WO2009097777A1

WO2009097777A1 - Flow control method, access equipment and network system

Info

Publication number: WO2009097777A1
Application number: PCT/CN2009/070167
Authority: WO
Inventors: Guannan Zhang; Gang He; Yuxiang Wu; Haixiang Wu; Guanglei Yang; Jing Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2008-01-25
Filing date: 2009-01-15
Publication date: 2009-08-13
Also published as: CN101494598B; CN101494598A

Abstract

A flow control method, an access equipment and a network system are provided. The flow control method includes: receiving data flow from a user equipment; judging whether the data flow from the user equipment is junk flow or not; performing flow control operation on the user equipment if the data flow is junk flow. The limitation that the junk flow in uplink flow of the user equipment occupies great network resources can be overcome. The work efficiency of the network is improved.

Description

Flow control method, access device and network system The present application claims priority to Chinese patent application filed on January 25, 2008, the Chinese Patent Office, Application No. 200810056880.9, entitled "Flow Control Method, Apparatus and System", The entire contents of this application are incorporated herein by reference. Technical field

The present invention relates to the field of mobile communications technologies, and in particular, to a flow control method, an access device, and a network system. Background technique

Long Time Evolution (LTE) and System Architecture Evolution (hereinafter referred to as SAE) are transitional communication technologies that smoothly evolve 3G communication technologies to 4G communication technologies. Therefore, they are often called B3G. (Beyond 3G) or E3G (Evolved 3G).

Currently, in GPRS/3G networks, Spam Flows consumes a large amount of air interface resources, and these garbage traffic is mainly caused by viruses, worms or Denial of Service (DoS) attacks. . Therefore, in an LTE/SAE network, whether the uplink traffic can be effectively monitored directly affects the performance of the LTE/SAE network.

The network elements of the LTE/SAE network, such as the eNodeB, the SGW, and the Public Data Network-Gateway (hereinafter referred to as PDN-GW), cannot parse the data packets of the application layer, so the virus included in the application layer. The worm and DOS attack packets have no effect on the network elements of the LTE/SAE network. However, these traffic is a useless part of the user's upstream traffic. Therefore, these traffic are called "junk traffic" in the LTE/SAE network.

In order to control the garbage traffic, in the LTE/SAE network architecture, the Deep Packet Inspect (DPI) function is added to the PDN-GW (DPI) network element, and the DPI is utilized. Upstream traffic on the air interface can be detected and filtered.

In the process of implementing the present invention, the inventors have found that the prior art has at least the following problems: Due to the lack of a mechanism for limiting the upstream traffic of the air interface, even if the garbage flow is detected on the PDN-GW, the garbage traffic cannot be controlled to occupy the air. Interface resource

Since LTE can support very high air interface data traffic, and the traffic of the SAE core network will also increase significantly, it is expected that the SAE core network traffic can reach Gigabit or even more, so when the PDN-GW is doing DPI, the PDN- The speed and performance requirements of the GW's detection equipment, chips, and algorithms are very high, and if the rate of DPI done by the PDN-GW does not match the traffic rate of the SAE core network, it will also cause traffic bottlenecks between the public data network and the SAE core network. . Summary of the invention

The embodiment of the invention provides a flow control method, an access device and a network system, which solves the defect that the garbage traffic in the uplink traffic of the user equipment occupies a large amount of air interface resources, and implements the flow control based on the LTE/SAE network.

The embodiment of the invention provides a flow control method, which is applied to a mobile communication network, and includes: receiving a data flow from a user equipment;

Determining whether the data flow from the user equipment is garbage traffic; if the data flow is garbage traffic, performing flow control operations on the user equipment.

An embodiment of the present invention further provides an access device, including:

a receiving unit, configured to receive a data stream from the user equipment;

The determining unit is configured to determine whether the data flow from the user equipment is garbage traffic; and the air interface resource management unit is configured to perform a flow control operation on the user equipment if the data flow is garbage traffic.

The embodiment of the invention provides a network system, including:

a user equipment, configured to send a data stream of the user equipment to the access device;

An access device, configured to receive a data flow from the user equipment; when the data flow is garbage traffic At the time, the user equipment is subjected to a flow control operation.

The embodiment of the invention provides a flow control method, which can reduce the garbage flow entering the network and reduce the load on the core network caused by a large amount of traffic detection and control.

