WO2016070633A1

WO2016070633A1 - Network log generation method and device

Info

Publication number: WO2016070633A1
Application number: PCT/CN2015/082563
Authority: WO
Inventors: 樊海彬
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-03
Filing date: 2015-06-26
Publication date: 2016-05-12
Also published as: CN105635329A

Abstract

Disclosed are a network log generation method and device. The method comprises: obtaining user private network information via a user control plane message GTP-C of a network; obtaining user network address translation (NAT) information; generating a user network log according to the obtained private network information and the NAT information. The present invention solves the problem in related technology that the user private network information cannot be obtained via Radius information, and consequently cannot be combined with the NAT information to generate user log information. Further, obtaining user private network information via GTP-C can provide a mobile user network data query support for a national security supervision department and has high reliability and scalability.

Description

Internet log generation method and device

Technical field

The present invention relates to the field of communications, and in particular to a method and apparatus for generating an online log.

Background technique

In recent years, with the rapid development of mobile access technologies such as 3G mobile communication 3G and Long Term Evolution (LTE), and with the combination of highly intelligent mobile terminals, mobile data services are combined. The advantages of both mobile communication and the Internet. However, the number of global public IP addresses has nearly exhausted. Generally, telecom operators use a firewall technology to solve this problem. The firewall is the gateway for connecting the mobile access network and the Internet. It has the function of Network Address Translation (NAT), which can be used to connect the Internet. The Internet Protocol (IP) address is translated into an idle public IP address in the firewall address pool. Specifically, the telecom operator will assign a private IP address to the mobile user who is going to access the Internet, and translate the private IP address of the user into a public IP address through the NAT function of the firewall. This solves the problem of the shortage of the IP address of the public network. It can make multiple terminals in the LAN share the network connection.

The content source of mobile Internet is complex. In order to strengthen network monitoring, the national security department requires basic telecommunications enterprises to provide necessary management and control functions, implement the retention, check and report of users' mobile Internet logs, and actively carry out the construction of user online log query system. However, due to the existence of the current firewall network architecture, the Internet server can only record the public IP address processed by the firewall NAT, and the Internet server cannot further know the corresponding private network IP address and international mobile subscriber identity through the public IP address. (International Mobile Subscriber Identification Number, IMSI for short) and Mobile Subscriber International ISDN/PSTN Number (MSISDN) are key information for identifying user identity.

In the related art, the Chinese patent "Administrative Device and Method for Integrating Mobile Internet Users' Internet Logs" with the patent number 103532752 completely relies on receiving the Remote Authentication Dial In User Service sent by the mobile internet gateway (Remote Authentication Dial In User Service). , referred to as Radius) message to obtain the correspondence between user information (such as mobile phone number) and private network IP address. However, in the actual network deployment, due to the limitation of the usage rights between devices of different vendors, or the operator's consideration of security and stability factors, the Radius message may not be obtained, and the correspondence between the private network IP address and the user information cannot be known. relationship. In addition, in the large-capacity networking environment, the patented technology uses a single NAT log and Radius message fusion processing module to contract network services, because the business rises beyond the processing performance limit, and the overload system appears. The system cannot meet the collection requirements. At the same time, once the communication link is interrupted, the entire log collection system is paralyzed. The reliability and scalability of the system are poor.

In the related art, the association process of the user information and the mapping table of the public network IP in the Chinese patent "an IP source-tracking method, device and system" with the patent number 103731515 is performed in the NAT device. That is, the NAT device needs to bear the basic private IP address and the public network IP address translation function on the one hand, and needs to complete the merge to generate the association mapping table on the other hand. This may require a NAT device to be modified, which is costly. At the same time, when the network traffic is large, it may cause the NAT device to work at full load, and even the possibility of embarrassment.

Therefore, in the related art, there is a problem that the online log of the generated user cannot be generated when the Radius message cannot be acquired.

Summary of the invention

The embodiment of the invention provides a method and a device for generating an online log, so as to solve at least the problem that the online log of the generated user cannot be generated when the Radius message cannot be obtained in the related art.

According to an aspect of the present invention, a method for generating an Internet log includes: obtaining a private network information of a user through a user control plane message GTP-C of the network; and acquiring NAT information of the network address of the user; The private network information and the NAT information generate an online log of the user.

In the embodiment of the present invention, before acquiring the private network information of the user by using the user control plane message GTP-C of the network, the method further includes: determining whether the right to obtain the private network information from the Radius message is included; If the determination result is no, the private network information of the user is obtained through the GTP-C of the network.

