CN114258052A

CN114258052A - Data association system, data association method and device, equipment and medium

Info

Publication number: CN114258052A
Application number: CN202210002785.0A
Authority: CN
Inventors: 吴远栋; 黄准; 张�成; 饶俊涛; 习奇
Original assignee: Accelink Technologies Co Ltd
Current assignee: Accelink Technologies Co Ltd
Priority date: 2022-01-04
Filing date: 2022-01-04
Publication date: 2022-03-29
Anticipated expiration: 2042-01-04
Also published as: CN114258052B

Abstract

The embodiment of the invention discloses a data association system, a data association method, a data association device, equipment and a medium. The exchange unit acquires signaling data and user plane data and sends the signaling data to the signaling processing unit; the signaling processing unit processes the signaling data to generate signaling log data and sends the signaling log data to the exchange unit; the exchange unit receives the signaling log data and then sends the signaling log data and the user plane data to the data association unit, and the data association unit associates the signaling data and the user plane data belonging to the same user, so that the association performance and stability of the user plane data and the signaling data are greatly improved, the system deployment is more flexible, and the application scene is wider.

Description

Data association system, data association method and device, equipment and medium

Technical Field

The present invention relates to the field of information technologies, and in particular, to a data association system, a data association method, a data association device, a data association apparatus, and a data association medium.

Background

Deep Packet Inspection (DPI) is a Deep Inspection technology based on data packets, and performs Deep Inspection on different network application layer loads, and determines the validity of a Packet by detecting the payload of the Packet. With the continuous development of the 5G technology, the data volume of the mobile network is increased rapidly, the size of the DPI data is also increased greatly, and how to improve the data processing efficiency of the DPI needs to be solved urgently.

Disclosure of Invention

In order to solve the existing technical problem, embodiments of the present invention provide a data association system, a data association method and apparatus, a device, and a medium.

In order to achieve the above purpose, the technical solution of the embodiment of the present invention is realized as follows:

the embodiment of the invention provides a data association system, which comprises an exchange unit, a signaling processing unit and a data association unit;

the switching unit is used for acquiring signaling data and user plane data of different users and sending the signaling data of the different users to the signaling processing unit;

the signaling processing unit is used for processing the signaling data, generating signaling log data and sending the signaling log data of different users to the exchange unit; wherein, one user corresponds to one signaling log data;

the exchange unit is further configured to send the signaling log data and the user plane data of the same user to the same data association unit;

and the data association unit is used for associating the signaling data and the user plane data belonging to the same user according to the received signaling log data and the received user plane data of the same user.

In the above scheme, the signaling processing unit includes a signaling transceiving module, a signaling parsing module and a signaling processing module, wherein,

the signaling transceiving module is used for receiving the signaling data and sending the signaling data to the signaling analysis module;

the signaling analysis module is used for analyzing the signaling data, acquiring key information in the signaling data and sending the key information to the signaling processing module; wherein the key information at least comprises: user information;

the signaling processing module is used for generating signaling log data comprising the key information on a user-by-user basis according to the user information and sending the signaling log data to the signaling transceiving module;

the signaling receiving and sending module is further configured to send the signaling log data of different users to the switching unit.

In the above scheme, the data association unit comprises a data receiving module, a signaling log processing module and a data association module, wherein,

the data receiving module is configured to receive the signaling log data and the user plane data sent by the switching unit, send the signaling log data to the signaling log processing module, and send the user plane data to the data association module;

the signaling log processing module is used for establishing a data association table for each user according to the signaling log data and sending the data association tables of different users to the data association module; the data association table comprises query information which takes a network address as a key word, and the network address information corresponding to different users is different;

the data association module is used for associating a group of the user plane data and the data association table, wherein the group of the user plane data and the data association table have the same network address information of the user plane data and the same network address information of the data association table.

In the above scheme, the data association unit further includes a tag module;

the data association module is further configured to receive user plane data to be queried, query the plurality of data association tables according to the received network address information of the user plane data, and send a query result to the tag module;

and the label module is further used for marking the user plane data when the query result represents that the data association table corresponding to the user plane data is queried.

In the above scheme, the signaling log processing module is further configured to establish a user information table for each user according to the signaling log data, and send the user information tables of different users to the data association module;

the tag module is further configured to query a target user pointed by the data association table in the user information table when the query result represents that the data association table corresponding to the user plane data is queried, and mark the user plane data by using user information of the target user in the user information table.

In the above scheme, the switching unit comprises a data acquisition module and a forwarding control module, wherein,

the data acquisition module is used for acquiring the signaling data and the user plane data of different users and sending the signaling data and the user plane data of different users to the forwarding control module;

the forwarding control module is used for sending the received signaling data to the signaling processing unit;

the forwarding control module is further configured to receive the signaling log data of the associated user processed by the signaling processing unit, and forward the signaling log data of different users and the user plane data load to different data association units in a balanced manner; and the signaling log data and the user plane data of the same user are forwarded to the same data association unit.

In the above solution, the format of the signaling log data is a UDP packet format, which at least includes: a DATA layer and an IP layer; and the DATA layer comprises the key information, the source network address of the IP layer is the user plane network address of the base station, and the destination network address is the user plane network address of the UPF.

In the foregoing solution, the user information includes: the method comprises the steps of identifying information of a user, position information of the user, tunnel information of a user PDU session, a session identifier of the user PDU session and a user plane network address of the user.

In the above scheme, the identity information of the user includes: a mobile subscriber identity IMSI, a mobile equipment international identity IMEI and a mobile subscriber number MSISDN;

the user location information comprises a cell identifier NCGI and a tracking area identifier TAI;

the tunnel information of the user PDU session comprises a user plane network address and a tunnel endpoint identifier TEID of a downlink base station, and a user plane network address and a tunnel endpoint identifier TEID of an uplink UPF.

