WO2019140789A1

WO2019140789A1 - Data validation method, network device, ue, and computer storage medium

Info

Publication number: WO2019140789A1
Application number: PCT/CN2018/081469
Authority: WO
Inventors: 唐海
Original assignee: Oppo广东移动通信有限公司
Priority date: 2018-01-16
Filing date: 2018-03-30
Publication date: 2019-07-25
Also published as: WO2019140554A1; CN110710183B; CN110710183A

Abstract

Disclosed are a data validation method, a network device, a user equipment (UE), and a computer storage medium, comprising: obtaining from a server side a public key corresponding to a service; receiving a random number and an identifier of the service, sent from a user equipment (UE); said random number being the information updated each time an HTTP connection is established; on the basis of said public key, random number, and service identifier, validating the data stream of the service.

Description

Data verification method, network device, UE and computer storage medium

Technical field

The present invention relates to the field of information processing technologies, and in particular, to a data verification method, a network device, a user equipment (UE), and a computer storage medium.

Background technique

In the HTTP 2.0 era, all HTTP and above application layer data will be encrypted by the TLS protocol, which is not recognized by the carrier mobile network. In addition, the plaintext identifier such as SNI of the TLS layer can be used to identify the encrypted traffic during the TLS protocol handshake, but the subsequent TLS protocol will no longer have the plaintext flag. In addition, the plaintext flag is prone to the problem of stolen traffic, so a proof is needed. The right method to accurately and securely identify encrypted traffic.

Summary of the invention

To solve the above technical problem, an embodiment of the present invention provides a data verification method, a network device, a user equipment (UE), and a computer storage medium.

The embodiment of the invention provides a data verification method, which is applied to a network device, and the method includes:

The public key and/or the application identification request message corresponding to the service is obtained from the server side.

An embodiment of the present invention provides a data verification method, which is applied to a UE, where the method includes:

Obtaining a public key corresponding to the service and a random number from the server side;

Sending the random number and the identifier of the service to the network side; wherein the random number is information updated every time an HTTP connection is established.

The embodiment of the invention provides a network device, where the network device includes:

The first communication unit acquires a public key and/or an application identification request message corresponding to the service from the server side.

An embodiment of the present invention provides a UE, where the UE includes:

The second communication unit acquires a public key corresponding to the service and a random number from the server side, and sends the random number and the identifier of the service to the network side, where the random number is information updated every time the HTTP connection is established. .

A network device provided by an embodiment of the present invention includes: a processor and a memory for storing a computer program capable of running on a processor,

Wherein the processor is configured to perform the steps of the foregoing method when the computer program is run.

A UE provided by an embodiment of the present invention includes: a processor and a memory for storing a computer program capable of running on the processor,

A computer storage medium is provided by the embodiment of the present invention. The computer storage medium stores computer executable instructions, and the foregoing method steps are implemented when the computer executable instructions are executed.

According to the technical solution of the embodiment of the present invention, the data stream of the service can be verified based on the public key and/or the application identification request message; thereby implementing a scheme for detecting the encrypted data, and introducing a new variable to identify the encrypted data. In this way, it is possible to avoid the problem that the data stream is easily generated by the plaintext and the fraudulent traffic is generated, and the transmitted data stream can be made more accurate and secure.

DRAWINGS

1 is a schematic flowchart 1 of a data verification method according to an embodiment of the present invention;

2a is a schematic diagram 1 of a PFD interaction processing flow;

Figure 2b is a schematic diagram 2 of a PFD interaction processing flow;

Figure 2c is a schematic diagram 3 of a PFD interaction processing flow;

3 is a schematic flowchart 2 of a data verification method according to an embodiment of the present invention;

4 is a schematic structural diagram of a network device according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a user equipment UE according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a hardware architecture according to an embodiment of the present invention; FIG.

FIG. 7 is a schematic flowchart 3 of a data verification method according to an embodiment of the present invention.