In the embodiment of the present invention, after determining whether the right to obtain the private network information is obtained from the Radius message, the method further includes: obtaining the private information from the Radius message according to the network gateway if the determination result is yes The network information is generated according to the private network information obtained from the Radius message and the NAT information.

In the embodiment of the present invention, after generating the online log of the user according to the obtained private network information and the NAT information, the method further includes: receiving a query request for querying a user's online log; The query request feeds back the query result to the query requester.

In the embodiment of the present invention, the private network information of the user includes at least one of the following: an international mobile subscriber identity (IMSI), a mobile subscriber international number (MSISDN), and a packet data protocol (PDP) activation time.

In the embodiment of the present invention, the NAT information of the user includes at least one of the following: a source private network IP address, a source private network port number, a source public network IP address, a source public network port number, a destination IP address, and a destination. Port number, NAT start time, and NAT end time.

According to another aspect of the present invention, an Internet log generating apparatus is provided, including: a first acquiring module, configured to acquire private network information of a user through a user control plane message GTP-C of the network; and a second acquiring module, configured to Obtaining the network address translation NAT information of the user; the generating module is configured to generate the online log of the user according to the acquired private network information and the NAT information.

In the embodiment of the present invention, the device further includes: a determining module, configured to determine whether the right to obtain the private network information is obtained from the Radius message; the first acquiring module is further configured to be determined by the determining module If the result is no, the private network information of the user is obtained through the GTP-C of the network.

In the embodiment of the present invention, the device further includes: a third acquiring module, configured to obtain the private network information from the Radius message according to the network gateway if the determining result of the determining module is yes; The generating module is further configured to generate an online log of the user according to the private network information obtained from the Radius message and the NAT information.

In the embodiment of the present invention, the device further includes: a receiving module, configured to receive a query request for querying the user's online log; and the feedback module is configured to feed back the query result to the query requesting party according to the received query request.

The user control plane message GTP-C is used to obtain the private network information of the user; the network address translation NAT information of the user is obtained; and the user's internet log is generated according to the obtained private network information and the NAT information. The problem that the user's private network information cannot be obtained through the Radius message in the related art, and thus the user's log information cannot be combined with the NAT information, and the private network information of the user is obtained through the GTP-C, thereby providing the mobile security user not only for the national security regulatory department. Internet data query support, and reliability, scalability is very strong.

DRAWINGS

The drawings are intended to provide a further understanding of the embodiments of the present invention, and are intended to be a part of the present invention, and the description of the present invention is not intended to limit the invention. In the drawing:

1 is a flowchart of a method for generating an online log according to an embodiment of the present invention;

2 is a structural block diagram of an Internet log generating apparatus according to an embodiment of the present invention;

3 is a block diagram 1 of a preferred structure of an Internet log generating apparatus according to an embodiment of the present invention;

4 is a block diagram 2 of a preferred structure of an Internet log generating apparatus according to an embodiment of the present invention;

5 is a block diagram 3 of a preferred structure of an Internet log generating apparatus according to an embodiment of the present invention;

Figure 6 is a schematic view showing the structure of a preferred embodiment 1 of the present invention;

7 is a flowchart showing the operation of a Radius message processing module according to a preferred embodiment 1 of the present invention;

Figure 8 is a schematic view showing the structure of a preferred embodiment 2 of the present invention;

9 is a flowchart showing the operation of a signaling collection processing module according to a preferred embodiment 2 of the present invention;

10 is a flowchart showing the operation of the NAT log processing module 3 according to a preferred embodiment 3 of the present invention;

Figure 11 is a block diagram showing the structure of a log merge processing module 4 in a preferred embodiment 3 of the present invention;

Figure 12 is a flowchart showing the data processing of the log merge processing module 4 in the preferred embodiment 3 of the present invention;

Figure 13 is a block diagram showing the structure of an application service module 5 in a preferred embodiment 3 of the present invention;

FIG. 14 is a flow chart showing the operation of querying a user's online log record in accordance with a preferred embodiment 3 of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

In this embodiment, a method for generating an Internet log is provided. FIG. 1 is a flowchart of a method for generating an Internet log according to an embodiment of the present invention. As shown in FIG. 1 , the process includes the following steps:

Step S102: Acquire private network information of the user through the user control plane message GTP-C of the network;

Step S104, acquiring network address translation NAT information of the user;

Step S106: Generate an online log of the user according to the obtained private network information and the NAT information.

