RU2798132C1 - Method and system for data management, associated subsystem and machine-readable data carrier - Google Patents

Abstract

FIELD: wireless communication.

EFFECT: providing the ability to track IP addresses and analyze large data sets. The user data plane information retrieved by the user plane functional entity is obtained. The user control plane information and the user data plane information are associated and merged to generate a subscriber traffic log.

SUBSTANCE: in order to manage user data, user control plane information extracted by the session management functional object is obtained.

13 cl, 8 dwg

Description

This application is filed on the basis of Chinese Patent Application No. 201911398795.5, filed on December 30, 2019, and claims priority on this Chinese patent application, the contents of which are hereby incorporated by reference in their entirety.

The field of technology to which the present invention relates

The present invention relates to the technical field of communication, in particular, to a data management method, an information association subsystem, a computer-readable storage medium, and a data management system.

Background of the Invention

The ability to trace IP addresses is of great importance for national security, especially in the field of anti-terror and criminal records. IP tracking schemes already exist for 2G, 3G, and 4G networks (2G, 3G, and 4G). With the commercial use of 5G (5G) networks and the advent of the Internet of Everything, more traffic will be consumed and network topology will become more complex, further increasing the importance of IP address tracking. At the same time, in the context of a sharp increase in the amount of data and the number of terminals in 5G networks, there is a need for an appropriate analysis of large data sets, which must also be satisfied.

However, the deployment of 5G networks differs in certain ways from the deployment of networks of previous generations. In the deployment of 5G networks, the control plane and the user plane are completely separated from each other based on the respective network elements. In addition, since most 5G networks use visualization and receive information in hardware, networking will be complex, difficult to implement, and less practicable. Co-deployed network elements cannot be signaled at their respective junctions.

Brief summary of the present invention

To address one of the identified technical problems, at least to some extent, the present invention provides a data management method, an information association subsystem, a computer-readable storage medium, and a data management system.

To achieve this goal, according to one aspect of the present invention, one embodiment of the present invention proposes a data management method. The method includes: obtaining user control plane information retrieved by the session management functional entity; obtaining user data plane information extracted by the user plane functional entity; and associating and merging the user control plane information and the user data plane information to generate a subscriber traffic log.

According to another aspect of the present invention, an information association subsystem is provided in one embodiment. This subsystem includes: one or more processors; and a memory configured to store one or more programs which, when executed by the one or more processors, cause the one or more processors to implement the data control method described in the above embodiment of the present invention.

According to another aspect of the present invention, in one embodiment, a computer-readable storage medium is provided for storing a computer program that, when executed by a processor, initiates the processor's implementation of the data management method described in the above embodiments of the present invention.

According to another aspect of the present invention, one embodiment of the invention is a data management system. This system includes: a session management functional object; many user plane functions; a plurality of network address converters in one-to-one correspondence with a plurality of user plane functions; and a plurality of information association subsystems in one-to-one correspondence with a plurality of user plane functions; wherein each of the information association subsystems is the information association subsystem described in the above embodiments of the present invention.

Brief description of the figures

1 is a flowchart illustrating a data management method according to one embodiment of the present invention;

Fig. 2 is a flowchart illustrating another data management method according to one embodiment of the present invention;

3 is a flowchart illustrating yet another data management method according to one embodiment of the present invention;

Fig. 4 is a block diagram illustrating yet another data management method according to one embodiment of the present invention;

Fig. 5 is a block diagram illustrating yet another data management method according to one embodiment of the present invention;

Fig. 6 is a block diagram illustrating yet another data management method according to one embodiment of the present invention;

Figure 7 schematically shows the structure of a data management system according to one embodiment of the present invention; And

FIG. 8 is a block diagram of a system architecture to which a data management method according to embodiments of the present invention is applicable.

Detailed disclosure of the present invention

In order to provide a better understanding of the technical diagrams of the claimed invention by those skilled in the art, the data management method, information association subsystem, computer-readable storage medium, and data management system of the present invention are described in detail below in conjunction with the accompanying drawings.

The data management method of the present invention can be used to generate IP address records based on relevant control plane and user plane information, and can meet IP address traceability and data analysis requirements.

1 is a flowchart illustrating a data management method according to one embodiment of the present invention. As shown in figure 1, this method involves the implementation of stages S1-S3.

In step S1, the user control plane information retrieved by the session management functional entity (SMF) is obtained.

In some embodiments of the present invention, the user control plane information includes: PDU session information, such as a session control functional entity identifier; user identification information such as International Mobile Subscriber Identity (IMSI), International ISDN/PSTN Mobile Subscriber Number (MSISDN), and International Mobile Equipment Identity (IMEI); location information; billing information; and other similar information.

