CN112788661B

CN112788661B - Network data processing method, network element and system

Info

Publication number: CN112788661B
Application number: CN201911081358.0A
Authority: CN
Inventors: 李卓明; 周艳
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2019-11-07
Filing date: 2019-11-07
Publication date: 2023-05-05
Anticipated expiration: 2039-11-07
Also published as: CN112788661A

Abstract

The application provides a processing method, a network element and a system for network data. Wherein the method comprises the following steps: the data analysis network element sends a request message to at least one functional network element, wherein the request message comprises a data sampling mode, the request message is used for indicating the at least one functional network element to report network data by adopting the data sampling mode, and the data sampling mode accords with a random decimation principle; the data analysis network element receives first network data from the at least one functional network element and performs association processing on the first network data received from the at least one functional network element. Because the data sampling mode accords with the random decimation principle, at least one functional network element performs random decimation on network data according to the data sampling mode, and only a small amount of network data is reported to the data analysis network element, so that the data acquisition load of the data analysis network element is reduced.

Description

Network data processing method, network element and system

Technical Field

The embodiment of the application relates to the technical field of communication, in particular to a network data processing method, a network element and a system.

Background

With the continuous emergence of various communication services, the requirements of different communication services on network performance are significantly different, and the third generation partnership project (3rd generation partnership project,3GPP) proposes a fifth generation (5th generation,5G) mobile communication system to meet the differential requirements of different communication services on network performance.

The structure and topology of 5G networks are becoming more and more complex, but it is required to be able to guarantee end-to-end network performance and service experience. By means of deep learning and other technology application in large data analysis, analysis advice is output through analysis of running state data of each network element device and link in the network, and reasonable decision is made to ensure end-to-end network performance and service experience. For this purpose, the 5G network incorporates network data analysis functions (network data analytics function, NWDAF) network elements. The NWDAF network element may collect network data from a Network Function (NF), an application function (application function, AF) of an operator or a third party, a data warehouse, etc., and analyze the network data, and the output analysis result may be provided to the NF, AF or operation administration and maintenance (operation administration and maintenance, OAM) for use in monitoring the network state or making predictions of the network state in real time.

According to the 3gpp TS 23.288 standard specification, NWDAF network elements collect network data to NF or AF by means of event subscription. An area of interest (AOI) is specified when subscribing to an event, and the AOI may be one or more Tracking Areas (TAs) or one or more base station cells (cells). In this way, the NWDAF network element collects network data related to each terminal device or each session in the designated AOI, the data volume is very large, and the data collection causes a very large load on the network (especially the signaling network), so that it is difficult to collect data in real time, and it is also difficult to analyze the network data in real time, so that it is impossible to monitor the network state or predict the network state in real time.

Disclosure of Invention

The application provides a network data processing method, a network element and a system, which are used for reducing network data acquisition load.

In a first aspect, the present application provides a method for processing network data, including: the data analysis network element sends a request message to at least one functional network element, wherein the request message comprises a data sampling mode, the request message is used for indicating the at least one functional network element to report network data by adopting the data sampling mode, and the data sampling mode accords with a random decimation principle; the data analysis network element receives first network data from the at least one functional network element; the data analysis network element performs association processing on the first network data received from the at least one functional network element.

The data analysis network element may be an NWDAF network element, and the functional network element may be an NF network element, an AF network element, or the like.

In this application, the network data refers to data for reflecting a network operation state or operation information, or data for reflecting an application service state, application information, or application experience, or data for reflecting a network connection state or network connection performance of a terminal. Network data is data of a single user granularity or a single session granularity.

Alternatively, the request message may be a subscription request message (e.g., an EventExposure_Subscriber message) for subscribing to network data. An event identification (event id) and a time filter (event filter) may be included in the request message.

In this application, the request message further includes a data sampling manner. The data sampling manner may be included as an independent parameter in the request message, and may also be carried in the event filter, which is not limited in this application. The request message is used for indicating at least one functional network element to report network data in the data sampling mode. The data sampling mode accords with the random extraction principle. Random extraction principles refer to ensuring that each user/session has a known, non-zero probability of being extracted. In other words, the data sampling mode designates a condition of random decimation, so that at least one functional network element performs random decimation according to the designated condition.

Optionally, the data sampling manner is used for indicating the at least one functional network element to report the network data when the first identifier meets the specified condition. The first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address. By way of example, the data sampling pattern may be expressed as: "Exp (a) = patterm". The operations specified by the Exp for the data analysis network element may be masks, operation expressions, regular expressions, hash operations, and the like. A is a first identifier, which can be any one of a terminal identifier, a user identifier, a session identifier and a terminal address. Patterm is a specified mode or specified condition. "= =" indicates that the result after the first flag performs the specification operation matches the specification pattern or satisfies the specification condition. For example: the result of 2 bits after the interception of the session identifier is 36, the result after the hash processing of the terminal identifier starts with 00, the result after the terminal address is operated by the mask 0xffffff0f is 0x00000000, and the like. By the data analysis network element, the data sampling mode conforming to the random lottery principle is appointed, so that the function network element only reports the network data of part of terminals or part of sessions of random lottery, and the load of data acquisition of the data analysis network element can be reduced.

Optionally, the data sampling mode is used for indicating that the network data is reported when the terminal identifier or the user identifier meets a first specified condition and the session identifier or the terminal address meets a second specified condition. Therefore, the data sampling mode can randomly select a small number of terminals from a plurality of terminals and randomly select a small number of sessions from a plurality of sessions of the small number of terminals, so that the functional network element only reports network data of the small number of sessions of the small number of terminals, and the data acquisition load of the data analysis network element is further reduced.

In the scene that the plurality of functional network elements report network data to the data analysis network element, the request message sent by the data analysis network element to the plurality of functional network elements comprises the same data sampling mode, so that the plurality of functional network elements report the network data according to the same data sampling mode, namely the plurality of functional network elements report the network data corresponding to the same user/the same session to the data analysis network element, and the correlation among the network data reported by different functional network elements is ensured.

In the application, the data analysis network element sends the request message to at least one functional network element, and the request message comprises a data sampling mode, so that the at least one functional network element performs random decimation on the user/session according to the data sampling mode, only reports a small amount of network data related to the user/small amount of session to the data analysis network element, reduces the data acquisition load of the data analysis network element, and ensures the real-time performance of the data analysis network element for acquiring the network data. Furthermore, as each functional network element reports the network data according to the data sampling mode, the data acquisition load is reduced, and meanwhile, the correlation among the network data reported by different functional network elements is ensured, so that the data analysis network element can perform correlation processing on the network data received from a plurality of functional network elements according to the correlation among the network data, and the correlation processing efficiency can be improved.

With reference to the first aspect, in a possible implementation manner, the request message further includes a processing parameter, and the request message is further configured to instruct the at least one functional network element to process a first identifier (an identifier capable of indicating user identity information) in network data into a second identifier according to the processing parameter; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address; the first network data received by the data analysis network element from the at least one functional network element comprises the second identifier, so that privacy protection can be carried out on user identity information.

The manner of processing the first identifier according to the processing parameter may be referred to as "anonymous processing manner", and the second identifier may be referred to as a special identifier or an anonymous identifier. The processing parameters refer to parameters required by an anonymization algorithm that processes the first identity. Anonymous processing means include, but are not limited to: deleting or modifying part of the content in the user identity information (first identification), hashing the user identity information (first identification), and the like. The processing parameters may be included in the request message as independent parameters, and the processing parameters may also be carried in the event filter, which is not limited in this application.

With reference to the first aspect, in a possible implementation manner, the processing the first identifier according to the processing parameter includes: the first identifier cannot be obtained from the second identifier. In other words, the manner of processing the first identifier according to the processing parameter is an irreversible processing manner. After the data analysis network element receives the network data, the first identifier cannot be obtained according to the second identifier in the network data, so that the privacy of the user is protected.

With reference to the first aspect, in one possible implementation manner, the data sampling manner is used to instruct the at least one functional network element to report network data when the second identifier meets a specified condition. In this implementation, the functional network element first processes the first identifier in the network data into the second identifier according to the processing parameter. And then judging whether the second identifier meets the condition specified by the data sampling mode. If the second identifier meets the condition specified by the data sampling mode, the functional network element reports network data to the data analysis network element; if the second identifier does not meet the condition specified by the data sampling mode, the functional network element does not report the network data to the data analysis network element.

In another possible implementation manner, the data sampling manner is used to instruct the at least one functional network element to report network data when the first identifier meets a specified condition. In the implementation manner, the functional network element can firstly judge whether a first identifier in the network data meets the condition specified by the data sampling manner, if the first identifier meets the condition specified by the data sampling manner, the functional network element processes the first identifier in the network data into a second identifier according to the processing parameter, and reports the processed network data to the data analysis network element; if the first identifier does not meet the condition specified by the data sampling mode, the functional network element does not report the network data to the data analysis network element.

In another possible implementation manner, the data sampling manner is used for indicating that the network data is reported when the terminal identifier or the user identifier meets a first specified condition and the session identifier or the terminal address meets a second specified condition. In the implementation manner, the functional network element can judge whether to report the network data according to the data sampling manner, if the terminal identification or the user identification in the network data meets a first specified condition and the session identification or the terminal address meets a second specified condition, the network data is determined to be reported, otherwise, the network data is determined not to be reported. And under the condition of determining to report the network data, the data sampling network element processes the first identifier in the network data into the second identifier according to the processing parameters, and reports the processed network data to the data analysis network element.

In the above-mentioned implementations, in the scenario that the plurality of functional network elements report network data to the data analysis network element, the request message sent by the data analysis network element to the plurality of functional network elements includes the same data sampling mode and the same processing parameters, on one hand, the plurality of functional network elements report network data according to the same data sampling mode, that is, the plurality of functional network elements report network data corresponding to the same user/the same session to the data analysis network element, so that correlation between network data reported by different functional network elements is ensured. On the other hand, the plurality of functional network elements perform the same anonymization processing on the first identifier in the network data according to the same processing parameters, so that the privacy of the user is protected, and meanwhile, the relevance between the anonymized network data is still ensured.

With reference to the first aspect, in a possible implementation manner, the at least one functional network element includes one or more of AN access and mobility management function network element (such as AN AMF network element), a session management function network element (such as AN SMF network element), a user plane function network element (such as a UPF network element), AN application function network element (such as AN AF network element), a policy control function network element (such as a PCF network element), a network opening function network element (such as a NEF network element), a data management function network element (such as a UMD network element), a data storage function network element (such as a UDR network element), AN access network function network element (such as AN network element), and a terminal device (such as a UE).

With reference to the first aspect, in a possible implementation manner, when the at least one functional network element includes a session management functional network element (e.g. an SMF network element), the method further includes: the data analysis network element (such as NWDAF network element) receives second network data from a user plane function network element (such as UPF network element), wherein the second network data comprises the second identifier acquired from the session management function network element by the user plane function network element; and the data analysis network element performs association processing on the first network data received from at least one functional network element and the second network data received from the user plane functional network element according to the second identifier.

In the implementation manner, when the user plane functional network element does not have the first identifier in the network data collected by the user plane functional network element, and the user plane functional network element cannot report the network data according to the specified condition indicated by the data sampling manner, when the session management functional network element determines that the network data of a certain session needs to be reported, the second identifier obtained by anonymizing the first identifier is sent to the user plane functional network element corresponding to the session, on one hand, the second identifier is used for indicating the user plane functional network element to report the network data of the user plane related to the session to the data analysis network element, and on the other hand, the second identifier is included when the user plane functional network element reports the network data to the data analysis network element, so that the network data analysis network element also includes the second identifier in the network data received from the user plane functional network element, and thus the data analysis network element can perform association processing on the first network data received from the functional network element and the second network data received from the user plane functional network element according to the second identifier.

With reference to the first aspect, in a possible implementation manner, when the at least one functional network element includes a session management functional network element (e.g. an SMF network element), the method further includes: the data analysis network element (for example, NWDAF network element) receives third network data from an application function network element (for example, AF network element), wherein the third network data comprises a fourth identifier obtained by the application function network element from the session management function network element, the fourth identifier is obtained by processing a third identifier by the session management function network element according to the processing parameter, and the third identifier is a terminal identifier or a user external identifier corresponding to a user identifier; the data analysis network element further comprises the fourth identifier in the first network data received from the session management function network element; and the data analysis network element performs association processing on the first network data received from the at least one functional network element and the third network data received from the application functional network element according to the second identifier and the fourth identifier.

In this implementation manner, when the network data collected by the application function network element does not have the first identifier, and the application function network element cannot report the network data according to the specified condition indicated by the data sampling manner, when the session management function network element determines that the network data of a certain session needs to be reported, the terminal identifier or the user external identifier (third identifier) corresponding to the user identifier in the session is obtained, and the third identifier is processed into the fourth identifier (may also be referred to as a special user external identifier or an anonymous user external identifier) according to the processing parameter. The session management function network element sends the fourth identifier to the application function network element to instruct the application function network element to report the network data to the data analysis network element, and the fourth identifier is included in the network data. Meanwhile, the network data reported by the session management function network element to the data analysis network element comprises a fourth identifier besides the second identifier. In this way, the data analysis network element may associate the third network data received from the application function network element with the first network data received from the session management function network element according to the fourth identifier, and perform association processing on the first network data received from the session management function network element and other function network elements according to the second identifier.