In the above scheme, the data association table includes an uplink data association table and a downlink data association table;

the signaling log processing module is further configured to establish the uplink data association table and the downlink data association table for each user according to the signaling log data; the uplink data association table comprises query information taking the user plane network address of the UPF and the tunnel endpoint identifier of the user PDU session as keywords, and the downlink data association table comprises query information taking the user plane network address of the base station and the tunnel endpoint identifier of the user PDU session as keywords.

The embodiment of the invention also provides a data association method, which is applied to a data association system and comprises the following steps:

acquiring signaling data and user plane data of different users;

processing the signaling data to generate signaling log data; wherein, one user corresponds to one signaling log data;

and associating the signaling data and the user plane data belonging to the same user according to the signaling log data and the user plane data of the same user.

In the foregoing solution, the processing the signaling data to generate signaling log data includes:

analyzing the signaling data to obtain key information in the signaling data; wherein the key information at least comprises: user information;

and generating signaling log data comprising the key information per user according to the user information.

In the foregoing solution, the associating signaling data and user plane data belonging to the same user according to the signaling log data and the user plane data of the same user includes:

establishing a data association table for each user according to the signaling log data; the data association table comprises query information which takes a network address as a key word, and the network address information corresponding to different users is different;

and associating a group of the user plane data and the data association table, wherein the network address information of the user plane data is the same as the network address information of the data association table.

In the above scheme, the method further comprises:

receiving user plane data to be inquired, and inquiring a plurality of data association tables according to the received network address information of the user plane data;

and marking the user plane data when the query result represents that the data association table corresponding to the user plane data is queried.

In the above scheme, the method further comprises:

establishing a user information table for each user according to the signaling log data;

when the query result represents that the data association table corresponding to the user plane data is queried, marking the user plane data, including:

when the query result represents that a data association table corresponding to the user plane data is queried, querying a target user pointed by the data association table in the user information table;

and marking the user plane data by using the user information of the target user in the user information table.

the establishing a data association table for each user according to the signaling log data comprises:

establishing the uplink data association table and the downlink data association table for each user according to the signaling log data; the uplink data association table comprises query information taking the user plane network address of the UPF and the tunnel endpoint identifier of the user PDU session as keywords, and the downlink data association table comprises query information taking the user plane network address of the base station and the tunnel endpoint identifier of the user PDU session as keywords.

An embodiment of the present invention further provides a data association apparatus, where the apparatus includes:

the acquisition module is used for acquiring signaling data and user plane data of different users;

the processing module is used for processing the signaling data to generate signaling log data; wherein, one user corresponds to one signaling log data;

and the association module is used for associating the signaling data and the user plane data belonging to the same user according to the signaling log data and the user plane data of the same user.

In the above apparatus, the processing module includes:

the analysis module is used for analyzing the signaling data to obtain key information in the signaling data; wherein the key information at least comprises: user information;

and the processing module is used for generating signaling log data comprising the key information on a user-by-user basis according to the user information.

In the above apparatus, the association module includes:

the table building module is used for building a data association table for each user according to the signaling log data; the data association table comprises query information which takes a network address as a key word, and the network address information corresponding to different users is different;

and the association submodule is used for associating a group of the user plane data and the data association table, wherein the network address information of the user plane data is the same as that of the data association table.

In the above apparatus, the associating module further includes:

the receiving module is used for receiving user plane data to be inquired and inquiring the data association tables according to the received network address information of the user plane data;

and the marking module is used for marking the user plane data when the query result represents and queries the data association table corresponding to the user plane data.

In the above device, the table building module is further configured to build a user information table for each user according to the signaling log data;

the marking module is further configured to query a target user pointed by the data association table in the user information table when the query result represents that the data association table corresponding to the user plane data is queried; and marking the user plane data by using the user information of the target user in the user information table.

In the above apparatus, the association module is further configured to establish the uplink data association table and the downlink data association table for each user according to the signaling log data; the uplink data association table comprises query information taking the user plane network address of the UPF and the tunnel endpoint identifier of the user PDU session as keywords, and the downlink data association table comprises query information taking the user plane network address of the base station and the tunnel endpoint identifier of the user PDU session as keywords.

An embodiment of the present invention further provides an electronic device, including: a processor and a memory for storing a computer program capable of running on the processor,

wherein the processor is configured to execute the steps of the method according to the embodiment of the present invention when the processor runs the computer program.

Embodiments of the present invention also provide a computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, implements the steps of the method according to the embodiments of the present invention.

By adopting the technical scheme of the embodiment of the invention, the exchange unit can forward the signaling log data of the same user and the corresponding user plane data to the same data association unit, thereby realizing that the user plane data and the control plane signaling of a large number of users in the mobile network are shared in different data association units, greatly reducing the redundancy among the data association units, improving the number of users which can be processed by the whole data association system, greatly improving the association performance and stability of the user plane data and the control plane signaling, and leading the system to be more flexible to deploy and have wider application scenes.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.

Fig. 1 is a schematic structural diagram of a data association system according to an embodiment of the present invention;

fig. 2 is a schematic structural diagram of a data association system according to an embodiment of the present invention;

fig. 3 is a schematic flowchart of a data association method according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a data association apparatus according to an embodiment of the present invention;

fig. 5 is a schematic diagram of a hardware component structure of an electronic device according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the following describes specific technical solutions of the present invention in further detail with reference to the accompanying drawings in the embodiments of the present invention. The following examples are intended to illustrate the invention but are not intended to limit the scope of the invention.

Deep packet inspection is a technique that is relatively common to packet analysis. The normal packet detection only analyzes the content below the application layer of an IP (internet protocol) packet, such as classifying the data packet according to the five-tuple information (including the source address, the destination address, the source port, the destination port, and the protocol type) of the received IP packet. And the DPI performs deeper detection on the packet, including performing application layer analysis or flow characteristic-based detection on the packet, identifying an application layer service type corresponding to the packet, and/or extracting application layer key information therein for subsequent service processing. Moreover, since the 5G adopts a C/U separation architecture, the user identifier is not carried in the user plane data, but is carried in the control plane signaling, and if only the user plane data is monitored, the service data stream cannot be associated with the user, which does not meet the service requirements of the operator. Therefore, it is necessary to monitor the user plane data and the control plane signaling simultaneously, so as to implement the association between the user plane data and the user identifier. Exemplarily, a New Radio, NR (New Radio, NR) unified DPI system of a current operator can acquire signaling data of an N11 interface in a 5G Core Network (5G Core Network, 5GC) Network, analyze the acquired signaling data, fill an obtained key information forming field into an object Detailed Record (xDR) ticket, and then provide the xDR ticket containing the key information to a service system for processing.