In some embodiments of the present invention, the step S1 of obtaining user control plane information retrieved by the session management functional entity is:

obtaining user control plane information directly from the session management functional entity via a software collection interface configured by the session management functional entity; or receiving, from the other information association subsystem, user control plane information that has been obtained in advance by the other information association subsystem from the session management functional entity.

In some embodiments of the present invention, the session control functional entity transfers user control plane information to the nearest information association subsystem, after which multiple information association subsystems share the user control plane information, thereby reducing network information and remote data transmissions.

In addition, the use of a software collection interface avoids the complexity of networking due to visualization. The software collection interface directly uses the data within the network element, and the information contained in the network element is more complete. Encoding and decoding data in a dedicated software collection interface is simple, and does not require decryption by a network-attached storage device (NAS) or complex association of protocol stacks.

Efficient association between the control plane and the user plane can be provided by a simple association method.

In some embodiments of the present invention, the step S1 of obtaining user control plane information retrieved by the session management functional entity is:

obtaining user control plane information extracted by the session management functional entity based on the PDU (protocol data unit) session process.

The PDU session process includes: a PDU session creation process, a PDU session modification process, and a PDU session release process. Obtaining user control plane information from the session control functional entity based on the PDU session process means that the user control plane information can be obtained during the execution of all processes from among the PDU session creation process, the PDU session modification process, and the release process. PDU session.

In some embodiments of the present invention, it is contemplated that when the user control plane information carries a creation process ID, it means that a PDU session creation process is in progress. In this case, a data area is created and the corresponding information is stored in this data area. If the user control plane information carries a modification process ID, it means that a PDU session modification process is in progress. In this case, the data area is updated. If the user control plane information carries a release process ID, it means that a PDU session release process is in progress. In this case, the data area is freed.

In step S2, the user data plane information retrieved by the user plane functional entity (UPF) is obtained.

In some embodiments of the present invention, the user data plane information includes: traffic information and deep packet inspection (DPI) information. The deep packet inspection information includes: PDU session information such as a session management functional entity identifier; information about a tuple of 5 elements; time information; application layer protocol; uniform resource locator (URL); application type; etc.

In some embodiments of the present invention, step S2 of obtaining user data plane information retrieved by the user plane functional entity comprises:

receiving, through a collection interface of the software configured by the user plane functional entity, user data plane information transmitted by the user plane functional entity.

In step S3, the user control plane information and the user data plane information are associated and merged to generate a subscriber traffic log.

In some embodiments of the present invention, the subscriber traffic log is a record of users' IP addresses.

2 is a flowchart illustrating another data management method according to one embodiment of the present invention. As shown in Fig.2, this method is one of the embodiments based on the method illustrated in Fig.1. This method includes not only steps S1 and S2, but also steps S301 and S4, step S301 being a specific example of step S3. Below, only steps S301 and S4 will be described in detail.

The step S3 of associating and merging the user control plane information and the user data plane information to generate a subscriber traffic log comprises step S301.

In step S301, the user control plane information is embedded in the user data plane information to obtain a subscriber traffic log.

Inserting user control plane information into user data plane information means inserting PDU session information, user identification information, location information, billing information, and the like into user data plane information to obtain a subscriber traffic log.

After performing step S301, this method further comprises performing step S4.

In step S4, a first index is created in accordance with the ID of the session management functional entity, and based on the first index, the subscriber traffic log is stored.

The session management functional entity identifier is implemented as "SMF-SEID", "SMF-IP", or the like. Each piece of information carried by the session management functional entity and the user plane functional entity carries an identifier of the session management functional entity.

According to the data management method proposed by this embodiment of the present invention, obtaining the control plane related information retrieved by the session management functional entity and the user plane related information retrieved by the user plane functional entity can be realized without using interface information. N4 between the session management functional entity and the user plane functional entity, thereby providing an association between the control plane information and the user plane information. The generated subscriber traffic log can be used for tracking IP addresses and data analysis. By using a plurality of information association subsystems that share control plane information, maintenance complexity and information redundancy can be effectively reduced.

3 is a flowchart illustrating yet another data management method according to one embodiment of the present invention. As shown in Fig.3, this method is an optional implementation based on the method shown in Fig.1. This method includes not only steps S1-S3, but also steps S5 and S6. Below, only steps S5 and S6 will be described in detail.

In step S5, a network address translation (NAT) log retrieved by the network address resolver that corresponds to the user plane functional entity is obtained.