With reference to the first aspect, in a possible implementation manner, when the at least one functional network element includes an access and mobility management functional network element (for example, an AMF network element), the method further includes: the data analysis network element (for example, NWDAF network element) receives fourth network data from a terminal device, where the fourth network data is network data reported by the terminal device according to the data sampling mode and the processing parameter acquired from the access and mobility management function network element; and the data analysis network element performs association processing on the first network data received from the at least one functional network element and the fourth network data received from the terminal equipment according to the second identifier.

In this implementation manner, the terminal device may also report the fourth network data to the data analysis network element. After the access and mobility management function network element receives the data sampling mode and the processing parameter from the data analysis network element, the data sampling mode and the processing parameter can be sent to the terminal equipment to instruct the terminal equipment to report fourth network data to the data analysis network element according to the data sampling mode and the processing parameter, so that the fourth network data reported to the data analysis network element by the terminal equipment also comprises the second identifier. In this way, the data analysis network element may perform association processing on the first network data received from the at least one functional network element and the fourth network data received from the terminal device according to the second identifier.

In a second aspect, the present application provides a method for processing network data, including: the communication equipment acquires a first request message, wherein the first request message comprises a data sampling mode, and the data sampling mode accords with a random decimation principle; and the communication equipment reports the first network data to the data analysis network element according to the data sampling mode.

The communication device may be a functional network element (e.g. NF, AF), a terminal device, etc.

When the communication device is a functional network element, the functional network element obtains a first request message from the data analysis network element. The first request message may be a subscription request message (e.g., an eventExposure_substrice message) sent by the data analysis network element to the functional network element for subscribing to network data.

When the communication device is a terminal device, the terminal device obtains a first request message from an access and mobility management function network element (e.g., an AMF network element). The access and mobility management function network element receives the first request message from the data analysis network element, and forwards the first request message to the terminal device to instruct the terminal device to report the network data to the data analysis network element.

With reference to the second aspect, in a possible implementation manner, the first request message further includes a processing parameter, where the processing parameter is used to instruct the communication device to process a first identifier in the first network data into a second identifier according to the processing parameter; the communication equipment includes the second identifier in the first network data reported to the data analysis network element; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

With reference to the second aspect, in a possible implementation manner, the processing the first identifier according to the processing parameter includes: the first identifier cannot be obtained from the second identifier.

With reference to the second aspect, in one possible implementation manner, the reporting, by the communication device, first network data to the data analysis network element according to the data sampling manner includes: the communication equipment processes the first identifier in the first network data into the second identifier according to the processing parameters; and if the second identifier meets the condition specified by the data sampling mode, the communication equipment reports the first network data to the data analysis network element.

With reference to the second aspect, in one possible implementation manner, the reporting, by the communication device, first network data to the data analysis network element according to the data sampling manner includes: and if the first identifier in the first network data meets the condition specified by the data sampling mode, the communication equipment processes the first identifier in the first network data into a second identifier according to the processing parameter, and reports the processed first network data to the data analysis network element, wherein the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

With reference to the second aspect, in one possible implementation manner, the first identifier in the first network data meets a condition specified by the data sampling manner, including: the terminal identification or the user identification in the first network data meets a first condition specified by the data sampling mode, and the session identification or the terminal address in the first network data meets a second condition specified by the data sampling mode.

With reference to the second aspect, in one possible implementation manner, the communication device is any one of the following: an access and mobility management function network element, a session management function network element, a user plane function network element, an application function network element, a policy control function network element, a network opening function network element, a data storage function network element, an access network function network element, and a terminal device.

With reference to the second aspect, in a possible implementation manner, the communication device is a session management function network element, and the method further includes at least one of the following: the session management function network element sends the second identifier to a user plane function network element, so that the user plane function network element comprises the second identifier when reporting second network data to the data analysis network element;

Or alternatively, the process may be performed,

the session management function network element processes a third identifier into a fourth identifier according to the processing parameter, wherein the third identifier is a terminal identifier or a user external identifier corresponding to the user identifier; the session management function network element sends a second request message to the application function network element, wherein the second request message comprises the fourth identifier, and the second request message is used for indicating the application function network element to report third network data to the data analysis network element and comprises the fourth identifier; the session management function network element further includes the fourth identifier in the first network data reported to the data analysis network element.

With reference to the second aspect, in one possible implementation manner, the communication device is an access and mobility management function network element, and the first request message received by the access and mobility management function network element further includes an indication for requesting the terminal device to report network data; after the communication device obtains the first request message, the method further includes: the access and mobility management function network element sends a third request message to the terminal equipment, wherein the third request message comprises the data sampling mode and the processing parameter, and the third request message is used for indicating the terminal equipment to report fourth network data to the data analysis network element according to the data sampling mode and the processing parameter.

In a third aspect, the present application provides a data analysis network element, comprising: a transmitting unit, a receiving unit and a processing unit;

the sending unit is configured to send a request message to at least one functional network element, where the request message includes a data sampling manner, and the request message is used to instruct the at least one functional network element to report network data in the data sampling manner, where the data sampling manner accords with a random decimation principle; the receiving unit is configured to receive first network data from the at least one functional network element; the processing unit is configured to perform association processing on the first network data received from the at least one functional network element.

With reference to the third aspect, in a possible implementation manner, the request message further includes a processing parameter, and the request message is further configured to instruct the at least one functional network element to process, according to the processing parameter, a first identifier in network data into a second identifier; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address; the first network data received by the data analysis network element from the at least one functional network element comprises the second identifier.

With reference to the third aspect, in a possible implementation manner, the processing the first identifier according to the processing parameter includes: the first identifier cannot be obtained from the second identifier.

With reference to the third aspect, in one possible implementation manner, the data sampling manner is used to instruct the at least one functional network element to report network data when the second identifier meets a specified condition.

With reference to the third aspect, in one possible implementation manner, the data sampling manner is used to instruct the at least one functional network element to report network data when the first identifier meets a specified condition; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

With reference to the third aspect, in one possible implementation manner, the data sampling manner is used for indicating that the network data is reported when the terminal identifier or the user identifier meets a first specified condition and the session identifier or the terminal address meets a second specified condition.

With reference to the third aspect, in a possible implementation manner, the at least one functional network element includes one or more of an access and mobility management functional network element, a session management functional network element, a user plane functional network element, an application functional network element, a policy control functional network element, a network opening functional network element, a data management functional network element, a data storage functional network element, and an access network functional network element.

With reference to the third aspect, in a possible implementation manner, when the at least one functional network element includes a session management functional network element, the receiving unit is further configured to receive second network data from a user plane functional network element, where the second network data includes the second identifier acquired by the user plane functional network element from the session management functional network element; the processing unit is further configured to perform association processing on the first network data received from at least one functional network element and the second network data received from the user plane functional network element according to the second identifier;

or alternatively, the process may be performed,

the receiving unit is further configured to receive third network data from an application function network element, where the third network data includes a fourth identifier obtained by the application function network element from the session management function network element, where the fourth identifier is obtained by processing, by the session management function network element, a third identifier according to the processing parameter, where the third identifier is a terminal identifier or a user external identifier corresponding to the user identifier; the data analysis network element further comprises the fourth identifier in the first network data received from the session management function network element; the processing unit is further configured to perform association processing on the first network data received from the at least one functional network element and the third network data received from the application functional network element according to the second identifier and the fourth identifier.

With reference to the third aspect, in one possible implementation manner, when the at least one functional network element includes an access and mobility management functional network element, the receiving unit is further configured to receive fourth network data from a terminal device, where the fourth network data is network data reported by the terminal device according to the data sampling manner and the processing parameter acquired from the access and mobility management functional network element; the processing unit is further configured to perform association processing on the first network data received from the at least one functional network element and the fourth network data received from the terminal device according to the second identifier.

In a fourth aspect, the present application provides a communication device comprising: a transmitting unit, a receiving unit and a processing unit; wherein, the liquid crystal display device comprises a liquid crystal display device,

the receiving unit is used for acquiring a first request message, wherein the first request message comprises a data sampling mode, and the data sampling mode accords with a random decimation principle; and the sending unit is used for reporting the first network data to the data analysis network element according to the data sampling mode.

With reference to the fourth aspect, in a possible implementation manner, the first request message further includes a processing parameter, where the processing parameter is used to instruct the communication device to process a first identifier in the first network data into a second identifier according to the processing parameter; the communication equipment includes the second identifier in the first network data reported to the data analysis network element; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

With reference to the fourth aspect, in a possible implementation manner, the processing the first identifier according to the processing parameter includes: the first identifier cannot be obtained from the second identifier.

With reference to the fourth aspect, in one possible implementation manner, when the communication device is a functional network element, the receiving unit is specifically configured to obtain a first request message from a data analysis network element; when the communication device is a terminal device, the receiving unit is specifically configured to obtain a first request message from an access and mobility management function network element.

With reference to the fourth aspect, in a possible implementation manner, the processing unit is configured to: processing the first identifier in the first network data into the second identifier according to the processing parameter; the sending unit is specifically configured to: and when the second identifier meets the condition specified by the data sampling mode, reporting the first network data to the data analysis network element.

With reference to the fourth aspect, in a possible implementation manner, the processing unit is configured to: if the first identifier in the first network data meets the condition specified by the data sampling mode, processing the first identifier in the first network data into a second identifier according to the processing parameter; the sending unit is specifically configured to report the processed first network data to the data analysis network element; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

With reference to the fourth aspect, in a possible implementation manner, the first identifier in the first network data meets a condition specified by the data sampling manner, including: the terminal identification or the user identification in the first network data meets a first condition specified by the data sampling mode, and the session identification or the terminal address in the first network data meets a second condition specified by the data sampling mode.

With reference to the fourth aspect, in one possible implementation manner, the communication device is any one of the following: an access and mobility management function network element, a session management function network element, a user plane function network element, an application function network element, a policy control function network element, a network opening function network element, a data storage function network element, an access network function network element, and a terminal device.

With reference to the fourth aspect, in a possible implementation manner, the communication device is a session management function network element, and the sending unit is further configured to send the second identifier to a user plane function network element, so that the user plane function network element includes the second identifier when reporting second network data to the data analysis network element;

or alternatively, the process may be performed,

The processing unit is used for: processing a third identifier into a fourth identifier according to the processing parameter, wherein the third identifier is a terminal identifier or a user external identifier corresponding to the user identifier; the sending unit is configured to send a second request message to an application function network element, where the second request message includes the fourth identifier, and the second request message is used to instruct the application function network element to include the fourth identifier when reporting third network data to the data analysis network element; the session management function network element further includes the fourth identifier in the first network data reported to the data analysis network element.

With reference to the fourth aspect, in one possible implementation manner, the communication device is an access and mobility management function network element, and the first request message received by the access and mobility management function network element further includes an indication for requesting the terminal device to report network data; the sending unit is further configured to send a third request message to a terminal device, where the third request message includes the data sampling manner and the processing parameter, and the third request message is used to instruct the terminal device to report fourth network data to the data analysis network element according to the data sampling manner and the processing parameter.

In a fifth aspect, the present application provides a data analysis network element, comprising: a memory for storing a computer program and a processor for calling and running the computer program from the memory, such that the processor runs the computer program to perform the method according to any of the above first aspects.

In a sixth aspect, the present application provides a communication device comprising: a memory for storing a computer program and a processor for calling and running the computer program from the memory, such that the processor runs the computer program to perform the method according to any of the second aspect above.

The communication device may be a functional network element (e.g. NF, AF, etc.), or may be a terminal device.

In a seventh aspect, the present application provides a communication system comprising: the data analysis network element of the fifth aspect, and at least one functional network element.

Alternatively, the data analysis network element may be an NWDAF network element.

In an eighth aspect, the present application provides a storage medium comprising a computer program for implementing a method according to any one of the first aspects above, or a method according to any one of the second aspects above.

In a ninth aspect, embodiments of the present application provide a chip or a chip system, where the chip or the chip system includes at least one processor and a communication interface, where the communication interface and the at least one processor are interconnected by a line, and where the at least one processor is configured to execute a computer program or instructions to perform a method for processing network data as described in any one of the possible implementations of the first aspect to the first aspect, or to perform a method for processing network data as described in any one of the possible implementations of the second aspect to the second aspect.

The communication interface in the chip can be an input/output interface, a pin, a circuit or the like.

In one possible implementation, the chip or chip system described above in the present application further includes at least one memory, where the at least one memory has instructions stored therein. The memory may be a memory unit within the chip, such as a register, a cache, etc., or may be a memory unit of the chip (e.g., a read-only memory, a random access memory, etc.).

The method, the network element and the system for processing the network data provided by the application comprise the following steps: the data analysis network element sends a request message to at least one functional network element, wherein the request message comprises a data sampling mode, and the data sampling mode accords with a random decimation principle, so that the at least one functional network element performs random decimation on users/sessions according to the data sampling mode, only reports a small amount of network data related to the users/the sessions to the data analysis network element, reduces the data acquisition load of the data analysis network element, and ensures the real-time performance of the data analysis network element for acquiring the network data. Furthermore, as each functional network element reports the network data according to the data sampling mode, the data acquisition load is reduced, and meanwhile, the correlation between the network data reported by different functional network elements is ensured, so that the data analysis network element can perform correlation processing on the network data received from a plurality of functional network elements according to the correlation between the network data, and the correlation processing efficiency can be improved.