Detailed ways

The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

Embodiment 1

The following describes the obtained public key and the application identification request message:

When the public key corresponding to the service is obtained from the server, as shown in FIG. 1, the method includes:

Step 101: Obtain a public key corresponding to the service from the server side.

Step 102: Receive a random number sent by the user equipment UE and an identifier of the service, where the random number is information updated every time an HTTP connection is established;

Step 103: Verify the data flow of the service based on the public key, the random number, and the identifier of the service.

It can be seen that the technical solution provided in this embodiment introduces new parameters compared with the prior art, and specifically includes: a new authentication parameter Public Key, and a random number (Random). The result Result can be calculated by a specific algorithm; and a Service ID is introduced to indicate a specific service.

It should be understood that the random number is a number that can change at different times and/or at different locations.

For example, include at least one of the following: a timestamp and a port number at the time.

In addition, one or more of the other at least one parameter may be used in combination with the public key to perform verification using a corresponding algorithm; for example, the public key is jointly verified with the timestamp and the port number; or the public key is only The calculation is performed based on one of the timestamps or port numbers therein.

It should be understood that the identifier of the service may be an application identifier, such as an APP ID. In the system, because the server and the core network identify the same application, different APP IDs may be used, but the same application may have one. The mapping relationship of the APP ID, that is to say, a mapping table of application identifiers is stored in the network device of the core network, wherein different identifiers of the same application are indicated in different systems.

Before performing step 101, the method further includes: generating, by using an OTT server, a parameter Public Key, a random number (Random).

The random number is information updated every time an HTTP connection is established; that is, a new Random is generated each time an HTTP connection is established.

In addition, the Public Key does not need to be generated every time the HTTP connection is established, and the retention period is long. The Public Key is used as a PFD and is saved and used by the OTT through the PFD to the core network. Correspondingly, the network side The network device acquires the updated public key based on the preset period. The preset period may be set according to actual conditions, for example, may be set to 1 day, or may also be set to 1 week, and is set by the network side (or the OTT server side) according to actual conditions.

Specifically, the obtaining the public key corresponding to the service from the server side includes:

Acquiring at least one PFD corresponding to the service based on a process of performing PFD interaction with the server side;

Extracting the public key from at least one PFD corresponding to the service.

For example, referring to FIG. 2a, 2b, and 2c, in FIG. 2a, the OTT server sends PFD management request information, where one service may correspond to one or more PFDs, and the PFD management request information in the figure may be one of them. The management request information corresponding to the PFD; the PFD management request information may carry information such as a triplet, a URL, and a public key corresponding to the service, and is not exhaustive. In Figure 2b, both the SMF and the PFDF network elements can be understood as the network device in the embodiment, and then at least one PFD is obtained from the UDR, and corresponding response information is obtained from the UDR; wherein the PFD can include Information such as public key. FIG. 2c shows a process of performing PFD management, and only needs to initiate PFD management information notification in the SMF network element and the PFDF network element, and the information in the PFD is modified.

Further, when the receiving the random number sent by the user equipment UE and the identifier of the service, the method further includes: receiving a first result that is sent by the UE and corresponding to the identifier of the service.

The method for verifying the data flow of the service based on the public key, the random number, and the identifier of the service, the method further includes:

Calculating a second result based on the random number and the public key; determining that the service data stream sent by the UE is a trusted data stream when the first result is the same as the second result.

After the verifying the data flow of the service based on the public key, the random number, and the identifier of the service, the method further includes:

Generating a corresponding filter based on the service data flow; detecting and counting the data flow sent by the UE based on the filter.

Specifically, the method for using several parameters provided in this embodiment is as follows: after each HTTP connection is established, the OTT server sends the Public Key and the Random to the UE through the established tunnel, and the UE calculates Result-1 (that is, First result);

Then, the UE transmits the random number Random and Result-1 to the network side, and carries the identifier Service ID of the service and the information describing the service data flow (which may be an IP address, etc.);

The network side calculates the Result-2 (that is, the second result) by using the Public Key saved by the network side and the obtained Random. If Result-1=Result-2, the network side considers that the Service ID and data flow information reported by the UE can be The letter then generates a Filter filter according to the data stream information to detect and count the data stream.

