041] A fifth aspect of the present disclosure provides a communication processing method, the method comprising: a data information collection function (DICF) network element receiving a first subscription message for terminal device behavior analysis sent by an AMF network element or an SMF network element, where the first subscription message includes expected behavior parameters of the terminal device;

[0042] The DICF network element receives a second subscription message for terminal device behavior analysis sent by the PCF network element;

[0043] The DICF network element sends a behavior monitoring request of the terminal device to the AMF network element or the SMF network element through the NEF network element, and receives a location information report of the terminal device sent by the AMF network element or the SMF network element;

[0044] The DICF network element requests a data information storage function (DIRF) network element to obtain a historical behavior analysis report of the terminal device, and receives the historical behavior analysis report sent by the third network element;

[0045] The DICF network element sends the expected behavior parameters, the location information report, and the historical behavior analysis report to a data calculation and processing function (DCP) network element;

[0046] The DCP network element performs a behavior analysis on the terminal device according to the expected behavior parameter, the location information report, and the historical behavior analysis report;

[0047] The DCP network element sends the behavior analysis report of the terminal device to a Data Information Exposure Function (DIEF) network element;

[0048] The DIEF network element sends an abnormal behavior analysis notification of the terminal device to the PCF network element based on the behavior analysis report.

[0049] The sixth aspect embodiment of the present disclosure provides a first network element, which is used to provide data information collection function, including: a first communication module, configured to send first information of a terminal device to a second network element; wherein the first information is used to perform behavior analysis of the terminal device, and the second network element is used to provide data calculation and processing functions.

[0050] The seventh aspect embodiment of the present disclosure provides a second network element, which is used to provide data calculation and processing functions. The second network element includes: a second communication module, configured to receive first information of a terminal device sent by a first network element; and perform behavioral analysis on the terminal device based on the first information; wherein the first network element is used to provide data information collection functions.

[0051] An eighth aspect embodiment of the present disclosure provides a third network element, which is used to provide a data information storage function, and the third network element includes: a third communication module, configured to receive a request for obtaining a historical behavior analysis report for a terminal device sent by a first network element; and send the historical behavior analysis report to the first network element; wherein the first network element is used to provide a data information collection function, and the historical behavior analysis report is used as the first information to perform behavior analysis on the terminal device.

[0052] The ninth aspect embodiment of the present disclosure provides a fourth network element, which is used to provide a data information opening function, and the fourth network element includes: a fourth communication module, configured to receive a behavior analysis report of a terminal device sent by a second network element; wherein, the second network element is used to provide data calculation and processing functions, and the behavior analysis report is obtained based on the analysis and calculation of the first information of the terminal device.

[0053] The tenth aspect embodiment of the present disclosure provides a communication processing system, including: a first network element, a second network element, a third network element and a fourth network element; the first network element executes the method as described in the first aspect embodiment, the second network element executes the method as described in the second aspect embodiment, the third network element executes the method as described in the third aspect embodiment, and the fourth network element executes the method as described in the fourth aspect embodiment.

[0054] An eleventh embodiment of the present disclosure provides a communication device, which includes: a transceiver; a memory; and a processor, which is connected to the transceiver and the memory respectively, and is configured to control the wireless signal reception and transmission of the transceiver by executing computer-executable instructions on the memory, and can implement the method as described in the first embodiment, or the method as described in the second embodiment, or the method as described in the third embodiment, or the method as described in the fourth embodiment, or the method as described in the fifth embodiment.

[0055] The twelfth aspect embodiment of the present disclosure provides a computer storage medium, wherein the computer storage medium stores computer-executable instructions; after the computer-executable instructions are executed by the processor, they can implement the method as described in the first aspect embodiment, or the method as described in the second aspect embodiment, or the method as described in the third aspect embodiment, or the method as described in the fourth aspect embodiment, or the method as described in the fifth aspect embodiment.

[0056] The disclosed embodiments provide a communication processing method and apparatus, wherein a first network element providing a data information collection function transmits first information from a terminal device to a second network element for analyzing the behavior of the terminal device. The second network element provides data calculation and processing functions. By applying the technical solution of this embodiment, effective monitoring of the behavior of the terminal device based on network data analysis can be achieved. For example, abnormal behavior of the terminal device can be detected, thereby effectively monitoring security risks, achieving timely risk avoidance, and ensuring network security.

[0057] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The above and / or additional aspects and advantages of the present disclosure will become apparent and readily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0059] FIG1 is a schematic diagram of the architecture of a communication processing system according to an embodiment of the present disclosure;

[0060] FIG2 is a timing diagram of a communication processing method according to an embodiment of the present disclosure;

[0061] FIG3 is a schematic diagram of an example of a communication architecture according to an embodiment of the present disclosure;

[0062] FIG4 is a flow chart of a communication processing method according to an embodiment of the present disclosure;

[0063] FIG5 is a flow chart of a communication processing method according to an embodiment of the present disclosure;

[0064] FIG6 is a flow chart of a communication processing method according to an embodiment of the present disclosure;

[0065] FIG7 is a flow chart of a communication processing method according to an embodiment of the present disclosure;

[0066] FIG8 is a timing diagram of an example according to an embodiment of the present disclosure;

[0067] FIG9 is a structural block diagram of a first network element according to an embodiment of the present disclosure;

[0068] FIG10 is a structural block diagram of a second network element according to an embodiment of the present disclosure;

[0069] FIG11 is a structural block diagram of a third network element according to an embodiment of the present disclosure;

[0070] FIG12 is a structural block diagram of a fourth network element according to an embodiment of the present disclosure;

[0071] FIG13 is a schematic structural diagram of a communication device according to an embodiment of the present disclosure;

[0072] FIG14 is a schematic structural diagram of a chip provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0073] The embodiments of the present disclosure are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure and are not to be construed as limiting the present disclosure. It should be noted that the embodiments of the present disclosure and the features in the embodiments may be combined with each other unless there is a conflict.

[0074] The present disclosure provides a communication processing method. In some embodiments, the terms "communication processing method," "information processing method," and "communication method" are interchangeable; the terms "communication processing device," "information processing device," and "communication device" are interchangeable; and the terms "communication processing system," "information processing system," and "communication system" are interchangeable.

[0075] The embodiments of the present disclosure are not exhaustive and are merely illustrative of some embodiments, and are not intended to be a specific limitation on the scope of protection of the present disclosure. In the absence of contradiction, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily exchanged. In addition, the optional implementations in a particular embodiment can be arbitrarily combined. In addition, the embodiments can be arbitrarily combined. For example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementations of other embodiments.

[0076] In each embodiment of the present disclosure, unless otherwise specified or provided for by logic, the terms and / or descriptions between the embodiments are consistent and can be referenced by each other. The technical features in different embodiments can be combined to form a new embodiment based on their inherent logical relationships.

[0077] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure.

[0078] In the embodiments of the present disclosure, unless otherwise specified, elements expressed in the singular, such as "a", "an", "the", "above", "said", "the", "the", etc., may mean "one and only one", or "one or more", "at least one", etc. For example, when using articles such as "a", "an", "the" in English in translation, the noun following the article may be understood as a singular expression or a plural expression.

[0079] In the embodiments of the present disclosure, “plurality” refers to two or more.

[0080] In some embodiments, the terms "at least one," "one or more," "a plurality of," "multiple," etc. may be used interchangeably.

[0081] In some embodiments, descriptions such as "at least one of A and B," "A and / or B," "A in one case, B in another case," or "in response to one case A, in response to another case B" may include the following technical solutions depending on the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed); and in some embodiments, A and B (both A and B are executed). The above is also applicable when there are more branches such as A, B, and C.

