WO2022121696A1 - 终端外发业务数据的路由选择方法、系统和终端 - Google Patents

终端外发业务数据的路由选择方法、系统和终端 Download PDF

Info

Publication number
WO2022121696A1
WO2022121696A1 PCT/CN2021/133151 CN2021133151W WO2022121696A1 WO 2022121696 A1 WO2022121696 A1 WO 2022121696A1 CN 2021133151 W CN2021133151 W CN 2021133151W WO 2022121696 A1 WO2022121696 A1 WO 2022121696A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
ursp rule
terminal
information
token
Prior art date
Application number
PCT/CN2021/133151
Other languages
English (en)
French (fr)
Inventor
赵嵩
田树一
陈鹏
Original Assignee
中国电信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国电信股份有限公司 filed Critical 中国电信股份有限公司
Publication of WO2022121696A1 publication Critical patent/WO2022121696A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/02—Communication route or path selection, e.g. power-based or shortest path routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/24—Connectivity information management, e.g. connectivity discovery or connectivity update
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/24—Connectivity information management, e.g. connectivity discovery or connectivity update
    • H04W40/248—Connectivity information update

Definitions

  • the present disclosure relates to the field of communications, and in particular, to a routing method, system and terminal for outgoing service data from a terminal.
  • URSP UE Route Selection Policy
  • OTT specific application providers
  • the premise for the URSP function to work properly is that in the process of establishing a PDU (Protocol Data Unit, Protocol Data Unit) session, the session establishment/modification request of the application that needs to be optimized can be accurately and effectively distinguished from the requests of other applications. open, and then adopt corresponding strategies. That is, being able to accurately and effectively identify the session establishment/modification request of the application that needs to be optimized is a necessary condition for operators to provide services such as dedicated slice services for users/customers based on URSP.
  • PDU Protocol Data Unit, Protocol Data Unit
  • the application service provider will frequently change the destination server information (including IP and non-IP) used when actually deploying the application, and may also change the target domain, DNN (Data Network Name, data network name) and other information, so , for operational efficiency, using application authentication is the most reasonable approach.
  • DNN Data Network Name, data network name
  • the OSid+OS app id method is used to describe the identity of the application.
  • a routing method for outgoing service data from a terminal including: acquiring a user routing policy URSP rule, wherein the URSP rule includes a public key provided by an application service provider; When requesting the information of the PDU session of the protocol data unit, the application information is matched with the URSP rule, wherein the application information includes the token generated by using the private key; if the application information matches the URSP rule, it is determined that the application matching the URSP rule is detected. ; and providing routing policies to applications that match URSP rules.
  • matching the application information with the URSP rule includes: decrypting the token carried in the application information by using the public key in the URSP rule.
  • the decrypted token content matches at least one of the parameters required for generating the token carried in the application information; and if it matches, determine the application The token carried in the message matches the public key in the URSP rule.
  • the token is generated based on at least one of an application identifier, IP triplet information, a non-IP descriptor, a data network name, a connection capability, and a domain name descriptor.
  • a terminal comprising: a rule acquisition unit configured to acquire a user routing policy URSP rule, wherein the URSP rule includes a public key information receiving unit provided by an application service provider, and is It is configured to receive information of a request protocol data unit PDU session containing application information, wherein the application information includes a token generated by using a private key; the rule matching unit is configured to match the application information with the URSP rule. If the URSP rule matches, it is determined that an application matching the URSP rule is detected; and a routing unit is configured to provide the application with a routing policy matching the URSP rule.
  • a rule acquisition unit configured to acquire a user routing policy URSP rule, wherein the URSP rule includes a public key information receiving unit provided by an application service provider, and is It is configured to receive information of a request protocol data unit PDU session containing application information, wherein the application information includes a token generated by using a private key
  • the rule matching unit is configured to match the application information with the URSP rule. If the
  • the rule matching unit is configured to decrypt the token carried in the application information using the public key in the URSP rule.
  • a terminal comprising: a memory; and a processor coupled to the memory, the processor is configured to perform the above-mentioned routing of the terminal outgoing service data based on instructions stored in the memory method.
  • a routing system for outgoing service data from a terminal comprising: the above-mentioned terminal; and an application configured to send information of a request protocol data unit PDU session including application information to the terminal, Wherein, the application information includes the token generated by using the private key.
  • the token is generated based on at least one of an application identifier, IP triplet information, a non-IP descriptor, a data network name, a connection capability, and a domain name descriptor.
  • a non-transitory computer-readable storage medium on which computer program instructions are stored.
  • the instructions are executed by a processor, the above-mentioned routing method for outgoing service data from a terminal is implemented.
  • FIG. 1 is a schematic flowchart of some embodiments of routing methods for outgoing service data from a terminal according to the present disclosure.
  • FIG. 2 is a schematic flowchart of other embodiments of the routing method for outgoing service data from a terminal according to the present disclosure.
