KR102504207B1 - System and method for detecting PFCP-IN-GTP packet in 5G standalone - Google Patents

Abstract

The present invention relates to a 5G SA network PFCP-IN-GTP packet detection system and a method thereof and, more specifically, to a 5G SA network PFCP-IN-GTP packet detection system and a method thereof which collect and analyze GTP user data messages in a 5G standalone (SA) network to identify user equipment that causes abnormal traffic.

Description

5G SA network PFCP-IN-GTP packet detection system and method {System and method for detecting PFCP-IN-GTP packet in 5G standalone}

The present invention relates to a system and method for detecting PFCP-IN-GTP packets in a 5G SA network, and more particularly, to collect and analyze GTP-U messages (GTP user data messages) in a 5G SA (StandAlone) network to detect abnormal traffic-causing users It relates to a 5G SA network PFCP-IN-GTP packet detection system and method capable of identifying user equipment.

As shown in FIG. 1, user data generated by user equipment accessing the 5G SA (StandAlone) network is transmitted to the UPF through GTP tunneling in the gNB (gNodeB) and UPF (User Plane Function) section, , the GTP tunneling packet data is removed from the UPF and transmitted to the outside.

At this time, in order to induce abnormal traffic, as shown in FIG. 2, the user equipment causing abnormal traffic modulates the src IP of the PFCP message in the user packet data of the GTP-U message into the SMF IP and transmits it, and the UPF receiving the message This is transmitted to the SMF, resulting in abnormal traffic.

Therefore, as described above, there is a need for a system capable of identifying and blocking user equipment that causes abnormal traffic.

The present invention was created due to the above necessity, and an object of the present invention is to collect and analyze GTP-U messages (GTP user data messages) in a 5G SA (StandAlone) network to prevent abnormal traffic-causing user equipment. It is to provide an identifiable 5G SA network PFCP-IN-GTP packet detection system and method.

The 5G SA network PFCP-IN-GTP packet detection system according to the present invention for achieving the above object includes a data collection unit 110 for collecting GTP-U messages (GTP user data messages) transmitted from user equipment; and a user equipment identification unit 120 that analyzes the GTP-U messages collected by the data collection unit 110 and identifies user equipment causing abnormal traffic.

According to a preferred embodiment of the present invention, the GTP-U message is a combination of user packet data generated by user equipment and GTP tunneling packet data, and is generated between a gNodeB (gNB) and a user plane function (UPF). Characterized in that it is packet data transmitted and received to.

According to a preferred embodiment of the present invention, the user equipment identification unit 120 checks whether the UDP (User Datagram Protocol) port of the GTP tunneling packet data of the GTP-U message collected by the data collection unit 110 is 2152. a GTP tunneling packet confirmation unit 121 that performs; If the UDP port of the GTP tunneling packet data checked by the GTP tunneling packet checker 121 is 2152, the user packet checker 122 checks whether the UDP port of the user packet data of the GTP-U message is 8805; And if the UDP port of the user packet data checked by the user packet checker 122 is 8805, the upper 2 bytes (flag/message type) of the PFCP message in the user packet data are extracted and examined to detect abnormal traffic causing user equipment (User Equipment). ) It is characterized in that it includes an abnormal determination unit 123 for determining whether.

According to a preferred embodiment of the present invention, the abnormality determination unit 123, if the upper 2 bytes (flag/message type) extracted from the PFCP message exist in a predefined table, the user who sent the GTP-U message It is characterized in that the user equipment is determined as abnormal traffic-causing user equipment, and detection information is generated and transmitted to the controller.

According to a preferred embodiment of the present invention, the data collection unit 110 collects the GTP-U message transmitted from the user equipment (GTP user data message); and analyzing, by the user equipment identification unit 120, the GTP-U message collected by the data collection unit 110 to identify abnormal traffic-causing user equipment.

According to a preferred embodiment of the present invention, the GTP-U message is a combination of user packet data generated by user equipment and GTP tunneling packet data, and is generated between a gNodeB (gNB) and a user plane function (UPF). Characterized in that it is packet data transmitted and received to.