The embodiment of the present invention further provides an access device, which can reduce the traffic flow entering the network by implementing traffic detection and control on the access device on the access network side, and the traffic control operation is terminated. Into the device, it can also reduce the load on the core network caused by a large amount of traffic detection and control.

The embodiment of the invention provides a network system, which can reduce the traffic flow entering the network by implementing traffic detection and control on the access device on the access network side, and the traffic control operation ends in the access device. It can also reduce the load on the core network caused by a large amount of traffic detection and control. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work.

1 is a flowchart of a first embodiment of a flow control method according to the present invention;

2 is a flowchart of a second embodiment of a flow control method according to the present invention;

3 is a schematic structural diagram of a first embodiment of an access device according to the present invention;

4 is a schematic structural diagram of a second embodiment of an access device according to the present invention;

FIG. 5 is a schematic structural diagram of an embodiment of a network system according to the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, instead of All embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiment of the present invention is applied to the field of mobile communications, and may be an LTE network, or may be: Global System for Mobile Communications (GSM), Wideband-Code Division Multiple Access (WCDMA), and time division. Time Division - Synchronized Code Division Multiple Access (TD-SCDMA), Code-Division Multiple Access (CDMA), Worldwide Interoperability for Microwave Access (WIMAX) Waiting for the network.

The technical solutions of the embodiments of the present invention are further described in detail below with reference to the accompanying drawings and embodiments.

1 is a flow chart of a first embodiment of a flow control method according to the present invention. As shown in FIG. 1, the flow control method of the embodiment of the present invention may specifically include:

Step 101: Receive a data stream from a user equipment.

Step 102: Determine whether the data flow from the user equipment is garbage traffic.

Step 103: Perform flow control operations on the user equipment if the data flow is garbage traffic.

In the first embodiment of the flow control method of the present invention, the statistical result includes the accumulated value of the garbage flow, the ratio of the accumulated value of the garbage amount to the accumulated value of the transmitted amount, or a simple conversion of the ratio. The statistical result here is the trigger condition of the flow control operation. Therefore, based on the accumulated value of the garbage, according to different situations, that is, the operator maintains the network demand or the user equipment user's specific demand for the service, the upgrade condition of the trigger condition is also obviously dropped. It is within the scope of the invention to be protected. In the specific implementation, if the statistical result is set to the garbage flow accumulation value, the flow control operation may be performed according to the total amount of garbage sent by the user equipment; if the statistical result is set to the ratio of the accumulated amount of the garbage amount to the accumulated value of the sent amount, The flow control operation can be performed according to the garbage amount ratio of the user equipment.

The method of the embodiment of the present invention can adjust the sequence of each step according to actual needs. In the first embodiment of the flow control method of the present invention, after receiving the data stream sent by the user equipment, the data stream is encrypted data, and then the data stream needs to be decrypted, so that the encrypted data stream becomes plaintext data. Accordingly, the step of judging the data popularity from the user equipment also becomes to judge the plaintext data after the data stream is decrypted. In addition, according to the specific network structure, the method provided in the first embodiment of the flow control method of the present invention can be performed on different network elements. The executor of the embodiment of the present invention may be an access device on the access network side, such as a base station or a base station controller, and may be an eNodeB in the LTE network, or a base station (BS) or a base station controller in the GSM network. (Base Station Controller, BSC). The user equipment in the embodiment of the present invention may be a mobile phone, a notebook computer, or the like.

In the embodiment of the present invention, the traffic detection and control of the user equipment can be implemented on the access device on the access network side, so that the garbage traffic entering the network can be reduced, and at the same time, the traffic control operation is terminated on the access device, and the traffic can be reduced. Detect and control the load on the core network.

2 is a flow chart of a second embodiment of a flow control method according to the present invention. As shown in FIG. 2, the second embodiment is specifically described by taking an LTE/S AE network as an example. The method may include the following:

Step 201: In the LTE access network, the air interface decryption module in the eNodeB receives the data stream sent from the user equipment (User Equipment, hereinafter referred to as UE).

Step 202: The decoding module in the eNodeB decrypts the data stream to generate plaintext data. Step 203: The accumulating module in the eNodeB performs statistical processing on the sending amount integral corresponding to the user equipment according to the plaintext data generated by the decoding module, and generates a sending amount accumulated value, where the sending amount integral is only used to indicate the sending of the user equipment. The total amount of data flow, so different accumulation methods can be used according to different total statistics methods.