Drawings

Fig. 1 is a schematic diagram of a network architecture provided in the present application;

fig. 2 is a schematic diagram of a service scenario adapted to an embodiment of the present application;

fig. 3 is an interaction schematic diagram of a method for processing network data according to an embodiment of the present application;

fig. 4 is a flow chart of a method for processing network data according to an embodiment of the present application;

fig. 5 is a schematic diagram of a PDU session connection establishment procedure in an embodiment of the present application;

FIG. 6 is an interactive schematic diagram of a method for processing network data according to an embodiment of the present application;

fig. 7 is an interaction schematic diagram of a method for processing network data according to an embodiment of the present application;

FIG. 8 is an interactive schematic diagram of a method for processing network data according to an embodiment of the present application;

FIG. 9 is an interactive schematic diagram of a method for processing network data according to an embodiment of the present application;

fig. 10 is a schematic structural diagram of a data analysis network element according to an embodiment of the present application;

fig. 11 is a schematic structural diagram of a communication device according to an embodiment of the present application;

fig. 12 is a schematic structural diagram of a data analysis network element according to an embodiment of the present application;

fig. 13 is a schematic structural diagram of a functional network element according to an embodiment of the present application;

Fig. 14 is a schematic structural diagram of a terminal device according to an embodiment of the present application.

Detailed Description

The network architecture and the service scenario described in the embodiments of the present application do not constitute a limitation to the technical solution provided in the embodiments of the present application, and those skilled in the art can know that, with the evolution of the network architecture and the appearance of a new service scenario, the technical solution provided in the embodiments of the present application is also applicable to similar technical problems.

The technical solution shown in the present application may be applied to a fifth generation mobile communication technology (the 5th generation mobile communication technology,5G) system, and may also be applied to a long term evolution (long term evolution, LTE) system, for example, a vehicle-to-all (V2X) system, a device-to-device (D2D) system, a machine type communication (machine type communication, MTC) system, and the like in the LTE communication system.

The technical solution shown in the present application may also be applied to other communication systems, for example: an evolution communication system of a 5G system, and the like, which is not limited in this application.

The following describes the technical solution shown in the present application in detail, taking the communication system used in the present application as a 5G communication system as an example.

Fig. 1 is a schematic diagram of a network architecture provided in the present application. Referring to fig. 1, the network node includes a User Equipment (UE), AN Access Network (AN) node, and a plurality of Network Function (NF) network elements. Wherein the plurality of NF network elements may include: user plane function (user plane function, UPF) network elements, access and mobility management function (access and mobility management function, AMF) network elements, session management function (session management function, SMF) network elements, policy control function (policy control function, PCF) network elements, network slice selection function (network slice selection function, NSSF) network elements, unified data management (unified data management, UDM) network elements, network warehouse function (network repository function, NRF) network elements, network opening function (network exposure function, NEF) network elements, network data analysis function (network data analytics function, NWDAF) network elements, data storage function network elements (unified data repository, UDR), and the like. In addition, the network architecture may further include: a Data Network (DN) node, an application function (application function, AF) network element, etc.

The network elements in fig. 1 may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (e.g., a cloud platform).

It should be noted that, in the network architecture shown in fig. 1, only network elements included in the entire network architecture are exemplarily described. In the embodiment of the present application, the network elements included in the entire network architecture are not limited, for example, in the embodiment of the present application, any one network element or any multiple network elements of all the network elements shown in fig. 1 may be included in the network architecture.

The terminal equipment is electronic equipment with a wireless communication function, can be deployed on land, and comprises indoor or outdoor, handheld or vehicle-mounted; can also be deployed on the water surface (such as ships, etc.); but may also be deployed in the air (e.g., on aircraft, balloon, satellite, etc.). The terminal device may be a UE, a mobile phone (mobile phone), a tablet computer (pad), a computer with a wireless transceiving function, a Virtual Reality (VR) terminal device, an augmented reality (augmented reality, AR) terminal device, a wireless terminal device in industrial control (industrial control), a wireless terminal device in unmanned driving (self driving), a wireless terminal device in remote medical (remote medical), a wireless terminal device in smart grid (smart grid), a wireless terminal device in transportation security (transportation safety), a wireless terminal device in smart city (smart city), a wireless terminal device in smart home (smart home), or the like.

AN Node may be a device that provides wireless access to a UE, including but not limited to AN evolved Node B (eNB), a wireless-fidelity access point (WiFi AP), a worldwide interoperability for microwave access base station (worldwide interoperability for microwave access base station, wiMAX BS), a base station in a 5G network (e.g., gNodeB, gNB), etc. The AN node may also be a (radio access network, RAN) node.

The UPF network element may process the message, for example: the UPF can execute functions of user data forwarding, routing, data statistics, speed limiting, statistics reporting and the like.

The AMF network element may perform mobility management in a mobile network, such as user location update, user registration network, user handover, etc. The AMF network element can access non-access stratum (NAS) signaling (comprising session management (session management, SM) signaling) of the UE through an N1 interface, and can also access RAN signaling through an N2 interface, so that the registration flow of a user, forwarding of SM signaling and mobility management are completed. The AMF network element may forward messages between the SMF network element and the UE.

The SMF network element may manage sessions in the mobile network, such as session establishment, session modification, session release, etc.

The PCF network element may manage user policies including mobility related policies, protocol data unit (Protocol Data Unit, PDU) session related policies, such as quality of service (quality of service, qoS) policies, charging policies, etc.

The NSSF network element is used to select a network slice (network slice). The network slice is a network for supporting logical isolation of specific network capability and network characteristics, and can be an end-to-end (E2E) network comprising the whole network, or can be a part of network functions shared among a plurality of network slices, which is a key technology for meeting the requirement of the fifth generation 5G mobile communication technology proposed by 3GPP on network differentiation. In general, the network characteristics of different network slices are not the same, and the network slices are required to be isolated from each other and not to influence each other. Network slicing such as enhanced (augmented reality, AR) or Virtual (VR) traffic requires large bandwidth, low latency; network slicing of internet of things (internet of things, IOT) services requires support of massive terminal access, but has small bandwidth and no time delay requirement.

The UDM network element is responsible for managing information such as subscription data of the user, and may provide subscription data of the user to the network elements such as AMF and SMF.

The UDR network element stores data structured in the network, including subscriber subscription data information and subscriber policies. The UDM may read terminal subscription data from the UDR and the PCF may read user policy information from the UDR. The UDR may also be split into two parts to be combined separately in the UDM and PCF network elements, without being deployed separately.

The NRF network element stores registration information of other functional network elements and provides service for finding each other between network functional network elements according to the registration information.

The NEF network element is responsible for the authorization and control of the network to open services and capabilities, and the AF network element outside the operator network can provide network data for the network through the NEF network element, and can also obtain the services and data of the network to open to the outside through the NEF.

The DN is used to provide data services to the UE and may be the access destination for the user's PDU session. The DN may be a PDN network such as the internet, IP Multimedia Service (IMS), etc.

The AF network element may send a request to affect the SMF routing policy and be responsible for selecting and relocating applications in the local DN. AF mainly performs dynamic policy/charging control on forwarding plane behavior. These services require dynamic policy and charging control. AF transmits dynamic session information needed by PCF, receives specific information of IP connection access network (IP-CAN) and confirmation of IP-CAN bearing layer event.

The structure and topology of the 5G network are more and more complex, and in order to ensure end-to-end network performance and service experience, the 5G network introduces NWDAF network elements. The NWDAF network elements are applied to big data analysis by deep learning and other technologies, and by analyzing the running state data of each network element and link in the network, analysis suggestions are output, and reasonable decisions are made to ensure the end-to-end network performance and service experience. The NWDAF network element may collect data from NF (e.g., AMF, SMF, PCF, UDM, NEF, etc.), operator or third party AF, operation administration and maintenance (operation administration and maintenance, OAM), and may retrieve information from data stores (e.g., user related information stores (unified data repository, UDR), NRF, NSSF, etc.). The NWDAF analyzes the collected data, and the output analysis result can be provided for NF, AF or OAM for use, so as to monitor the network state or predict the network operation state.

In this application, data collected by the NWDAF from at least one network element in NF, AF, and information repository is referred to as network data (network data). The network data reflects data of network operation states and operation information, and reflects application business states, application information, and application experiences. The data collected from the OAM is referred to as network management data (network management data). The network management data reflects network and device configuration information, performance statistics, fault notification, and alarms. The distinction between network data and network management data is mainly the following:

(1) Network data is single user granularity or single session connection granularity; and network management data is network device granularity.

(2) Network data may be obtained from NF, AF and data warehouse in real time; the network management data is generally a result of summarizing the processing for a period of time (for example, 5 minutes, 15 minutes or 1 hour), and does not have real-time property.

(3) The network data may all be user-specific or session-specific, and may be associated with a single user or session connection; the network management data is device level granular and cannot be correlated for a single user or a single session connection.

Fig. 2 is a schematic diagram of a service scenario adapted to an embodiment of the present application. Referring to fig. 2, an nwdaf network element may collect network data from NF (e.g., AMF, SMF, PCF, UDM, NEF, etc.), AF of an operator or a third party, a data warehouse (e.g., UDR, NRF, NSSF, etc.). The NWDAF analyzes the collected network data, and the output analysis result can be provided for NF, AF or OAM for use, so as to monitor the network state or predict the network operation state.

The network data that the NWDAF may collect to the NF includes: network parameters and network key performance indicators (key performance indicator, KPI). The network parameters refer to parameters of the operation state of the 5G network function. Such as a cache function switch state, session continuity mode, etc. The network KPI refers to a key performance index of the 5G network function, and can reflect the running state of the 5G network function.

The network data that the NWDAF can collect to the AF is typically application information. The application information includes application parameters, application traffic and application experience. Wherein the application parameters are used to determine a mobility pattern and/or a communication pattern (communication pattern) used by a user's terminal device when using the application service (application service). The movement mode refers to parameters of movement behavior characteristics of the terminal equipment, and may include: the time the terminal device is stationary, the time of movement, the length of stationary duration, the length of movement duration, or the speed of movement, etc. The communication mode refers to parameters of communication behavior characteristics of the terminal device, and may include: the application layer initiates and ends the communication time, communication duration length, communication silence duration, average communication traffic, bursty communication traffic, communication message length, or number of communications per unit time, etc. The application traffic may be used to describe the number of connections or data traffic of the application layer traffic between the terminal device and the application server. An application experience describing how well a network slice meets the requirements of supported application services. For example, user experience metrics (customer experience index, CEI) of the application service, mean opinion score (mean opinion score, MOS) of the audio-video application, perceived experience (quality of experience, qoE) of the user, etc.

Illustratively, as shown in fig. 1, NWDAF, NEF, AMF, SMF, PCF, UDM (UDR), NRF, NSSF, etc. NFs are connected to the service bus. The NWDAF collects network data from each NF of AMF, SMF, PCF, UDM (UDR), NRF, NSSF, NEF, etc. through the service bus. Referring to fig. 1, the AF may be connected on a service bus, and the NWDAF may collect network data directly from the AF. The AF may also be indirectly connected to the service bus through the NEF, from which the NWDAF may collect network data. The network data of the UPF may be reported to the NWDAF through the SMF, or the UPF may directly report the network data to the NWDAF through the service bus. Thus, the NWDAF collects network data from each functional network element, performs association processing on the network data collected from different functional network elements, analyzes the network operation condition in real time, and outputs an analysis result.

The NWDAF network element may collect a large amount of network data (e.g., application information, network parameters, network KPIs, etc.) and deep learn the collected network data. The regression model is trained using the plurality of network data to obtain an ideal regression model, which indicates the association between the network data and the network operation information. For this purpose, the NWDAF may first sort the above-mentioned collected network data into individual data samples according to whether it relates to a single user or a single session connection, i.e. correlate network data related to the same user or the same session connection collected from different functional network elements. Thus, each data sample after association is network data related to a single user or a single session connection. The regression model is then trained with these data samples. The regression model is a model that describes the mapping relationship between the independent variables (network data) and the dependent variables (network operation information) using a regression algorithm. The purpose of the regression algorithm is to find the hypothesis function (hypothesis) to best fit a given dataset. Common regression algorithms include: linear regression (linear regression), logistic regression (logistic regression), polynomial regression (polynomial regression), and the like. After the ideal regression model is obtained through training, the NWDAF can use the regression model to judge whether the network operates normally or predict the future network operation condition according to the network data collected currently, and output the suggestion of network optimization. The method for processing the network data provided in the embodiment of the present application may be applied to the above-mentioned training stage of the regression model (for example, the network data processed in the embodiment is used as training data to train the regression model), and may also be applied to the above-mentioned use stage of the regression model (for example, the network data processed in the embodiment is analyzed by using the regression model to determine whether the operation of the network is normal or not, or predict the future network operation condition, and output a suggestion of network optimization).

According to the 3gpp TS 23.288 specification, NWDAF gathers network data to NF or AF by means of event subscription.