In some embodiments of the present invention, the network address translation log contains: the source IP address and source port number of the private network, the source IP address and source port number of the public network, and the corresponding protocol.

It should be noted that the order of steps S1-S3 and step S5 is not restrictive in the technical schemes of the present invention, i. e. steps S1-S3 may be performed before, after or simultaneously with step S5, which is within the scope of the present invention.

After performing steps S3 and S5, this method further includes performing step S6.

In step S6, the association and merging of the subscriber traffic log and the network address translation log is performed in order to generate a detailed log of IP addresses.

A detailed log of IP addresses is permanently stored in the database, and it can be used to more closely track user information, private network source and destination IP, public network source IP, location information, and other information. of this kind.

Fig. 4 is a block diagram illustrating yet another data management method according to one embodiment of the present invention. As shown in Fig.4, this method is an optional implementation based on the method illustrated in Fig.3. This method includes not only steps S1-S5, but also steps S601 and S7, step S601 being a specific example of step S6. Below, only steps S601 and S7 will be described in detail.

The step S6 of associating and merging the subscriber traffic log and the network address translation log to generate a detailed IP address log includes step S601.

In step S601, the network address translation log is stored in the subscriber traffic log in order to obtain a detailed log of IP addresses.

Bookmarking the network address translation log in the subscriber traffic log means laying the source IP address and source port number of the public network and the corresponding protocol in the subscriber traffic log in order to obtain a detailed log of IP addresses.

After performing step S601, this method further comprises performing step S7.

In step S7, a second index is created according to the source IP address and the source port number of the private network and the specified protocol, based on the second index, a detailed log of IP addresses is stored.

In general, the specified protocol includes: a transmission control protocol (TCP), a user datagram protocol (UDP), an Internet protocol (IP), an Internet control message protocol (ICMP), and the like.

Fig. 5 is a block diagram illustrating yet another data management method according to one embodiment of the present invention. As shown in Fig.5, this method is an optional implementation based on the method illustrated in Fig.4. This method includes not only steps S1-S7, but also steps S8 and S9. Below, only steps S8 and S9 will be described in detail.

After performing step S7, this method further comprises performing step S8.

In step S8, a cluster analysis of the stored verbose IP address log is performed to obtain a first result of the cluster analysis.

The first cluster analysis result only applies to the locally stored verbose IP address log. Although the cluster analysis covers all indicators, the first result of the cluster analysis is local.

In step S9, cluster analysis is performed again based on the obtained first cluster analysis result and the first cluster analysis result transmitted by the other information association subsystem to obtain the second cluster analysis result.

The second cluster analysis result is a global analysis result derived from the first cluster analysis result.

FIG. 6 is a flowchart illustrating yet another data management method according to one embodiment of the present invention. As shown in Fig.6, this method is an optional implementation based on the method illustrated in Fig.4. This method includes not only steps S1-S7, but also steps S10-S12. Below, only steps S10-S12 will be described in detail.

After performing step S7, this method further comprises performing steps S10-S12.

In step S10, in response to the request request, the detailed IP address log stored locally and the IP address detailed log stored in another information association subsystem are requested.

In step S11, the results of the local query and the query of the other information association subsystem are summed to obtain a response to the query.

In step S12, the response to the request is sent back to the server.

This embodiment of the present invention proposes a data management method that can implement appropriate analysis of large datasets based on a detailed log of IP addresses and response to an appropriate request request.

It should be noted that different stages of the above embodiments of the present invention can be combined with each other to form a new embodiment, while the technical scheme corresponding to the new embodiment is also within the scope of the claimed invention.

One embodiment of the present invention also provides a data management system. This system includes: a session management functional entity, a plurality of user plane functions; a plurality of network address converters in one-to-one correspondence with a plurality of user plane functions; and a plurality of information association subsystems in one-to-one correspondence with the plurality of user plane functions, each of the information association subsystems being the information association subsystem described in the above embodiments of the present invention.

The steps and processes performed within the implementation of the data management method and data management system of the present invention will be described in detail below in connection with their practical applications.