Step 204: The first determining module in the eNodeB determines whether the plaintext data is garbage traffic, where the determining method may specifically be: performing DPI on the plaintext data, such as using a "characteristic word" based identification technology, or Application layer gateway identification technology, or behavior pattern recognition can also be an ACL-based port filtering method, which is more mature in firewall technology. This will not be repeated here.

Step 205: When the plaintext data is garbage traffic, the intercepting module in the eNodeB intercepts the plaintext data, that is, deletes the garbage traffic from the corresponding device, and simultaneously collects the garbage amount corresponding to the user equipment. The score is statistically processed to generate an accumulated amount of garbage, wherein the garbage amount is only used to represent the total amount of garbage flow sent by the user equipment, so different accumulation methods can be used according to different total amount statistics methods, but the statistical method of the garbage amount integral Must be consistent with the method of sending amount integration statistics.

Step 206: The second determining module in the eNodeB determines whether the ratio of the accumulated amount of the garbage amount to the accumulated value of the sending amount exceeds a threshold threshold. In an actual application process, the accuracy of the first determining module in the eNodeB is considered. Factors such as the characteristics of the data stream sent by the user equipment, and the threshold value are set according to specific needs.

Step 207: If the ratio of the accumulated amount of the accumulated amount of the accumulated amount exceeds the threshold value, the second determining module in the eNodeB notifies the air interface resource management module in the eNodeB to perform a flow control operation on the user equipment, such as The user equipment performs an air interface data traffic limiting operation, or performs an air interface bandwidth limiting operation on the user equipment, or disconnects the user equipment, or prohibits the network operation of the user equipment.

The user equipment in the embodiment of the present invention may be a mobile phone, a notebook computer, or the like.

The method of the embodiment of the present invention can adjust the sequence of each step according to actual needs.

The LTE/SAE network spam flow (Spam Flows) mentioned in the embodiments of the present invention may include: traffic such as viruses, worms, and DoS attacks that occupy air interface resources. In the second embodiment of the flow control method of the present invention, the garbage flow detection is implemented on the eNodeB in the LTE access network, and according to the detected garbage traffic, the uplink traffic of the UE may be restricted, and the garbage traffic in the network is performed. Intercepting, thereby preventing the detection of the upstream garbage traffic on the PDN-GW, and failing to control the upstream garbage traffic, so that the flow control method embodiment of the present invention can improve the operating efficiency of the network; For example, the air interface resource management is terminated on the eNodeB, and there is no need to additionally increase the PDN-GW and the network elements in the LTE access network. The communication mechanism reduces the requirements on the corresponding hardware devices, and can also reduce the load on the core network caused by a large amount of traffic detection and control.

In the second embodiment of the flow control method of the present invention, the following steps may be further included: Step 208: When the plaintext data is not garbage traffic, the eNodeB performs the sending process on the plaintext data. When the data is specifically transmitted, the plaintext data may be processed according to the communication protocol of the GTP-U (GPRS Tunneling Protocol - Packet Data User Plane), and the GTP-U data packet is generated and sent to the SGW. This will send the cleaned plaintext data to the SGW.

In the second embodiment of the flow control method of the present invention, after the intercepting the plaintext data, the method may further include:

Step 209: The security management control background generates a log according to the intercepted plaintext data, or generates an alarm, or generates garbage traffic characteristic information. Further, the security management control background may also send the generated log, alarm or garbage traffic characteristic information to the UE by SMS or email, for example, performing anti-virus; and may also generate generated logs, alarms or garbage flows. The feature information and the like are directly output to other devices, and further analysis processing is performed.

FIG. 3 is a schematic structural diagram of a first embodiment of an access device according to the present invention. As shown in FIG. 3, the device may be an access device in a mobile network, including:

a receiving unit 11 , configured to receive a data stream from the user equipment;

The determining unit 12 is configured to determine whether the data flow from the user equipment is garbage traffic; and the air interface resource management unit 13 is configured to perform a flow control operation on the user equipment if the data flow is garbage traffic.