Fig. 3 is an interaction schematic diagram of a processing method of network data according to an embodiment of the present application. As shown in fig. 3, the NWDAF may send a subscription request message to the NF or AF, where an area of interest (AOI) may be specified in the subscription request message, to instruct the NF or AF to report network data related to each UE or each session in the AOI. The AOI may be one or more Tracking Areas (TAs) or one or more base station cells (cells). In this way, NF or AF will report the network data related to each UE or each session in the AOI to NWDAF in real time through a notification message.

However, the NWDAF collects network data of each UE or each session in the designated AOI from each NF and AF, the data amount is very large, so that the data collection causes a very large load on the network (especially, the signaling network), which makes it difficult for the NWDAF to collect network data in real time and analyze the collected network data in real time, so that it is impossible to monitor the network state or make predictions of the network state in real time.

In many application scenarios, in order to evaluate whether a service quality or service level agreement (service level agreement, SLA) of a network slice meets a requirement, the NWDAF needs to collect network data corresponding to the network slice, which needs to collect network data of each location. The above-described way of limiting AOI does not actually reduce the data collection load in these application scenarios.

Therefore, the application provides a network data processing method, in which the NWDAF can randomly collect network data of each functional network element in real time, reduce the number of data collection, and realize real-time data collection and real-time data analysis.

The technical scheme shown in the application is described in detail through specific embodiments. It should be noted that the following embodiments may exist alone or in combination with each other. For the same or similar matters, for example, explanation of terms or nouns, explanation of steps, etc., reference may be made to each other in different embodiments, and the explanation is not repeated.

Fig. 4 is a flow chart of a processing method of network data according to an embodiment of the present application. As shown in fig. 4, the method may include:

s401: the data analysis network element sends a request message to at least one functional network element, wherein the request message comprises a data sampling mode, and the data sampling mode accords with a random decimation principle.

The request message is used for indicating at least one functional network element to report network data in a data sampling mode.

S402: the data analysis network element receives network data from at least one functional network element.

S403: the data analysis network element performs association processing on network data received from the at least one functional network element.

In this embodiment, for different service scenarios, there may be different numbers of functional network elements reporting network data to the data analysis network element, and the number of the functional network elements is not limited in this embodiment. Only two functional network elements are illustrated in fig. 4 as examples.

The data analysis network element refers to a network element that collects network data from other functional network elements and analyzes the collected network data to monitor or predict the network operation state in real time. The functional network element refers to a device that generates network data and reports the network data to the data analysis network element. The functional network element may be NF, AF, etc. In the present application, the data analysis network element and the functional network element may be independent network elements in the communication system, and the data analysis network element may also be integrated into the functional network element, which is not limited in this application.

Taking the network architecture shown in fig. 1 as an example, the data analysis network element may be a network data analysis function network element (i.e., the NWDAF network element in fig. 1). The at least one functional network element may comprise one or more of the following: AN access and mobility management function element (i.e., AMF element in fig. 1), a session management function element (i.e., SMF element in fig. 1), a user plane function element (i.e., UPF element in fig. 1), AN application function element (i.e., AF element in fig. 1), a policy control function element (i.e., PCF element in fig. 1), a network opening function element (i.e., NEF element in fig. 1), a unified data management function element (i.e., UDM element in fig. 1), a data storage function element (i.e., UDR element in fig. 1), AN access network function element (i.e., AN element in fig. 1).

In this embodiment of the present application, the network data refers to data collected by the foregoing functional network elements and used to reflect a network operation state and operation information, or data used to reflect an application service state, application information, and application experience. Network data is data of a single user granularity or a single session granularity. Typically, network data collected by different functional network elements is different. Exemplary, NF-collected network data includes: network parameters and network KPIs, etc. The network data collected by the AF comprises: application parameters, application traffic, application experience, etc.

In this embodiment, the data analysis network element sends a request message to at least one functional network element. The request message may be a subscription request message for subscribing to network data. After each functional network element receives the request message, it can send a confirmation message to the data analysis network element.

The request message may include an event identifier (event id), which is used to instruct the functional network element to report network data related to which type of event, for example: session class events, mobile class events, qoS parameter class events, negotiation class events, etc. For example, when the event identifier carried in the request message is the identifier of the session event, the functional network element needs to report network parameters related to the establishment of the session, the switching of the session and the release of the session of the UE. For example, the AMF needs to report data such as location information of the UE when the UE establishes a session or releases the session, and the SMF needs to report data such as attribute parameters, source and destination addresses, qoS parameters, and the like when the UE establishes a session or switches the session, and data such as session release time and cause.

An event filter (event filter) may also be included in the request message. The event filter is used for designating the functional network element to report only network data under specific conditions, such as the network data of session events when the UE is at a specific position.

In this embodiment, the request message further includes a data sampling manner, where the request message is used to instruct at least one functional network element to report network data by using the data sampling manner. The data sampling mode accords with the random extraction principle. Random extraction principles refer to ensuring that each user/session has a known, non-zero probability of being extracted. In other words, the data sampling mode designates a condition of random decimation, so that at least one functional network element performs random decimation according to the designated condition.

In a possible implementation manner, the data sampling manner is used for indicating at least one functional network element to report network data when the first identifier meets a specified condition. Wherein the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

The terminal identifier refers to an identifier number or a device fingerprint (equipment fingerprint) of the terminal, and may be any one of an international mobile equipment identifier number (international mobile equipment identity, IMEI), a mobile equipment identifier (mobile equipment identifier, MEID), and a device serial number (equipment serial number, ESN).

The subscriber identity refers to a number capable of identifying the identity of a mobile subscriber, and may be any of an international mobile subscriber identity (international mobile subscriber identify, IMSI), a subscriber fixed or mobile telephone number (integrated service digital network number, ISDN number), a temporary mobile subscriber identity (temporary mobile subscriber identity, TMSI), a subscriber permanent identity (subscription permanent identifier, SUPI), a subscriber hidden identity (subscription concealed identifier, sui), a mobile subscriber identity (mobile subscriber identification number, MSIN), a network access identity (network access identifier, NAI), an internal subscriber group identity (internal group identifier), an external subscriber group identity (external group identifier), a user account number (user name or user Id or user account) of an application.

Session identification refers to a Session ID that identifies the Session's descriptor, and each Session connection of a terminal has a unique descriptor for that terminal. AMF, SMF, PCF, etc. uses the terminal identity together with the session identity to uniquely identify a session connection in the network.

The terminal address refers to an internet access protocol (internet protocol, IP) address or a medium access control (media access control, MAC) address of the terminal.

By way of example, the data sampling pattern may be expressed as: exp (a) = PATTERN. The operations specified by the Exp for the data analysis network element may be masks, operation expressions, regular expressions, hash operations, and the like. A is a first identifier, which can be any one of a terminal identifier, a user identifier, a session identifier and a terminal address. Patterm is a specified mode or specified condition.

In one example, taking Exp as a mask operation and a as a session identifier as an example, the specified condition may be: the result of 2 bits after the interception of the session identification is 36. In this way, before the functional network element sends the network data to the data sharing network element, judging whether the session identifier in the network data meets the specified condition, and if so, sending the network data to the data analysis network element; and if the specified condition is not met, not sending the network data to the data analysis network element. Considering randomness of the UE allocation session identity, the data sampling manner may randomly decimate a small number of sessions from many sessions (e.g., 1 session may be randomly decimated from 100 sessions in the above example) so that the functional network element only reports network data of a small number of sessions.

In another example, taking Exp as a hash operation and a as a terminal identifier as an example, the specified condition may be: the hashed result of the terminal identity satisfies a specific pattern (e.g. starts with 00). In this way, before the functional network element sends the network data to the data analysis network element, the functional network element can judge whether the terminal identifier in the network data meets the specified condition, and if the terminal identifier meets the specified condition, the functional network element sends the network data to the data analysis network element; and if the specified condition is not met, not sending the network data to the data analysis network element. The data sampling mode can randomly select a small number of terminals from a plurality of terminals, so that the functional network element only reports the network data of the small number of terminals.

In yet another example, taking Exp as a mask operation and a as a terminal address as an example, the specified condition may be: the result of the terminal address operation with the mask 0xffffff0f is 0x00000000. In this way, before the functional network element sends the network data to the data analysis network element, the functional network element can judge whether the terminal identifier in the network data meets the specified condition, and if the terminal identifier meets the specified condition, the functional network element sends the network data to the data analysis network element; and if the specified condition is not met, not sending the network data to the data analysis network element. The data sampling approach may randomly decimate a small number of sessions from a large number of sessions (e.g., in this example, random decimating 16 sessions from 256 may be implemented approximately) so that the functional network element only reports network data for these small number of sessions.

In the above examples, the data analysis network element designates the data sampling mode according with the random decimation principle, so that the functional network element only reports the network data of part of terminals or part of sessions of random decimation, thereby reducing the load of data acquisition of the data analysis network element.

In another possible implementation manner, the data sampling manner is used for indicating that the network data is reported when the terminal identifier or the user identifier meets a first specified condition and the session identifier or the terminal address meets a second specified condition.

In one example, the first specified condition indicated by the data sampling manner is: the hash result of the terminal identifier meets a specific mode (the proportion starts with 00), and the second specified condition is that: the result of 2 bits after the interception of the session identification is 36. In this way, before the functional network element sends the network data to the data analysis network element, the functional network element will judge whether the terminal identifier in the network data meets the first specified condition and whether the session identifier meets the second specified condition, and if the two conditions are met at the same time, the functional network element sends the network data to the data analysis network element; otherwise, the network data is not sent to the data analysis network element. According to the embodiment, the data sampling mode can randomly select a small number of terminals from a plurality of terminals and randomly select a small number of sessions from a plurality of sessions of the small number of terminals, so that the functional network element only reports network data of the small number of sessions of the small number of terminals, and the data acquisition load of the data analysis network element is further reduced.

It should be noted that, the data sampling manner in this embodiment may be included as an independent parameter in the request message, and the data sampling manner may also be carried in the event filter, which is not limited in this embodiment.

In this embodiment, in a scenario in which a plurality of functional network elements report network data to a data analysis network element, a request message sent by the data analysis network element to the plurality of functional network elements includes the same data sampling manner, so that the plurality of functional network elements report network data according to the same data sampling manner, that is, the plurality of functional network elements report network data corresponding to the same user/the same session to the data analysis network element, thereby ensuring that the network data reported by different functional network elements have relevance. Further, the data analysis network element may perform association processing on the network data received from the plurality of functional network elements according to the association between the network data. For example, if the network data received in the same time period all carry the same first identifier (session identifier, terminal identifier, user identifier or terminal address), the network data are considered to belong to the network data corresponding to the same user/session, so that the network data can be associated to form a data sample. The data analysis network can analyze the data samples in real time, and monitor the network state in real time or predict the network state according to the analysis result.

The processing method of network data provided in this embodiment includes: the data analysis network element sends a request message to at least one functional network element, wherein the request message comprises a data sampling mode, and the data sampling mode accords with a random decimation principle, so that the at least one functional network element performs random decimation on users/sessions according to the data sampling mode, only reports a small amount of network data related to the users/the sessions to the data analysis network element, reduces the data acquisition load of the data analysis network element, and ensures the real-time performance of the data analysis network element for acquiring the network data. Furthermore, as each functional network element reports the network data according to the data sampling mode, the data acquisition load is reduced, and meanwhile, the correlation between the network data reported by different functional network elements is ensured, so that the data analysis network element can perform correlation processing on the network data received from a plurality of functional network elements according to the correlation between the network data, and compared with the network data collection mode shown in fig. 3, the correlation processing efficiency can be improved.

In connection with the network data collection method shown in fig. 3, in order to generate an effective data set by performing association processing according to a user or session from a large amount of collected network data, the collected network data must include a first identifier (for example, a terminal identifier, a user identifier, a session identifier, a terminal address, etc.) for indicating the user/session, which makes the identity information of the user unprotected.

To solve this problem, in one possible implementation manner of this embodiment, the request message may further include a processing parameter. The request message is further used for indicating at least one functional network element to process the first identifier in the network data into the second identifier according to the processing parameter. Thereby, the second identity is included in the network data received by the data analysis network element from the at least one functional network element. The manner of processing the first identifier according to the processing parameter may be referred to as "anonymous processing manner", and the second identifier may be referred to as a special identifier or an anonymous identifier.

Wherein the processing parameters are used to indicate parameters required by an anonymization algorithm that processes the first identity. The first identifier comprises at least one of: terminal identification, user identification, session identification, terminal address. Anonymous processing means include, but are not limited to: deleting or modifying part of the content in the user identity information (first identification), hashing the user identity information (first identification), and the like.

Optionally, the manner of processing the first identifier according to the processing parameter includes: the first identifier cannot be obtained from the second identifier. In other words, the manner of processing the first identifier according to the processing parameter is an irreversible processing manner.

In one example, taking the first identifier as the terminal identifier as an example, it is assumed that the processing parameter specified by the data analysis network element is a parameter for hashing the terminal identifier, for example, 256 bits of SHA-2 (Secure Hash Algorithm, secure hash algorithm 2) is specified to be used for computing the terminal identifier, so as to obtain a 256-bit value as a result (i.e., the second identifier) after anonymization processing. In this way, before the functional network element reports the network data to the data analysis network element, the terminal identifier in the network data is anonymized by adopting the processing parameters, so that the network data sent to the data analysis network element includes not the first identifier but the second identifier obtained by anonymizing the first identifier. Because the hash operation has unidirectional irreversibility, namely B can be obtained after the hash operation is performed on A, but no method can reversely obtain A from B, after the data analysis network element receives the network data, the terminal identification cannot be obtained according to the second identification in the network data, so that the privacy of the user is protected.