According to a preferred embodiment of the present invention, in the step of identifying the abnormal traffic-causing user equipment by the user equipment identification unit 120, the GTP tunneling packet checking unit 121 determines that the data collection unit 110 Checking whether the User Datagram Protocol (UDP) port of the GTP tunneling packet data of the collected GTP-U message is 2152; When the UDP port of the GTP tunneling packet data checked by the GTP tunneling packet checking unit 121 is 2152, the user packet checking unit 122 checks whether the UDP port of the user packet data of the GTP-U message is 8805; And if the UDP port of the user packet data checked by the user packet checker 122 is 8805, the abnormal determination unit 123 extracts and examines the upper 2 bytes (flag/message type) of the PFCP message in the user packet data to detect abnormalities. It is characterized in that it includes the step of determining whether it is a traffic generating user equipment (User Equipment).

According to a preferred embodiment of the present invention, the abnormality determination unit 123, if the upper 2 bytes (flag/message type) extracted from the PFCP message exist in a predefined table, the user who sent the GTP-U message It is characterized in that the user equipment is determined as abnormal traffic-causing user equipment, and detection information is generated and transmitted to the controller.

5G SA network PFCP-IN-GTP packet detection system and method according to the present invention collects and analyzes GTP-U messages (GTP user data messages) in a 5G SA (StandAlone) network to detect abnormal traffic-causing user equipment By identifying and notifying the controller, there is an effect of preventing an attack that causes abnormal traffic.

1 is a flowchart of user data processing in a 5G SA network
2 is an example of an attack by user equipment causing abnormal traffic
3 is a block diagram of a 5G SA network PFCP-IN-GTP packet detection system according to an embodiment of the present invention.
4 is a block diagram of a user equipment identification unit according to an embodiment of the present invention;
5 is a flow chart of a PFCP-IN-GTP packet detection method through a 5G SA network PFCP-IN-GTP packet detection system according to an embodiment of the present invention.
6 is a flowchart of a method for identifying a user causing abnormal traffic in a user equipment identification unit according to an embodiment of the present invention.
7 is an exemplary diagram of a GTP-U message according to an embodiment of the present invention;
8 is an exemplary view of a (flag/message type) definition table according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them, will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms, only the present embodiments make the disclosure of the present invention complete, and the common knowledge in the art to which the present invention belongs It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used in a meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined. Terminology used herein is for describing the embodiments and is not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. Hereinafter, some embodiments of the present invention will be described with reference to the drawings.

3 is a block diagram of a 5G SA network PFCP-IN-GTP packet detection system according to an embodiment of the present invention, and FIG. 4 is a block diagram of a user equipment identification unit according to an embodiment of the present invention. As shown in FIGS. 3 and 4, the 5G SA network PFCP-IN-GTP packet detection system according to the present invention includes a data collection unit 110 that collects GTP-U messages (GTP user data messages) transmitted from user equipment and a user equipment identification unit 120 that analyzes the GTP-U messages collected by the data collection unit and identifies user equipment causing abnormal traffic.

In addition, the user equipment identification unit 120 is a GTP tunneling packet checking unit that checks whether the UDP (User Datagram Protocol) port of the GTP tunneling packet data of the GTP-U message collected by the data collecting unit 110 is 2152 ( 121) and the GTP tunneling packet checker 121 confirms that the UDP port of the GTP tunneling packet data is 2152, the user packet checker 122 checks whether the UDP port of the user packet data of the GTP-U message is 8805, and If the UDP port of the user packet data checked by the user packet checker 122 is 8805, the upper 2 bytes (flag/message type) of the PFCP message in the user packet data are extracted and inspected to generate abnormal traffic User Equipment It is configured to further include an abnormality determining unit 123 for determining whether or not it is normal.

Each component 110 or 120 may include at least one processor. The at least one processor may include an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Programmable Logic Device (PLD), a Field Programmable Gate Array (FPGA), a Central Processing Unit (CPU), a microcontroller, and/or It may be implemented with a microprocessor or the like. Each component 110 or 120 may further include a memory. Memory includes flash memory, hard disk, solid state disk (SSD), random access memory (RAM), static random access memory (SRAM), read only memory (ROM), and programmable read only (PROM) memory. memory), electrically erasable and programmable ROM (EEPROM), erasable and programmable ROM (EPROM), and/or embedded multimedia card (eMMC).

Hereinafter, a 5G SA network PFCP-IN-GTP packet detection method through the 5G SA network PFCP-IN-GTP packet detection system configured as described above will be described in detail with reference to FIGS. 5 to 7.