Fig. 7 schematically shows the structure of a data management system according to one embodiment of the present invention. As shown in Fig. 7, if we take the existing scenario of one central control room and three auxiliary equipment rooms as an example, the network elements associated with the control plane, such as the session management functional entity, will be deployed in the central control room, and each of the three support equipment rooms will deploy the network elements associated with the user plane, such as the user plane functional entities and the network address resolver. In addition, an information association subsystem is deployed in each of the three control rooms for auxiliary equipment. User plane functions are deployed one-to-one with network address resolvers, and user plane functions are deployed one-to-one with information association subsystems

The session management functional entity transmits the user control plane information to the information association subsystem (more specifically, the data collection module of the information association subsystem) located in the first control room, after which this information association subsystem will use the user control plane information in conjunction with the information association subsystems in the second and third hardware. During this period, this information association subsystem (data acquisition module) receives the user data plane information transmitted by the corresponding user plane functional entity and the network address translation log transmitted by the corresponding network address resolver. This information association subsystem associates and merges user control plane information and user data plane information to generate a subscriber traffic log, and associates and merges a subscriber traffic log and a network address translation log to generate a detailed IP address log.

Thereafter, the detailed IP address log is stored in the information association subsystem (more specifically, in the source data storage module of the information association subsystem), and the IP address verbose log is not transmitted further. Keeping a detailed log of IP addresses locally prevents excessive traffic consumption. After storing a detailed log of IP addresses, this information association subsystem (more precisely, the primary cluster analysis module of the information association subsystem) can perform an initial analysis of large data sets in order to generate the first cluster analysis result. In addition, to avoid excessive traffic consumption, the analysis is performed only against the locally stored verbose log of IP addresses. Then, this information association subsystem (more specifically, the secondary cluster analysis module of the information association subsystem) receives the results of the first cluster analysis transmitted by other hardware, and performs a secondary cluster analysis of large data sets to generate a second cluster analysis result. Since the first results of the cluster analysis are aggregated data, which are characterized by a small volume, the traffic consumption will be low.

The first results of the cluster analysis and the second results of the cluster analysis, such as statistics on lost data packets, statistics on the number of connections, statistics on the numbers dialed by the user, and statistics on the type of access, can be applied during operation and when performing maintenance work.

The information association subsystem in the second control room (more specifically, the snoop request module) can respond to the corresponding request request, for example, by performing the following process: distributing the request request to all information association subsystems (source data storage modules) to request verbose IP logs. addresses stored in the information association subsystem in the second hardware and other information association subsystems; summing the query results to obtain a response to the query; and transmitting a response to the request back to the web server. The data transfer during the query process is only between the back-end equipment rooms, which does not consume traffic between the back-up equipment rooms and the central control room, thereby preventing negative impact on control plane signaling. In addition, the response to the request received by the web server is the final set of data, and therefore the amount of data is kept to a minimum.

It should be noted that the deployment of the secondary cluster analysis module and the tracking request module in different hardware, i.e. performing the process corresponding to steps S8 and S9 and the process corresponding to steps S10-S12 by two different information association subsystems is just one of the optional implementations within the embodiments of the present invention.

FIG. 8 is a block diagram of a system architecture to which a data management method according to embodiments of the present invention is applicable. As shown in Fig. 8, the system architecture is deployed based on the existing 5G architecture. In addition, responses to requests for tracing requests can also be issued through the appropriate request summation system.

One embodiment of the present invention also provides an information association subsystem. This subsystem includes: one or more processors; and a memory configured to store one or more programs which, when executed by the one or more processors, cause that one or more processors to implement any of the data management methods described above in connection with the disclosed embodiments of the claimed invention.

One embodiment of the present invention also provides a computer-readable storage medium for storing a computer program which, when executed by a processor, causes that processor to implement any of the data management methods described above in connection with the disclosed embodiments of the claimed invention.

Embodiments of the present invention provide the following benefits.

Embodiments of the present invention provide a data management method, an information association subsystem, a computer-readable storage medium, and a data management system that can appropriately acquire control plane information and user plane information and generate a traffic log based on the information, satisfying thus the need for IP address traceability and analysis of large datasets, which simplifies network deployment and improves network performance.

Those skilled in the art will appreciate that all or some of the steps of the methods disclosed above and the functional modules/blocks in the device may be implemented in software, firmware, hardware, or appropriate combinations thereof. When implemented in hardware, the separation of functional modules/blocks in the above description does not necessarily correspond to the separation of physical components. For example, a single physical component may have multiple functions, or a single function or step may be shared by multiple physical components. Some or all of the physical components may be implemented as programs that are executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an ASIC. Such programs may be distributed on a computer-readable storage medium, which may include a computer storage medium (or non-volatile storage medium) and a communication medium (or volatile storage medium). Those skilled in the art will appreciate that the term "computer storage media" includes non-volatile and volatile, removable and non-removable storage media implemented in any method or technology for storage of information (such as computer-readable instructions, data structures, program modules, or other data). ). Computer storage media includes, but is not limited to, random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD). -ROM), digital versatile disk (DVD) or other optical storage device, cassette storage device, magnetic tape, magnetic disk memory or other magnetic storage device, or any other storage medium that can be used to store the required information, and to which can be accessed from a computer.