Through the above steps, the private network information of the user is obtained through the GTP-C. Compared with the related technology, the private network information of the user can only be obtained according to the Radius message. When the Radius message cannot be obtained, the problem of the user's online log record cannot be generated. Through a new way to obtain private network information of users, it not only solves the related technology in the absence of When the Radius message is obtained, the problem of the user's Internet log record cannot be generated, and the user's Internet log can be generated when the Radius message cannot be obtained.

In the embodiment of the present invention, before the user control plane message GTP-C of the network obtains the private network information of the user, it may also determine whether the right to obtain the private network information from the Radius message is obtained; if the judgment result is negative, Only through the network GTP-C to obtain the user's private network information. If the result of the determination is yes, the network gateway obtains the private network information from the Radius message; and generates the user's online log according to the private network information and the NAT information obtained from the Radius message. That is, through the combination of the two ways of obtaining the private network information of the user, the private network information of the user can be effectively obtained in various network environments, thereby effectively generating the online log of the user.

After the user's Internet log is generated according to the obtained private network information and the NAT information, the generated online log may be stored to provide subsequent query work, for example, after the online log is stored, the received log is received. The query request for querying the user's online log; and feeding back the query result to the query requester according to the received query request.

It should be noted that the private network information of the foregoing user may include multiple types, for example, at least one of the following: an international mobile subscriber identity IMSI, a mobile subscriber international number MSISDN, and a packet data protocol PDP activation time.

The NAT information of the user may also include multiple types, for example, at least one of the following: a source private network IP address, a source private network port number, a source public network IP address, a source public network port number, a destination IP address, and a destination port. Number, NAT start time, and NAT end time.

In the embodiment, an online log generating device is provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

In this embodiment, an Internet log generating device is also provided. FIG. 2 is a structural block diagram of an Internet log generating device according to an embodiment of the present invention. As shown in FIG. 2, the device includes a first acquiring module 22 and a second. The acquisition module 24 and the generation module 26 are described below.

The first obtaining module 22 is configured to obtain the private network information of the user through the user control plane message GTP-C of the network. The second obtaining module 24 is connected to the first obtaining module 22, and is configured to obtain the network address translation NAT information of the user. The generating module 26 is connected to the first obtaining module 22 and the second obtaining module 24, and is configured to generate an online log of the user according to the obtained private network information and the NAT information.

FIG. 3 is a block diagram of a preferred structure of an Internet log generating apparatus according to an embodiment of the present invention. As shown in FIG. 3, the apparatus includes, in addition to all the modules shown in FIG. 2, a determining module 32. Module 32 is described.

The determining module 32 is connected to the first obtaining module 22, and is configured to determine whether the right to obtain private network information from the Radius message is provided. The first obtaining module 22 is further configured to: if the determining result of the determining module is negative, Obtain the private network information of the user through the GTP-C of the network.

4 is a block diagram of a preferred structure of an Internet log generating apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus includes: a third acquiring module 42 in addition to all the modules shown in FIG. The third acquisition module 42 is described.

The third obtaining module 42 is connected to the determining module 32, and is configured to obtain private network information from the Radius message according to the network gateway if the determining result of the determining module is yes; the generating module is further configured to be based on the Radius message. The obtained private network information and the NAT information generate the user's online log.

5 is a block diagram 3 of a preferred structure of an Internet log generating apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus includes: a receiving module 52 and a feedback module 54 in addition to all the modules shown in FIG. The device will be described.

The receiving module 52 is connected to the generating module 26, and is configured to receive a query request for querying the user's online log. The feedback module 54 is connected to the receiving module 52, and is configured to feed back the query to the query requesting party according to the received query request. result.

To implement the following requirements in the related art: in deploying a network function with NAT function, a scheme for tracing the user's online behavior is provided. That is, the log system can record the log information of the public network IP address, the private network address, the user's IMSI, and the MSISDN number of the Internet in a certain period of time, and provide an external query interface, which can trace and locate the Internet based on the query conditions. The user is thus beneficial to the operator to fulfill the requirements of the relevant national departments for the safe maintenance and control of the mobile data Internet. In this embodiment, a method for generating an Internet log is provided. The probe is used to collect a user control plane signaling message (GPRS Tunneling Protocol-Control, GTP-C for short), or a mobile Internet gateway is collected. The Radius message (based on different network topologies, one of which is selected), combined with the firewall NAT log, establishes the correspondence between the key user information such as the IMSI and the MSISDN number and the public network IP address when the Internet is connected, and forms a detailed online log record. Store and provide an inquiry system to provide data security support for mobile users to the national security regulatory authorities.

In addition, in this embodiment, a distributed networking policy is also provided. For a large data volume network service requirement, a different number of firewall NAT log processing servers and a log merge processing server are dynamically deployed in the network. Designed to evenly share network traffic and improve system processing power and reliability.