5 is a flowchart of a 5G SA network PFCP-IN-GTP packet detection method of a 5G SA network PFCP-IN-GTP packet detection system according to an embodiment of the present invention. 5, the 5G SA network PFCP-IN-GTP packet detection method of the 5G SA network PFCP-IN-GTP packet detection system according to the present invention is Collecting a U message (GTP user data message) (S100) and the user equipment identification unit 120 analyzes the GTP-U message collected by the data collection unit 110, ) It consists of a step (S200) of identifying.

First, the GTP-U message collected in the step S100 is a combination of GTP tunneling packet data with user packet data generated from user equipment, and a gNB (gNodeB) and UPF (User Plane Function) This is packet data transmitted and received between the terminals, as shown in FIG. 7 . 7 is an exemplary diagram of a GTP-U message according to an embodiment of the present invention.

Next, the step (S200) will be described in more detail as shown in FIG. 6. 6 is a flow chart of a method for identifying a user causing abnormal traffic in a user equipment identification unit according to an embodiment of the present invention. As shown in FIG. 6, in step S200, first, the GTP tunneling packet checking unit 121 transmits UDP (User Datagram Protocol) and checking whether the port is 2152 (S210).

In the step S210, if the UDP (User Datagram Protocol) port of the GTP tunneling packet data of the GTP-U message is not 2152, the GTP tunneling packet checking unit 121 determines that the user equipment is normal and terminates the process. do.

Next, in the step S200, if the UDP port of the GTP tunneling packet data checked by the GTP tunneling packet checking unit 121 is 2152, the user packet checking unit 122, the UDP port of the user packet data of the GTP-U message and checking whether is 8805 (S220).

In the step S220, if the UDP port of the GTP tunneling packet data is not 8805, the user packet checking unit 122 determines that the user equipment is normal and ends the process.

Finally, in the step S200, if the UDP port of the user packet data confirmed by the user packet checker 122 is 8805 by the abnormal determination unit 123, the upper 2 bytes of the PFCP message in the user packet data (flag/message type ) is extracted and inspected to determine whether it is an abnormal traffic-causing user equipment (S230).

In the step S230, the abnormal determination unit 123, if the upper 2 bytes (flag/message type) extracted from the PFCP message exist in a predefined table, the user equipment that transmitted the GTP-U message ) is determined as abnormal traffic-causing user equipment, and detection information is generated and transmitted to a controller. The predefined table is shown in FIG. 8. 8 is an exemplary view of a (flag/message type) definition table according to an embodiment of the present invention. As shown in FIG. 8, the upper 2 bytes (flag/message type) extracted from the PFCP message are Heartbeat when the flag is 0x20 to 0x27 and the message type (Request: 1, Response: 2), and the message type (Request : 3, Response: 4), PFD Management, message type (Request: 5, Response: 6), Association Setup, message type (Request: 7, Response: 8), Association Update, In case of message type (Request: 9, Response: 10), Association Release, in case of message type (Request: -, Response: 11), Version Not Supported, in case of message type (Request: 12, Response: 13) is Node Report, message type (Request: 14, Response: 15) is Session Set Deletion, message type (Request: 50, Response: 51) is Session Establishment, message type (Request: 52, Response : 53), Session Modification, message type (Request: 54, Response: 55), Session Deletion, message type (Request: 56, Response: 57), Session Report, which corresponds to abnormal traffic. .

Therefore, as described above, the 5G SA network PFCP-IN-GTP packet detection system according to the present invention collects and analyzes GTP-U messages (GTP user data messages) transmitted from user equipment in the 5G SA (StandAlone) network to detect abnormalities. There is an effect of preventing abnormal traffic-causing attacks by identifying traffic-causing user equipment and informing the controller.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art to which the present invention pertains can be implemented in other specific forms without changing the technical spirit or essential features of the present invention. you will be able to understand Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting.

