JP2019114950A - LTE communication system and communication control method - Google Patents

Abstract

To provide an LTE communication system and a communication control method that can appropriately cope with abnormality of a network related to LTE (Long Term Evolution) communication.SOLUTION: An LTE communication system includes a core network device for communicating according to an LTE communication scheme and a protection device. The protection device detects abnormality of a communication line that transmits data from the core network device and reduces communication available capacity of the communication line on which the abnormality is detected. The core network device holds information on the communication available capacity after reduction.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an LTE communication system and communication control method for communicating according to an LTE (Long Term Evolution) communication scheme.

  Conventionally, LTE (Long Term Evolution) communication is used as a communication method for accelerating mobile communication. An LTE communication system that performs LTE communication includes an EPC (Evolved Packet Core) device, an eNB (eNodeB) device, a terminal, and the like. The EPC apparatus has an SGW (Serving GateWay) and a PGW (Packet data network (PDN) GateWay). The PGW performs transmission quality control of an IP packet and the like according to policy control information notified from a Policy and Charging Rule Function (PCRF) through the Gx interface (see Non-Patent Document 1).

  In addition, in order to cope with abnormalities in the communication line caused by attacks from the outside, etc., when a communication abnormality of the terminal is detected by a protection device called IPS that is connected to the EPC device, the communication is disconnected or communication is performed on another route. There is also known a method of transferring data to the destination (see Patent Document 1).

JP, 2017-017553, A

Takehiro Nakamura and 5 others, “Activities and Contributions in Completing 3GPP LTE / SAE Standard Specification”, NTT DOCOMO Technical Journal Vol.17 No.2, P36-P45

  According to the conventional policy for dealing with communication lines, when a terminal having a plurality of communication means is infected with, for example, a virus, if disconnection of communication or change of transfer destination is performed, an abnormality is caused by another communication means. There is a fear.

  The present invention has been made in view of the above-described conventional situation, and provides an LTE communication system and communication control method capable of appropriately coping with a network abnormality related to LTE communication.

  One aspect of the present invention is an LTE communication system including a core network device that communicates according to an LTE communication scheme and a protection device, wherein the protection device detects an abnormality in a communication line that transmits data from the core network device. The communicable capacity of the communication line in which the abnormality is detected is reduced, and the core network device holds information on the communicable capacity after reduction.

  One aspect of the present invention is a communication control method in an LTE communication system for communicating according to an LTE communication method, which detects an abnormality in a communication line for transmitting data from a core network device, and detects the abnormality in the communication line. The communicable capacity is reduced, and information on the communicable capacity after reduction is held.

  According to the present invention, it is possible to appropriately cope with an abnormality in a network related to LTE communication, and to suppress the induction of a new abnormality.

A diagram showing a configuration example of an LTE communication system in an embodiment Diagram showing a configuration example of a defense device Sequence diagram showing an operation example of a conventional LTE communication system A sequence diagram showing an operation example of the LTE communication system of the embodiment

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

In the following embodiments, the LTE communication system and the communication control method are applied to an LTE communication system that performs communication in an LTE (Long Term Evolution) communication scheme. The LTE communication scheme may include a scheme (eg, LTE over Wifi) that communicates according to the LTE protocol via a wireless LAN (Local Area Network). The LTE over Wifi is disclosed, for example, in Patent Document 1.
(Reference Patent Document 1: Japanese Published Patent Application No. 2016-507993)

  The LTE over Wifi technology is applicable to a method of communicating according to the LTE protocol via a WAN (Wide Area Network). That is, the LTE communication scheme may include a scheme for communicating according to the LTE protocol via the WAN.

(Embodiment)
FIG. 1 is a diagram showing a schematic configuration of the LTE communication system 5 in the embodiment. The LTE communication system 5 includes a plurality of UEs (User Equipment) 10, one or more eNBs 20, a communication network line (communication line) 30, a communication network line (communication line) 31, a protection device 40, and an EPC apparatus. And 50.

  The UE 10 is owned by a user and performs processing related to LTE communication. LTE communication includes, for example, VoLTE communication. In FIG. 1, a plurality of UEs 10 are described as UE 10A, UE 10B, UE 10C,.