At present, a traditional DPI device adopts a full-scale signaling access processing mode for signaling processing, a data association system sends full-scale (assuming that M million users are provided) signaling data to all data association units (N), then each data association unit establishes full-scale (M million users) Mobile Subscriber Identity (IMSI) entries (the key value of the entry is IMSI), M million uplink control Plane entries (the key value of the entry is smf (session Management function)) IP and Tunnel Endpoint identifiers (Tunnel Endpoint Identifier, TEID) and M million downlink control Plane entries (the key value of the entry is IP and TEID of AMF), M million uplink user Plane entries (the key value of the entry is IP and TEID of upf (user Plane function)) and M million downlink user Plane entries (the key value of the entry is IP and TEID of base station), and then receives user Plane data only, i.e. the user plane data is directly associated with the signalling data. The association means that the data association unit searches whether the entry with the same key value exists in M ten million uplink data association entries and M ten million downlink data association entries by taking the IP and TEID of the user plane data destination (the IP of the uplink user plane data destination is the IP of UPF, the TEID is the TEID of UPF, the IP of the downlink user plane data destination is the IP of the base station, and the TEID is the TEID of the base station) as the key value, and indicates that the association is successful and does not indicate that the association is failed.

The disadvantage of this processing mode is gradually revealed with the expansion of the DPI data size. Specifically, the conventional DPI splitter cannot split control plane signaling data of different users and user plane data of corresponding users into the same DPI splitter, so that each DPI splitter needs to receive the full amount of control plane signaling data to be associated with the received user plane data, which causes serious redundancy of signaling data among devices and greatly consumes hardware resources of the devices. In addition, hardware resources of one DPI splitter are limited, and only a limited number of users can be borne, including user plane related entries and user plane related entries, but in a large-scale splitting system model, the number of users often exceeds the upper limit of the number of users that one DPI splitter can bear, thereby greatly reducing the association rate of the splitters. Therefore, a system for separating signaling and user of a mobile network is needed, which can balance the signaling data and user plane data load of the same user into the same DPI splitter.

To this end, an embodiment of the present invention provides a data association system, and fig. 1 is a schematic diagram of a composition structure of the data association system provided in the embodiment of the present invention; as shown in fig. 1, the system includes a switching unit 101, a signaling processing unit 102, and a data association unit 103;

the switching unit 101 is configured to obtain signaling data and user plane data of different users, and send the signaling data of different users to the signaling processing unit 102;

the signaling processing unit 102 is configured to process the signaling data, generate signaling log data, and send the signaling log data of different users to the switching unit 101; wherein, one user corresponds to one signaling log data;

the switching unit 101 is further configured to send the signaling log data and the user plane data of the same user to the same data association unit 103;

the data association unit 103 is configured to associate signaling data and user plane data belonging to the same user according to the received signaling log data and the received user plane data of the same user.

It should be noted that the data association system of this embodiment may be applied to any data association system including the switching unit 101, the signaling processing unit 102, and the data association unit 103, which is not limited herein, and as an example, the data association system may be used as a data association system of control plane signaling and user plane data.

The signaling data is a control instruction in the communication system, which can guide the terminals, the switching system and the transmission system to cooperatively operate, establish a temporary communication channel between the designated terminals, and maintain the normal operation of the network itself. The signaling data includes information such as user identification. The user plane data is real user data, including voice coding (CS service), packet data packet (PS service), IP and TEID of the user plane data, etc.

In this embodiment, the data association system includes a switching unit 101, a signaling processing unit 102, and a data association unit 103. The switching unit 101 acquires signaling data and user plane data of different users at an N11 interface, and then sends the signaling data of all the users to the signaling processing unit 102; the signaling processing unit 102 processes the received signaling data of different users, generates signaling log data according to different users, and sends the generated signaling log data of all different users to the exchanging unit 101, where one user corresponds to one signaling log data. After receiving the signaling log data of different users, the switching unit 101 sends the signaling log data and user plane data of different users to the data association unit 103. In the data association system, the number of the data association units 103 may be set by itself according to the actual usage scenario of the data association system, and is not limited herein.

In this embodiment, the switching unit 101 sends signaling log data and user plane data of the same user to the same data association unit 103 in the sending process. Also, one data association unit 103 may receive signaling log data and user plane data of a plurality of users transmitted by the switching unit 101. Since the signaling log data carries signaling data of a user, the data association unit 103 may associate the signaling data belonging to the same user with the user plane data according to the received signaling log data and the user plane data of the same user.

It can be understood that the switching unit 101 can forward signaling log data of the same user and corresponding user plane data to the same data association unit 103, thereby implementing sharing of user plane data and control plane signaling of a large number of users in the mobile network to different data association units 103, greatly reducing redundancy between the data association units 103, increasing the number of users that the whole data association system can handle, and greatly improving the association performance and stability of the user plane data and the control plane signaling, the system deployment is more flexible, and the application scenarios are more extensive.

Fig. 2 is a schematic structural diagram of a data association system according to an embodiment of the present invention; as shown in fig. 2, in an alternative embodiment of the present invention, the signaling processing unit 102 includes a signaling transceiving module 1021, a signaling parsing module 1022 and a signaling processing module 1023, wherein,

the signaling transceiving module 1021 is configured to receive the signaling data, and send the signaling data to the signaling parsing module 1022;

the signaling analyzing module 1022 is configured to analyze the signaling data, obtain key information in the signaling data, and send the key information to the signaling processing module 1023; wherein the key information at least comprises: user information;

the signaling processing module 1023 is configured to generate signaling log data including the key information on a user-by-user basis according to the user information, and send the signaling log data to the signaling transceiving module 1021;

the signaling transceiving module 1021 is further configured to send the signaling log data of different users to the switching unit 101.