Before the basis of the foregoing solution, the embodiment further detects the end of the data stream, and specifically includes the following methods:

Manner 1: When the TCP connection corresponding to the HTTP connection is disconnected, it is confirmed that the service data stream transmission of the UE ends, and the filter is deleted. That is to say, when the TCP connection corresponding to the HTTP connection is disconnected, the network considers that the data flow of the service ends, and the network side deletes the previously installed filter.

Manner 2: receiving a PDU session modification request sent by the UE when the service data flow is terminated, and the PDU session modification request carries the identifier of the service; The modification request deletes the binding information of the corresponding user plane filter.

That is to say, after the service data stream is delivered, the HTTP connection is disconnected, and the UE initiates a PDU session modification request to the network side to carry the Service ID, and the network side deletes the user plane Filter binding information corresponding to the Service ID according to the request.

Manner 3: After the service data stream is transmitted, the data stream deletion request sent by the server side is received; wherein the data stream deletion request includes at least the identifier of the service; and the data stream deletion request is deleted according to the Binding information of the user plane filter corresponding to the identifier of the service.

That is, after the data stream is delivered, the OTT side initiates the data stream deletion request to the network side to include the Service ID, and the network side deletes the user plane Filter binding information corresponding to the Service ID according to the request.

The following describes the use of application identification request information:

The application identification request message includes at least one of the following information: first feature information, valid duration, and application identifier.

The first feature information includes at least one of the following: an IP source address, an IP source port number, an IP destination address, an IP destination port number, a MAC source address, an IP source port number, a MAC destination address, a MAC destination port number, and a protocol type. , and VLAN tags.

Based on the foregoing application identification request message, the solution provided in this embodiment may further include:

Receiving a request message of the server, and verifying the request message;

After the request message is verified, the data stream filter is configured to identify the traffic of the application data stream according to the first feature information.

Specifically, the request message is verified based on the first feature information, the effective duration, the application identifier, for example, the related information of the IP address, the related information of the MAC address, and the protocol type, and then according to the first The feature information configures a data stream filter to perform traffic identification of the application data stream based on the data stream filter.

It should be noted that the application identification request message sent by the server is received; wherein the application identification request message occurs in a TLS handshake setup or after a TLS handshake is successful.

In addition, an application identification request message sent after the server receives the TLS handshake completion message is received.

For example, referring to FIG. 7, step 0, after the UE completes the TLS handshake with the OTT server (that is, the foregoing server) on the network side, the TLS handshake completion information is exchanged;

Step 1: The OTT server and the SCEF send an AAR application detection request, and the SCEF performs information verification, that is, verification of the request message;

Step 2: After the verification of the application identification request message by the SCEF is passed, the RAR application detection request is sent to the control plane of the 5GC/EPC; then the control plane of the 5GC/EPC and the user plane of the 5GC/EPC are mutually installed to install the data stream filter;

Step 3: The network side then performs encrypted service detection based on the installed data stream filter, that is, configures the data stream filter to identify the traffic of the application data stream according to the first feature information.

Further, the data stream filter takes effect within the valid duration, and the data stream filter is automatically released after the effective duration ends.

That is to say, the data stream filter can be timed and can be controlled by a timer, for example, when the data stream filter is started, the timer is turned on, and then the timer duration reaches the preset time threshold. When the value is used, the data stream is automatically released. The preset time limit can be set according to requirements. For example, it can be set for 10 minutes. Of course, it can be longer or shorter.

Then, the server initiates a release request message, and the data filter is released according to the message. That is, when it is determined that the data stream filter is released, the release information of the data stream filter sent by the server is received. The server is an application server.