The following provides two methods for backtracking processing based on distributed Internet logs for different scenarios in the actual network environment:

1. When having the right to obtain a Radius message through the Internet gateway, the Radius message is obtained from the Internet gateway by connecting to the Internet gateway and parsing the user identification information (IMSI, MSISDN) and the private network IP address. At the same time, the firewall log processing module is connected to the firewall NAT device, and obtains the public network IP address of the online user's IMSI, MSISDN, and user terminal after being translated by the firewall NAT through the interaction between the signaling source and the firewall log processing module. The port number is used to establish the correspondence between the user ID and the public IP address, and generate detailed user log records and provide query functions.

2. When the access rights of the Radius message are strictly restricted, that is, when the Radius issued by the Internet gateway cannot be obtained, the signaling collector is connected to the network control plane message transmission interface in a mirrored manner to obtain the corresponding signaling message GTP- C and pars out the user identification information therein. The subsequent steps are the same as described in the above one.

In the embodiment, the distributed Internet log backtracking processing method is further provided. In this embodiment, a distributed Internet log backtracking processing system is provided. The system is provided with a Radius message processing module (the function is equivalent to the foregoing third obtaining module 42). 1) a signaling collection processing module (function equivalent to the first acquisition module 22) 2, a firewall log processing module (function equivalent to the second acquisition module 24) 3, a log merge processing module (function equivalent to the generation module 26) 4, The application service module (function is equivalent to the receiving module 52 and the feedback module 54) 5 and the log storage module 6 has six components. The Radius message processing module 1 and the signaling collection processing module 2 are respectively deployed in different network scenarios. The functions of each part are as follows:

Radius message processing module 1: When having the access rights of Radius from the Internet gateway, it is deployed in the network and interfaces with the Internet gateway. Responsible for receiving Radius messages includes: the user's IMSI, MSISDN, private network IP address, private network port number and so on. Therefore, the module performs parsing processing on the received Radius message to extract the user identification information, and sends the identification information to the log merge processing module 4.

The signaling collection processing module 2: when the authority for obtaining the Radius message from the Internet gateway is limited, the signaling collection processing module 2 needs to be deployed in the system instead of the Radius message processing module 1 and connected to the network in a mirrored manner. User control plane message interface. The signaling collection processing module 2 can completely capture all user control plane signaling messages GTP-C flowing through the interface, and perform in-depth analysis on the user control plane signaling message GTP-C to mine user identification information: IMSI, MSISDN, private network IP address, and private network port number. And sending the user identification information to the log merge processing module 4.

Firewall log processing module 3: Connects to the NAT device of the network firewall and is responsible for receiving the NAT log sent by the firewall NAT device. The firewall log processing module 3 parses the received NAT log and obtains the NAT translation information: the source private network IP address, the source private network port number, the source public network IP address, the source public network port number, and the destination IP address. The destination port number, the NAT start time, and the NAT end time are sent to the log merge processing module 4.

The log merge processing module 4 is connected to the Radius message processing module 1, the signaling collection processing module 2, and the firewall log processing module 3. Mainly responsible for three aspects of work:

1) Associate the user identification information sent by the Radius message processing module 1 or the signaling collection processing module 2 with the NAT conversion information sent by the firewall log processing module 3, and generate an IP address including the user IMSI, the MSISDN, and the source private network. Detailed user Internet log records of the source private network port number, the source public network IP address, the source public network port number, the destination IP address, the destination port number, the NAT start time, and the NAT end time;

2) The generated post-use Internet log record is saved to the log storage module 6 according to a certain policy;

3) After receiving the query request including the query condition, it is responsible for providing the user's online log record query function, and feeding the query result to the query command requesting end.

The application service module 5 is connected to the Radius message processing module 1, the firewall log processing module 3, and the log merge processing module 4, and assumes the role of the control center. Can provide two functions:

1) Provide detailed user online log record query function. The query personnel can input query conditions such as the start time, end time, and public IP address used by the user according to the query interface provided by the application service module 5. The query condition is sent to the log merge processing module 4 connected thereto, and the query result is fed back to the query personnel through the query interface. The query results include: IMSI, MSISDN, source private network IP address, source private network port number, source public network IP address, source public network port number, destination IP address, destination port number, NAT start time, and NAT end time.