[0082] In some embodiments, "A or B" and other descriptions may include the following technical solutions depending on the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed). The above is also applicable when there are more branches such as A, B, C, etc.

[0083] The prefixes such as "first" and "second" in the embodiments of the present disclosure are only used to distinguish different description objects and do not constitute any restriction on the position, order, priority, quantity or content of the description objects. For the statement of the description object, please refer to the description in the context of the claims or embodiments, and no unnecessary restriction should be constituted due to the use of prefixes. For example, if the description object is a "field", the ordinal number before the "field" in the "first field" and the "second field" does not limit the position or order between the "fields". "First" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of the "first field" and the "second field". For another example, if the description object is a "level", the ordinal number before the "level" in the "first level" and the "second level" does not limit the priority between the "levels". For another example, the number of description objects is not limited by the ordinal number and can be one or more. Taking "first device" as an example, the number of "devices" can be one or more. In addition, the objects modified by different prefixes can be the same or different. For example, if the description object is "device", then the "first device" and the "second device" can be the same device or different devices, and their types can be the same or different; for another example, if the description object is "information", then the "first information" and the "second information" can be the same information or different information, and their contents can be the same or different.

[0084] In some embodiments, terms such as "in response to...", "in response to determining...", "in the case of...", "at the time of...", "when...", "if...", "if...", etc. can be used interchangeably.

[0085] In some embodiments, terms such as "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not less than", and "above" can be replaced with each other, and terms such as "less than", "less than or equal to", "not greater than", "less than", "less than or equal to", "not more than", "lower than", "lower than or equal to", "not higher than", and "below" can be replaced with each other.

[0086] In some embodiments, devices, etc. can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as "device", "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", and "subject" can be used interchangeably.

[0087] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, etc. can be used interchangeably.

[0088] In some embodiments, "obtain", "get", "obtain", "receive", "transmit", "bidirectional transmission", "send and / or receive" can be interchangeable, and can be interpreted as receiving from other entities, obtaining from a protocol, obtaining by self-processing, autonomous implementation, etc.

[0089] In some embodiments, terms such as "send", "transmit", "report", "download", "transmit", "bidirectional transmission", "send and / or receive" can be used interchangeably.

[0090] In some embodiments, "predetermined" and "preset" can be interpreted as pre-specified in a protocol, etc., or can be interpreted as a pre-set action performed by a device, etc.

[0091] In some embodiments, determining may be interpreted as judging, calculating, computing, processing, deriving, investigating, searching, looking up, retrieving, ascertaining, receiving, transmitting, inputting, outputting, accessing, resolving, selecting, choosing, establishing, comparing, “assuming,” “expecting,” “considering,” broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, assigning, and the like, but is not limited thereto.

[0092] In some embodiments, the determination or judgment can be performed by a value represented by 1 bit (0 or 1), or by a true or false value (Boolean value) represented by true or false, or by comparison of numerical values ​​(for example, comparison with a predetermined value), but is not limited thereto.

[0093] In some embodiments, "network" can be interpreted as devices included in the network (eg, access network equipment, core network equipment, etc.).

[0094] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, etc. can be used interchangeably.

[0095] In some embodiments, the access network device, the core network device, or the network device can be replaced by a terminal. For example, the various embodiments of the present disclosure can also be applied to a structure in which the communication between the access network device, the core network device, or the network device and the terminal is replaced by communication between multiple terminals (for example, device-to-device (D2D), vehicle-to-everything (V2X), etc.). In this case, it is also possible to set the structure in which the terminal has all or part of the functions of the access network device. In addition, terms such as "uplink" and "downlink" can also be replaced by terms corresponding to communication between terminals (for example, "side"). For example, uplink channels, downlink channels, etc. can be replaced by side channels, and uplinks, downlinks, etc. can be replaced by side links.

[0096] In some embodiments, the terminal may be replaced by an access network device, a core network device, or a network device. In this case, the access network device, the core network device, or the network device may have a structure that has all or part of the functions of the terminal.

[0097] In some embodiments, obtaining data, information, etc. may comply with the laws and regulations of the country where the data is obtained.

[0098] In some embodiments, data, information, etc. may be obtained with the user's consent.

[0099] In some embodiments, the threshold mentioned in this embodiment may be a numerical value, a constant, or some fixed value.

[0100] In addition, each element, each row, or each column in the table of the embodiment of the present disclosure can be implemented as an independent embodiment, and the combination of any elements, any rows, and any columns can also be implemented as an independent embodiment.

[0101] With the development of big data and artificial intelligence, the value of data continues to increase, and more and more terminal devices (such as smart cars and smartphones) are at risk of abuse and hijacking. However, there is currently a lack of effective solutions for monitoring the behavior of terminal devices.

[0102] To this end, this embodiment proposes a communication processing method and apparatus, which can effectively monitor the behavior of terminal devices based on network data analysis.

[0103] The communication processing method and device provided by the present disclosure are described in detail below with reference to the accompanying drawings.

[0104] FIG1 shows a structural diagram of a communication processing system according to an embodiment of the present disclosure. As shown in FIG1 , the system architecture of the communication processing system 100 may include a terminal device 101 and a network device 102 .

[0105] In some embodiments, the terminal device 101 includes, for example, a mobile phone, a wearable device, an Internet of Things device, a car with communication function, a smart car, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, and at least one of a wireless terminal device in a smart home, but is not limited thereto.

[0106] In some embodiments, the network device 102 may be a core network device. The core network may include, for example, at least one of an Evolved Packet Core (EPC), a 5G Core Network (5GCN), and a Next Generation Core (NGC).

[0107] In some embodiments, the network device 102 may be a single device including a first network element 1021, a second network element 1022, a third network element 1023, a fourth network element 1024, etc., or may be a plurality of devices or a device group including all or part of the first network element 1021, the second network element 1022, the third network element 1023, the fourth network element 1024, etc. The network element may be virtual or physical.

[0108] In some embodiments, the first network element 1021 may be a network element for providing data information collection functions, capable of obtaining real-time network information, such as real-time network traffic, congestion anomalies, and illegal access, and capable of collecting and aggregating information / data uploaded by terminal devices and access network devices.

[0109] In some embodiments, the first network element 1021 is, for example, a data information collection function (DICF) network element, but the name is not limited thereto.

[0110] In some embodiments, the second network element 1022 may be a network element for data computation and processing. It can perform two functions: 1. It can use algorithms appropriate to the task at hand to perform computation and reasoning on data transmitted via the data plane, and output the data in a specific format using pre-processing / post-processing methods; and 2. It can filter, process, and analyze information included in signaling transmitted via the control plane.

[0111] In some embodiments, the second network element 1022 is, for example, a data calculation and processing (DCP) network element, but the name is not limited thereto.

[0112] In some embodiments, the third network element 1023 may be a network element for data information storage, and may store the information collected by the first network element 1021 for subsequent analysis and calculation.

[0113] In some embodiments, the third network element 1023 is, for example, a data information storage function (DIRF) network element, but the name is not limited thereto.

[0114] In some embodiments, the fourth network element 1024 may be a network element for data information disclosure, capable of disclosing and outputting computation results, specifically by feeding back inference information to other network elements.

[0115] In some embodiments, the fourth network element 1024 is, for example, a data information exposure function (DIEF) network element, but the name is not limited thereto.

[0116] Based on the above-mentioned network elements, this embodiment is equivalent to proposing a new collaborative perception computing network architecture, establishing data information collection, information storage, information computing and processing, and information open network functions within the network. On the one hand, control signaling interaction can be carried out through the core network control plane and other network functions (NF), and on the other hand, data can be transmitted through the user plane with the user plane function (UPF).