In this embodiment, the signaling processing unit 102 includes a signaling transceiving module 1021, a signaling analyzing module 1022 and a signaling processing module 1023. The signaling transceiving module 1021 receives signaling data of different users sent by the switching unit 101, and then sends the received signaling data of different users to the signaling analyzing module 1022; the signaling analysis module 1022 analyzes the received signaling data of different users to obtain key information of the users in the signaling data of different users, where the key information at least includes user information.

In an alternative embodiment, the user information includes: the method comprises the steps of identifying information of a user, position information of the user, tunnel information of a user PDU session, a session identifier of the user PDU session and a user plane network address of the user.

In an alternative embodiment, the identity information of the user comprises: a mobile subscriber identity IMSI, a mobile equipment international identity IMEI and a mobile subscriber number MSISDN; the user location information comprises a cell identifier NCGI and a tracking area identifier TAI; the tunnel information of the user PDU session comprises a user plane network address and a tunnel endpoint identifier TEID of the downlink base station, and a user plane network address and a tunnel endpoint identifier TEID of the uplink UPF.

The signaling parsing module 1022 parses the identity information of the user in the obtained signaling data: IMSI, IMEI and MSISDN; user location information: NCGI and TAI; tunnel information of user PDU session: the user plane IP and TEID of the downlink base station, the user plane IP and TEID of the uplink UPF, etc. are sent to the signaling processing module 1023. The signaling processing module 1023 generates signaling log data containing user key information for each user according to the received user information.

In this embodiment, the user identity information may include: IMSI, Mobile Equipment International Mobile Equipment Identity (IMEI), Mobile Subscriber number (MSISDN), and the like; the user location information may include: a Cell Identifier (NR Cell Global Identifier, NCGI) and a Tracking Area Identifier (TAI); the tunnel information of the user PDU session may include user plane IP and TEID of the base station, user plane IP and TEID of the UPF, etc.

It should be noted that the data format of the signaling log may be set by the user according to the actual usage scenario of the signaling log data, which is not limited herein.

In an optional embodiment, the format of the signaling log data is a UDP packet format, which at least includes: a DATA layer and an IP layer; and the DATA layer comprises the key information, the source network address of the IP layer is the user plane network address of the base station, and the destination network address is the user plane network address of the UPF.

It should be noted that, in this embodiment, the user plane network address includes a user plane IP and a TEID.

For example, in this embodiment of the present invention, a DATA format of the signaling log may be set as a User Datagram Protocol (UDP) packet format, and at least includes a DATA layer and an IP layer, where specifically, a Protocol stack of the signaling log DATA is:

DATA
	UDP
IP
	L2
L1

the DATA part contains necessary information required for DATA association, including identity information of the user: IMSI, IMEI and MSISDN; user location information: NCGI and TAI; tunnel information of user PDU session: user information such as user plane IP and TEID of downlink base station, user plane IP and TEID of uplink UPF, etc. The rest required information can be set and added by the user according to the specific use scene of the signaling log data, and is not limited herein.

The IP layer comprises a source IP and a destination IP, wherein the source IP is a user plane IP of the base station, and the destination IP is a user plane IP of the UPF. The UDP layer indicates that the protocol stack is in the form of a UDP packet, a header of the UDP layer indicates a source port and a destination port on the host, and a segment (segment) of the UDP transport is composed of a header of 8 bytes and a payload field. L1 denotes a physical layer, and L2 denotes a MAC layer.

In this embodiment, the signaling processing module 1023 sends signaling log data carrying user key information to the signaling transceiver module 1021, and the signaling transceiver module 1021 sends signaling log data of different users to the exchange unit 101.

In this embodiment, the signaling processing unit 102 processes signaling data of different users, and generates signaling log data containing user key information for each user. And the source IP of the IP layer in the signaling log data is set as the user plane IP of the base station, the destination IP is set as the user plane IP of the UPF, and the source IP and the destination IP of the user plane data are consistent, so that the user plane data and the signaling log data of the same user are ensured to be sent to the same data association unit 103. Thereby, it is more convenient to associate signalling data and user plane data of the same user.

In an alternative embodiment of the present invention, the switching unit 101 comprises a data acquisition module 1011 and a forwarding control module 1012, wherein,

the data acquisition module 1011 is configured to acquire the signaling data and the user plane data of different users, and send the signaling data and the user plane data of different users to the forwarding control module 1012;

the forwarding control module 1012 is configured to send the received signaling data to the signaling processing unit 102;

the forwarding control module 1012 is further configured to receive the signaling log data of the associated user processed by the signaling processing unit 102, and forward the signaling log data of different users and the user plane data to different data associating units 103 according to load balancing; wherein, the signaling log data and the user plane data of the same user are forwarded to the same data association unit 103.

It should be noted that, when the forwarding control module 1012 performs load balancing forwarding, a source-destination IP HASH algorithm may be adopted, where the source-destination IP HASH algorithm is to find a corresponding server from a statically allocated HASH table as a HASH Key (HASH Key) according to a source IP address or a target IP address of a request, and if the server is available and not overloaded, the request is sent to the server, otherwise, the server returns to null.

It will be appreciated that with this load balancing, it is ensured that each session of the user is only sent to the same specific server and not to other servers.

In this embodiment, the switching unit 101 includes a data acquisition module 1011 and a forwarding control module 1012. The data acquisition module 1011 acquires signaling data and user plane data of different users, and sends the signaling data and the user plane data of the different users to the forwarding control module 1012; the forwarding control module 1012 sends the received signaling data to the signaling processing unit 102.