2) Provide the network management parameter configuration management and control center, which can provide the parameter configuration interface for the network management personnel, set the Radius message processing module 1 to connect to the mobile Internet network management address, the signaling collection and processing module 2 needs to connect the switch address of the control plane mirror interface, and the firewall log. The processing module 3 needs to connect the firewall address, the address of the Radius message processing module 1 and the firewall log processing module 3 that the log merge processing module 4 needs to connect.

The log storage module 6 is connected to the log merge processing module 4, and is used for saving the online log records of the merged user for later use by the staff.

In the embodiment, a distributed networking policy is also provided, and multiple log merge processing modules 4 are deployed on the network, and the direct connection is performed. The way is connected to the firewall log processing module 3, and these log merge processing modules 4 share the storage and query tasks together. The Radius message processing module 1 and the signaling collection processing module 2 are directly connected to each log combination processing module 4, and the Radius message processing module 1 or the signaling collection processing module 2 broadcasts the user's IMSI, MSISDN, and private network IP address by means of broadcast. And the private network port number is sent to each log merge processing module 4, and merged with the firewall NAT conversion information received by the log merge processing module 4.

Compared with the related art, the embodiment of the present invention can achieve the following effects:

1. In the actual network environment, when the permission to obtain Radius messages from the mobile Internet gateway is restricted, the signaling plane message is collected from the network, and key user identification information such as IMSI, MSISDN, user private network IP address, and private network port are parsed. No., similar to the function of obtaining Radius messages directly from the mobile Internet gateway, and associated with the firewall NAT log to provide a detailed user online log information. The system and method for backing up the user's Internet log can be applied to different networking environments to provide application scope and value.

In the embodiment of the present invention, a distributed networking policy is also provided, so that the network element can share the entire network service load in parallel and improve the service processing performance of the network under the demand of a large amount of data. At the same time, when a network element communication link is interrupted or faulty, other network elements in the distributed network take over the network element service, and the entire network operation state is not interrupted, thereby ensuring network stability and reliability.

Preferred embodiments of the invention are described below.

Preferred embodiment 1:

6 is a schematic structural diagram of a preferred embodiment 1 according to the present invention. As shown in FIG. 6, in a network scenario in which a Radius message can be obtained from a mobile Internet gateway, in this embodiment, a log collection device structure in a distributed deployment manner is adopted. The composition, deployment location, and data flow are as follows:

The distributed device is implemented by adding a network element in a mobile data network of an operator in the related art. The Radius message processing module 1 is deployed in the mobile data network architecture topology to access the mobile internet gateway. The Radius message processing module 1 is responsible for obtaining the Radius message from the mobile internet gateway, parsing the Radius message, and obtaining the user identification information IMSI, MSISDN, PDP activation. Time and private network IP address and private network port number.

7 is a flowchart of the operation of a Radius message processing module according to a preferred embodiment 1 of the present invention. As shown in FIG. 7, the process includes the following steps:

Step S202: Obtain a Radius message from the Internet gateway.

Step S204: Parsing the Radius message to obtain the field values of the user identification information IMSI, the MSISDN, the PDP activation time, and the private network IP address and the private network port number;

Step S206: Re-encode these fields into one data block and send it to all log merge processing modules 4 connected thereto.

Preferred embodiment 2:

8 is a schematic structural diagram of a preferred embodiment 2 of the present invention. As shown in FIG. 8, when a Radius message cannot be obtained through a mobile Internet gateway, that is, a network environment in which a Radius message acquisition condition is limited, a structure of a user's Internet log collection device is shown. The composition, deployment location, and data flow are as follows:

The device is also implemented by adding a network element in a mobile data network of an operator in the related art. It deploys the signaling collection processing module 2 in the mobile data network architecture topology to access the Internet service support node (such as SGSN (Serving GPRS SUPPORT NODE) in the 3G network, MME (Mobility Management Entity) in the 4G network) and the mobile Internet gateway. The interface of the firewall log processing module 3 accesses the NAT firewall. Through the interaction of the two network elements, the signaling collection processing module 2 obtains the user control plane message from the interface in the image collection manner, and extracts the user identification information IMSI, MSISDN, and PDP activation time, as well as the private network IP address and the private network port number.

9 is a flowchart of the operation of a signaling collection processing module according to a preferred embodiment 2 of the present invention. As shown in FIG. 4, the process includes the following steps:

Step S302: Grab the user control plane message packet of the interface between the service support node and the mobile internet gateway;

Step S304: Parsing the control plane message to obtain a user identification information field value such as an MSISDN, an IMSI, and a PDP activation time;

Step S306: Re-encode these fields into one data block and send it to the log merge processing module 4 connected thereto.