  The eNB 20 manages the UE 10 subordinate to the eNB 20, which is the own apparatus, and relays the communication performed between the UE 10 and the EPC device 50. For example, the eNB 20 may be installed outdoors, or installed for each building May be A plurality of eNBs 20 may exist, and one or more UEs 10 may exist under the control of the plurality of eNBs 20, respectively.

  The communication network line 30 is a downstream line connecting the eNB 20 and the EPC device 50. On the other hand, the communication network line 31 is an upstream line for connecting the PGW 51 of the EPC device 50 to an external service, a server, etc., and transmitting data from the EPC device 50. The communication network lines 30, 31 may be wired lines or wireless lines. The wired line may be, for example, an optical line or another wired line. The wireless link may be, for example, a satellite link or any other wireless link. As the communication network lines 30, 31, an SD-WAN (Software Defined WAN) in which a physical WAN line is operated by software may be used.

  The EPC device 50 is a device disposed in the core network of LTE, and performs communication connection via the eNB 20 and the communication network circuit 30 in accordance with the LTE protocol. Furthermore, the EPC device 50 communicates with various devices such as external services and servers via the communication network line 31.

  The EPC device 50 includes a PGW 51, a PCRF 52, an SGW 53, an MME (Mobility Management Entity) 54, and an HSS (Home Subscriber Server) 55. Each node of PGW 51, PCRF 52, SGW 53, MME 54, and HSS 55 may be a logical node or a physical node. That is, functions may be integrated into one device, or functions may be distributed to a plurality of individual devices. EPC device 50 is not limited to this configuration, and may include other additional components.

  The MME 54, the HSS 55, and the PCRF 52 process C plane data which is a control signal. The SGW 53 and the PGW 51 process transmission of U-plane data which is user data. Therefore, for example, when U plane data from the external network (upstream from EPC device 50) to UE 10A, that is, U plane traffic reaches EPC device 50 from the external network, PGW 52, SGW 53, communication network circuit 30, and eNB 20 Are transmitted to the UE 10A.

  The MME 54 is a node that provides mobility control and the like, and performs mobility control such as location registration, paging, handover, etc. and establishment or deletion of a bearer (data communication path) BR.

  The bearer BR is a route through which data communicated by LTE communication passes, and is, for example, a route connecting the PGW 52, the SGW 53, the communication network circuit 30, the eNB 20, and each UE 10. In this case, the bearer BR has different communication paths in each of the UEs 10A, 10B, and 10C. Therefore, in the case of identifying the bearer BR, it may be identified which one of the UE 10A, 10B, and 10C.

  The HSS 55 is a node having a subscriber management database in LTE, and manages subscriber contract information, authentication information, location information, and the like. The MME 54 performs user authentication based on the authentication information notified from the HSS 55.

  The SGW 53 is a gateway that accommodates the 3GPP access system and transmits data to the UE 10 and the PGW 51.

  The PGW 51 is a gateway that performs assignment of an IP address to the UE 10, packet transfer, and the like at a connection point with an external network (PDN). The PGW 51 may operate in accordance with the policy (policy control information) that the PCRF 52 has by cooperating with the PCRF 52. The PGW 51 may obtain the policy possessed by the PCRF 52 during communication (during LTE communication). Therefore, the PGW 51 can control the communication of the UE 10 by dynamically changing the communication control policy even during communication.

  The PGW 51 may control the amount and speed of communication communicated via each bearer BR in accordance with the policy possessed by the PCRG 52. When the PGW 51 controls the communication amount and the communication speed of each bearer BR, the processing load can be reduced as compared with the case where the communication amount and the communication speed are implemented by the UE 10 and the eNB 20. This is because the processing of congestion / retransmission control caused by communication exceeding the communicable capacity of the lower layer is suppressed. In addition, the PGW 51 controls the amount of communication and the communication speed, whereby communication control is performed according to the amount of communication and the communication speed also in the lower side network or device.

  The PCRF 52 is a node that performs control for quality of service (QoS) of user data transfer (control of communication quality such as priority transfer of packets) and charging. The QoS value determined by the PCRF 52 is notified to the PGW 51 and the SGW 53. The PGW 51 and the SGW 53 perform QoS control on U plane data according to the notified QoS value. The QoS value may be, for example, a setting value included in control information of a policy. The policy includes the communicable capacity in the communication via the bearer BR.