After the traffic identification of the data flow is completed, the OTT server sends the AAR application detection release information to the SCEF.

Step 5: The SCEF sends a RAR application detection request to the control plane of the 5GC/EPC to release the data stream filter; then the control plane of the 5GC/EPC and the user plane of the 5GC/EPC interact to remove the data stream filter.

It can be seen that, by adopting the above scheme, it is possible to verify the data stream of the service based on the public key and/or the application identification request message; thereby implementing a scheme for detecting the encrypted data and expanding to introduce a new variable to identify the encrypted data, so that It can avoid the problem that the data stream is easy to generate misappropriation traffic by plaintext, and the transmitted data stream can be made more accurate and safe.

Embodiment 2

An embodiment of the present invention provides a data verification method, which is applied to a UE, as shown in FIG. 3, and includes:

Step 301: Obtain a public key corresponding to the service and a random number from the server side.

Step 302: Send the random number and the identifier of the service to the network side, where the random number is information updated every time an HTTP connection is established.

Before performing step 301, the method further includes: generating, by the OTT server, a parameter Public Key, a random number (Random).

In addition, the Public Key does not need to be generated every time the HTTP connection is established, and the retention period is long. The Public Key is used as a PFD and is saved and used by the OTT through the PFD to the core network. Correspondingly, the network side The network device acquires the updated public key based on the preset period. The preset period may be set according to an actual situation, for example, may be set to 1 day, or may also be set to 1 week, and is set by the network side (or the OTT server side) according to actual conditions.

Specifically, after the obtaining the public key corresponding to the service and the random number from the server side, the method further includes: calculating the first result based on the random number and the public key.

When the random number and the identifier of the service are sent to the network side, the method further includes: sending, to the network side, a first result corresponding to the identifier of the service.

Manner 2: When the service data flow is terminated, the HTTP connection is disconnected, and the PDU session modification request is sent to the network side, where the PDU session modification request carries the identifier of the service.

Correspondingly, the network side receives the PDU session modification request sent by the UE when the service data flow is terminated and the HTTP connection is disconnected; wherein the PDU session modification request carries the identifier of the service; The PDU session modification request deletes the binding information of the corresponding user plane filter.

Embodiment 3

The embodiment of the invention provides a network device, including:

When the public key corresponding to the service is obtained from the server, as shown in FIG. 4, the method includes:

The first communication unit 41 acquires the public key corresponding to the service from the server side, and receives the random number sent by the user equipment UE and the identifier of the service; wherein the random number is information updated every time the HTTP connection is established;

The first processing unit 42 verifies the data stream of the service based on the public key, the random number, and the identifier of the service.

The random number is information that is updated each time an HTTP connection is established; that is, a new Random is generated each time an HTTP connection is established.

Specifically, the first communication unit 41 acquires at least one PFD corresponding to the service based on a process of performing PFD interaction with the server side;

The first processing unit 42 extracts the public key from at least one PFD corresponding to the service.

For example, referring to FIG. 2, the OTT server sends PFD management request information, where one service may correspond to one or more PFDs, and the PFD management request information in the figure may be management request information corresponding to one of the PFDs.

The PFD management request information may carry information such as a triplet, a URL, and a public key corresponding to the service, and is not exhaustive.

Further, the first communication unit 41 receives a first result sent by the UE corresponding to the identifier of the service.

The first processing unit 42 calculates a second result based on the random number and the public key; when the first result is the same as the second result, determining that the service data flow sent by the UE is Trusted data stream.

The first processing unit 42 generates a corresponding filter based on the service data flow, and detects and counts the data flow sent by the UE based on the filter.

The first processing unit 42 confirms that the service data stream transmission of the UE ends and deletes the filter when the TCP connection corresponding to the HTTP connection is disconnected. That is to say, when the TCP connection corresponding to the HTTP connection is disconnected, the network considers that the data flow of the service ends, and the network side deletes the previously installed filter.