The distributed mobile Internet behavior backtracking system of the preferred embodiment 1 and the preferred embodiment 2 adopts a distributed networking architecture, that is, a plurality of log consolidation processing modules 4 are arranged in a distributed networking architecture in the network.

The plurality of merge processing modules 4 are respectively connected to the firewall log processing module 3, and according to the polling policy, the plurality of merge processing modules 4 corresponding to the sequential number receive the NAT conversion information processed by the firewall log processing module 3 each time. Used for jointly merging user identification information and NAT conversion information, and for generating, querying, and storing tasks of user online log records;

The plurality of merge processing modules 4 are respectively connected to the Radius message processing module 1 and the signaling collection processing module 2, and are configured to receive user identification information that is sent by the Radius message processing module 1 or the signaling collection processing module 2 in a broadcast manner.

Preferred Embodiment 3:

The firewall log processing module 3 is connected to the NAT device of the network firewall, obtains the NAT log from the NAT device of the network firewall, and parses the NAT log to obtain the NAT conversion information. The NAT conversion information includes: the source private network IP address and the source private network port number. The source public network IP address, the source public network port number, the destination IP address, the destination port number, the NAT start time, and the NAT end time, and send the NAT conversion packet to the log data merge module 4 for use with the Radius message processing module. 1 or the user identification information, the private network IP address, and the private network port number sent by the signaling collection processing module 2 are associated and processed;

FIG. 10 is a flowchart of the operation of the NAT log processing module 3 according to the preferred embodiment 3 of the present invention. As shown in FIG. 5, the process includes the following steps:

Step S402: Receive a NAT log data packet sent by the network firewall.

Step S404: Parsing the NAT log data packet to obtain the NAT conversion information field value, that is, the source private network IP address and port number, the source public network IP address and port number, the destination address and port number, the NAT start time, and the NAT end time. value;

Step S406: The NAT conversion information field values are reassembled into a new data block and sent to the log merge processing module 4 connected thereto.

The log merge processing module 4 is connected to the Radius message processing module 1, the signaling collection processing module 2, and the firewall log processing module 3, respectively, for using the user identification information sent by the Radius message processing module 1 or the signaling collection processing module 2, The private network IP address and the private network port number are associated with the NAT translation information sent by the firewall log processing module 3, and a detailed user online log record is generated.

11 is a structural block diagram of a log merge processing module 4 according to a preferred embodiment 3 of the present invention. As shown in FIG. 11, the log merge processing module 4 mainly includes the following parts:

The first communication sub-module 401 is connected to the Radius message processing module 1 and the signaling collection processing module 2, and is configured to receive the user identification information and the private network IP sent by the Radius message processing module 1 or the signaling collection processing module 2 The address and the private network port number, and the user identification information, the private network IP address, and the private network port number are pushed to the processing queue sub-module 403;

The second communication sub-module 402 is connected to the firewall log processing module 3, configured to receive the NAT conversion information sent by the firewall log processing module 3, and split the NAT conversion information into a plurality of single NAT conversion information log records, and the log The record is pushed to the processing queue sub-module 403;

The processing queue sub-module 403 is connected to the first communication sub-module 401 and the second communication sub-module 402, and is set to user identification information, a private network IP address, a private network port number, and a second communication that are pushed by the first communication sub-module 401. The NAT conversion information pushed by the submodule 402 is sent to the associated merge submodule 404;

The association merge sub-module 404 (executing the same function of the generation module 26) is connected to the processing queue sub-module 403, and is configured to receive the user identification information, the private network IP address, the private network port number, and the NAT translation sent by the processing queue sub-module 403. Information; using the private network IP address as a key, using the user identification information as a mapping value for association and merging, generating a complete user online log record, and placing the user online log record into the storage sub-module 405;

The association merge sub-module 404 maintains a Map data area structure, with the private network IP address as a key and the user identification information as a mapping value. When the processing queue sub-module 403 sends the user identification information, the private network IP address, and the private network port number, the message is parsed first, and the private network IP address field value is extracted. And use the private network IP address as a key value to retrieve whether the Map container contains a corresponding record. If it does not exist, the user identification information is added to the Map container; otherwise, no processing is done.

When the processing queue sub-module 403 dispatches the firewall NAT conversion information message, the private network IP address is extracted and the private network IP address is used as the key value to retrieve whether the map container contains a user identification information record of the key value. If yes, the record is merged with the firewall NAT translation information to generate an IMSI, an MSISDN, a source private network IP address, a source private network port number, a source public network IP address, a source public network port number, and a destination IP address. The user's online log record of the destination port number, NAT start time, NAT end time, and protocol type. If there is no corresponding record, only the firewall NAT translation information itself generates an Internet record (the record lacks information such as IMSI, MSISDN, etc.).