100: 5G SA network PFCP-IN-GTP packet detection system
110: data collection unit
120: user equipment identification unit
121: GTP tunneling packet verification unit
122: user packet verification unit
123: abnormal judgment unit

Claims (8)

a data collection unit 110 that collects GTP-U messages transmitted from user equipment; and
a user equipment identification unit 120 that analyzes the GTP-U messages collected by the data collection unit 110 and identifies user equipment causing abnormal traffic;
Including,
The user equipment identification unit 120,
a GTP tunneling packet checking unit 121 that checks whether a User Datagram Protocol (UDP) port of the GTP tunneling packet data of the GTP-U message collected by the data collecting unit 110 is 2152;
If the UDP port of the GTP tunneling packet data checked by the GTP tunneling packet checker 121 is 2152, the user packet checker 122 checks whether the UDP port of the user packet data of the GTP-U message is 8805; and
If the UDP port of the user packet data checked by the user packet checker 122 is 8805, the upper 2 bytes (flag/message type) of the PFCP message in the user packet data are extracted and inspected to generate abnormal traffic User Equipment an abnormal determination unit 123 for determining whether the recognition is abnormal;
Including,
The abnormal determination unit 123,
If the upper 2 bytes (flag/message type) extracted from the PFCP message exist in a predefined table, the user equipment that transmitted the GTP-U message is determined to be an abnormal traffic-causing user equipment, Generates and delivers detection information to the controller,
In the predefined table, the flag is 0x20 to 0x27, the message type (Request: 1, Response: 2) is Heartbeat, the message type (Request: 3, Response: 4) is PFD Management, and the message type (Request: 5, Response: 6) is Association Setup, message type (Request: 7, Response: 8) is Association Update, and message type (Request: 9, Response: 10) is Association Release , and in case of message type (Request: -, Response: 11), Version Not Supported, in case of message type (Request: 12, Response: 13), it is Node Report, and in case of message type (Request: 14, Response: 15) , Session Set Deletion, message type (Request: 50, Response: 51), Session Establishment, message type (Request: 52, Response: 53), Session Modification, message type (Request: 54 , Response: 55), Session Deletion, and message type (Request: 56, Response: 57), Session Report. PFCP-IN-GTP packet detection system for 5G SA network.
According to claim 1,
The GTP-U message,
GTP tunneling packet data is combined with user packet data generated by user equipment, and packet data transmitted and received between gNB (gNodeB) and UPF (User Plane Function) PFCP-IN of 5G SA network -GTP packet detection system.
delete delete Collecting, by the data collecting unit 110, a GTP-U message (GTP user data message) transmitted from user equipment; and
analyzing, by the user equipment identification unit 120, the GTP-U message collected by the data collection unit 110, and identifying user equipment causing abnormal traffic;
Including,
The step of the user equipment identification unit 120 identifying abnormal traffic-causing user equipment,
checking, by the GTP tunneling packet checking unit 121, whether the UDP (User Datagram Protocol) port of the GTP tunneling packet data of the GTP-U message collected by the data collection unit 110 is 2152;
When the UDP port of the GTP tunneling packet data checked by the GTP tunneling packet checking unit 121 is 2152, the user packet checking unit 122 checks whether the UDP port of the user packet data of the GTP-U message is 8805; and
If the UDP port of the user packet data confirmed by the user packet checker 122 is 8805, the abnormality determination unit 123 extracts and inspects the upper 2 bytes (flag/message type) of the PFCP message in the user packet data to detect abnormal traffic Determining whether it is a triggering user equipment;
Including,
The abnormal determination unit 123,
If the upper 2 bytes (flag/message type) extracted from the PFCP message exist in a predefined table, the user equipment that transmitted the GTP-U message is determined to be an abnormal traffic-causing user equipment, Generates and delivers detection information to the controller,
In the predefined table, the flag is 0x20 to 0x27, the message type (Request: 1, Response: 2) is Heartbeat, the message type (Request: 3, Response: 4) is PFD Management, and the message type (Request: 5, Response: 6) is Association Setup, message type (Request: 7, Response: 8) is Association Update, and message type (Request: 9, Response: 10) is Association Release , and in case of message type (Request: -, Response: 11), Version Not Supported, in case of message type (Request: 12, Response: 13), it is Node Report, and in case of message type (Request: 14, Response: 15) , Session Set Deletion, message type (Request: 50, Response: 51), Session Establishment, message type (Request: 52, Response: 53), Session Modification, message type (Request: 54 , Response: 55), Session Deletion, and 5G SA network PFCP-IN-GTP packet detection method, characterized in that Session Report in case of message type (Request: 56, Response: 57).
According to claim 5,
The GTP-U message,
GTP tunneling packet data is combined with user packet data generated by user equipment, and packet data transmitted and received between gNB (gNodeB) and UPF (User Plane Function) PFCP-IN of 5G SA network -GTP packet detection method.
delete delete

Images