In the above examples, the anonymization process of the terminal identifier is taken as an example to illustrate that the anonymization process of the user identifier, the session identifier and the terminal address is similar, and will not be described herein. It should be appreciated that when a plurality of first identifiers are included in the network data at the same time, the anonymization processing described above may be performed on each first identifier separately, that is, each first identifier is processed as the second identifier.

It should be noted that, the processing parameters in this embodiment may be included as independent parameters in the request message, and the processing parameters may also be carried in the event filter, which is not limited in this embodiment.

On the basis that the request message comprises processing parameters, as a possible implementation manner, the data sampling manner is used for indicating the at least one functional network element to report network data when the second identifier meets the specified condition. In this embodiment, the functional network element first processes the first identifier in the network data into the second identifier according to the processing parameter. And then judging whether the second identifier meets the condition specified by the data sampling mode. If the second identifier meets the condition specified by the data sampling mode, the functional network element reports network data to the data analysis network element; if the second identifier does not meet the condition specified by the data sampling mode, the functional network element does not report the network data to the data analysis network element.

On the basis that the request message comprises processing parameters, as a possible implementation manner, the data sampling manner is used for indicating the at least one functional network element to report network data when the first identifier meets the specified condition. In this embodiment, the functional network element may first determine whether the first identifier in the network data meets a condition specified by the data sampling manner, and if the first identifier meets the condition specified by the data sampling manner, the functional network element processes the first identifier in the network data into the second identifier according to the processing parameter, and reports the processed network data to the data analysis network element; if the first identifier does not meet the condition specified by the data sampling mode, the functional network element does not report the network data to the data analysis network element.

On the basis that the request message includes processing parameters, as a possible implementation manner, the data sampling manner is used for indicating that the network data is reported when the terminal identifier or the user identifier meets a first specified condition and the session identifier or the terminal address meets a second specified condition. In this embodiment, the functional network element may determine whether to report the network data according to the data sampling manner, and if the terminal identifier or the user identifier in the network data meets the first specified condition and the session identifier or the terminal address meets the second specified condition, determine to report the network data, otherwise determine not to report the network data. And under the condition of determining to report the network data, the data sampling network element processes the first identifier in the network data into the second identifier according to the processing parameters, and reports the processed network data to the data analysis network element.

In this embodiment, in a scenario in which a plurality of functional network elements report network data to a data analysis network element, the request message sent by the data analysis network element to the plurality of functional network elements includes the same data sampling manner and the same processing parameters, on one hand, the plurality of functional network elements report network data according to the same data sampling manner, that is, the plurality of functional network elements report network data corresponding to the same user/the same session to the data analysis network element, so that correlation between network data reported by different functional network elements is ensured. On the other hand, the plurality of functional network elements perform the same anonymization processing on the first identifier in the network data according to the same processing parameters, so that the privacy of the user is protected, and meanwhile, the relevance between the anonymized network data is still ensured. Further, the data analysis network element may perform association processing on the network data received from the plurality of functional network elements according to the association between the network data. For example, if the same second identifier is included in all network data received in the same time period, the network data are considered to belong to the same user/session corresponding network data, and thus, the network data may be associated to form a data sample. The data analysis network can analyze the data samples in real time, and monitor the network state in real time or predict the network state according to the analysis result.

It can be appreciated that in different traffic scenarios, the data analysis network element may need to collect network data to different functional network elements. In addition, for the same functional network element, the content of the network data reported to the data analysis network element may be different in different service scenarios. In the following, a detailed description will be given of a method for processing network data according to the present application, taking a PDU session connection establishment scenario as an example, in combination with several specific embodiments.

Fig. 5 is a schematic diagram of a PDU session connection establishment procedure in an embodiment of the present application. For ease of understanding, the PDU session connection establishment procedure will be briefly described with reference to fig. 5.

As shown in fig. 5, in the PDU session connection establishment procedure, after the UE initiates a session connection establishment request, the UE needs to process AMF, SMF, and UPF respectively to complete PDU session establishment. First, the UE transmits a PDU session establishment request message to the AMF through the RAN (PDU session establishment request). The PDU session establishment request message may carry a user identifier, a terminal identifier, a session identifier, and the like. Then, the AMF selects an SMF for the session and transmits a PDU session context creation request message (nsmf_pduse_ CreateSMContext Request) to the SMF. The AMF may carry the user identifier, the terminal identifier, the session identifier, and the like in the PDU session context creation request message. In turn, the SMF sends an N4 session setup request message (N4 Session Establishment Request) to the UPF to control the UPF to set up a user plane connection from the RAN to the data network DN for the session via one to a plurality of UPFs. If the SMF allocates an IP address (namely a terminal address) for the UE, the SMF carries the terminal address allocated by the SMF for the UE in an N4 session establishment request message; if the UPF allocates the terminal address for the UE, the UPF allocates the terminal address for the UE after receiving the N4 session establishment request message, and the response message sent to the SMF by the UPF carries the terminal address allocated by the UPF for the UE.

In the PDU session connection establishment procedure, the N4 session establishment request message sent by the SMF to the UPF does not carry the user identifier, the terminal identifier, and the session identifier, that is, the UPF cannot know the user identifier, the terminal identifier, and the session identifier related to the session, but only knows the terminal address related to the session.

Fig. 6 is an interaction schematic diagram of a processing method of network data according to an embodiment of the present application. This embodiment describes a procedure in which NWDAF collects network data related to session connection establishment to AMF, SMF and UPF, taking the PDU session connection establishment flow shown in fig. 5 as an example.

As shown in fig. 6, the method of the present embodiment includes:

s601: the NWDAF sends a request message to the AMF and the SMF, respectively, where the request message includes a data sampling mode and a processing parameter.

For example, the request message may be an eventExponsure_substrice message for subscribing to network data, which includes an event identification (event id) and an event filter (event filter). The data sampling pattern and processing parameters may be carried in Event filters (Event filters).

In this embodiment, it is assumed that the data sampling manner indicates that the network data is reported when the first identifier satisfies the specified condition. For example, the specified conditions may be: the 2-bit result after the interception of the session identifier is 36, or the result after the hash operation of the terminal identifier starts with 00, etc. The processing parameter may be a hash parameter, for example, the processing parameter may be a parameter of a 256-bit SHA-2 algorithm, that is, the second identifier is obtained after the first identifier passes through the 256-bit SHA-2.

It can be appreciated that the specific implementation of S601 is similar to the embodiment shown in fig. 4, and will not be repeated here.

In this embodiment, the description will be given taking any one of the user identifier, the terminal identifier, and the session identifier as an example of the first identifier specified in the data sampling manner. Since the UPF network element cannot see the session related user identifier, terminal identifier, and session identifier, the NWDAF in this embodiment only sends a request message for subscribing to the network data to the AMF and the SMF, and does not send a request message to the UPF.

S602: the UE requests establishment of a session connection from the AMF.

The PDU session establishment request message (PDU session establishment request) sent by the UE is delivered to the AMF through the RAN, where a first identity (session identity, terminal identity, user identity) may be carried. The session establishment request message may further include: network slice identification, destination data network name, etc.

S603: the AMF performs network data sampling and anonymization processing.

The AMF performs specified calculation on the first identifier (session identifier, terminal identifier, user identifier) in the PDU session establishment request message received in S602 according to the data sampling manner in the request message received in S601a, and determines whether the calculation result meets the conditions specified in the data sampling manner. If so, the AMF determines that network data for session establishment needs to be reported. The network data to be reported may include: terminal identification, terminal location, user identification, session identification, etc. Then the AMF can also carry out hash operation on a first identifier (terminal identifier, user identifier and session identifier) in the network data according to the processing parameters, and the first identifier is processed into a second identifier so as to achieve the aim of anonymizing the user identity information in the network data.

S604: the AMF reports the network data to the NWDAF.

The AMF reports the network data sampled and anonymized in S603 to the NWDAF in real time through a notification message (e.g., an eventExposure_notify message). Thus, included in the network data received by the NWDAF from the AMF is the second identification.

S605: AMF selects SMF.

The AMF selects one SMF to process the session establishment request of the UE according to parameters such as the network slice identification, the destination data network name and the like in the session request message.

S606: the AMF requests the SMF to create a session context.

The AMF sends a PDU session context creation request message (nsmf_pduse_ CreateSMContext Request) to the SMF. Wherein the first identification in the PDU session establishment request message received S502 is carried.

S607: the SMF performs network data sampling and anonymization processing.

The SMF performs specified computation on the first identifier (session identifier, terminal identifier, user identifier) in the PDU session context creation request message received in S606 according to the data sampling manner in the request message received in S601b, and determines whether the computation result meets the conditions specified in the data sampling manner. If so, the SMF determines that network data for session establishment needs to be reported. The network data to be reported may include: terminal identification, user identification, session identification, qoS parameters, etc. If the IP address of the UE is allocated by the SMF, the network data reported by the SMF may further include: source address (i.e., terminal address), destination address, etc. of the session. Then the SMF carries out hash operation on a first identifier (terminal identifier, user identifier, session identifier, terminal address and the like) in the network data according to the processing parameters, and the first identifier is processed into a second identifier so as to achieve the aim of anonymizing the user identity information in the network data.

S608: the SMF reports the network data to the NWDAF.

The SMF reports the network data sampled and anonymized in S607 to the NWDAF in real time through a notification message (e.g., an eventExposure_notify message). Thus, the NWDAF also includes the second identifier in the network data received from the SMF.

S609: the SMF controls the UPF to establish a user plane connection for the session.

The SMF sends an N4 session establishment request message (N4 Session Establishment Request) to the UPF through the N4 interface, and carries the second identifier (i.e. the result of anonymizing the first identifier by the SMF according to the processing parameter) in the request message. The second identifier is used for indicating the UPF to report the network data of the user plane of the session connection to the NWDAF.

S610: the UPF reports network data to the NWDAF.

The UPF reports the network data of the user plane of the session connection to the NWDAF according to the second identifier carried in the N4 session establishment request message received in S609. The network data reported by the UPF can include: the service flow rate, time delay, the number of uplink and downlink transmission messages, the packet loss rate and the like of the user plane. If the terminal address of the UE is allocated by the UPF, the network data reported by the UPF may further include: source address (i.e., terminal address), destination address, etc. of the session. In addition, the UPF also reports the second identification received from the SMF in S609 to the NWDAF together. Thus, the NWDAF also includes the second identifier in the network data received from the UPF.

It can be understood that in this embodiment, the UPF network element cannot see the terminal identifier, the user identifier, and the session identifier related to the session, so the NWDAF does not directly send a request message for subscribing to network data to the UPF, but sends, when the SMF network element determines that network data of a certain session needs to be reported, a second identifier obtained by anonymizing the first identifier to the UPF corresponding to the session, where the second identifier is used to instruct the UPF to report the network data of the user plane related to the session to the NWDAF, and where the second identifier is included when the UPF reports the network data to the NWDAF, so the network data received by the NWDAF from the UPF also includes the second identifier, and thus the NWDAF may perform association processing on the network data received from AMF, SMF, UPF according to the second identifier.

S611: the NWDAF performs association processing on the network data received from AMF, SMF, UPF.

After the NWDAF receives the network data from the AMF, the SMF and the UPF, the NWDAF performs association processing on the network data received from the three network elements by using the time information and the second identifier (i.e. the result after the anonymization processing is performed on the first identifier) carried in the network data. Illustratively, because the hash algorithm has good unidirectional certainty, that is, if the hash results of a and C are the same, then a and C are the same with a great probability, the NWDAF may detect the second identifier carried in the network data reported by AMF, SMF, UPF, and if they are the same, consider the network data reported by AMF, SMF, UPF to belong to the associated network data (network data corresponding to the same terminal, or network data corresponding to the same session). The NWDAF correlates the network data to form a data sample.

S612: the NWDAF analyzes the associated network data.

The NWDAF performs real-time analysis on the data samples formed after the correlation, for example, evaluates the service quality of the slice or the condition of the SLA, and outputs the analysis result for NF, AF or OAM.

In this embodiment, the NWDAF specifies a data sampling manner in the request message, that is, when the terminal identifier, the session identifier or the user identifier meets the specified condition, the network data is reported, so that the AMF and the SMF can randomly extract a small amount of network data of the terminal or the session according to the data sampling manner and report the network data to the NWDAF, thereby reducing the data acquisition load of the NWDAF and ensuring the real-time performance of the NWDAF for acquiring the network data. The NWDAF designates the processing parameters in the request message, so that the AMF and the SMF perform the same anonymization processing on the first identifier in the network data according to the same processing parameters, and the association between the anonymized processed network data is still ensured while protecting the privacy of the user.

In the embodiment shown in fig. 6, the NWDAF may collect network data at the network side (e.g., AMF, SMF, UPF). However, in some scenarios, for example: when the NWDAF performs SLA assessment or SLA guarantee, network data on the application side often needs to be collected. Next, in connection with fig. 7, a procedure in which NWDAF collects network data of a network side to AMF, SMF, and UPF and collects network data of an application side to AF in a PDU session establishment procedure will be described.