The storage sub-module 405 is connected to the associated merge sub-module 404, configured to receive the user's Internet log record, and write it to the log storage module 6;

FIG. 12 is a flowchart of data processing of the log merge processing module 4 according to the preferred embodiment 3 of the present invention. As shown in FIG. 12, the flow includes the following steps:

Step S502: Receive firewall NAT conversion information and user identification information data packets processed by the firewall log collection module 3, the Radius message processing module 1 or the signaling collection processing module 2, respectively.

Step S504: The received data packet is pushed to the processing queue sub-module 403, and the data packet is taken out from the queue header. The data packet type needs to be parsed and distributed according to different policies. If the packet type is not a firewall NAT translation information packet, that is, a user identification information packet, step S506 is performed. Otherwise, step S514 is performed.

Step S506: Determine the integrity of the user identification information data packet. If complete, perform a decoding operation on the data packet to obtain a field value such as a private IP address, a port number, an IMSI, an MSISDN, and a PDP activation time; otherwise, discard.

Step S508: Using the private IP address as a key value, it is found whether there is a record of the key value in the Map container. If not, step S510 is performed; otherwise, step S512 is performed.

In step S510, the private IP address is used as an index key, and a record is added in the Map container, and the IMSI, MSISDN, and PDP activation time field values in the user identification message are used as mapping values of the record. At the same time, the timer is started, and the private IP address is used as the timer index value. If the timeout period arrives, the record is cleared from the Map container.

Step S512: Update the original record value in the Map container with the value of each field in the new message.

Step S514: Decapsulating the firewall NAT conversion information packet, and splitting the data packet into a plurality of firewall NAT conversion information message blocks.

Step S516: Check the validity of each data block and extract the private IP address field. Using the private IP address as a key value, it is queried whether there is a record containing the key value in the Map container. If yes, step S518 is performed; otherwise, step S520 is performed.

Step S518: determining the IP address type in the firewall NAT translation information data block, that is, extracting the IMSI number, the MSISDN number, and the PDP activation time field value (that is, the user identification information part) of the record in the Map container, and converting the information record with the firewall NAT. The source private IP address and port number, source public IP address and port number, destination IP address and port number, NAT start time, NAT end time, and protocol type fields are recombined into a complete online log record containing user information.

Step S520: no longer obtain the IMSI, MSISDN, PDP activation time and other field values from the Map container, but directly set the field values to 0, and then merge with the firewall NAT conversion information to reassemble one without the user identification information. Internet log records.

Step S522: Write the re-merged user online log record to the log storage module 6 for storage.

In order to facilitate the management to query the stored user's Internet log records, as shown in FIG. 13, a corresponding application service module 5 is also provided, which is connected to the log merge processing module 4; the application service module 5 includes an Internet log query terminal 501, which is set. In order to provide a query interface for the querying personnel, the query interface is configured to receive the input user online log record query condition, and send the query condition to the log merge processing module 4 connected thereto, and the user fed back by the log merge processing module 4 accesses the Internet. Log records are displayed through the query interface for inspection by the inquiring personnel;

Correspondingly, the third communication sub-module 406 is connected to the online log query terminal 501, and the third communication sub-module 406 is configured to receive the query request command including the query condition sent by the online log query terminal 501, and The query condition is parsed and sent to the query sub-module 407 (the same function of the feedback module 54 is executed), and is set to feed back the query result to the online log query terminal 501; the query sub-module 407 includes an efficient query algorithm and log storage. The module 6 is connected, configured to perform a lookup match in the log storage module 6 according to the query condition, and feed back the search result to the third communication submodule 406.

The query conditions for the user's Internet log record include: the start time and end time of the user's online log record, and the public IP address used by the user. The query results include: IMSI, MSISDN, source private network IP address, source private network port number, source public network IP address, source public network port number, destination IP address, destination port number, NAT start time, NAT end time, and protocol type. .

FIG. 14 is a flowchart of a process for querying a user's online log record according to a preferred embodiment 3 of the present invention. As shown in FIG. 14, the process includes the following steps:

Step S602: The user inputs the query conditions in the online log query terminal 51 of the application service processing module 5, including: a start time, an end time, and a public network IP address.

Step S604: The application service processing module 5 sends the query request data packet to the log merge processing module 4 connected thereto.

Step S606: The log merge processing module 4 queries to listen to the arrival of the query request data packet, and converts the query condition in the data packet into: a start date, an end date, a session hour, and a public network IP address. Search for the log records that meet the conditions on the connected log storage module (LSU).