The forwarding control module 1012 further receives the identity information carrying the user after the signaling processing unit 102 processes the signaling data of different users: IMSI, IMEI and MSISDN; user location information: NCGI and TAI; tunnel information of user PDU session: the user plane IP and TEID of the downlink base station, the user plane IP and TEID of the uplink UPF, and other information, the signaling log data of different users, and the signaling log data and the user plane data of different users are forwarded to the different data association unit 103 according to the user plane IP and the user plane IP load balance of the base station; it should be noted that, the source IP of the signaling log data of the user is the IP of the base station, and the destination IP is the IP of the UPF; dividing user plane data of a user into uplink user plane data and downlink user plane data, wherein a source IP of the uplink user plane data is an IP of a base station, and a target IP is an IP of UPF; the source IP of the downlink user plane data is the IP of UPF, and the target IP is the IP of the base station; as long as the IP of the base station and the IP of the UPF of the user plane data of the user are the same as the source IP (IP of the base station) and the destination IP (IP of the UPF) of the signaling log data of the user, the corresponding user plane data and signaling log data will be forwarded to the same data association unit 103, i.e. the signaling log data and the user plane data of the same user will be forwarded to the same data association unit 103.

In this embodiment, the switching unit 101 realizes that the uniform load of the user plane data and the control plane signaling of the massive users is shared to different data association units 103 according to the source-destination IP HASH algorithm, and the signaling log data of the same user and the corresponding user plane data are sent to the same data association unit 103, thereby greatly reducing the redundancy of data between the data association units 103, saving the memory space of the data association unit 103, and greatly increasing the number of users that can be processed by the whole data association system.

In an alternative embodiment of the present invention, the data association unit 103 comprises a data receiving module 1031, a signaling log processing module 1032 and a data association module 1033, wherein,

the data receiving module 1031 is configured to receive the signaling log data and the user plane data sent by the switching unit 101, send the signaling log data to the signaling log processing module 1032, and send the user plane data to the data association module 1033;

the signaling log processing module 1032 is configured to establish a data association table for each user according to the signaling log data, and send the data association tables of different users to the data association module 1033; the data association table comprises query information which takes a network address as a key word, and the network address information corresponding to different users is different;

the data association module 1033 is configured to associate the user plane data with a group of the user plane data and the data association table, where the network address information of the user plane data is the same as the network address information of the data association table.

In this embodiment, the data association unit 103 includes a data receiving module 1031, a signaling log processing module 1032, and a data association module 1033.

The data receiving module 1031 receives the signaling log data including the user key information and the user plane data sent by the switching unit 101, sends the signaling log data including the user key information to the signaling log processing module 1032, and sends the user plane data to the data associating module 1033.

It should be noted that the network address in this embodiment includes a user plane IP and a TEID of a base station corresponding to a user, and a user plane IP and a TEID of a UPF, and network addresses corresponding to different users are different.

The key information of the user comprises the identity information of the user: IMSI, IMEI and MSISDN; user location information: NCGI and TAI; tunnel information of user PDU session: user plane IP and TEID of downlink base station, user plane IP and TEID of uplink UPF, etc.

The signaling log processing module 1032 processes the received signaling log data including the user key information, and establishes a data association table for each user, where the data association table uses the user plane IP and TEID of the base station corresponding to the user or the user plane IP and TEID of the UPF as the key words of the query information, and in addition, the data association table also includes the user key information. The data association module 1033 uses the user plane IP and TEID of the base station of the user plane data or the user plane IP and TEID of the UPF as the key words, and queries whether there is a data association table that is the same as the user plane IP and TEID of the base station of the user plane data or the user plane IP and TEID of the UPF in the data association table. And if the data association table with the same key words of the user plane IP and the TEID of the base station of the user plane data or the user plane IP and the TEID of the UPF is found, associating a group of user plane data and data association table with the same user plane IP and TEID of the base station or the user plane IP and the TEID of the UPF.

In the embodiment, the data association table of the query information with the network address as the key word is established for the user according to the key information of the user in the signaling log data, and the key information of the user is carried in the data association table, so that the time for searching the data association table by the user plane data is greatly shortened, the association performance and stability of the user plane data and the control plane signaling are further improved, and the system deployment is more flexible.

In an optional embodiment of the present invention, the data association table includes an uplink data association table and a downlink data association table;

the signaling log processing module 1032 is further configured to establish the uplink data association table and the downlink data association table for each user according to the signaling log data; the uplink data association table comprises query information taking the user plane network address of the UPF and the tunnel endpoint identifier of the user PDU session as keywords, and the downlink data association table comprises query information taking the user plane network address of the base station and the tunnel endpoint identifier of the user PDU session as keywords.

In this embodiment, the data association table includes an uplink data association table and a downlink data association table, the keywords of the uplink data association table are the user plane IP and the TEID of the UPF, and the keywords of the downlink data association table are the user plane IP and the TEID of the base station.

The signaling log processing module 1032 establishes an uplink data association table and a downlink data association table for each user according to the signaling log data of different users. The keywords of the query information in the downlink data association table are the user plane IP and TEID of the base station corresponding to the user, and the keywords of the query information in the uplink data association table are the user plane IP and TEID of the UPF corresponding to the user. In addition, the uplink data association table and the downlink data association table both include key information of the user. Illustratively, the key information of the user includes identity information of the user: IMSI, IMEI and MSISDN; user location information: NCGI and TAI; tunnel information of user PDU session: user plane IP and TEID of downlink base station, user plane IP and TEID of uplink UPF, etc.

In this embodiment, the data association table is divided into the uplink data association table and the downlink data association table, so that the time for associating the user plane data with the data association table is further shortened, and the association efficiency is improved.

In an alternative embodiment of the present invention, the data association unit 103 further includes a tag module 1034;

the data association module 1033 is further configured to receive user plane data to be queried, query a plurality of data association tables according to network address information of the received user plane data, and send a query result to the tag module 1034;

the tag module 1034 is further configured to mark the user plane data when the query result represents that the data association table corresponding to the user plane data is queried.