[0117] For example, as shown in Figure 2, a 6G network architecture designed based on the aforementioned network elements can add data information collection, information storage, information computing and processing, and information exposure network functions based on the architecture of the 5G core network (5GC). For example, the DICF network element, DIRF network element, DCP network element, and DIEF network element in Figure 2 are respectively used for network information collection, data storage, data computing and processing, and output of inference results. This embodiment can utilize the information collection and computing and analysis capabilities of this new network architecture as shown in Figure 2 to detect terminal device misbehavior, assess the risks and damages brought to the terminal device and network system, and prevent security risks by sending policy update solutions to relevant network functions.

[0118] It can be understood that the communication processing system described in the embodiment of the present disclosure is for the purpose of more clearly illustrating the technical solution of the embodiment of the present disclosure, and does not constitute a limitation on the technical solution proposed in the embodiment of the present disclosure. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new business scenarios, the technical solution proposed in the embodiment of the present disclosure is also applicable to similar technical problems.

[0119] The following embodiments of the present disclosure may be applied to the communication processing system shown in Figure 1, or a portion thereof, but are not limited thereto. The entities shown in Figure 1 are illustrative only. The communication processing system may include all or part of the entities shown in Figure 1, or may include other entities outside of Figure 1. The number and form of the entities may be arbitrary. The connection relationship between the entities is illustrative only. The entities may be connected or disconnected, and the connection may be in any manner, whether direct or indirect, and wired or wireless.

[0120] The embodiments of the present disclosure can be applied to satellite communications, Long Term Evolution (LTE), LTE-Advanced (LTE-A), LTE-Beyond (LTE-B), SUPER 3G, IMT-Advanced, 4th generation mobile communication system (4G), 5th generation mobile communication system (5G), 5G NR, Future Radio Access (FRA), New-Radio Access Technology (RAT), New Radio (NR), New Radio Access (NX), Future generation radio access (FX), Global System for Mobile communications (GSM (registered trademark)), CDMA2000, Ultra Mobile Broadband (UMB), IEEE 802.11 (Wi-Fi (registered trademark)), IEEE 802.16 (WiMAX (registered trademark)), IEEE 802.17 (WiMAX (registered trademark)), IEEE 802.18 (WiMAX (registered trademark)), IEEE 802.19 (WiMAX (registered trademark)), IEEE 802.20 (WiMAX (registered trademark)), IEEE 802.21 (WiMAX (registered trademark)), IEEE 802.22 (WiMAX (registered trademark)), IEEE 802.23 (WiMAX (registered trademark)), IEEE 802.24 (WiMAX (registered trademark)), IEEE 802.25 (WiMAX (registered trademark)), IEEE 802.26 (WiMAX (registered trademark)), IEEE 802.27 (WiMAX (registered trademark)), IEEE 802.28 (WiMAX (registered trademark)), IEEE 802.29 (WiMAX (registered trademark)), IEEE 802.30 (WiMAX (registered trademark)), IEEE 802.31 (WiMAX (registered trademark)), IEEE 802.32 (WiMAX (registered trademark)), IEEE 802.33 (WiMAX (registered trademark) 802.20, Ultra-WideBand (UWB), Bluetooth (registered trademark), Public Land Mobile Network (PLMN) networks, Device-to-Device (D2D) systems, Machine-to-Machine (M2M) systems, Internet of Things (IoT) systems, Vehicle-to-Everything (V2X), systems utilizing other communication methods, and next-generation systems based on and extending these methods. Furthermore, multiple systems may be combined (for example, a combination of LTE or LTE-A with 5G).

[0121] Furthermore, to illustrate the specific execution process of the above-mentioned communication processing system, FIG3 shows a timing diagram of a communication processing method according to an embodiment of the present disclosure. The method is applied to the above-mentioned communication processing system, as shown in FIG3, and may include the following steps:

[0122] Step 201: The first network element receives a first subscription message for terminal device behavior analysis sent by an AMF network element or an SMF network element.

[0123] In some embodiments, the first network element may be used to provide a data information collection function, for example, the first network element may be a DICF network element. The AMF network element or the SMF network element sends a first subscription message for terminal device behavior analysis to the DICF network element.

[0124] In some embodiments, the first subscription message may include expected behavior parameters of the terminal device. The expected behavior parameters can be considered as expected parameters of the behavior of the terminal device, and can be used to measure whether the behavior of the terminal device is abnormal.

[0125] For example, in the process of a terminal device initiating network registration to a network device, during the network registration process, the Unified Data Management (UDM) network element may send the expected behavior parameters of the terminal device stored therein to the AMF network element or the SMF network element. In this way, when the AMF network element or the SMF network element sends the first subscription message for the terminal device behavior analysis report to the DICF network element, the expected behavior parameters of the terminal device may be carried.

[0126] In some embodiments, the expected behavior parameter may include at least one of the following:

[0127] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0128] Among them, mobility indicators may refer to parameters such as the access network type, cell identifier, and Tracking Area Identity (TAI) expected by the terminal device. Communication time may refer to the expected communication time information when the terminal device interacts with the access network device. Uplink latency may refer to the expected uplink communication delay duration when the terminal device interacts with the access network device. Uplink communication rate may refer to the expected uplink communication rate when the terminal device interacts with the access network device.

[0129] Step 202: The first network element receives a second subscription message for terminal device behavior analysis sent by the PCF network element.

[0130] The second subscription message is different from the first subscription message. According to the second subscription message, when the fourth network element determines that the behavior of the terminal device is abnormal based on the behavior analysis report, it sends an abnormal behavior analysis notification of the terminal device to the PCF network element. The PCF network element can adjust the policy related to the AMF network element or SMF network element based on the abnormal behavior analysis notification. According to the first subscription message, the AMF network element or SMF network element will receive the adjustment policy information sent by the PCF network element.

[0131] After determining that the first subscription message and the second subscription message are received, the first network element may execute the process shown in steps 203 to 207.

[0132] Step 203: The first network element sends a behavior monitoring request of the terminal device to the AMF network element or the SMF network element through the NEF network element.

[0133] In some embodiments, the purpose of the first network element sending the behavior monitoring request is to obtain a location information report of the terminal device, and the location information report may include the location information of the terminal device.

[0134] In some embodiments, the location information report includes at least one of the following:

[0135] Identification of the monitoring event; location information of the monitored terminal device; identity information of the terminal device; monitoring result of whether the terminal device exists in the AoI of the access network device; monitoring time information.

[0136] The identifier of the monitoring event may refer to the name or ID number of this monitoring event, etc. The location information of the monitored terminal device may refer to the latitude and longitude position of the terminal device monitored this time, the relative position within the service cell, etc. The identity information of the terminal device may refer to the subscriber permanent identifier (Subscriber Permanent Identifier) ​​of the terminal device, the permanent equipment identifier (PEI), the generic public user identifier (GPSI), the group identifier of the terminal, etc. The monitoring result of whether the terminal device exists in the AoI of the access network device can be used to determine whether the terminal device is in the AoI of the access network device. The monitoring time information may refer to the timestamp corresponding to this monitoring event, etc.

[0137] In some embodiments, the first network element (such as a DICF network element) may send a behavior monitoring request of a terminal device to the NEF network element, and the NEF network element forwards the behavior monitoring request to the AMF network element or the SMF network element.

[0138] Step 204: The first network element receives the location information report of the terminal device sent by the AMF network element or the SMF network element through the NEF network element.