In the first embodiment of the access device of the present invention, after receiving the data stream sent by the user equipment, the data stream is encrypted data, and then the data stream needs to be decrypted, so that the encrypted data stream becomes plaintext data. Accordingly, the step of judging the data popularity from the user equipment also becomes to judge the plaintext data after the data stream is decrypted. In addition, according to the specific network structure, the device provided in the first embodiment of the access device of the present invention may be set on different network elements. The access device in the embodiment of the present invention may be a base station or a base station controller on the access network side, or an LTE network. The eNodeB is either a base station (BS) of the GSM network or a Base Station Controller (BSC). The user equipment in the embodiment of the present invention may be a mobile phone, a notebook computer, or the like.

The various units of the embodiments of the present invention may be integrated or may be deployed separately. The above units may be combined into one unit, or may be further split into a plurality of subunits.

In the embodiment of the present invention, traffic detection and control of the user equipment can be implemented on the access device, so that the garbage traffic entering the network can be reduced, and at the same time, because the traffic control operation ends in the access device, a large amount of traffic detection and control can be reduced to the core. The load brought by the net.

In the embodiment of the present invention, the receiving unit specifically includes: a receiving module, configured to receive a data stream from the user equipment; a decoding module, configured to decrypt the data stream to generate plaintext data; and an accumulation module, configured to The plaintext data is statistically processed by the transmission amount integral corresponding to the user equipment, and a transmission amount accumulated value is generated.

In the embodiment of the present invention, the determining unit specifically includes: a first determining module, configured to determine whether the plaintext data is garbage flow; and an intercepting module, configured to: when the first determining module determines that the plaintext data is garbage traffic And performing interception processing on the plaintext data, performing statistical processing on the garbage amount corresponding to the user equipment, and generating an accumulated amount of garbage amount; and second determining module, configured to determine the cumulative value based on the garbage amount and the accumulated value of the sending amount Whether the statistical result exceeds the preset threshold value. In this embodiment, the air interface resource management unit is specifically configured to: an air interface resource management module, configured to perform a flow control operation on the user equipment when the second determining module determines that the threshold threshold is exceeded .

FIG. 4 is a schematic structural diagram of a second embodiment of an access device according to the present invention. As shown in FIG. 4, the device may be an access device in a mobile network, including:

The receiving module 21 is configured to receive a data stream from a user equipment (UE).

The decoding module 22 is configured to decrypt the data stream received by the receiving module 21 to generate plaintext data corresponding to the data stream.

The accumulating module 26 is configured to send a quantity product corresponding to the user equipment according to the plaintext data. The statistical processing is performed to generate a transmission amount accumulated value, wherein the transmission amount integration is only used to indicate the total amount of data streams transmitted by the user equipment, and therefore different accumulation methods may be used according to different total amount statistics methods.

The first judging module 23 is configured to determine whether the plaintext data is garbage flow, wherein the determining method may be: performing DPI on the plaintext data, such as using a "characteristic word" based identification technology, or using an application layer The gateway identification technology or the behavior pattern recognition technology is used to determine whether there is garbage flow on the application layer of the plaintext data, and the method for implementing the judgment may also be an ACL-based port filtering method, which is compared in the firewall technology. Mature, so I won't go into details here.

The intercepting module 24 is configured to: when the first determining module determines that the plaintext data is garbage traffic, intercept the plaintext data, that is, send the plaintext data back to the user equipment, or send the plaintext data from the corresponding The device is deleted, and the garbage amount corresponding to the user equipment is statistically processed to generate a garbage accumulation value, wherein the garbage amount is only used to represent the total amount of garbage traffic sent by the user equipment, and therefore, according to different total statistics. The method can use different accumulation methods, but the statistical method of the garbage amount integration must be consistent with the transmission amount integration statistics method.

The second judging module 25 is configured to determine that the statistical result based on the accumulative value of the garbage quantity and the accumulated value of the sending quantity exceeds a preset threshold value. In the actual application process, the accuracy of the first judging module in the access device is considered. The threshold value may be set according to a specific requirement of the data stream sent by the user equipment, and the statistical result includes the garbage flow accumulation value, the ratio of the garbage accumulation value to the transmission amount accumulated value, or the ratio Simple transformations, etc.

The air interface resource management module 27 is configured to perform a flow control operation on the user equipment, such as performing an air interface data traffic limiting operation on the user equipment, or in the performing, when the second determining module determines that the threshold threshold is exceeded. The user equipment performs an air interface bandwidth limiting operation, or disconnects the user equipment, or prohibits the network operation of the user equipment.