  • FIG. 3 is a schematic structural diagram of some embodiments of the disclosed terminal.
  • FIG. 4 is a schematic structural diagram of other embodiments of the disclosed terminal.
  • FIG. 5 is a schematic structural diagram of some embodiments of a routing system for outgoing service data from a terminal according to the present disclosure.
  • FIG. 1 is a schematic flowchart of some embodiments of routing methods for outgoing service data from a terminal according to the present disclosure. This embodiment is performed by the terminal.
  • a URSP rule is obtained, wherein the URSP rule includes the public key provided by the application service provider.
  • an application service provider willing to use the operator's special services such as independent slicing provides the operator with a public key for establishing URSP rules, and the public key will be used as a public key verification condition.
  • the public key is located in the traffic descriptor of the URSP rule.
  • step 120 when receiving the information of the request PDU session including the application information, the application information is matched with the URSP rule, wherein the application information includes the token generated by using the private key.
  • the Token is generated according to at least one of an application identifier, IP triplet information, non-IP descriptor, data network name, connection capability, and domain name descriptor.
  • the bottom layer of the terminal receives the information of the request PDU session from the upper layer, the information includes application information, and the application information carries the Token.
  • the bottom layer of the terminal matches the application information with the description information in the URSP rule, so that the correct PDU session request can be generated.
  • step 130 if the application information matches the URSP rule, it is determined that an application matching the URSP rule is detected.
  • the public key verification condition and its matching process are used as one of the matching verification conditions, and other verification conditions are processed according to the existing URSP matching process.
  • the terminal when the terminal evaluates whether the application information matches the URSP rule, if the URSP rule contains a service descriptor matching the application information, the terminal matches the application information with the URSP rule according to the priority order of the service descriptors. If the application information matches the URSP rule, it is considered that an application matching the URSP rule is detected, and the routing policy corresponding to the URSP rule can be executed.
  • the application is provided with a routing policy that matches the URSP rules. This enables the operator to provide services to the application.
  • routing the application's data to an already established PDU session or migrating the application's data load to a non-3GPP access outside the PDU session, or triggering the establishment of a new PDU session for the application.
  • the terminal regards the token in the received application information as one of the conditions for matching with the URSP. While ensuring the policy matching, it also ensures the verification of the validity of the application, and can ensure that the services provided by the URSP are only available to the URSP. Specific applications are open, and this application uses tokens as one of the conditions for validating legitimate applications, which can support applications to use different destination IP addresses/destination non-IP information to establish and modify PDU sessions at different times, without affecting the operator's The application uses the same path optimization strategy.
  • FIG. 2 is a schematic flowchart of other embodiments of the routing method for outgoing service data from a terminal according to the present disclosure.
  • step 210 the operator and the application service provider agree on the correspondence between the public key and the private key.
  • step 220 when the application establishes the connection, the application identifier, IP triplet information, non-IP descriptor, data network name, connection capability and domain name descriptor are encrypted by using the private key to generate a Token.
  • the encrypted information should be consistent with a certain agreed-upon plaintext information data in the request.
  • the application encrypts one or more IP triples defined in 3GPP TS 23.503 [2], that is, the target IP address, the target port number, and the protocol used by the IP to generate a Token.
  • the application encrypts one or more non-IP descriptors, ie, destination information of non-IP traffic, to generate a Token.
  • the application encrypts one or more application identifiers to generate a Token.
  • the application encrypts one or more data network names to generate a Token.
  • the application encrypts one or more connection capabilities to generate a Token.
  • the application encrypts one or more domain name descriptors to generate a Token.
  • step 230 the bottom layer of the terminal obtains the URSP rule, wherein the URSP rule includes the public key provided by the application service provider.
  • step 240 the upper layer of the terminal sends the generated Token to the lower layer of the terminal as a part of the application information for making the PDU session request.
  • step 250 the bottom layer of the terminal performs the existing URSP matching process, and decrypts the Token by using the public key.
  • the bottom layer of the terminal determines that the upper layer information does not contain Token, it means that the request does not meet the public key verification condition.
  • the bottom layer of the terminal can use the public key to decrypt the content in the Token, it means that the Token matches the public key in the URSP rule.
  • step 260 the bottom layer of the terminal determines whether the decrypted Token content matches at least one of the parameters required for generating the token carried in the application information.
  • the bottom layer of the terminal can use the public key to decrypt the content in the Token, but the content of the Token is empty, it means that the request does not meet the public key verification condition.
  • the decrypted content is consistent with the plaintext data information in the corresponding request, indicating that the Token verification is passed.