[0139] After receiving the behavior monitoring request of the terminal device, the AMF network element or SMF network element may send a request for obtaining the location information report of the terminal device to the access network device. The access network device may send the location information report of the terminal device to the AMF network element or SMF network element based on the request. Then the AMF network element or SMF network element sends the location information report of the terminal device to the NEF network element, and the NEF network element then sends the location information report of the terminal device to the first network element, such as the DICF network element.

[0140] Step 205: The first network element requests the third network element to obtain a historical behavior analysis report of the terminal device.

[0141] In some embodiments, the third network element is used to provide data information storage function, such as a DIRF network element.

[0142] The third network element may store historical behavior analysis reports of terminal devices, and may store different historical behavior analysis reports of different terminal devices. These historical behavior analysis reports are historical behavior analysis reports of terminal devices. Each time a behavior analysis report is obtained, it may be stored accordingly in the third network element.

[0143] Step 206: The first network element receives the historical behavior analysis report sent by the third network element.

[0144] Step 207: The first network element sends the first information of the terminal device to the second network element.

[0145] In some embodiments, the second network element may be configured to provide data computing and processing functions, such as a DCP network element.

[0146] In some embodiments, the first information may be used to perform behavioral analysis of the terminal device.

[0147] In some embodiments, the first information may include at least one of the following:

[0148] Location information report of terminal devices; historical behavior analysis report of terminal devices; expected behavior parameters of terminal devices.

[0149] For example, based on the above steps, the DICF network element may send the location information report, and / or historical behavior analysis report, and / or expected behavior parameters of the terminal device to the DCP network element. The DCP network element may perform behavior analysis on the terminal device based on these data, and specifically execute the process shown in step 208.

[0150] Step 208: The second network element performs a behavior analysis on the terminal device based on the first information.

[0151] In some embodiments, the second network may generate a behavior analysis report of the terminal device.

[0152] For example, the DCP network element can compare, calculate, and analyze the data in the terminal device's location information report, combined with the historical behavior analysis results in the terminal device's historical behavior analysis report, with expected behavior parameters to determine or identify whether the terminal device has abnormal behavior and / or suspicious behavior, etc., such as comparing the terminal device's current operating data with the expected behavior parameter threshold to determine whether the terminal device's behavior is abnormal. Furthermore, artificial intelligence (AI) models can also be used for analysis and calculation, and then a behavior analysis report for the terminal device can be generated.

[0153] In addition, in some embodiments, if the second network element analyzes that the terminal device exhibits abnormal behavior, in order to ensure the security of the terminal device, network, etc., the second network element can also analyze the corresponding adjustment policy information, such as adjusting the policy information of the relevant network function (NF) in the network device, and then generate a behavior analysis report for the terminal device based on the behavior analysis results.

[0154] For example, in 6G networks, AI and machine learning (ML) technologies, such as deep learning, will be closely integrated with communication networks and big data. This network will have native information collection and data analysis capabilities, enabling it to detect a wide range of data in network nodes, such as data traffic and behavioral anomalies, effectively improving security levels and mitigating risks. By collecting network node information for model training and inference, and outputting corresponding results to each relevant NF, it can effectively monitor security risks and ensure network security.

[0155] Step 209: The second network element sends the behavior analysis report of the terminal device to the fourth network element.

[0156] In some embodiments, the fourth network element may be used to provide a data information disclosure function, such as a DIEF network element. The fourth network element may then be provided to required network elements (such as network elements inside or outside the core network), or third-party application functions (AFs), or application servers, etc.

[0157] Step 210: The fourth network element sends an abnormal behavior analysis notification of the terminal device to the PCF network element based on the behavior analysis report.

[0158] In some embodiments, the PCF network element may adjust the policy related to the AMF network element or the SMF network element based on the abnormal behavior analysis notification. The PCF network element provides the updated policy to the AMF network element or the SMF network element to ensure network security and prevent abnormal behavior from damaging the network. The AMF network element or the SMF network element adopts corresponding measures to mitigate risks based on the policy provided by the PCF network element. For example, mobility restrictions for the terminal device location, adjustment of the registration area of ​​the terminal device, and release of the packet data unit (PDU) session, etc.

[0159] For example, taking a mobile phone as an example, if a user's mobile phone is attacked by a hacker, the hacker logs into the user account, and the IP address changes, based on the communication between the mobile phone and the network device (which may include access network devices and core network devices), the solution provided in this embodiment can be used to identify this abnormal behavior. The network device notifies the relevant user of this risk, or sends corresponding policy adjustment notifications to each NF to reduce the risk, such as blocking the network connection of the mobile phone.

[0160] This embodiment can detect abnormal terminal behavior from a group of terminals over a period of time, thereby identifying terminals with abnormal behavior or hijacked, such as incorrect cell location, incorrect PDU session flow, abnormal uplink delay jitter, abnormal DDoS attack, etc. Once the network analysis results determine that the risk brought by the abnormal terminal behavior is serious enough to alert users and change policies, the network will send corresponding policy adjustment notifications to various NFs such as PCF to make terminal-related policy adjustments, thereby reducing suspicious risks and ensuring network security.

[0161] To illustrate the specific execution process on the network device side, Figure 4 shows a flow chart of a communication processing method according to an embodiment of the present disclosure, which can be applied to the first network element side and may include the following steps.

[0162] Step 301: The first network element sends first information of a terminal device to the second network element.

[0163] In some embodiments, the first network element is used to provide data information collection functions, and the second network element is used to provide data calculation and processing functions.

[0164] The first information is used to perform behavior analysis on the terminal device. In some embodiments, the first information includes at least one of the following:

[0165] Location information report of terminal devices; historical behavior analysis report of terminal devices; expected behavior parameters of terminal devices.

[0166] In some embodiments, the first network element may send a behavior monitoring request for the terminal device to the AMF network element or the SMF network element through the NEF network element, and receive the location information report of the terminal device sent by the AMF network element or the SMF network element through the NEF network element; wherein, the location information report of the terminal device is obtained by the AMF network element or the SMF network element requesting the access network device.

[0167] In some embodiments, the access network device may be a base station, etc.

[0168] In some embodiments, the location information report of the terminal device includes at least one of the following:

[0169] Identification of the monitoring event; location information of the monitored terminal device; identity information of the terminal device; monitoring result of whether the terminal device exists in the AoI of the access network device; monitoring time information.

[0170] In some embodiments, the first network element may request a historical behavior analysis report of the terminal device from a third network element; and receive the historical behavior analysis report of the terminal device sent by the third network element; wherein the third network element can be used to provide a data information storage function.

[0171] In some embodiments, the first network element may receive a first subscription message sent by an AMF network element or an SMF network element for behavior analysis of the terminal device, where the first subscription message includes expected behavior parameters of the terminal device.

[0172] In some embodiments, the expected behavior parameter of the terminal device includes at least one of the following:

[0173] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0174] In some embodiments, the first network element may also receive a second subscription message sent by the PCF network element for behavior analysis of the terminal device.

[0175] For the description of the specific examples in this embodiment, please refer to the corresponding description of the embodiments in Figures 1 to 3, and will not be repeated here.

[0176] By applying the technical solution of this embodiment, it is possible to effectively monitor the behavior of terminal devices based on network data analysis. For example, abnormal behavior of terminal devices can be monitored, and then security risks can be effectively monitored, and timely risk avoidance can be achieved, thereby ensuring network security.

[0177] Figure 5 shows a flow chart of a communication processing method according to an embodiment of the present disclosure. As shown in Figure 5, the method can be applied to the second network element side and can include the following steps.

[0178] Step 401: The second network element receives first information of a terminal device sent by the first network element.