Fig. 7 is an interaction schematic diagram of a method for processing network data according to an embodiment of the present application. As shown in fig. 7, the method of the present embodiment includes:

s701: the NWDAF sends a request message to the AMF and the SMF, respectively, where the request message includes a data sampling mode and a processing parameter.

S702: the UE requests establishment of a session connection from the AMF.

S703: the AMF performs network data sampling and anonymization processing.

S704: the AMF reports the network data to the NWDAF.

S705: AMF selects SMF.

S706: the AMF requests the SMF to create a session context.

S707: the SMF performs network data sampling and anonymization processing.

In this embodiment, the implementation of S701 to S707 is similar to S601 to S607 in fig. 6, and will not be described here.

S708: the SMF obtains a third identification.

The third identifier is a user external identifier corresponding to the terminal identifier or the user identifier.

Illustratively, the SMF requests a user external identity from the UDM based on the terminal identity or user identity in the PDU session context creation request message.

S709: and the SMF processes the third identifier into a fourth identifier according to the processing parameter, and sends a request message to the AF, wherein the request message comprises the fourth identifier.

The SMF hashes the third identifier (external identifier of the user) according to the processing parameter in the request message received in S701b, and processes the third identifier into a fourth identifier (the result of anonymizing the external identifier of the user). The fourth identity may also be referred to as a special external identity or an anonymous external identity. The SMF sends a request message for subscribing to network data to the AF through the NEF, for example: eventExposure_subscore message. An event filter (event filter) of the request message is set as a user external identifier, and an address of the NWDAF is used as a destination address of the network data, so that the AF samples the network data according to the user external identifier and reports the network data to the NWDAF. The request message also carries a fourth identifier at the same time, so as to indicate that the fourth identifier is carried when the AF reports network data.

S710: the SMF reports the network data to the NWDAF.

The SMF reports the network data sampled and anonymized in S707 to the NWDAF in real time through a notification message (e.g., an eventExposure_notify message), and the reported network data includes a fourth identifier. Thus, the NWDAF includes the second identifier and the fourth identifier in the network data received from the SMF.

S711: the SMF controls the UPF to establish a user plane connection for the session.

S712: the UPF reports network data to the NWDAF.

In this embodiment, the implementation of S711 and S712 is similar to S609 and S610 in fig. 6, and will not be repeated here.

S713: the AF reports network data to the NWDAF.

And the AF reports the network data to the NWDAF in real time through a notification message (such as an EventExposure_notify message), and the reported network data carries a fourth identifier. Thus, the NWDAF includes the fourth identification in the network data received from the AF.

S714: the NWDAF performs association processing on the network data received from AMF, SMF, UPF, AF.

In this embodiment, the NWDAF includes both the second identifier and the fourth identifier in the network data received from the SMF, the second identifier in the network data received from the AMF and the UPF, and the fourth identifier in the network data received from the AF. Thus, the NWDAF may first associate the network data received from the AF with the network data received from the SMF according to the fourth identification. For example, if the same fourth identifier is carried in the network data received from the AF and the SMF in a certain period of time, the network data are considered to be associated network data (network data corresponding to the same terminal, or network data corresponding to the same session). The NWDAF may then associate the network data received from the AMF, UPF and the network data received from the SMF according to the second identification. For example, if the same second identifier is carried in the network data received from the AMF, UPF, and SMF within a certain period of time, the network data are considered to be associated network data (network data corresponding to the same terminal, or network data corresponding to the same session). In this way, the NWDAF can complete the association processing of the network data received from AMF, SMF, UPF, AF according to the second identifier and the fourth identifier, and form the associated network data into one data sample.

S715: the NWDAF analyzes the associated network data.

S715 is similar to S612 in fig. 6, and will not be described again here.

In this embodiment, NWADA may collect network data of the application side (AF) in addition to network data of the network side (AMF, SMF, UPF). And sending a request message to the AF through the SMF, and carrying a fourth identifier in the request message, so that the AF can only report a small amount of terminals or a small amount of session-related network data, and the data acquisition load of the NWDAF is reduced. In addition, the network data reported to the NWDAF by the AF includes the fourth identifier, so that the association of the network data reported by the network side and the application side is ensured while protecting the privacy of the user in the network data.

Fig. 8 is an interaction schematic diagram of a method for processing network data according to an embodiment of the present application. In this embodiment, the data sampling mode uses the terminal address as a random decimation condition. As shown in fig. 8, the method of the present embodiment includes:

s801: the NWDAF sends request messages to the SMF, UPF and AF, respectively, the request messages including data sampling mode and processing parameters.

Here, a specific implementation manner of S801 in this embodiment may be referred to S601 in fig. 6. The difference from S601 is that in this embodiment, the data sampling manner indicates that the network data is reported when the terminal address satisfies a specific condition after specified calculation. For example: the specified calculation may be a mask, an operational expression or a regular expression of the terminal IPV4, IPV6 or link-layer address. In one example, the NWDAF reports network data when the NWDAF specified terminal address is 0x00000000 as a result of operation with the specified mask 0xffffff0 f. The data sampling mode can realize random extraction of 16 sessions from 256 sessions in view of randomness of terminal address allocation. In another example, the NWDAF specifies that the hash of the terminal address results in a particular pattern (e.g., starting with 00), so that a small number of sessions can be randomly extracted from a large number of sessions. The NWDAF may enable the SMF, UPF or AF to randomly extract the network data of a part of the session to report by indicating the above data sampling manner in the request message.

The NWDAF may also anonymize the first identity (user identity, terminal identity, session identity, terminal address, etc.) in the network data by specifying a processing parameter in the request message, such that the SMF, UPF or AF.

It can be understood that, in this embodiment, the NWDAF designates the data sampling manner by using the terminal address as a selection condition, and since the AMF network element cannot see the terminal address, and the SMF, UPF and AF can know the terminal address, in this embodiment, the NWDAF sends the request message only to the SMF, UPF and AF, and does not send the request message to the AMF. In addition, in this embodiment, the request message sent by the NWDAF to the AF may be forwarded through the NEF.

S802: the UE requests establishment of a session connection from the AMF.

The embodiment S802 is similar to S602 in the embodiment shown in fig. 6, and will not be described here again.

S803: AMF selects SMF.

The present embodiment S803 is similar to S605 in the embodiment shown in fig. 6, and will not be described here again.

S804: the AMF requests the SMF to create a session context.

The embodiment S804 is similar to the embodiment S606 shown in fig. 6, and will not be repeated here.

S805: the SMF controls the UPF to establish a user plane connection for the session.

The embodiment S805 is similar to S609 in the embodiment shown in fig. 6, and will not be described here again.

If the SMF allocates an IP address (namely a terminal address) for the UE, the SMF carries the terminal address allocated by the SMF for the UE in an N4 session establishment request message; if the UPF allocates the terminal address for the UE, the UPF allocates the terminal address for the UE after receiving the N4 session establishment request message, and the response message sent to the SMF by the UPF carries the terminal address allocated by the UPF for the UE. Thus, both the SMF and the UPF can know the terminal address of the current session.

S806: the SMF performs network data sampling and anonymization processing.

The SMF performs specified calculation on the terminal address of the current session according to the data sampling manner in the request message received in S801a, and determines whether the calculation result satisfies the condition specified in the data sampling manner. If so, the SMF determines that network data for session establishment needs to be reported. The network data to be reported may include: terminal identification, user identification, session identification, qoS parameters, source address of the session (i.e., terminal address), destination address, etc. Then the SMF carries out hash operation on a first identifier (terminal identifier, user identifier, session identifier, terminal address and the like) in the network data according to the processing parameters, and the first identifier is processed into a second identifier so as to achieve the aim of anonymizing the user identity information in the network data.

S807: the SMF reports the network data to the NWDAF.

The SMF reports the network data sampled and anonymized in S806 to the NWDAF in real time through a notification message (e.g., an eventExposure_notify message). Thus, the NWDAF includes the second identifier in the network data received from the SMF.

S808: the UPF performs network data sampling and anonymization processing.

The UPF performs the specified calculation on the terminal address of the current session according to the data sampling manner in the request message received in S801b, and determines whether the calculation result meets the conditions specified in the data sampling manner. If so, the UPF determines that network data for session establishment needs to be reported. The network data to be reported may include: the service flow rate, time delay, the number of uplink and downlink transmission messages, the packet loss rate, the source address (i.e. terminal address) of the session, the target address and the like of the user plane. Then the UPF carries out hash operation on a first identifier (terminal address) in the network data according to the processing parameters, and the first identifier is processed into a second identifier so as to achieve the aim of anonymizing the user identity information in the network data.

S809: the UPF reports network data to the NWDAF.

The UPF reports the network data sampled and anonymized in S808 to the NWDAF in real time through a notification message (e.g., an eventExposure_notify message). Thus, the NWDAF also includes the second identifier in the network data received from the UPF.

S810: and the AF performs network data sampling and anonymization processing.

AF executes appointed calculation on the terminal address of the current session according to the data sampling mode in the request message received by S801c, and judges whether the calculation result meets the appointed condition in the data sampling mode. If so, the AF determines that network data for session establishment needs to be reported. The network data to be reported may include: user experience, application parameters, source address of the session (i.e., terminal address), destination address, etc. And then the AF carries out hash operation on a first identifier (terminal address) in the network data according to the processing parameters, and the first identifier is processed into a second identifier so as to achieve the aim of anonymizing the user identity information in the network data.

S811: the AF reports network data to the NWDAF.

The AF reports the network data sampled and anonymized in S810 to the NWDAF in real time through a notification message (e.g., an eventExposure_notify message). Thus, the NWDAF also includes the second identifier in the network data received from the AF. In this embodiment, the network data reported by the AF to the NWDAF may be forwarded through the NEF.

S812: the NWDAF performs association processing on the network data received from SMF, UPF, AF.

Since the NWDAF includes the second identifier in the network data received from the SMF, the UPF, and the AF, the NWDAF may perform association processing on the network data received from the SMF, the UPF, and the AF according to the second identifier. For example: if the second identifiers included in the network data received from the SMF, the UPF and the AF within a certain period of time are the same, and the destination addresses are the same, the description is the network data corresponding to the same session, so that the network data can be associated to form a data sample.

S813: the NWDAF analyzes the associated network data.

The embodiment S813 is similar to S612 in the embodiment shown in fig. 6, and will not be repeated here.

In this embodiment, when the NWDAF designates that the terminal identifier meets the designated condition in the request message, the network data is reported, so that the SMF, the UPF and the AF can randomly extract a small amount of session network data according to the terminal address and report the session network data to the NWDAF, thereby reducing the data acquisition load of the NWDAF and ensuring the real-time performance of the NWDAF for acquiring the network data. The NWDAF designates the processing parameters in the request message, so that the SMF, the UPF and the AF perform the same anonymization processing on the first identifier in the network data according to the same processing parameters, and the association between the anonymized network data is still ensured while protecting the privacy of the user.

In some scenarios, NWDAF may collect network data of UE in addition to network side (AMF, SMF, UPF) and application side (AF). In this embodiment, the network data of the UE refers to network data generated at the UE side when the UE uses the network service, and includes: connection status, business experience, etc. The following describes the embodiment shown in fig. 9.

Fig. 9 is an interaction schematic diagram of a method for processing network data according to an embodiment of the present application. This embodiment describes a process in which NWDAF collects network data to AMF, SMF, UPF, UE, taking UE registration and PDU session connection establishment procedure as an example. As shown in fig. 9, the method of the present embodiment includes:

s901: the NWDAF sends a request message to the AMF and the SMF, respectively, where the request message includes a data sampling mode and a processing parameter.

In this embodiment, it is assumed that the data sampling manner in the request message indicates: and reporting the network data when the terminal identifier or the user identifier meets the first specified condition and the session identifier or the terminal address meets the second specified condition. The first specified condition and the second specified condition may be referred to the embodiments shown in fig. 6 to 8, and are not described herein. NWDAF specifies processing parameters in the request message, such as: parameters required for performing the hash operation are used for anonymizing the first identification (user identification, terminal identification, session identification, terminal address, etc.) in the network data.

Unlike the embodiments shown in fig. 6 to 8, in this embodiment, the request message sent by the NWDAF to the AMF further includes an indication for indicating that the UE is required to report network data. In this way, NWDAF may subscribe to network data with UE through AMF.

S902: the UE requests registration to the network from the AMF.

The network registration request (UE register to network) sent by the UE is delivered to the AMF through the RAN, where it may carry a user identity or a terminal identity.

S903: the AMF performs network data sampling and anonymization processing.

The AMF performs a first specified calculation on the user identifier or the terminal identifier in the network registration request received in S902 according to the data sampling manner received in S901a, and determines whether the calculation result meets a first specified condition. If so, the AMF determines that network registration-related network data for the UE needs to be reported. Then, the AMF carries out hash operation on the terminal identification or the user identification in the network data according to the processing parameters, and the terminal identification or the user identification is processed into a second identification so as to achieve the aim of anonymizing the user identity information in the network data.

S904: the AMF reports the network data to the NWDAF.

The AMF reports the network data sampled and anonymized in S903 to the NWDAF in real time through a notification message (e.g., an eventExposure_notify message). Thus, included in the network data received by the NWDAF from the AMF is the second identification.