In addition, as is known to those skilled in the art, communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated communication signal, such as a data carrier or other communication mechanism, and may include any means of delivering information.

Embodiments of the claimed invention are described herein, and while specific terms are used, these terms are used in a broadly descriptive sense and should be considered solely in that sense and not as being restrictive. In some examples, it will be apparent to those skilled in the art that, unless expressly stated otherwise, a particular feature, characteristic, and/or element described in connection with a particular embodiment of the present invention may be used alone or in combination with a particular feature. , characteristic and/or element described in connection with another embodiment of the present invention. Therefore, it will be understood by those skilled in the art that various changes are indicated in the appended claims without departing from the scope of the present invention.

Claims (43)

1. Method of data management, providing: obtaining user control plane information retrieved by the session management functional entity; obtaining user data plane information extracted by the user plane functional entity; And associating and merging the user control plane information and the user data plane information to generate a subscriber traffic log. 2. The data management method according to claim 1, in which: Associating and merging user control plane information and user data plane information to generate a subscriber traffic log involves: bookmarking the user control plane information into the user data plane information to obtain a subscriber traffic log; And upon completion of the association and merging of the user control plane information and the user data plane information to generate a subscriber traffic log, the method further comprises: creating a first index based on the session management functional entity identifier; and storing a subscriber traffic log based on the first index. 3. The data management method of claim 1, wherein obtaining the user control plane information retrieved by the session management functional entity comprises: obtaining user control plane information directly from the session management functional entity via a software collection interface configured by the session management functional entity; or receiving, from the other information association subsystem, user control plane information that has been obtained in advance by the other information association subsystem from the session management functional entity. 4. The data management method of claim 1, wherein obtaining the user control plane information retrieved by the session management functional entity comprises: obtaining user control plane information based on the PDU session process. 5. The data management method of claim 1, wherein obtaining the user data plane information retrieved by the user plane functional entity comprises: receiving, through a collection interface of the software configured by the user plane functional entity, user data plane information transmitted by the user plane functional entity. 6. The data management method according to any one of the preceding paragraphs. 1-5, additionally providing: obtaining a network address translation log retrieved by the network address resolver that corresponds to the user plane functional entity; And upon completion of the association and merging of the user control plane information and the user data plane information to generate a subscriber traffic log, the method further comprises: association and merging of the subscriber traffic log and the network address translation log in order to generate a detailed log of IP addresses. 7. The data management method according to claim 6, in which the association and merging of the subscriber traffic log and the network address translation log to generate a detailed log of IP addresses includes: bookmarking the network address translation log into the subscriber traffic log in order to obtain a detailed log of IP addresses; And upon completion of the association and merging of the subscriber traffic log and the network address translation log to generate a verbose IP address log, this method further comprises: creating a second index according to a source IP address and a source port number of the private network and a predetermined protocol, and storing a detailed log of the IP addresses based on the second index. 8. The data management method of claim 7, wherein after storing a detailed log of IP addresses based on the second index, the method further comprises: performing a cluster analysis of the stored verbose IP address log in order to obtain the first result of the cluster analysis. 9. The data management method of claim 8, wherein after performing a cluster analysis of the stored verbose IP address log, the method further comprises: re-executing the cluster analysis based on the obtained first analysis result and the first cluster analysis result transmitted by the other information association subsystem to obtain the second cluster analysis result. 10. The data management method of claim 7, wherein after storing a detailed log of IP addresses based on the second index, the method further comprises: requesting a detailed log of IP addresses stored locally and a detailed log of IP addresses stored in another information association subsystem in response to the request; summing the result of the local query and the result of the query of another information association subsystem to obtain a response to the query; And sending the response to the request back to the server. 11. Information association subsystem, containing: one or more processors; And a memory configured to store one or more programs; wherein one or more programs, when executed by one or more processors, initiate the implementation by this one or more processors of the data management method according to any of the preceding claims. 1-10. 12. A computer-readable storage medium for storing a computer program which, when executed by a processor, causes that processor to implement the data management method according to any one of the preceding claims. 1-10. 13. Data management system, containing: a session management functional entity configured to perform a session management function; a plurality of user plane functional entities configured to perform a user plane function; a plurality of network address converters in one-to-one correspondence with a plurality of user plane functional entities configured to translate network addresses; And a plurality of information association subsystems in one-to-one correspondence with a plurality of user plane functions; wherein each of the information association subsystems is the information association subsystem of claim 11.

Images