[0179] In some embodiments, the second network element is used to provide data calculation and processing functions, and the first network element is used to provide data information collection functions.

[0180] In some embodiments, the first information includes at least one of the following:

[0181] Location information report of terminal devices; historical behavior analysis report of terminal devices; expected behavior parameters of terminal devices.

[0182] In some embodiments, the location information report of the terminal device includes at least one of the following:

[0183] Identification of the monitoring event; location information of the monitored terminal device; identity information of the terminal device; monitoring result of whether the terminal device exists in the AoI of the access network device; monitoring time information.

[0184] In some embodiments, the expected behavior parameter of the terminal device includes at least one of the following:

[0185] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0186] Step 402: The second network element performs a behavior analysis on the terminal device based on the first information.

[0187] In some embodiments, after step 402, the second network element may send a behavior analysis report of the terminal device to a fourth network element; wherein the fourth network element is used to provide a data information opening function.

[0188] For the description of the specific examples in this embodiment, please refer to the corresponding description of the embodiments in Figures 1 to 4, and will not be repeated here.

[0189] By applying the technical solution of this embodiment, it is possible to effectively monitor the behavior of terminal devices based on network data analysis. For example, abnormal behavior of terminal devices can be monitored, and then security risks can be effectively monitored, and timely risk avoidance can be achieved, thereby ensuring network security.

[0190] Figure 6 shows a flow chart of a communication processing method according to an embodiment of the present disclosure. As shown in Figure 6, the method can be applied to the third network element side and can include the following steps.

[0191] Step 501: The third network element receives a request for obtaining a historical behavior analysis report of a terminal device sent by the first network element.

[0192] In some embodiments, the third network element is used to provide a data information storage function, and the first network element is used to provide a data information collection function.

[0193] Step 502: The third network element sends the historical behavior analysis report of the terminal device to the first network element.

[0194] The historical behavior analysis report may be used as the first information to perform behavior analysis on the terminal device.

[0195] In some embodiments, the first information may further include at least one of the following:

[0196] Location information report of terminal equipment; expected behavior parameters of terminal equipment.

[0197] In some embodiments, the location information report of the terminal device includes at least one of the following:

[0198] Identification of the monitoring event; location information of the monitored terminal device; identity information of the terminal device; monitoring result of whether the terminal device exists in the AoI of the access network device; monitoring time information.

[0199] In some embodiments, the expected behavior parameter of the terminal device includes at least one of the following:

[0200] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0201] For the description of the specific examples in this embodiment, please refer to the corresponding description of the embodiments in Figures 1 to 5, and will not be repeated here.

[0202] By applying the technical solution of this embodiment, it is possible to effectively monitor the behavior of terminal devices based on network data analysis. For example, abnormal behavior of terminal devices can be monitored, and then security risks can be effectively monitored, and timely risk avoidance can be achieved, thereby ensuring network security.

[0203] Figure 7 shows a flow chart of a communication processing method according to an embodiment of the present disclosure. As shown in Figure 6, the method can be applied to the fourth network element side and may include the following steps.

[0204] Step 601: The fourth network element receives a behavior analysis report of a terminal device sent by the second network element.

[0205] In some embodiments, the fourth network element may be used to provide a data information opening function, and the second network element may be used to provide a data calculation and processing function.

[0206] The behavior analysis report may be obtained by analyzing and calculating the first information of the terminal device.

[0207] In some embodiments, the first information includes at least one of the following:

[0208] Location information report of terminal devices; historical behavior analysis report of terminal devices; expected behavior parameters of terminal devices.

[0209] In some embodiments, the location information report of the terminal device includes at least one of the following:

[0210] The identification of the monitoring event; the location information of the terminal device monitored; the monitoring result of whether the terminal device exists in the AoI of the access network device; and the monitoring time information.

[0211] In some embodiments, the expected behavior parameter of the terminal device includes at least one of the following:

[0212] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0213] In some embodiments, the fourth network element may send an abnormal behavior analysis notification of the terminal device to the PCF network element based on the behavior analysis report of the terminal device.

[0214] For the description of the specific examples in this embodiment, please refer to the corresponding description of the embodiments in Figures 1 to 6, and will not be repeated here.

[0215] By applying the technical solution of this embodiment, it is possible to effectively monitor the behavior of terminal devices based on network data analysis. For example, abnormal behavior of terminal devices can be monitored, and then security risks can be effectively monitored, and timely risk avoidance can be achieved, thereby ensuring network security.

[0216] The method of this embodiment can be applied to a variety of application scenarios. As one of the application scenarios, take the case where the first network element is a DICF network element, the second network element is a DCP network element, the third network element is a DIRF network element, and the fourth network element is a DIEF network element. For example, the DICF network element receives a first subscription message for terminal device behavior analysis sent by an AMF network element or an SMF network element, where the first subscription message includes expected behavior parameters of the terminal device; the DICF network element receives a second subscription message for terminal device behavior analysis sent by a PCF network element; the DICF network element sends a behavior monitoring request for the terminal device to the AMF network element or the SMF network element through the NEF network element, and receives a location information report for the terminal device sent by the AMF network element or the SMF network element; the DICF network element requests the DIRF network element to obtain a historical behavior analysis report for the terminal device, and receives the historical behavior analysis report sent by the third network element. The DICF network element sends the expected behavior parameters, location information report and historical behavior analysis report of the terminal device to the DCP network element; the DCP network element performs behavior analysis on the terminal device based on the expected behavior parameters, location information report and historical behavior analysis report; the DCP network element sends the behavior analysis report of the terminal device to the DIEF network element; the DIEF network element sends an abnormal behavior analysis notification of the terminal device to the PCF network element based on the behavior analysis report.

[0217] The overall process may be shown in FIG8 , which shows a timing diagram of an example of a communication processing method according to an embodiment of the present disclosure. As shown in FIG8 , the process may include:

[0218] Step 0: The terminal (UE) initiates the registration process with the network.

[0219] During the registration process, the Unified Data Management (UDM) network element provides the expected UE behavior parameters (such as mobility indicators, communication time, uplink delay, uplink communication rate, etc.) and the UE group ID to the AMF network element or SMF network element, thereby enabling behavior monitoring of a group of UEs.

[0220] Step 1: The AMF network element or SMF network element initiates a behavior analysis report subscription message for the UE to the DICF network element.

[0221] The behavior analysis report may also be called a risk analysis report, and the behavior analysis report subscription message carries expected behavior parameters for the UE.

[0222] Step 2: The PCF network element initiates a behavior analysis report subscription message for the UE to the DICF network element.

[0223] Step 3: The DICF network element makes behavior determinations and decisions based on the subscription message.

[0224] That is, decide from which NFs to collect UE-related behavior parameters.

[0225] Step 4: The DICF network element sends a UE behavior monitoring request to the AMF network element or SMF network element through the NEF network element.

[0226] Step 5: The AMF network element or SMF network element sends a request for obtaining the UE location information report to the access network device (NG-RAN).

[0227] Step 6: NG-RAN responds to the AMF network element or SMF network element with the UE location information report.

[0228] The location information report may include event ID, UE location, UE identity, whether the UE is in the NG-RAN AoI, and monitoring timestamp.

[0229] Step 7: The AMF network element or SMF network element sends the UE location information report to the DICF network element.

[0230] Step 8: The DICF network element sends a request for obtaining a historical behavior analysis report related to the UE behavior to the DIRF network element.

[0231] Step 9: After receiving the request, the DIRF network element retrieves the stored historical behavior analysis report of the UE and sends it to the DICF network element.

[0232] Step 10: The DICF network element summarizes the received location information report, historical behavior analysis report, and expected behavior parameters of the UE and sends them to the DCP network element, requesting the DCP network element to perform behavior calculation analysis on the UE.