Step S608: The log merge processing module 4 sends all the log record component data packets that satisfy the condition to the application service processing module 5.

Step S610: The application service processing module 5 receives the query result data packet returned by each log merge processing module 4, and displays the final result on the query interface of the application service processing module 5.

As shown in FIG. 13, the application service module 5 further provides a corresponding network management configuration terminal 502 for managing and configuring the network; the network management configuration terminal 502 and the Radius message processing module 1 and the signaling collection processing module 2, respectively. And the firewall log processing module 3 is used to set:

Radius message processing module 1 needs to connect to the mobile internet network management address;

The switch address of the mirrored interface of the user control plane that the signaling collection processing module 2 needs to connect to;

Firewall log processing module 3 needs to connect to the firewall address; and,

The address of the Radius message processing module 1 and the firewall log processing module 3 that the log merge processing module 4 needs to connect to.

Through the foregoing embodiments and the preferred embodiments, the user control plane signaling message GTP-C (GPRS Tunnelling Protocol-Control) in the network is deployed, or the Radius message sent by the mobile internet gateway is collected (based on different network topologies, two Select one), combined with the firewall NAT log, establish the correspondence between the key user information such as IMSI and MSISDN number and the public network IP address when accessing the Internet, form a detailed online log record for storage and provide an inquiry system, thus solving the relevant In the actual network deployment, when the Radius message cannot be obtained in the technology, the problem of the user's online log record cannot be obtained, and the national security supervision department provides the mobile user's online data query support. At the same time, when the network traffic is large, the above-mentioned online log generation method and device can prevent the communication link from being interrupted, resulting in a flaw in the entire log collection system, and reliability and scalability are very strong.

Obviously, those skilled in the art should understand that the above modules or steps of the embodiments of the present invention can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from The steps shown or described are performed sequentially, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

As described above, the above embodiments and preferred embodiments solve the problem that the user's private network information cannot be obtained through the Radius message in the related art, and the log information of the user cannot be generated in combination with the NAT information, and the user's private information is obtained through the GTP-C. The network information not only provides the national security supervision department with the data query support for mobile users, but also has strong reliability and scalability.

Claims

An online log generation method includes:

The user's private network information is obtained through the user control plane message GTP-C of the network;

Obtaining the network address translation NAT information of the user;

Generating the online log of the user according to the obtained private network information and the NAT information.
The method according to claim 1, wherein before the user control plane message GTP-C of the network obtains the private network information of the user, the method further includes:

Determining whether the right to obtain the private network information from the Radius message is available;

If the result of the determination is no, the private network information of the user is obtained through the GTP-C of the network.
The method according to claim 2, further comprising: after determining whether the right to obtain the private network information is obtained from the Radius message, further comprising:

If the result of the determination is yes, the private network information is obtained from the Radius message according to the network gateway;

Generating an online log of the user according to the private network information obtained from the Radius message and the NAT information.
The method of claim 1, further comprising: after generating the online log of the user according to the acquired private network information and the NAT information,

Receiving a query request for querying a user's online log;

The query result is fed back to the query requester according to the received query request.
The method according to any one of claims 1 to 4, wherein the private network information of the user comprises at least one of the following:

International Mobile Subscriber Identity IMSI, Mobile Subscriber International Number MSISDN, Packet Data Protocol PDP Activation Time.
The method according to any one of claims 1 to 4, wherein the NAT information of the user comprises at least one of the following:

Source private network IP address, source private network port number, source public network IP address, source public network port number, destination IP address, destination port number, NAT start time, and NAT end time.
An internet log generating device includes:

The first obtaining module is configured to obtain the private network information of the user by using a user control plane message GTP-C of the network;

a second obtaining module, configured to acquire network address translation NAT information of the user;

The generating module is configured to generate the online log of the user according to the obtained private network information and the NAT information.
The apparatus according to claim 7, further comprising:

The determining module is configured to determine whether the right to obtain the private network information from the Radius message is available;

The first obtaining module is further configured to acquire the private network information of the user through the GTP-C of the network if the determining result of the determining module is negative.
The apparatus of claim 8 further comprising:

a third obtaining module, configured to obtain the private network information from the Radius message according to the network gateway, if the determining result of the determining module is yes;

The generating module is further configured to generate an online log of the user according to the private network information obtained from the Radius message and the NAT information.
The apparatus according to claim 7, further comprising:

a receiving module, configured to receive a query request for querying a user's online log;

The feedback module is configured to feed back the query result to the query requester according to the received query request.