S905: the AMF sends a request message to the UE, wherein the request message comprises a data sampling mode and processing parameters.

In case that the user identity or the terminal identity satisfies the first specified condition, the AMF sends a request message for subscribing to the network data to the UE. The request message carries a data sampling mode and a processing parameter designated by the NWDAF, so as to instruct the UE to report network data to the NWDAF when the session identifier or the terminal address meets a second designated condition, and instruct the UE to process a first identifier in the network data into a second identifier through hash operation, so that the network data received by the NWDAF from the UE includes the second identifier.

S906: the UE requests to establish a session connection, and AMF, SMF, UPF performs related processing.

Illustratively, the UE sends a PDU session establishment request message (PDU session establishment request) to the AMF, which selects the SMF for the session, and sends a PDU session context creation request message (nsmf_pduse_ CreateSMContext Request) to the SMF, which sends an N4 session establishment request message (N4 Session Establishment Request) to the UPF over the N4 interface to control the UPF to establish a user plane connection for the session.

The specific implementation process can be seen from the relevant description of fig. 6 to 8.

S907: AMF, SMF and UPF sample network data and anonymize.

The AMF performs a first specified calculation on the terminal identifier or the user identifier in the received PDU session establishment request message according to the data sampling manner in the request message received in S901a, determines whether the calculation result meets a first specified condition, and performs a second specified calculation on the session identifier or the terminal address, and determines whether the calculation result meets a second specified condition. If the first specified condition and the second specified condition are both satisfied, the AMF determines that network data for session establishment needs to be reported. The network data to be reported may include: terminal identification, terminal location, user identification, session identification, etc. And then the AMF carries out hash operation on a first identifier (a terminal identifier, a user identifier and a session identifier) in the network data according to the processing parameters, and the first identifier is processed into a second identifier so as to achieve the aim of anonymizing the user identity information in the network data.

The processes of network data sampling and anonymizing by the SMF and the UPF are similar to those of the AMF, and are not repeated here.

S908: AMF, SMF and UPF report network data to NWDAF.

The AMF, SMF and UPF report the network data sampled and anonymized in S907 to the NWDAF in real time through a notification message (e.g., eventExposure_notify message). Thus, included in the network data received by the NWDAF from the AMF, SMF and UPF is the second identification.

S909: the UE performs network data sampling and anonymization processing.

And the UE executes second specified calculation on the session identifier or the terminal address according to the data sampling mode indicated in the request message received from the AMF, and judges whether the calculation result meets the second specified condition. If so, the UE determines that network data for the session connection needs to be reported to the NWDAF. The network data to be reported may include: terminal side user experience, application parameters, source address (terminal address) of session, destination address and other network data. The UE may further perform a hash operation on a first identifier (terminal identifier, user identifier, session identifier, terminal address) in the network data according to a processing parameter indicated in the request message received from the AMF, so as to process the first identifier into a second identifier, so as to achieve the purpose of anonymizing user identity information in the network data.

S910: the UE reports network data to the NWDAF.

The AMF reports the network data sampled and anonymized in S909 to the NWDAF in real time. Thus, included in the network data received by the NWDAF from the UE is the second identity.

In one possible implementation, the UE may report the network data to the NWDAF in real time through a notification message (e.g., an eventExposure_notify message).

In another possible implementation, the UE may also establish a session connection to the NWDAF and then report the network data to the NWDAF in real time through the user plane.

S911: the NWDAF performs association processing on the network data received from AMF, SMF, UPF, UE.

Since the NWDAF includes the second identifier in the network data received from AMF, SMF, UPF and the UE, the NWDAF may perform association processing on the network data received from AMF, SMF, UPF and the UE according to the second identifier. For example: if the second identifiers included in the network data received from the AMF, SMF, UPF and UE in a certain period of time are the same, and the destination addresses are the same, the description is the network data corresponding to the same session, so that the network data can be associated to form a data sample.

S912: the NWDAF analyzes the associated network data.

The embodiment S912 is similar to the embodiment S612 shown in fig. 6, and will not be repeated here.

In this embodiment, the AMF randomly selects the UE according to the data sampling mode indicated by the NWDAF, and sends a request message for indicating to subscribe to the network data to the selected UE, and indicates the UE to randomly select the network data of a part of the session according to the data sampling mode indicated by the NWDAF and report the network data to the NWDAF. Therefore, the AMF, SMF, UPF and the UE can randomly select part of terminals or part of session network data to report to the NWDAF according to the NWDAF specified data sampling mode, so that the data acquisition load of the NWDAF is reduced, and the real-time property of the network data acquired by the NWDAF is ensured. AMF, SMF, UPF and the UE both carry out the same anonymization processing on the first identifier in the network data according to the same processing parameters, and the relevance between the anonymized network data is still ensured while the privacy of the user is protected.

Fig. 10 is a schematic structural diagram of a data analysis network element according to an embodiment of the present application. As shown in fig. 10, the data analysis network element 100 includes: a transmitting unit 101, a receiving unit 102, and a processing unit 103; wherein, the liquid crystal display device comprises a liquid crystal display device,

the sending unit 101 is configured to send a request message to at least one functional network element, where the request message includes a data sampling manner, and the request message is used to instruct the at least one functional network element to report network data in the data sampling manner, where the data sampling manner accords with a random decimation principle; the receiving unit 102 is configured to receive first network data from the at least one functional network element; the processing unit 103 is configured to perform association processing on the first network data received from the at least one functional network element.

In a possible implementation manner, the request message further includes a processing parameter, and the request message is further used for instructing the at least one functional network element to process the first identifier in the network data into the second identifier according to the processing parameter; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address; the first network data received by the data analysis network element from the at least one functional network element comprises the second identifier.

In one possible implementation, the manner of processing the first identifier according to the processing parameter includes: the first identifier cannot be obtained from the second identifier.

In a possible implementation manner, the data sampling manner is used for indicating the at least one functional network element to report network data when the second identifier meets a specified condition.

In a possible implementation manner, the data sampling manner is used for indicating the at least one functional network element to report network data when the first identifier meets a specified condition; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

In a possible implementation manner, the data sampling manner is used for indicating that the network data is reported when the terminal identifier or the user identifier meets a first specified condition and the session identifier or the terminal address meets a second specified condition.

In a possible implementation manner, the at least one functional network element includes one or more of an access and mobility management functional network element, a session management functional network element, a user plane functional network element, an application functional network element, a policy control functional network element, a network opening functional network element, a data management functional network element, a data storage functional network element, and an access network functional network element.

In a possible implementation manner, when the at least one functional network element includes a session management functional network element, the receiving unit 102 is further configured to receive second network data from a user plane functional network element, where the second network data includes the second identifier acquired by the user plane functional network element from the session management functional network element; the processing unit is further configured to perform association processing on the first network data received from at least one functional network element and the second network data received from the user plane functional network element according to the second identifier;

or alternatively, the process may be performed,

the receiving unit 102 is further configured to receive third network data from an application function network element, where the third network data includes a fourth identifier obtained by the application function network element from the session management function network element, where the fourth identifier is obtained by processing, by the session management function network element, a third identifier according to the processing parameter, where the third identifier is a terminal identifier or a user external identifier corresponding to the user identifier; the data analysis network element further comprises the fourth identifier in the first network data received from the session management function network element; the processing unit is further configured to perform association processing on the first network data received from the at least one functional network element and the third network data received from the application functional network element according to the second identifier and the fourth identifier.

In a possible implementation manner, when the at least one functional network element includes an access and mobility management functional network element, the receiving unit 102 is further configured to receive fourth network data from a terminal device, where the fourth network data is network data reported by the terminal device according to the data sampling manner and the processing parameter acquired from the access and mobility management functional network element; the processing unit is further configured to perform association processing on the first network data received from the at least one functional network element and the fourth network data received from the terminal device according to the second identifier.

The data analysis network element provided in this embodiment may be used to execute the method executed by the data analysis network element in the foregoing method embodiment, for example: the sending unit 101 may implement the signal sending operation of the data analysis network element in the above method embodiment, the receiving unit 102 may be configured to implement the signal receiving operation of the data analysis network element in the above method embodiment, and the processing unit 103 may implement the signal processing operation of the data analysis network element in the above method embodiment. The implementation principle and technical effect are similar, and are not repeated here.

Fig. 11 is a schematic structural diagram of a communication device according to an embodiment of the present application. As shown in fig. 11, the communication device 110 of the present embodiment includes: a transmitting unit 111, a receiving unit 112, and a processing unit 113; wherein, the liquid crystal display device comprises a liquid crystal display device,

the receiving unit 112 is configured to obtain a first request message, where the first request message includes a data sampling manner, and the data sampling manner conforms to a random decimation principle; the sending unit 111 is configured to report the first network data to a data analysis network element according to the data sampling manner.

In a possible implementation manner, the first request message further includes a processing parameter, where the processing parameter is used to instruct the communication device to process a first identifier in the first network data into a second identifier according to the processing parameter; the communication equipment includes the second identifier in the first network data reported to the data analysis network element; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

In a possible implementation manner, when the communication device is a functional network element, the receiving unit 112 is specifically configured to obtain the first request message from the data analysis network element; when the communication device is a terminal device, the receiving unit 112 is specifically configured to obtain the first request message from an access and mobility management function network element.

In a possible implementation manner, the processing unit 113 is configured to: processing the first identifier in the first network data into the second identifier according to the processing parameter; the transmitting unit 111 specifically is configured to: and when the second identifier meets the condition specified by the data sampling mode, reporting the first network data to the data analysis network element.

In a possible implementation manner, the processing unit 113 is configured to: if the first identifier in the first network data meets the condition specified by the data sampling mode, processing the first identifier in the first network data into a second identifier according to the processing parameter; the sending unit 111 is specifically configured to report the processed first network data to the data analysis network element; the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

In one possible implementation manner, the first identifier in the first network data meets a condition specified by the data sampling mode, including: the terminal identification or the user identification in the first network data meets a first condition specified by the data sampling mode, and the session identification or the terminal address in the first network data meets a second condition specified by the data sampling mode.

In one possible implementation, the communication device is any one of the following: an access and mobility management function network element, a session management function network element, a user plane function network element, an application function network element, a policy control function network element, a network opening function network element, a data storage function network element, an access network function network element, and a terminal device.

In a possible implementation manner, the communication device is a session management function network element, and the sending unit 111 is further configured to send the second identifier to a user plane function network element, so that the user plane function network element includes the second identifier when reporting second network data to the data analysis network element;

or alternatively, the process may be performed,

the processing unit 113 is configured to: processing a third identifier into a fourth identifier according to the processing parameter, wherein the third identifier is a terminal identifier or a user external identifier corresponding to the user identifier; the sending unit 111 is configured to send a second request message to an application function network element, where the second request message includes the fourth identifier, and the second request message is configured to instruct the application function network element to include the fourth identifier when reporting third network data to the data analysis network element; the session management function network element further includes the fourth identifier in the first network data reported to the data analysis network element.

In a possible implementation manner, the communication device is an access and mobility management function network element, and the first request message received by the access and mobility management function network element further includes an indication for requesting the terminal device to report network data; the sending unit 111 is further configured to send a third request message to a terminal device, where the third request message includes the data sampling manner and the processing parameter, and the third request message is used to instruct the terminal device to report fourth network data to the data analysis network element according to the data sampling manner and the processing parameter.

The communication device provided in this embodiment may be used to perform the method performed by the communication device (functional network element or terminal device) in the foregoing method embodiment, for example: the transmitting unit 111 may implement a signal transmitting operation of the communication device in the above-described method embodiment, the receiving unit 112 may be configured to implement a signal receiving operation of the communication device in the above-described method embodiment, and the processing unit 113 may implement a signal processing operation of the communication device in the above-described method embodiment. The implementation principle and technical effect are similar, and are not repeated here.

Fig. 12 is a schematic structural diagram of a data analysis network element according to an embodiment of the present application. As shown in fig. 12, the data analysis network element 120 of the present embodiment may include: a processor 121, a memory 122 and a communication interface 123.

Wherein the memory 122 is used for storing a computer program; a processor 121 for executing the computer program stored in the memory 122 to implement the method performed by the data analysis network element in the above embodiment. A communication interface 123 for communicating data or signals with a functional network element.

Alternatively, the memory 122 may be separate or integrated with the processor 121. When the memory 122 is a device independent from the processor 121, the data analysis network element 120 may further include: a bus 124 for connecting the memory 122 and the processor 121.

In a possible implementation, the processing module 103 in fig. 10 may be implemented integrally in the processor 121, and the receiving module 102 and the transmitting module 101 may be implemented integrally in the communication interface 123.

In a possible implementation manner, the processor 121 may be configured to implement the signal processing operation of the data analysis network element in the above-described method embodiment, and the communication interface 123 may be configured to implement the signal transceiving operation of the data analysis network element in the above-described method embodiment.

The data analysis network element provided in this embodiment may be used to execute the method executed by the data analysis network element in the foregoing method embodiment, and its implementation principle and technical effects are similar, and are not described herein again.

The embodiment of the application also provides communication equipment, which can be a functional network element or terminal equipment. Described below in connection with fig. 13 and 14, respectively.