[0233] Step 11: The DCP network element may compare, calculate, and analyze the UE runtime data with the expected UE behavior, and determine / identify suspicious UE behavior.

[0234] Step 12: The DCP network element sends a behavior analysis report to the DIEF network element for output.

[0235] Step 13: The DIEF network element sends an abnormal behavior analysis notification of the UE to the PCF network element, so that the PCF network element can adjust the policies related to the AMF network element or SMF network element.

[0236] Step 14: The PCF network element provides the updated policy to the AMF network element or SMF network element to ensure network security and prevent abnormal behavior from damaging the network.

[0237] Step 15: The AMF network element or SMF network element takes corresponding measures to mitigate risks according to the PCF strategy.

[0238] For example, mobility restriction based on UE location, adjustment of UE registration area, and release of PDU session.

[0239] For the description of the specific examples in this embodiment, please refer to the corresponding description of the embodiments in Figures 1 to 7, and will not be repeated here.

[0240] In this embodiment, the network equipment can intelligently identify UEs with abnormal behavior, evaluate and analyze the risks brought by such UEs, and update policies to deal with the risks. This is very useful for improving network management efficiency and enhancing the network's risk resistance. It can effectively serve large-scale terminal devices in the cell, such as connected vehicles, drones, and mobile phones, etc., and can improve safety performance.

[0241] In the embodiments provided above, the methods provided in the embodiments of the present disclosure are described from the perspective of each network element of the network device. To implement the various functions of the methods provided in the embodiments of the present disclosure, the network device may include a hardware structure and a software module, and implement the aforementioned functions in the form of a hardware structure, a software module, or a hardware structure and a software module. Certain of the aforementioned functions may be implemented in the form of a hardware structure, a software module, or a hardware structure and a software module.

[0242] Corresponding to the communication processing methods provided in the above-mentioned embodiments, the present disclosure also provides a communication processing device. Since the communication processing device provided in the embodiment of the present disclosure corresponds to the communication processing methods provided in the above-mentioned embodiments, the implementation method of the communication processing method is also applicable to the communication processing device provided in this embodiment and will not be described in detail in this embodiment.

[0243] FIG9 is a schematic structural diagram of a first network element provided in an embodiment of the present disclosure, where the first network element can be used to improve data information collection functions.

[0244] As shown in Figure 9, the first network element may include: a first communication module 81, configured to send first information of the terminal device to the second network element; wherein, the first information is used to perform behavior analysis of the terminal device, and the second network element is used to provide data calculation and processing functions.

[0245] In some embodiments, the first information includes at least one of the following:

[0246] The location information report of the terminal device; the historical behavior analysis report of the terminal device; and the expected behavior parameters of the terminal device.

[0247] In some embodiments, the first communication module 81 is configured to send a behavior monitoring request of the terminal device to the AMF network element or the SMF network element through the NEF network element, and receive the location information report sent by the AMF network element or the SMF network element; wherein, the location information report is obtained by the AMF network element or the SMF network element requesting the access network device.

[0248] In some embodiments, the location information report includes at least one of the following:

[0249] The identification of the monitoring event; the location information of the monitored terminal device; the identity identification information of the terminal device; the monitoring result of whether the terminal device exists in the AoI of the access network device; and the monitoring time information.

[0250] In some embodiments, the first communication module 81 is configured to request a historical behavior analysis report of the terminal device from a third network element; receive the historical behavior analysis report sent by the third network element; wherein the third network element is used to provide a data information storage function.

[0251] In some embodiments, the first communication module 81 is configured to receive a first subscription message sent by an AMF network element or an SMF network element for the behavior analysis of the terminal device, where the first subscription message includes expected behavior parameters of the terminal device.

[0252] In some embodiments, the expected behavior parameter includes at least one of the following:

[0253] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0254] In some embodiments, the first communication module 81 is configured to receive a second subscription message for the behavior analysis of the terminal device sent by the PCF network element.

[0255] By applying the technical solution of this embodiment, it is possible to effectively monitor the behavior of terminal devices based on network data analysis. For example, abnormal behavior of terminal devices can be monitored, and then security risks can be effectively monitored, and timely risk avoidance can be achieved, thereby ensuring network security.

[0256] FIG10 is a schematic structural diagram of a second network element provided in an embodiment of the present disclosure, where the second network element is used to provide data calculation and processing functions.

[0257] As shown in Figure 10, the second network element may include: a second communication module 91, configured to receive first information of a terminal device sent by the first network element; perform behavioral analysis on the terminal device based on the first information; wherein the first network element is used to provide data information collection function.

[0258] In some embodiments, the first information includes at least one of the following:

[0259] The location information report of the terminal device; the historical behavior analysis report of the terminal device; and the expected behavior parameters of the terminal device.

[0260] In some embodiments, the location information report includes at least one of the following:

[0261] The identification of the monitoring event; the location information of the monitored terminal device; the identity identification information of the terminal device; the monitoring result of whether the terminal device exists in the AoI of the access network device; and the monitoring time information.

[0262] In some embodiments, the expected behavior parameter includes at least one of the following:

[0263] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0264] In some embodiments, the second communication module 91 is configured to send the behavior analysis report of the terminal device to a fourth network element; wherein the fourth network element is used to provide a data information opening function.

[0265] By applying the technical solution of this embodiment, it is possible to effectively monitor the behavior of terminal devices based on network data analysis. For example, abnormal behavior of terminal devices can be monitored, and then security risks can be effectively monitored, and timely risk avoidance can be achieved, thereby ensuring network security.

[0266] FIG11 is a schematic structural diagram of a third network element provided in an embodiment of the present disclosure, where the third network element is used to provide a data information storage function.

[0267] As shown in Figure 11, the third network element may include: a third communication module 1001, configured to receive a request for obtaining a historical behavior analysis report for a terminal device sent by the first network element; and send the historical behavior analysis report to the first network element; wherein the first network element is used to provide a data information collection function, and the historical behavior analysis report is used as the first information to perform behavior analysis on the terminal device.

[0268] In some embodiments, the first information further includes at least one of the following:

[0269] The location information report of the terminal device; the expected behavior parameters of the terminal device.

[0270] In some embodiments, the location information report includes at least one of the following:

[0271] The identification of the monitoring event; the location information of the monitored terminal device; the identity identification information of the terminal device; the monitoring result of whether the terminal device exists in the AoI of the access network device; and the monitoring time information.

[0272] In some embodiments, the expected behavior parameter includes at least one of the following:

[0273] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0274] By applying the technical solution of this embodiment, it is possible to effectively monitor the behavior of terminal devices based on network data analysis. For example, abnormal behavior of terminal devices can be monitored, and then security risks can be effectively monitored, and timely risk avoidance can be achieved, thereby ensuring network security.

[0275] FIG12 is a schematic structural diagram of a fourth network element provided in an embodiment of the present disclosure, where the fourth network element is used to provide a data information opening function.

[0276] As shown in Figure 12, the network device may include: a fourth communication module 1101, configured to receive a behavior analysis report of a terminal device sent by a second network element; wherein, the second network element is used to provide data calculation and processing functions, and the behavior analysis report is obtained based on the first information analysis and calculation of the terminal device.

[0277] In some embodiments, the fourth communication module 1101 is configured to send an abnormal behavior analysis notification of the terminal device to the PCF network element based on the behavior analysis report.

[0278] In some embodiments, the first information includes at least one of the following:

[0279] The location information report of the terminal device; the historical behavior analysis report of the terminal device; and the expected behavior parameters of the terminal device.