Manner 2: The first processing unit 42 is configured to receive, by the first communication unit, a PDU session modification request sent by the UE, when the service data flow is terminated, and the PDU session modification request is carried in the PDU session modification request. The identifier of the service; deleting the binding information of the corresponding user plane filter based on the PDU session modification request.

Manner 3: The first processing unit 42 receives a data stream deletion request sent by the server side after the end of the service data stream transmission; wherein the data stream deletion request includes at least the identifier of the service; The data stream deletion request deletes the binding information of the user plane filter corresponding to the identifier of the service.

The first communication unit 41 receives a request message of the server;

The first processing unit 42 verifies the request message. After the request message is verified, the data stream filter is configured to identify the traffic of the application data stream according to the first feature information.

It should be noted that the first communication unit 41 receives an application identification request message sent by the server, where the application identification request message occurs in a TLS handshake setup or after a TLS handshake is successful.

Step 5: The SCEF sends a RAR application detection request to the control plane of the 5GC/EPC to release the data stream filter; then the 5GC/EPC control plane and the 5GC/EPC user plane interact to remove the data stream filter.

Embodiment 4

An embodiment of the present invention provides a UE, as shown in FIG. 5, including:

The second communication unit 51 acquires a public key corresponding to the service and a random number from the server side, and sends the random number and the identifier of the service to the network side, where the random number is updated every time the HTTP connection is established. information.

Specifically, the UE further includes:

The second processing unit 52 calculates a first result based on the random number and the public key.

The second communication unit 51 sends a first result corresponding to the identifier of the service to the network side.

Manner 2: The second communication unit 51 sends a PDU session modification request to the network side when the service data flow is terminated and the HTTP connection is disconnected. The PDU session modification request carries the identifier of the service.

The embodiment of the present invention further provides a hardware component architecture of the user equipment or the receiver device. As shown in FIG. 6, the method includes at least one processor 61, a memory 62, and at least one network interface 63. The various components are coupled together by a bus system 64. It will be appreciated that bus system 64 is used to implement connection communication between these components. The bus system 64 includes, in addition to the data bus, a power bus, a control bus, and a status signal bus. However, for clarity of description, various buses are labeled as bus system 64 in FIG.

It is to be understood that the memory 62 in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.

In some embodiments, memory 62 stores elements, executable modules or data structures, or a subset thereof, or their extension set:

Operating system 621 and application 622.

The processor 61 is configured to be able to process the method steps of the foregoing first embodiment, and details are not described herein.

The embodiment of the present invention provides a computer storage medium, where the computer storage medium stores computer executable instructions, and when the computer executable instructions are executed, the method steps of the foregoing first embodiment are implemented.

Embodiments of the Invention The above apparatus may be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a standalone product. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk. Thus, embodiments of the invention are not limited to any specific combination of hardware and software.

Correspondingly, an embodiment of the present invention further provides a computer storage medium, wherein a computer program is configured, and the computer program is configured to execute a data scheduling method according to an embodiment of the present invention.

While the preferred embodiments of the present invention have been disclosed for purposes of illustration, those skilled in the art will recognize that various modifications, additions and substitutions are possible, and the scope of the invention should not be limited to the embodiments described above.

Claims

A data verification method is applied to a network device, and the method includes:

The public key and/or the application identification request message corresponding to the service is obtained from the server side.
The method of claim 1 wherein the method further comprises:

Receiving a random number sent by the user equipment UE and an identifier of the service; where the random number is information updated every time an HTTP connection is established;

The data stream of the service is verified based on the public key, the random number, and the identity of the service.
The method of claim 2, wherein the random number is a number that can change at different times and/or at different locations.
The method of claim 2, wherein after the verifying the data stream of the service, the method further comprises:

Generating a corresponding filter based on the service data stream;

The data stream sent by the UE is detected and counted based on the filter.
The method of claim 4, wherein after the generating the corresponding filter based on the service data stream, the method further comprises:

When the TCP connection corresponding to the HTTP connection is disconnected, it is confirmed that the service data stream transmission of the UE ends, and the filter is deleted.
The method of claim 4 wherein the method further comprises:

And receiving, by the UE, a PDU session modification request sent by the UE, where the PDU session modification request carries the identifier of the service;

Deleting binding information of the corresponding user plane filter based on the PDU session modification request.
The method of claim 4 wherein the method further comprises:

After the service data stream is transmitted, the data stream deletion request sent by the server is received; wherein the data stream deletion request includes at least the identifier of the service;

Binding information of the user plane filter corresponding to the identifier of the service is deleted according to the data stream deletion request.
The method according to claim 1, wherein the obtaining the public key corresponding to the service from the server side comprises:

Acquiring at least one PFD corresponding to the service based on a process of performing PFD interaction with the server side;

Extracting the public key from at least one PFD corresponding to the service.
The method according to claim 2, wherein when the receiving the random number sent by the user equipment UE and the identifier of the service, the method further includes:

Receiving a first result sent by the UE corresponding to an identifier of the service.
The method of claim 9, wherein the verifying the data stream of the service based on the public key, the random number, and the identifier of the service, the method further comprising:

Calculating a second result based on the random number and the public key;

When the first result is the same as the second result, determining that the service data stream sent by the UE is a trusted data stream.
The method of claim 1 wherein the method further comprises:

The updated public key is obtained based on the preset period.
The method according to claim 1, wherein the application identification request message includes at least one of the following information: first feature information, valid duration, and application identifier.
The method according to claim 12, wherein the first feature information comprises at least one of the following: an IP source address, an IP source port number, an IP destination address, an IP destination port number, a MAC source address, an IP source port number, and a MAC destination. Address, MAC destination port number, protocol type, and VLAN tag.
The method of claim 12 or 13, wherein the method further comprises:

Receiving a request message of the server, and verifying the request message;

After the request message is verified, the data stream filter is configured to identify the traffic of the application data stream according to the first feature information.
The method of claim 12, wherein the data stream filter is valid for the effective duration, and the data stream filter is automatically released after the valid duration ends.
The method of claim 12 wherein said method further comprises:

Receiving the server initiate release request message, releasing the data filter according to the message.
The method of claim 12 wherein the server is an application server.
The method of claim 12, wherein the method further comprises:

Receiving an application identification request message sent by the server; wherein the application identification request message occurs in a TLS handshake setup, or after a TLS handshake is successful.
The method of claim 18, wherein the method further comprises:

Receiving an application identification request message sent after the server receives the TLS handshake completion message.
A data verification method is applied to a UE, and the method includes:

Obtaining a public key corresponding to the service and a random number from the server side;

Sending the random number and the identifier of the service to the network side; wherein the random number is information updated every time an HTTP connection is established.
The method of claim 20, wherein the random number is a number that can change at different times and/or at different locations.
The method of claim 21, wherein the method further comprises:

When the service data flow is terminated, the HTTP connection is disconnected, and the PDU session modification request is sent to the network side, where the PDU session modification request carries the identifier of the service.
The method according to claim 21, wherein after the obtaining the public key corresponding to the service and the random number from the server side, the method further comprises:

A first result is calculated based on the random number and the public key.
The method according to claim 23, wherein when the sending the random number and the identifier of the service to the network side, the method further comprises:

Sending a first result corresponding to the identity of the service to the network side.
A network device, the network device comprising:

The first communication unit acquires a public key and/or an application identification request message corresponding to the service from the server side.
The network device according to claim 25, wherein the network device further comprises:

The first processing unit performs verification on the data flow of the service based on the public key, the random number, and the identifier of the service;