Fig. 13 is a schematic structural diagram of a functional network element according to an embodiment of the present application. As shown in fig. 13, the functional network element 130 of the present embodiment includes: a processor 131, a memory 132, and a communication interface 133.

Wherein the memory 132 is used for storing a computer program; a processor 131 for executing the computer program stored in the memory 132 to implement the method executed by the functional network element in the above embodiment. A communication interface 133 for communicating data or signals with a data analysis network element or other communication device.

Alternatively, the memory 132 may be separate or integrated with the processor 131. When the memory 132 is a device independent from the processor 131, the functional network element 130 may further include: a bus 134 for connecting the memory 132 and the processor 131.

In a possible implementation, the processing module 113 in fig. 11 may be implemented integrally in the processor 131, and the receiving module 112 and the transmitting module 111 may be implemented integrally in the communication interface 133.

In a possible implementation manner, the processor 131 may be configured to implement the signal processing operation of the functional network element in the above method embodiment, and the communication interface 133 may be configured to implement the signal transceiving operation of the functional network element in the above method embodiment.

The functional network element provided in this embodiment may be used to execute the method executed by the functional network element in the foregoing method embodiment, and its implementation principle and technical effects are similar, and are not repeated herein.

Fig. 14 is a schematic structural diagram of a terminal device according to an embodiment of the present application. As shown in fig. 14, the terminal device 140 of the present embodiment includes: processor 141, memory 142, and transceiver 143.

Wherein the memory 142 is used for storing a computer program; a processor 141 for executing a computer program stored in the memory 142 to implement the method performed by the terminal device in the above embodiment. A transceiver 143 for data communication or signal communication with a data analysis network element or other communication device.

Alternatively, the memory 142 may be separate or integrated with the processor 141. When the memory 142 is a device independent from the processor 141, the terminal device 140 may further include: a bus 144 for connecting the memory 142 and the processor 141.

In one possible implementation, the processing module 113 in fig. 11 may be implemented integrated in the processor 141, and the receiving module 112 and the transmitting module 111 may be implemented integrated in the transceiver 143.

In a possible implementation manner, the processor 141 may be configured to implement the signal processing operation of the terminal device in the above method embodiment, and the transceiver 143 may be configured to implement the signal transceiving operation of the terminal device in the above method embodiment.

The terminal device provided in this embodiment may be used to execute the method executed by the terminal device in the foregoing method embodiment, and its implementation principle and technical effects are similar, and are not described herein again.

The embodiment of the application provides a storage medium, which comprises a computer program, and the computer program is used for implementing a method executed by a data analysis network element in the embodiment of the method or implementing a method executed by a communication device (a functional network element or a terminal device) in the embodiment of the method.

The embodiment of the application also provides a chip, which comprises a memory and a processor, wherein the memory is used for storing a computer program, and the processor is used for calling and running the computer program from the memory, so that a device installed with the chip executes a method executed by the data analysis network element in the method embodiment or realizes a method executed by the communication device (the functional network element or the terminal device) in the method embodiment.

The embodiments of the present application also provide a computer program product, where the computer program product includes computer program code, where the computer program code when executed on a computer causes the computer to perform the method performed by the data analysis network element in the method embodiment described above, or implement the method performed by the communication device (the functional network element or the terminal device) in the method embodiment described above.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the above-described embodiments of the apparatus are merely illustrative, and for example, the division of the modules is merely a logical function division, and there may be additional divisions when actually implemented, for example, multiple modules may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or modules, which may be in electrical, mechanical, or other forms.

The modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical units, may be located in one place, or may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional module in each embodiment of the present application may be integrated in one processing unit, or each module may exist alone physically, or two or more modules may be integrated in one unit. The units formed by the modules can be realized in a form of hardware or a form of hardware and software functional units.

The integrated modules, which are implemented in the form of software functional modules, may be stored in a computer readable storage medium. The software functional module is stored in a storage medium, and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (english: processor) to perform some of the steps of the methods described in the embodiments of the present application.

It should be understood that the above processor may be a central processing unit (english: central processing unit, abbreviated as CPU), or may be other general purpose processors, digital signal processors (english: digital signal processor, abbreviated as DSP), application specific integrated circuits (english: application specific integrated circuit, abbreviated as ASIC), or the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of a method disclosed in connection with the present invention may be embodied directly in a hardware processor for execution, or in a combination of hardware and software modules in a processor for execution.

The memory may comprise a high-speed RAM memory, and may further comprise a non-volatile memory NVM, such as at least one magnetic disk memory, and may also be a U-disk, a removable hard disk, a read-only memory, a magnetic disk or optical disk, etc.

The bus may be an industry standard architecture (industry standard architecture, ISA) bus, an external device interconnect (peripheral component, PCI) bus, or an extended industry standard architecture (extended industry standard architecture, EISA) bus, among others. The buses may be divided into address buses, data buses, control buses, etc. For ease of illustration, the buses in the drawings of the present application are not limited to only one bus or one type of bus.

The storage medium may be implemented by any type or combination of volatile or nonvolatile memory devices such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk. A storage media may be any available media that can be accessed by a general purpose or special purpose computer.

An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an application specific integrated circuit (application specific integrated circuits, ASIC for short). It is also possible that the processor and the storage medium reside as discrete components in an electronic device or a master device.

Claims

1. A method for processing network data, comprising:

the data analysis network element sends a request message to at least one functional network element, wherein the request message comprises a data sampling mode, the request message is used for indicating the at least one functional network element to report network data by adopting the data sampling mode, and the data sampling mode accords with a random decimation principle;

the data analysis network element receives first network data from the at least one functional network element;

the data analysis network element performs association processing on the first network data received from the at least one functional network element;

the request message further comprises a processing parameter, and the request message is further used for indicating the at least one functional network element to process the first identifier in the network data into the second identifier according to the processing parameter;

the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address;

the first network data received by the data analysis network element from the at least one functional network element comprises the second identifier.

2. The method of claim 1, wherein the manner in which the first identifier is processed according to the processing parameters comprises: the first identifier cannot be obtained from the second identifier.

3. A method according to claim 1 or 2, wherein the data sampling means is configured to instruct the at least one functional network element to report network data when the second identifier meets a specified condition.

4. The method according to claim 1 or 2, wherein the data sampling manner is used for indicating the at least one functional network element to report network data when the first identifier meets a specified condition;

the first identifier comprises at least one of a terminal identifier, a user identifier, a session identifier and a terminal address.

5. The method of claim 4, wherein the data sampling means is configured to indicate that the network data is reported when the terminal identifier or the user identifier satisfies a first specified condition and the session identifier or the terminal address satisfies a second specified condition.

6. The method according to any of claims 1-2, 5, wherein the at least one functional network element comprises one or more of an access and mobility management functional network element, a session management functional network element, a user plane functional network element, an application functional network element, a policy control functional network element, a network open functional network element, a data management functional network element, a data storage functional network element, an access network functional network element.

7. The method according to claim 1 or 2, wherein when the at least one functional network element comprises a session management functional network element, the method further comprises:

the data analysis network element receives second network data from a user plane function network element, wherein the second network data comprises the second identifier acquired by the user plane function network element from the session management function network element;

the data analysis network element carries out association processing on the first network data received from at least one functional network element and the second network data received from the user plane functional network element according to the second identifier;

or alternatively, the process may be performed,

the data analysis network element receives third network data from an application function network element, wherein the third network data comprises a fourth identifier obtained by the application function network element from the session management function network element, the fourth identifier is obtained by processing a third identifier by the session management function network element according to the processing parameter, and the third identifier is a terminal identifier or a user external identifier corresponding to the user identifier; the data analysis network element further comprises the fourth identifier in the first network data received from the session management function network element;

And the data analysis network element performs association processing on the first network data received from the at least one functional network element and the third network data received from the application functional network element according to the second identifier and the fourth identifier.

8. The method according to claim 1 or 2, wherein when the at least one functional network element comprises an access and mobility management functional network element, the method further comprises:

the data analysis network element receives fourth network data from terminal equipment, wherein the fourth network data is the network data reported by the terminal equipment according to the data sampling mode and the processing parameters acquired from the access and mobility management function network element;

and the data analysis network element performs association processing on the first network data received from the at least one functional network element and the fourth network data received from the terminal equipment according to the second identifier.

9. A method for processing network data, comprising:

the communication equipment acquires a first request message, wherein the first request message comprises a data sampling mode, and the data sampling mode accords with a random decimation principle;

The communication equipment reports first network data to a data analysis network element according to the data sampling mode;

the first request message further comprises a processing parameter, wherein the processing parameter is used for indicating the communication equipment to process a first identifier in the first network data into a second identifier according to the processing parameter;

the communication equipment includes the second identifier in the first network data reported to the data analysis network element;

10. The method of claim 9, wherein the manner in which the first identifier is processed according to the processing parameters comprises: the first identifier cannot be obtained from the second identifier.

11. The method according to any of the claims 9 to 10, wherein when the communication device is a functional network element, the communication device obtains a first request message, comprising:

the functional network element acquires a first request message from the data analysis network element;

when the communication device is a terminal device, the communication device acquires a first request message including:

the terminal device obtains a first request message from an access and mobility management function network element.

12. A data analysis network element, comprising: a transmitting unit, a receiving unit and a processing unit;

the sending unit is configured to send a request message to at least one functional network element, where the request message includes a data sampling manner, and the request message is used to instruct the at least one functional network element to report network data in the data sampling manner, where the data sampling manner accords with a random decimation principle;

the receiving unit is configured to receive first network data from the at least one functional network element;

the processing unit is used for carrying out association processing on the first network data received from the at least one functional network element;

13. The data analysis network element of claim 12, wherein the manner in which the first identity is processed according to the processing parameters comprises: the first identifier cannot be obtained from the second identifier.

14. A data analysis network element according to claim 12 or 13, wherein the data sampling means is adapted to instruct the at least one functional network element to report network data when the second identity meets a specified condition.

15. The data analysis network element according to any one of claims 12 to 13, wherein the data sampling manner is configured to instruct the at least one functional network element to report network data when the first identifier meets a specified condition;

16. The data analysis network element of claim 15, wherein the data sampling means is configured to indicate that the network data is reported when the terminal identifier or the user identifier satisfies a first specified condition and the session identifier or the terminal address satisfies a second specified condition.

17. The data analysis network element according to any of claims 12-13, 16, wherein the at least one functional network element comprises one or more of an access and mobility management function network element, a session management function network element, a user plane function network element, an application function network element, a policy control function network element, a network opening function network element, a data management function network element, a data storage function network element, an access network function network element.

18. The data analysis network element according to claim 12 or 13, wherein when the at least one functional network element comprises a session management functional network element, the receiving unit is further configured to receive second network data from a user plane functional network element, where the second network data includes the second identifier obtained by the user plane functional network element from the session management functional network element;

the processing unit is further configured to perform association processing on the first network data received from at least one functional network element and the second network data received from the user plane functional network element according to the second identifier;

or alternatively, the process may be performed,

the receiving unit is further configured to receive third network data from an application function network element, where the third network data includes a fourth identifier obtained by the application function network element from the session management function network element, where the fourth identifier is obtained by processing, by the session management function network element, a third identifier according to the processing parameter, where the third identifier is a terminal identifier or a user external identifier corresponding to the user identifier; the data analysis network element further comprises the fourth identifier in the first network data received from the session management function network element;

The processing unit is further configured to perform association processing on the first network data received from the at least one functional network element and the third network data received from the application functional network element according to the second identifier and the fourth identifier.

19. The data analysis network element according to any of claims 12-13, 16, wherein when the at least one functional network element comprises an access and mobility management functional network element, the receiving unit is further configured to receive fourth network data from a terminal device, where the fourth network data is network data reported by the terminal device according to the data sampling manner and the processing parameter acquired from the access and mobility management functional network element;

the processing unit is further configured to perform association processing on the first network data received from the at least one functional network element and the fourth network data received from the terminal device according to the second identifier.

20. A communication device, comprising: a transmitting unit, a receiving unit and a processing unit;

the receiving unit is used for acquiring a first request message, wherein the first request message comprises a data sampling mode, and the data sampling mode accords with a random decimation principle;

The sending unit is used for reporting the first network data to the data analysis network element according to the data sampling mode;

the first request message further comprises a processing parameter, wherein the processing parameter is used for indicating the processing unit of the communication device to process a first identifier in the first network data into a second identifier according to the processing parameter;

21. The communication device of claim 20, wherein the manner in which the first identification is processed in accordance with the processing parameters comprises: the first identifier cannot be obtained from the second identifier.

22. The communication device according to claim 20 or 21, wherein when the communication device is a functional network element, the receiving unit is specifically configured to obtain the first request message from a data analysis network element;

when the communication device is a terminal device, the receiving unit is specifically configured to obtain a first request message from an access and mobility management function network element.

23. A data analysis network element, comprising: a memory for storing a computer program and a processor for calling and running the computer program from the memory, such that the processor runs the computer program to perform the method according to any one of claims 1 to 8.

24. A communication device, comprising: a memory for storing a computer program and a processor for calling and running the computer program from the memory, such that the processor runs the computer program to perform the method according to any of claims 9 to 11.

25. A communication system, comprising: the data analysis network element of claim 23, and at least one functional network element.

26. A storage medium comprising a computer program for implementing the method of any one of claims 1 to 8 or the method of any one of claims 9 to 11.