[0280] In some embodiments, the location information report includes at least one of the following:

[0281] The identification of the monitoring event; the location information of the monitored terminal device; the identity identification information of the terminal device; the monitoring result of whether the terminal device exists in the AoI of the access network device; and the monitoring time information.

[0282] In some embodiments, the expected behavior parameter includes at least one of the following:

[0283] Mobility indicators; communication time; uplink delay; uplink communication rate.

[0284] By applying the technical solution of this embodiment, it is possible to effectively monitor the behavior of terminal devices based on network data analysis. For example, abnormal behavior of terminal devices can be monitored, and then security risks can be effectively monitored, and timely risk avoidance can be achieved, thereby ensuring network security.

[0285] Please refer to Figure 13, which is a schematic diagram of the structure of a communication device 1800 provided in this embodiment. Communication device 1800 can be a network device or a user device, or a chip, chip system, or processor that supports the network device to implement the above method. It can also be a chip, chip system, or processor that supports the user device to implement the above method. This device can be used to implement the method described in the above method embodiment. For details, please refer to the description of the above method embodiment.

[0286] The communication device 1800 may include one or more processors 1801. The processor 1801 may be a general-purpose processor or a dedicated processor. For example, it may be a baseband processor or a central processing unit. The baseband processor may be used to process communication protocols and communication data, and the central processing unit may be used to control the communication device (e.g., a base station, a baseband chip, a terminal device, a terminal device chip, a DU or CU, etc.), execute computer programs, and process computer program data.

[0287] Optionally, the communication device 1800 may further include one or more memories 1802, on which a computer program 1804 may be stored. The processor 1801 executes the computer program 1804, causing the communication device 1800 to perform the method described in the above method embodiment. Optionally, the memory 1802 may also store data. The communication device 1800 and the memory 1802 may be provided separately or integrated together.

[0288] Optionally, the communication device 1800 may further include a transceiver 1805 and an antenna 1806. The transceiver 1805 may be referred to as a transceiver unit, a transceiver, or a transceiver circuit, and is configured to implement transceiver functions. The transceiver 1805 may include a receiver and a transmitter. The receiver may be referred to as a receiver or a receiving circuit, and is configured to implement a receiving function; the transmitter may be referred to as a transmitter or a transmitting circuit, and is configured to implement a transmitting function.

[0289] Optionally, the communication device 1800 may further include one or more interface circuits 1807. The interface circuit 1807 is configured to receive code instructions and transmit the instructions to the processor 1801. The processor 1801 executes the code instructions to enable the communication device 1800 to perform the method described in the above method embodiment.

[0290] In one implementation, processor 1801 may include a transceiver for implementing receiving and transmitting functions. For example, the transceiver may be a transceiver circuit, an interface, or an interface circuit. The transceiver circuit, interface, or interface circuit for implementing the receiving and transmitting functions may be separate or integrated. The transceiver circuit, interface, or interface circuit may be used for reading and writing code / data, or may be used for transmitting or delivering signals.

[0291] In one implementation, processor 1801 may store a computer program 1803. Computer program 1803, when executed on processor 1801, enables communication device 1800 to perform the method described in the above method embodiment. Computer program 1803 may be embedded in processor 1801, in which case processor 1801 may be implemented by hardware.

[0292] In one implementation, the communication device 1800 may include a circuit that can implement the functions of sending, receiving, or communicating in the aforementioned method embodiments. The processor and transceiver described in the present disclosure can be implemented on an integrated circuit (IC), an analog IC, a radio frequency integrated circuit RFIC, a mixed signal IC, an application specific integrated circuit (ASIC), a printed circuit board (PCB), an electronic device, etc. The processor and transceiver can also be manufactured using various IC process technologies, such as complementary metal oxide semiconductor (CMOS), N-type metal oxide semiconductor (nMetal-oxide-semiconductor, NMOS), P-type metal oxide semiconductor (positive channel metal oxide semiconductor, PMOS), bipolar junction transistor (bipolar junction transistor, BJT), bipolar CMOS (BiCMOS), silicon germanium (SiGe), gallium arsenide (GaAs), etc.

[0293] The communication device described in the above embodiments may be a network device or a user device, but the scope of the communication device described in this disclosure is not limited thereto, and the structure of the communication device may not be limited to FIG13. The communication device may be an independent device or may be part of a larger device. For example, the communication device may be:

[0294] (1) An independent integrated circuit (IC), or chip, or chip system or subsystem;

[0295] (2) a collection of one or more ICs, optionally including a storage component for storing data and computer programs;

[0296] (3) ASIC, such as modem;

[0297] (4) Modules that can be embedded in other devices;

[0298] (5) Receivers, terminal devices, intelligent terminal devices, cellular phones, wireless devices, handheld devices, mobile units, vehicle-mounted devices, network devices, cloud devices, artificial intelligence devices, etc.;

[0299] (6)Others, etc.

[0300] If the communication device can be a chip or a chip system, please refer to the schematic diagram of the chip structure shown in Figure 14. The chip shown in Figure 14 includes a processor 1901 and an interface 1902. The number of processors 1901 can be one or more, and the number of interfaces 1902 can be multiple.

[0301] Optionally, the chip further includes a memory 1903, which is used to store necessary computer programs and data.

[0302] Those skilled in the art will also appreciate that the various illustrative logical blocks and steps listed in the embodiments of the present disclosure may be implemented by electronic hardware, computer software, or a combination of both. Whether such functionality is implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functionality for each specific application, but such implementation should not be construed as exceeding the scope of protection of the embodiments of the present disclosure.

[0303] The present disclosure also provides a readable storage medium having instructions stored thereon, which implement the functions of any of the above method embodiments when executed by a computer.

[0304] The present disclosure also provides a computer program product, which implements the functions of any of the above method embodiments when executed by a computer.

[0305] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, all or part of the processes or functions according to the embodiments of the present disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program can be transmitted from one website, computer, server or data center to another website, computer, server or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. Available media may be magnetic media (eg, floppy disks, hard disks, tapes), optical media (eg, high-density digital video discs (DVDs)), or semiconductor media (eg, solid state disks (SSDs)).

[0306] Those skilled in the art will understand that the various numerical numbers such as first and second involved in the present disclosure are only for the convenience of description and are not used to limit the scope of the embodiments of the present disclosure, and also indicate the order of precedence.

[0307] The at least one in the present disclosure can also be described as one or more, and the multiple can be two, three, four or more, which is not limited in the present disclosure. In the embodiments of the present disclosure, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", and there is no order of precedence or size between the technical features described by "first", "second", "third", "A", "B", "C" and "D".

[0308] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., a magnetic disk, an optical disk, a memory, a programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0309] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0310] Computer systems may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The client and server relationship arises through computer programs running on the respective computers and having a client-server relationship to each other.

[0311] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions of this disclosure can be achieved. This is not limited herein.

[0312] In addition, it should be understood that the various embodiments described in the present disclosure may be implemented independently or in combination with other embodiments where the solution permits.

[0313] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments applied for herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0314] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0315] The above description is merely a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. A communication processing method, characterized in that: The method is executed by a first network element, the first network element being used to provide a data information collection function, and the method includes: Sending the first information of the terminal device to the second network element; The first information is used to perform behavior analysis on the terminal device, and the second network element is used to provide data calculation and processing functions.

2. The method according to claim 1, characterized in that The first information includes at least one of the following: Location information report of the terminal device; A historical behavior analysis report of the terminal device; Expected behavioral parameters of the terminal device.