In this embodiment, the data association module 1033 receives user plane data of different users to be queried, and queries a plurality of uplink data association tables and downlink data association tables that have been established in the data association module 1033 according to a user plane IP and TEID of a base station or a UPF corresponding to the received user plane data as a query key, and when a correlation table that is the same as the user plane IP and TEID of the base station corresponding to the user plane data is found in the uplink data association table or a correlation table that is the same as the user plane IP and TEID of the UPF corresponding to the user plane data is found in the downlink data association table, the tag module 1034 tags the user plane data.

It should be noted that the way that the tag module 1034 tags the user plane data is not limited, and for example, the way that the tag module 1034 tags the user plane data may be to add key information of a corresponding user in the data association table after the user plane data packet.

In this embodiment, the association between the user plane data and the user identifier is realized by marking the user plane data through the tag module 1034.

In an optional embodiment of the present invention, the signaling log processing module 1032 is further configured to establish a user information table for each user according to the signaling log data, and send the user information tables of different users to the data association module 1033;

the tag module 1034 is further configured to, when the query result represents that the data association table corresponding to the user plane data is queried, query a target user pointed by the data association table in the user information table, and mark the user plane data by using the user information of the target user in the user information table.

In this embodiment, the signaling log processing module 1032 is further configured to establish an IMSI table for each user according to signaling log data of different users, where a key value of the entry is an IMSI, and the IMSI table includes key information of the user, such as identity information IMSI, IMEI, and MSISDN of the user; user location information NCGI and TAI, etc. The IMSI tables for the different subscribers are then sent to the data association module 1033.

The data association module 1033 receives user plane data of different users to be queried, and queries a plurality of uplink data association tables and downlink data association tables established in the data association module 1033 according to a user plane IP and TEID of a base station or a user plane IP and TEID of an UPF corresponding to the received user plane data as query keywords, if a correlation table with the same user plane IP and TEID of the base station corresponding to the user plane data exists in the uplink data association table, or a correlation table with the same user plane IP and TEID of the UPF corresponding to the user plane data exists in the downlink data association table. The tag module 1034 queries the target user pointed by the data association table in the IMSI table, and marks the user plane data by using the user information of the target user in the IMSI table, where the marking may be performed by adding the key information of the corresponding user in the data association table after the user plane data packet.

In this embodiment, a user information table using the IMSI as a key value is established for each user, and the user information table carries key information of the user. The data amount in the data association table can be reduced, and since only one key value of the user information table is provided, the tag module 1034 makes the process of tagging the user plane data more concise and shortens the tagging time after the user plane data is associated with the data association table.

Based on the foregoing embodiment, the embodiment of the present invention further provides a data association method, which is applied to a data association system, and it should be noted that the data association system of the embodiment of the present invention includes the switching unit 101, the signaling processing unit 102, and the data association unit 103 in the foregoing embodiment; and the switching unit 101 includes a data acquisition module 1011 and a trigger control module 1012, the signaling processing unit 102 includes a signaling transceiving module 1021, a signaling parsing module 1022 and a signaling processing module 1023, and the data association unit 103 includes a data receiving module 1031, a signaling log processing module 1032, a data association module 1033 and a tag module 1034.

Fig. 3 is a schematic flowchart of a data association method according to an embodiment of the present invention; as shown in fig. 3, the method includes:

step 201: acquiring signaling data and user plane data of different users;

step 202: processing the signaling data to generate signaling log data; wherein, one user corresponds to one signaling log data;

step 203: and associating the signaling data and the user plane data belonging to the same user according to the signaling log data and the user plane data of the same user.

It should be noted that the signaling data is a control command in the communication system, and it can instruct the terminals, the switching system and the transmission system to operate cooperatively, establish a temporary communication channel between the designated terminals, and maintain the normal operation of the network itself. The signaling data may include user identity information, user location information, a tunnel identifier of a user PDU session, and the like, where the user identity information may include: IMSI, IMEI, MSISDN, etc.; the user location information may include: NCGI and TAI; the tunnel information of the user PDU session may include the user plane IP and TEID of the downlink base station, the user plane IP and TEID of the uplink UPF, and the like.

The user plane data is real user data, including voice coding (CS service), packet data packet (PS service), IP and TEID of the user plane data, etc.

In the embodiment of the invention, the signaling log is generated by processing the signaling data of the user, and the signaling data and the user plane data belonging to the same user are associated according to the signaling log data of the same user and the corresponding user plane data, so that the association performance and stability of the user plane data and the control plane signaling are greatly improved.

In an optional embodiment of the present invention, the processing the signaling data to generate signaling log data includes:

In this embodiment, the key information of the user may include the identity information of the user, IMSI, IMEI, and MSISDN; user location information, NCGI and TAI; tunnel information of user PDU session, user plane IP and TEID of downlink base station, user plane IP and TEID of uplink UPF, etc.

In the embodiment of the invention, the signaling data of different users are processed, and the signaling log data containing the key information of the users are generated for each user, so that the signaling data of the same user is conveniently associated with the user plane data.

In an optional embodiment of the present invention, the associating, according to the signaling log data and the user plane data of the same user, signaling data and user plane data belonging to the same user includes:

The key information of the user comprises the identity information of the user in the signaling data of the user obtained by analysis: IMSI, IMEI and MSISDN; user location information: NCGI and TAI; tunnel information of user PDU session: user plane IP and TEID of downlink base station, user plane IP and TEID of uplink UPF, etc.

In this embodiment, the received signaling log data including the user key information is processed, a data association table is established for each user, the data association table uses the user plane IP and TEID of the base station corresponding to the user or the user plane IP and TEID of the UPF as the key words of the query information, and in addition, the data association table also includes the user key information. And inquiring whether a data association table which is the same as the user plane IP and TEID of the base station of the user plane data or the user plane IP and TEID of the UPF exists in the data association table by taking the user plane IP and TEID of the base station of the user plane data or the user plane IP and TEID of the UPF as keywords. And if the data association table with the same key words of the user plane IP and the TEID of the base station of the user plane data or the user plane IP and the TEID of the UPF is found, associating a group of user plane data and data association table with the same user plane IP and TEID of the base station or the user plane IP and the TEID of the UPF.