The receiving module 21, the decoding module 22, the accumulating module 26, the first judging module 23, and the blocking The intercepting module 24, the second judging module 25 and the air interface resource management module 27 constitute an access device. In the embodiment of the flow control device of the present invention, the access device may further include a sending module 28, configured to: when the first determining module determines that the plaintext data is not garbage traffic, send the plaintext data. Specifically, the sending module 28 encapsulates the plaintext data into a GTP-U data packet, and sends the data to the serving gateway 20 (Serving Gateway). Further, in the embodiment of the flow control device of the present invention, the security management control background 29 may be further disposed outside the access device. When the first determining module determines that the plaintext data is garbage traffic, according to the plaintext data, Generate logs, or generate alerts, or generate garbage traffic characteristics. Further, in the embodiment of the flow control device of the present invention, the notification module may be further configured to notify the user equipment to perform antivirus according to the log, or the alarm, or the garbage flow characteristic information.

The access device in the embodiment of the present invention may be a base station or a base station controller, and may be an eNodeB in the LTE network, and may be a base station (BS) or a base station controller (BSC) in the GSM network. The user equipment in the embodiment of the present invention may be a mobile phone, a notebook computer, or the like.

In the embodiment of the present invention, the traffic detection and control of the user equipment is implemented on the access device on the access network side, and the uplink traffic of the UE can be restricted, the garbage traffic entering the network is reduced, and the traffic control operation is terminated. Into the device, it can also reduce the load on the core network caused by a large amount of traffic detection and control.

FIG. 5 is a schematic structural diagram of an embodiment of a network system according to the present invention. As shown in FIG. 5, applied to a mobile network, the system may include:

a user equipment 31, configured to send a data stream of the user equipment;

The access device 32 is configured to receive a data flow from the user equipment, and perform a flow control operation on the user equipment when the data flow is a garbage flow.

The user equipment 31 of the embodiment of the present invention may be a mobile phone, a notebook computer or the like. The access device 32 of the embodiment of the present invention may be a base station or a base station controller, etc., and may be an eNodeB in an LTE network, or a base station (Base Station, BS) or a base station controller (BSC) in a GSM network. .

In the LTE network, the access device 32 may be an eNodeB, and the eNodeB includes a flow control module, configured to intercept the data flow when the data flow is garbage traffic, and accumulate the garbage flow of the data flow sent by the user equipment. When the ratio of the value to the accumulated value of the transmission amount is greater than the threshold threshold, the flow control operation is performed on the user equipment.

In the embodiment of the flow control system of the present invention, after the data stream sent by the user equipment is detected, the flow control module located on the eNodeB performs flow control on the uplink traffic of the user equipment, and the prior art cannot effectively control the user. The defect of the upstream traffic of the device, and because the flow control operation ends in the eNodeB, can reduce the load on the core network caused by a large amount of traffic detection and control.

In the embodiment of the flow control system of the present invention, the flow control module may be integrated into the eNodeB part of the flow control device embodiment of the present invention. The flow control module may be an integrated circuit module, a program code, or an integrated circuit. An organic combination with the program code. The various units of the system of the present invention may be integrated into one device or distributed across multiple devices. The above units may be combined into one unit, or may be further split into a plurality of subunits.

In the embodiment of the flow control system of the present invention, the flow control system may further include: a security management control module 33, configured to generate a log or generate an alarm according to the flow control operation after performing a flow control operation on the user equipment, or Generate garbage flow characteristics information. In this case, after the traffic control module performs uplink traffic control on the user equipment, the user equipment is notified by the security management control module to perform an anti-virus operation or a detection operation, thereby fundamentally solving the garbage traffic entering the network.

In the embodiment of the present invention, the traffic detection and control of the user equipment can be implemented on the access device on the access network side, so that the garbage traffic entering the network can be reduced, and at the same time, the traffic control operation is terminated on the access device, and the traffic can be reduced. Detect and control the load on the core network. A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The method includes the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Those skilled in the art will appreciate that information, messages, and signals can be represented using any of a number of different processes and techniques. For example, the messages and information mentioned in the above description can be expressed as voltage, current, electromagnetic wave, magnetic field or magnetic particle, light field or any combination of the above.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

A flow control method, comprising: applying to a mobile communication network, comprising: receiving a data stream from a user equipment;

Determining whether the data flow from the user equipment is garbage traffic;

If the data stream is garbage traffic, perform flow control operations on the user equipment.