  The policy may be changed dynamically. For example, the changed policy is notified to the PGW 51 and the SGW 53, and is reflected in the communication control by the PGW 51 and the SGW 53.

  The EPC device 50 includes a processing unit, a storage unit, and a communication unit. When each node of the EPC device 50 is a logical node, one device may be provided with a processing unit, a storage unit, and a communication unit. When each node of the EPC device 50 is a physical node, each node may be provided with a processing unit, a storage unit, and a communication unit.

  The processing unit of the EPC device 50 realizes various functions by causing a processor (for example, a CPU (Central Processing Unit)) to execute a program held in a memory. The storage unit of the EPC device 50 may have, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), and various storages (for example, HDDs (Hard Disk Drives), SSDs (Solid State Drives)). Hold data, program. The communication unit of the EPC device 50 communicates (wired communication or wireless communication) with the communication network circuit 30, the protection device 40, and various devices in the external network.

  The defense device 40 is a device that detects an attack by access from the outside, for example, the communication network line 30 by monitoring the communication network line 31, and performs a predetermined countermeasure, for example, IPS (Intrusion Prevention System) It is also called as etc. The protection device can also be said to apply predetermined measures to a so-called intrusion detection system (IDS). The protection device 40 detects a DoS (Denial of Service) attack or the like from the outside and performs a predetermined countermeasure. The protection device 40 may be provided independently of other devices. The protection device 40 may be provided inside the EPC device 50, that is, the EPC device 50 may have the function of the protection device 40.

  FIG. 2 is a diagram showing a configuration example of the defense device 40. As shown in FIG. The defense device 40 includes a processing unit 410, a storage unit 42, and a communication unit 430.

  The processing unit 410 realizes various functions by the processor executing a program held in the memory. The processing unit 41 controls the operation of each unit of the defense device 40. For example, the processing unit 41 may acquire information on the channel capacity after the change of the communication network line 31 when the channel capacity of the communication network line 31 changes. The processing unit 41 may calculate new channel capacity by dividing the channel capacity after change of the communication network line 31 based on the ratio of the current channel capacity of each bearer BR.

  The storage unit 42 may include, for example, a ROM, a RAM, and various storages, and holds various information, data, and programs.

  The communication unit 43 communicates with the communication network line 31 (for example, wired communication or wireless communication). The communication unit 43 communicates (for example, wired communication or wireless communication) with the PCRF 52 of the EPC device 50.

Next, the operation of the LTE communication system will be described.
FIG. 3 is a sequence diagram showing an operation example of the LTE communication system according to the conventional processing procedure.

  In FIG. 3, the bearer BR (BR1, BR2, BR3) is established between the UE 10 (UE 10A, 10B, 10C) and the EPC device 50 (S11). These bearers BR (BR1, BR2, BR3) are communication paths passing through the UE 10 (any one of the UEs 10A, 10B, 10C), the eNB 20, the communication network circuit 30, the protection device 40, the SGW 53, and the PGW 51.

  Here, it is assumed that the UE 10A is infected with, for example, a virus due to an external attack (S12), and the infected UE 10A performs a DoS attack on the EPC apparatus 50 via the eNB 20 and the communication network line 30 (S12) S13).

  In the defense device 40, when the processing unit 41 detects an abnormality in a communication line such as a DoS attack via the communication unit 43, here, an abnormality in the communication network line 31 (S14), the PCRF 52 of the EPC apparatus 50 via the communication unit 43. Is notified that the DoS attack has been detected (S15). In the conventional system, in response to this notification, the PCRF 52 generally performs processing for disconnecting communication (S16). Such processing can prevent DoS attacks through the LTE communication system.

  However, due to the disconnection of the LTE communication, the virus may attack again by other communication means (S17). Generally, UE 10A has other communication means other than LTE communication, such as Wi-Fi (registered trademark) and Bluetooth (registered trademark), etc., and when a virus detects disconnection of LTE communication, such other It is also possible to resume a DoS attack via the communication means of

  As described above, in the conventional processing, there is a risk of resuming a new attack through another communication means possessed by the infected terminal. Therefore, the LTE communication system 5 according to the embodiment of the present invention shown in FIG. 4 does not disconnect LTE communication, but handles it using another method.