In the embodiment of the invention, the data association table of the query information with the network address as the key word is established for the user according to the key information of the user in the signaling log data, and the key information of the user is carried in the data association table, so that the time for searching the data association table by the user plane data is greatly shortened, and the association performance and the stability of the user plane data and the control plane signaling are further improved.

In this embodiment, an uplink data association table and a downlink data association table are established for each user according to signaling log data of different users. The keywords of the query information in the downlink data association table are the user plane IP and TEID of the base station corresponding to the user, and the keywords of the query information in the uplink data association table are the user plane IP and TEID of the UPF corresponding to the user. In addition, the uplink data association table and the downlink data association table both include key information of the user. Illustratively, the key information of the user includes identity information of the user: IMSI, IMEI and MSISDN; user location information: NCGI and TAI; tunnel information of user PDU session: user plane IP and TEID of downlink base station, user plane IP and TEID of uplink UPF, etc.

In an optional embodiment of the invention, the method further comprises:

In this embodiment, user plane data of different users to be queried is received, a plurality of uplink data association tables and downlink data association tables which are already established are queried according to a query keyword which is a user plane IP and TEID of a base station or a user plane IP and TEID of an UPF corresponding to the received user plane data, and when a correlation table which is the same as the user plane IP and TEID of the base station corresponding to the user plane data exists in the uplink data association table or a correlation table which is the same as the user plane IP and TEID of the UPF corresponding to the user plane data exists in the downlink data association table, the user plane data is marked.

It should be noted that, the manner of marking the user plane data is not limited, and for example, the manner of marking the user plane data may be to add the key information of the corresponding user in the data association table after the user plane data packet.

In an optional embodiment of the invention, the method further comprises:

In this embodiment, an IMSI table is established for each user according to signaling log data of different users, a key value of the entry is an IMSI, and the IMSI table includes key information of the user, such as identity information IMSI, IMEI, and MSISDN of the user; user location information NCGI and TAI, etc.

Receiving user plane data of different users to be inquired, inquiring a plurality of established uplink data association tables and downlink data association tables according to the user plane IP and TEID of the base station or the user plane IP and TEID of UPF corresponding to the received user plane data as inquiry keywords, and if the user plane IP and TEID of the base station corresponding to the user plane data are inquired to be the same association tables in the uplink data association tables or the user plane IP and TEID of the UPF corresponding to the user plane data are inquired to be the same association tables in the downlink data association tables. And inquiring the target user pointed by the data association table in the IMSI table, and marking the user plane data by using the user information of the target user in the IMSI table, wherein the marking mode can be that key information of a corresponding user in the data association table is added after the user plane data message.

In this embodiment, a user information table using the IMSI as a key value is established for each user, and the user information table carries key information of the user, so that the data amount in the data association table can be reduced. And because the key value of the user information table is only one, the marking process of the user surface data is simpler after the user surface data is associated with the data association table, and the marking time is shortened.

Based on the above embodiment, the embodiment of the invention also provides a data association device. Fig. 4 is a schematic structural diagram of a data association apparatus according to an embodiment of the present invention; as shown in fig. 4, the apparatus includes:

an obtaining module 301, configured to obtain signaling data and user plane data of different users;

a processing module 302, configured to process the signaling data to generate signaling log data; wherein, one user corresponds to one signaling log data;

the associating module 303 is configured to associate signaling data and user plane data belonging to the same user according to the signaling log data and the user plane data of the same user.

In some optional embodiments of the invention, the processing module 302 comprises:

an analyzing module 3021, configured to analyze the signaling data to obtain key information in the signaling data; wherein the key information at least comprises: user information;

a processing module 3022, configured to generate signaling log data including the key information on a user-by-user basis according to the user information.

In some optional embodiments of the invention, the associating module 303 comprises:

a table building module 3031, configured to build a data association table for each user according to the signaling log data; the data association table comprises query information which takes a network address as a key word, and the network address information corresponding to different users is different;

an association submodule 3032, configured to associate a set of the user plane data and the data association table, where the network address information of the user plane data is the same as the network address information of the data association table.

In some optional embodiments of the present invention, the associating module 303 further comprises:

a receiving module 3033, configured to receive user plane data to be queried, and query the multiple data association tables according to network address information of the received user plane data;

a marking module 3034, configured to mark the user plane data when the query result represents that the data association table corresponding to the user plane data is queried.

In some optional embodiments of the present invention, the table building module 3031 is further configured to build a user information table for each user according to the signaling log data;

the marking module 3034 is further configured to query, when the query result represents that the data association table corresponding to the user plane data is queried, a target user pointed by the data association table in the user information table; and marking the user plane data by using the user information of the target user in the user information table.

In some optional embodiments of the present invention, the association module 303 is further configured to establish the uplink data association table and the downlink data association table for each user according to the signaling log data; the uplink data association table comprises query information taking the user plane network address of the UPF and the tunnel endpoint identifier of the user PDU session as keywords, and the downlink data association table comprises query information taking the user plane network address of the base station and the tunnel endpoint identifier of the user PDU session as keywords.

Fig. 5 is a schematic diagram of a hardware component structure of an electronic device according to an embodiment of the present invention, where the electronic device may be a computer, a tablet device, or the like. As shown in fig. 5, the electronic device 400 comprises a processor 401 and a memory 402 for storing a computer program capable of running on the processor 401, wherein the processor 401 is configured to execute any of the steps of the method according to the embodiment of the present invention when the computer program is run.

Optionally, the electronic device may further comprise at least one network interface 404 and a user interface 403. The various components in the electronic device 400 are coupled together by a bus system 405. It is understood that the bus system 405 is used to enable connection communication between these components. The bus system 405 includes a power bus, a control bus, and a status signal bus in addition to a data bus. For clarity of illustration, however, the various buses are labeled as bus system 405 in fig. 5.