The flow control method according to claim 1, wherein if the data flow is garbage flow, performing flow control operations on the user equipment includes:

If the data flow is garbage flow, the garbage flow is counted, and a statistical result is obtained. When the statistical result exceeds a preset threshold, the user equipment is subjected to a flow control operation.

The flow control method according to claim 2, wherein the statistical result comprises a garbage flow accumulated value, or a garbage accumulated value, or a ratio of the transmitted amount accumulated value, or a transformation of the ratio.

The flow control method according to claim 2, wherein if the data flow is garbage flow, the garbage flow is counted, and a statistical result is obtained, when the statistical result exceeds a preset threshold value. And performing flow control operations on the user equipment, including:

And performing statistical processing on the transmission amount integral corresponding to the user equipment according to the data stream, and generating a transmission amount accumulated value;

If the data stream is a garbage flow, the data flow is intercepted, and the garbage amount corresponding to the user equipment is statistically processed to generate an accumulated amount of garbage;

And determining whether the ratio of the accumulated amount of the garbage amount to the accumulated value of the sending amount exceeds a threshold threshold, and if the threshold value is exceeded, performing flow control operations on the user equipment.

The flow control method according to claim 4, wherein the performing flow control operations on the user equipment comprises:

Performing an air interface data traffic limiting operation on the user equipment, or performing an air interface bandwidth limiting operation on the user equipment, or performing a disconnection operation on the user equipment, or performing a network operation prohibiting the user equipment.

The flow control method according to claim 4 or 5, further comprising: after performing the flow control operation on the user equipment,

Generate a log, or generate an alarm, or generate garbage flow characteristic information according to the plaintext data.

7. The flow control method according to claim 6, further comprising:

The user equipment is notified to perform corresponding processing according to the log, alarm, or garbage flow characteristic information.

8. An access device, comprising:

a receiving unit, configured to receive a data stream from the user equipment;

The determining unit is configured to determine whether the data flow from the user equipment is garbage traffic; and the air interface resource management unit is configured to perform a flow control operation on the user equipment when the data flow is garbage traffic.

The access device according to claim 8, wherein the receiving unit specifically includes:

a receiving module, configured to receive a data stream from the user equipment;

a decoding module, configured to decrypt the data stream to generate plaintext data;

And an accumulating module, configured to perform statistical processing on the transmission amount integral corresponding to the user equipment according to the plaintext data, to generate a transmission amount accumulated value.

The access device according to claim 8, wherein the determining unit specifically includes:

a first determining module, configured to determine whether the plaintext data is garbage traffic;

The intercepting module is configured to: when the first determining module determines that the plaintext data is garbage traffic, intercept the plaintext data, perform statistical processing on the garbage amount corresponding to the user equipment, and generate an accumulated amount of garbage;

The second judging module is configured to determine whether the statistical result based on the accumulative value of the garbage amount and the accumulated value of the sending amount exceeds a preset threshold value.

1 1. The access device according to claim 10, wherein the air interface resource The management unit is specifically:

The air interface resource management module is configured to perform a flow control operation on the user equipment when the second determining module determines that the threshold threshold is exceeded.

12. The access device of claim 10, further comprising:

And a sending module, configured to: when the first determining module determines that the plaintext data is not garbage traffic, send the plaintext data.

13. The access device of claim 10, further comprising:

The security management control background is configured to generate a log according to the plaintext data, generate an alarm, or generate garbage flow characteristic information when the first determining module determines that the plaintext data is garbage flow.

14. The access device of claim 13, further comprising:

The notification module is configured to notify the user equipment to perform corresponding processing according to the log, the alarm, or the garbage flow characteristic information.

15. A network system, comprising:

And an access device, configured to receive a data flow from the user equipment, and perform flow control operations on the user equipment when the data flow is garbage traffic.

The network system according to claim 15, further comprising:

The security management control module is configured to generate a log, generate an alarm, or generate garbage traffic characteristic information according to the flow control operation after the flow control module performs a flow control operation on the user equipment.