3. The method according to claim 2, characterized in that The method further comprises: Sending a behavior monitoring request of the terminal device to an access and mobility management function AMF network element or a session management function SMF network element through a network capability development function NEF network element, and receiving the location information report sent by the AMF network element or the SMF network element; Among them, the location information report is obtained by the AMF network element or SMF network element requesting the access network device.

4. The method according to claim 2 or 3, characterized in that: The location information report includes at least one of the following: Identification of monitoring events; The monitored location information of the terminal device; The identity information of the terminal device; A monitoring result of whether the terminal device exists in the area of ​​interest AoI of the access network device; Monitoring time information.

5. The method according to any one of claims 2 to 4, characterized in that The method further comprises: Requesting a third network element to obtain a historical behavior analysis report of the terminal device; Receiving the historical behavior analysis report sent by the third network element; Wherein, the third network element is used to provide a data information storage function.

6. The method according to any one of claims 2 to 5, characterized in that The method further comprises: Receive a first subscription message for the behavior analysis of the terminal device sent by an AMF network element or an SMF network element, wherein the first subscription message includes expected behavior parameters of the terminal device.

7. The method according to any one of claims 2 to 6, characterized in that The expected behavior parameter includes at least one of the following: Mobility indicators; Communication time; Uplink latency; Uplink communication rate.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: Receive a second subscription message sent by a policy control function PCF network element for the behavior analysis of the terminal device.

9. A communication processing method, characterized in that: The method is executed by a second network element, the second network element being used to provide data calculation and processing functions, and the method includes: Receiving first information of a terminal device sent by a first network element; Performing behavior analysis on the terminal device according to the first information; Among them, the first network element is used to provide data information collection function.

10. The method according to claim 9, characterized in that The first information includes at least one of the following: Location information report of the terminal device; A historical behavior analysis report of the terminal device; Expected behavioral parameters of the terminal device.

11. The method according to claim 10, characterized in that The location information report includes at least one of the following: Identification of monitoring events; The monitored location information of the terminal device; The identity information of the terminal device; A monitoring result of whether the terminal device exists in the area of ​​interest AoI of the access network device; Monitoring time information.

12. The method according to claim 10 or 11, characterized in that: The expected behavior parameter includes at least one of the following: Mobility indicators; Communication time; Uplink latency; Uplink communication rate.

13. The method according to any one of claims 9 to 12, characterized in that After performing behavior analysis on the terminal device according to the first information, the method further includes: Sending the behavior analysis report of the terminal device to a fourth network element; The fourth network element is used to provide a data information opening function.

14. A communication processing method, characterized in that: The method is executed by a third network element, the third network element being used to provide a data information storage function, and comprising: Receiving a request for obtaining a historical behavior analysis report for a terminal device sent by the first network element; Sending the historical behavior analysis report to the first network element; Among them, the first network element is used to provide a data information collection function, and the historical behavior analysis report is used as the first information to perform a behavior analysis of the terminal device.

15. The method according to claim 14, characterized in that The first information also includes at least one of the following: Location information report of the terminal device; Expected behavioral parameters of the terminal device.

16. The method according to claim 15, characterized in that The location information report includes at least one of the following: Identification of monitoring events; The monitored location information of the terminal device; The identity information of the terminal device; A monitoring result of whether the terminal device exists in the area of ​​interest AoI of the access network device; Monitoring time information.

17. The method according to claim 15 or 16, characterized in that The expected behavior parameter includes at least one of the following: Mobility indicators; Communication time; Uplink latency; Uplink communication rate.

18. A communication processing method, characterized in that: The method is executed by a fourth network element, the fourth network element being used to provide a data information opening function, and the method includes: Receiving a behavior analysis report of the terminal device sent by the second network element; The second network element is used to provide data calculation and processing functions, and the behavior analysis report is obtained by analyzing and calculating the first information of the terminal device.

19. The method according to claim 18, characterized in that The method further comprises: According to the behavior analysis report, an abnormal behavior analysis notification of the terminal device is sent to a policy control function PCF network element.

20. The method according to claim 18 or 19, characterized in that The first information includes at least one of the following: Location information report of the terminal device; A historical behavior analysis report of the terminal device; Expected behavioral parameters of the terminal device.

21. The method according to claim 20, characterized in that The location information report includes at least one of the following: Identification of monitoring events; The monitored location information of the terminal device; The identity information of the terminal device; A monitoring result of whether the terminal device exists in the area of ​​interest AoI of the access network device; Monitoring time information.

22. The method according to any one of claims 20 to 21, characterized in that The expected behavior parameter includes at least one of the following: Mobility indicators; Communication time; Uplink latency; Uplink communication rate.

23. A communication processing method, characterized in that: include: The data information collection function DICF network element receives a first subscription message for terminal device behavior analysis sent by an access and mobility management function AMF network element or a session management function SMF network element, where the first subscription message includes expected behavior parameters of the terminal device; The DICF network element receives a second subscription message for terminal device behavior analysis sent by a policy control function PCF network element; The DICF network element sends a behavior monitoring request of the terminal device to the AMF network element or the SMF network element through the network capability exposure function NEF network element, and receives a location information report of the terminal device sent by the AMF network element or the SMF network element; The DICF network element requests the data information storage function DIRF network element to obtain the historical behavior analysis report of the terminal device, and receives the historical behavior analysis report sent by the third network element; The DICF network element sends the expected behavior parameter, the location information report and the historical behavior analysis report to a data calculation and processing function DCP network element; The DCP network element performs a behavior analysis on the terminal device according to the expected behavior parameter, the location information report and the historical behavior analysis report; The DCP network element sends the behavior analysis report of the terminal device to the data information open function DIEF network element; The DIEF network element sends an abnormal behavior analysis notification of the terminal device to the policy control function PCF network element based on the behavior analysis report.

24. A communication processing system, characterized in that: Includes the following network elements: A first network element for executing the method according to any one of claims 1 to 8; A second network element for performing the method according to any one of claims 9 to 13; A third network element for executing the method according to any one of claims 14 to 17; A fourth network element for executing the method according to any one of claims 18 to 22.

25. A first network element, the first network element being used to provide a data information collection function, the first network element comprising: The first communication module is configured to send first information of a terminal device to a second network element; wherein the first information is used to perform a behavior analysis of the terminal device, and the second network element is used to provide data calculation and processing functions.

26. A second network element, the second network element being configured to provide data calculation and processing functions, the second network element comprising: A second communication module is configured to receive first information of a terminal device sent by the first network element; Based on the first information, a behavior analysis is performed on the terminal device; wherein the first network element is used to provide a data information collection function.

27. A third network element, the third network element being used to provide a data information storage function, the third network element comprising: A third communication module is configured to receive a request for obtaining a historical behavior analysis report for a terminal device sent by the first network element; The historical behavior analysis report is sent to the first network element; wherein the first network element is used to provide a data information collection function, and the historical behavior analysis report is used as the first information to perform behavior analysis on the terminal device.

28. A fourth network element, the fourth network element being used to provide a data information opening function, the fourth network element comprising: The fourth communication module is configured to receive a behavior analysis report of a terminal device sent by a second network element; wherein the second network element is used to provide data calculation and processing functions, and the behavior analysis report is obtained by analyzing and calculating the first information of the terminal device.

29. A communication device, wherein: include: Transceiver; Memory; A processor is connected to the transceiver and the memory, respectively, and is configured to control the wireless signal reception and transmission of the transceiver by executing computer executable instructions on the memory, and can implement any one of the methods of claims 1 to 23.

30. A computer storage medium, wherein: The computer storage medium stores computer executable instructions; after the computer executable instructions are executed by the processor, the method described in any one of claims 1 to 23 can be implemented.

Images