  Steps S11 to S15 in FIG. 4 are the same as the procedure according to the conventional communication sequence in FIG. After this, the PCRF 52 of the EPC apparatus 50 according to the embodiment does not cut off the communication in response to the notification of detection of the DoS attack, but reduces the speed of the bearer BR, that is, the communicable capacity of the communication network line 31. It reduces (S21). In response to this, the bearer is updated (S22).

  In S21, although the bearer which becomes the object which reduces the communicable capacity of a communication line is identified, the identification method in particular is not limited. For example, in the defense device 40, the processing unit 41 acquires information on each bearer BR that has already been established. The information on the bearer BR may be, for example, association information between the eNB 20 and the UE 10 corresponding to each bearer BR using the communication network circuit 30. The association information may be based on identification information (for example, eNB ID) of the eNB 20 and identification information (for example, UE ID) of the UEs 10 connected to the eNB 20. The information on the bearer BR may be preset in the defense device 40 and held in the storage unit 42. The information on the bearer BR may be acquired from the EPC device 50 via the communication unit 43. Thereby, even if the protection device 40 is disposed outside the EPC device 50, it can recognize which bearer BR is established inside the communication network line 31, and which communication line (bearer BR) or which UE 10 It can recognize whether an abnormality has occurred.

  Further, in S21, in the EPC device 50, when the PCRF 52 receives a notification of the communication line (bearer BR) in which an abnormality has occurred from the protection device 40, the communicable capacity of the generated bearer BR held in the storage unit or the like is Read and change.

  The PGW 51 will reduce the communicable capacity according to the changed policy. In the EPC device 50, the bearer is updated as in S22 by holding the information of the communicable capacity after the reduction in the storage unit or the like.

  By the above processing, although the attack seems to be continuing from the virus side, the size of the bearer is restricted on the real system, the effectiveness of the attack is reduced, and the attack is neutralized. (S23). Therefore, when the protection device 40 detects an abnormality in any communication line (bearer BR) or the UE 10, it is possible to suppress the occurrence of a new attack and reduce the risk.

  In the above embodiment, the defense device 40 detects an abnormality of the communication network line 31. This abnormality includes an abnormality that occurs in the EPC device 50, particularly in the PGW 51. Although the degree of reducing the communicable capacity of the communication line is not particularly limited, it is preferable to reduce the estimated effectiveness of the attack to such an extent that it is sufficiently eliminated. However, it is necessary to leave the communication capacity of the communication line to such an extent that communication on the attacking side (for example, communication of DoS attack) is possible.

  Although various embodiments have been described above with reference to the drawings, it goes without saying that the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the appended claims, and of course these also fall within the technical scope of the present invention. It is understood.

  INDUSTRIAL APPLICABILITY The present invention is useful for an LTE communication system, communication control method, and the like that can appropriately cope with a network abnormality related to LTE communication.

5 LTE communication system 10, 10A, 10B UE
20 eNB
30, 31 Communication network line (communication line)
50 EPC Device (Core Network Device)
51 PWG
52 PCRF
53 SGW
54 MME
55 HSS
BR bearer

Claims (4)

A core network device for communicating according to an LTE (Long Term Evolution) communication scheme, and an LTE communication system comprising a protection device,
The protection device
Detecting an abnormality in a communication line for transmitting data from the core network device;
Reducing the communicable capacity of the communication line in which the abnormality is detected;
The core network device is
Hold information of the communicable capacity after reduction,
LTE communication system. The LTE communication system according to claim 1, wherein
The core network device includes a packet data network gate way (PGW),
The information of the communicable capacity is included in the policy of the Policy and Charging Rule Function (PCRF),
The policy is changed based on the communicable capacity from the protection device,
The PGW reduces the communicable capacity according to the changed policy.
LTE communication system. The LTE communication system according to claim 1 or 2,
The core network device comprises the protection device.
LTE communication system. A communication control method in an LTE communication system for communicating according to an LTE communication method, comprising:
Detects an abnormality in the communication line that transmits data from the core network device,
Reducing the communicable capacity of the communication line in which the abnormality is detected;
Hold information of the communicable capacity after reduction,
Communication control method.

Images