The first communication unit receives the random number sent by the user equipment UE and the identifier of the service; wherein the random number is information updated every time the HTTP connection is established.
The network device of claim 26, wherein the random number is a number that can change at different times and/or at different locations.
The network device according to claim 26, wherein the first processing unit generates a corresponding filter based on the service data stream; and detects and counts the data stream sent by the UE based on the filter.
The network device according to claim 26, wherein the first processing unit confirms that the service data stream transmission of the UE ends and deletes the filter when the TCP connection corresponding to the HTTP connection is disconnected.
The network device according to claim 28, wherein the first processing unit receives the PDU session modification request sent by the UE by using the first communication unit when the service data stream delivery ends the HTTP connection disconnection; The PDU session modification request carries the identifier of the service; and the binding information of the corresponding user plane filter is deleted according to the PDU session modification request.
The network device according to claim 28, wherein the first processing unit receives a data stream deletion request sent by the server side after the end of the service data stream transmission; wherein the data stream deletion request is at least And including the identifier of the service; deleting the binding information of the user plane filter corresponding to the identifier of the service according to the data stream deletion request.
The network device according to claim 25, wherein

The first communication unit acquires at least one PFD corresponding to the service based on a process of performing PFD interaction with the server side;

The first processing unit extracts the public key from at least one PFD corresponding to the service.
The network device according to claim 26, wherein

The first communication unit receives a first result that is sent by the UE and corresponds to an identifier of the service.
The network device according to claim 33, wherein

The first processing unit calculates a second result based on the random number and the public key; when the first result is the same as the second result, determining that the service data flow sent by the UE is Letter data stream.
The network device according to claim 34, wherein

The first communication unit acquires the updated public key based on the preset period.
The network device according to claim 25, wherein the application identification request message includes at least one of the following: first feature information, valid duration, and application identifier.
The network device according to claim 36, wherein the first feature information comprises at least one of the following: an IP source address, an IP source port number, an IP destination address, an IP destination port number, a MAC source address, an IP source port number, and a MAC address. Destination address, MAC destination port number, protocol type, and VLAN tag.
A network device according to claim 36 or 37, wherein

The first communication unit receives a request message of the server;

The first processing unit verifies the request message; after the request message is verified, the data stream filter is configured to identify the traffic of the application data stream according to the first feature information.
The network device according to claim 38, wherein the data stream filter is valid within the effective duration, and the data stream filter is automatically released after the valid duration ends.
The network device according to claim 36, wherein

The first communication unit receives the server initiate release request message;

The first processing unit releases the data filter according to the message.
The network device of claim 36, wherein the server is an application server.
The network device according to claim 36, wherein the first communication unit receives an application identification request message sent by the server; wherein the application identification request message occurs in a TLS handshake establishment or after a TLS handshake is successful .
The network device according to claim 32, wherein said first communication unit receives an application identification request message transmitted after said server receives a TLS handshake completion message.
A UE, the UE includes:

The second communication unit acquires a public key corresponding to the service and a random number from the server side, and sends the random number and the identifier of the service to the network side, where the random number is information updated every time the HTTP connection is established. .
The UE of claim 44, wherein the random number is a number that can change at different times and/or at different locations.
The UE according to claim 44, wherein the second communication unit transmits a PDU session modification request to the network side when the service data stream delivery ends the HTTP connection disconnection; wherein the PDU session modification request is Carry the logo of the service.
The UE of claim 46, wherein the UE further comprises:

The second processing unit calculates a first result based on the random number and the public key.
The UE according to claim 47, wherein said second communication unit transmits a first result corresponding to the identity of the service to said network side.
A network device comprising: a processor and a memory for storing a computer program capable of running on the processor,

Wherein the processor is operative to perform the steps of the method of any one of claims 1-19 when the computer program is run.
A UE includes: a processor and a memory for storing a computer program capable of running on the processor,

Wherein the processor is operative to perform the steps of the method of any one of claims 20-24 when the computer program is run.
A computer storage medium storing computer executable instructions that, when executed, implement the steps of the method of any of claims 1-24.