It will be appreciated that the memory 402 can be either volatile memory or nonvolatile memory, and can include both volatile and nonvolatile memory. Among them, the nonvolatile Memory may be a Read Only Memory (ROM), a Programmable Read Only Memory (PROM), an Erasable Programmable Read-Only Memory (EPROM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a magnetic random access Memory (FRAM), a Flash Memory (Flash Memory), a magnetic surface Memory, an optical disk, or a Compact Disc Read-Only Memory (CD-ROM); the magnetic surface storage may be disk storage or tape storage. Volatile Memory can be Random Access Memory (RAM), which acts as external cache Memory. By way of illustration and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Enhanced Synchronous Dynamic Random Access Memory (Enhanced DRAM), Synchronous Dynamic Random Access Memory (SLDRAM), Direct Memory (DRmb Access), and Random Access Memory (DRAM). The memory 302 described in connection with the embodiments of the invention is intended to comprise, without being limited to, these and any other suitable types of memory.

Memory 402 in embodiments of the present invention is used to store various types of data to support the operation of monitoring device 400. Examples of such data include: any computer program for operating on the electronic device 400, such as an operating system 4021 and application programs 4022. The operating system 4021 includes various system programs for implementing various basic services. The application programs 4022 may include various application programs such as a Browser (Browser) and the like for implementing various application services. A program for implementing the method according to the embodiment of the present invention may be included in the application 4022.

The method disclosed in the above embodiments of the present invention may be applied to the processor 401, or implemented by the processor 401. The processor 401 may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware or instructions in the form of software in the processor 401. The processor 401 described above may be a general purpose processor, a DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, or the like. Processor 301 may implement or perform the methods, steps, and logic blocks disclosed in embodiments of the present invention. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed by the embodiment of the invention can be directly implemented by a hardware decoding processor, or can be implemented by combining hardware and software modules in the decoding processor. The software modules may be located in a storage medium located in the memory 402, and the processor 401 reads the information in the memory 402 and performs the steps of the aforementioned methods in conjunction with its hardware.

In an exemplary embodiment, the electronic Device 400 may be implemented by one or more Application Specific Integrated Circuits (ASICs), Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), FPGAs, general purpose processors, controllers, MCUs, microprocessors (microprocessors), or other electronic components for performing the aforementioned methods.

The features disclosed in the several method or device embodiments provided in the present application may be combined in any combination to arrive at a new method or device embodiment without conflict.

In the several embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described device embodiments are merely illustrative, for example, the division of the unit is only a logical functional division, and there may be other division ways in actual implementation, such as: multiple units or components may be combined, or may be integrated into another system, or some features may be omitted, or not implemented. In addition, the coupling, direct coupling or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between the devices or units may be electrical, mechanical or other forms.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed on a plurality of network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, all the functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may be separately regarded as one unit, or two or more units may be integrated into one unit; the integrated unit can be realized in a form of hardware, or in a form of hardware plus a software functional unit.

Those of ordinary skill in the art will understand that: all or part of the steps for implementing the method embodiments may be implemented by hardware related to program instructions, and the program may be stored in a computer readable storage medium, and when executed, the program performs the steps including the method embodiments; and the aforementioned storage medium includes: a removable storage device, a ROM, a RAM, a magnetic or optical disk, or various other media that can store program code.

Alternatively, the integrated unit of the present invention may be stored in a computer-readable storage medium if it is implemented in the form of a software functional module and sold or used as a separate product. Based on such understanding, the technical solutions of the embodiments of the present invention may be essentially implemented or a part contributing to the prior art may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the methods described in the embodiments of the present invention. And the aforementioned storage medium includes: various media that can store program code, such as removable storage devices, magnetic or optical disks, etc.

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the appended claims.

Claims

1. A data association system is characterized in that the system comprises a switching unit, a signaling processing unit and a data association unit;

2. The system according to claim 1, wherein the signaling processing unit comprises a signaling transceiving module, a signaling parsing module and a signaling processing module, wherein,

3. The system of claim 2, wherein the data association unit comprises a data receiving module, a signaling log processing module and a data association module, wherein,

4. The system of claim 3, wherein the data association unit further comprises a tag module;

5. The system of claim 4,

the signaling log processing module is further configured to establish a user information table for each user according to the signaling log data, and send the user information tables of different users to the data association module;

6. The system of claim 1, wherein the switching unit comprises a data acquisition module and a forwarding control module, wherein,

7. The system of claim 2,

the format of the signaling log data is a UDP message format, which at least comprises: a DATA layer and an IP layer; and the DATA layer comprises the key information, the source network address of the IP layer is the user plane network address of the base station, and the destination network address is the user plane network address of the UPF.

8. The system of claim 2,

the user information includes: the method comprises the steps of identifying information of a user, position information of the user, tunnel information of a user PDU session, a session identifier of the user PDU session and a user plane network address of the user.

9. The system of claim 8,

the identity information of the user comprises: a mobile subscriber identity IMSI, a mobile equipment international identity IMEI and a mobile subscriber number MSISDN;

10. The system of claim 3, wherein the data association table comprises an upstream data association table and a downstream data association table;

11. A data association method is applied to a data association system, and the method comprises the following steps:

acquiring signaling data and user plane data of different users;

12. The method of claim 11, wherein the processing the signaling data to generate signaling log data comprises:

13. The method of claim 12, wherein associating signaling data and user plane data belonging to the same user according to the signaling log data and the user plane data of the same user comprises:

14. The method of claim 13, further comprising:

15. The method of claim 14, further comprising:

16. The method of claim 13, wherein the data association table comprises an upstream data association table and a downstream data association table;

17. An apparatus for associating data, the apparatus comprising:

18. An electronic device, comprising: a processor and a memory for storing a computer program capable of running on the processor,

wherein the processor is adapted to perform the steps of the method of any one of claims 12 to 16 when running the computer program.

19. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method of any one of claims 12 to 16.