  • step 270 if the decrypted Token content matches at least one of the parameters required to generate the token carried in the application information, and other parameters in the upper layer information match the URSP rule, then it is considered that the URSP rule has been detected. matching application.
  • a routing policy that matches the URSP rules is selected for the application.
  • an application can be supported to establish a modified PDU session using different destination IP addresses/destination non-IP information at different times, without affecting the operator's use of the same path optimization strategy for the application.
  • the introduction of Token can provide matching rule conditions and user legality verification at the same time, improve the accuracy and security of matching, and ensure that the services provided by URSP are only open to specific applications and will not be used by other Application fraudulent use.
  • FIG. 3 is a schematic structural diagram of some embodiments of the disclosed terminal.
  • the terminal includes a rule obtaining unit 310 , an information receiving unit 320 , a rule matching unit 330 and a routing unit 340 .
  • the rule obtaining unit 310 is configured to obtain a URSP rule, wherein the URSP rule includes the public key provided by the application service provider.
  • an application service provider willing to use the operator's special services such as independent slicing provides the operator with a public key for establishing URSP rules, and the public key will be used as a public key verification condition.
  • the information receiving unit 320 is configured to receive information of a request PDU session including application information, wherein the application information includes a token generated by using a private key.
  • the Token is generated based on at least one of an application identifier, IP triplet information, a non-IP descriptor, a data network name, a connection capability, and a domain name descriptor.
  • IP triplet information includes the target IP address, the target port number, and the protocol used by the IP.
  • the rule matching unit 330 is configured to match the application information with the URSP rule, and if the application information matches the URSP rule, determine that an application matching the URSP rule is detected.
  • the token carried in the application information is decrypted using the public key in the URSP rule.
  • the token is decrypted by using the public key, it is determined whether the content of the decrypted token matches at least one of the parameters carried in the application information and required for generating the token ; and if it matches, determining that the token carried in the application information matches the public key in the URSP rule. Taking the above public key verification condition and its matching process as one of the matching verification conditions, in the URSP matching, the matching and the user verification can be completed at one time, thereby improving the efficiency.
  • the routing unit 340 is configured to provide the application with routing policies that match the URSP rules. This enables the operator to provide services to the application.
  • the terminal takes the token in the received application information as one of the conditions for matching with the URSP. While ensuring the matching of the policy, it also ensures the verification of the validity of the application, and can ensure that the services provided by the URSP are only available to specific users. Application is open.
  • FIG. 4 is a schematic structural diagram of other embodiments of the disclosed terminal.
  • the terminal 400 includes a memory 410 and a processor 420 .
  • the memory 410 may be a magnetic disk, a flash memory or any other non-volatile storage medium.
  • the memory 410 is used to store the instructions in the embodiments corresponding to FIGS. 1-2 .
  • the processor 420 is coupled to the memory 410 and may be implemented as one or more integrated circuits, such as a microprocessor or microcontroller.
  • the processor 420 is used to execute instructions stored in the memory.
  • processor 420 is coupled to memory 410 through BUS bus 430 .
  • the terminal 400 can also be connected to an external storage system 450 through a storage interface 440 to call external data, and can also be connected to a network or another computer system (not shown) through a network interface 460 . It will not be described in detail here.
  • FIG. 5 is a schematic structural diagram of some embodiments of a routing system for outgoing service data from a terminal according to the present disclosure.
  • the system includes a terminal 510 and an application 520, where the terminal 510 has been described in detail in the above embodiments, and will not be further described here.
  • the application 520 is configured to send to the terminal 510 information of a request PDU session including application information, wherein the application information includes a token generated by using a private key.
  • the token is generated based on at least one of the application identifier, IP triplet information, non-IP descriptor, data network name, connection capability, and domain name descriptor, even if the application uses a different destination IP address/destination non-IP information to create and modify PDU sessions, nor does it affect the operator using the same path optimization strategy for that application.
  • a computer-readable storage medium has computer program instructions stored thereon that, when executed by a processor, implement the steps of the methods in the embodiments corresponding to Figures 1-2.
  • embodiments of the present disclosure may be provided as a method, apparatus, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more computer-usable non-transitory storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein .
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
  • the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本公开公开了一种终端外发业务数据的路由选择方法、系统和终端，涉及通信领域。该方法包括：获取URSP规则，其中，URSP规则中包括应用服务提供商提供的公钥；接收到包含应用信息的请求PDU会话的信息时，将应用信息与URSP规则进行匹配，其中，应用信息包括利用私钥生成的令牌；若应用信息与URSP规则匹配，则确定检测出与URSP规则匹配的应用；以及向应用提供与URSP规则匹配的路由策略。

Description

终端外发业务数据的路由选择方法、系统和终端
相关申请的交叉引用
本申请是以CN申请号为202011434535.1，申请日为2020年12月10日的申请为基础，并主张其优先权，该CN申请的公开内容在此作为整体引入本申请中。
技术领域
本公开涉及通信领域，尤其涉及一种终端外发业务数据的路由选择方法、系统和终端。
背景技术
5G网络中，运营商可以使用URSP(UE Route Selection Policy，用户路由选择策略)功能，提供to-B(面向应用提供商)和to-C(面向特定用户)的数据面优化服务。例如，通过URSP规则，为OTT(特定应用提供商)和特定用户提供专用切片保障特定应用的服务质量。
但URSP功能得以正常工作的前提是，在PDU(Protocol Data Unit，协议数据单元)会话建立的过程中，能够准确、有效地将需要优化的应用的会话建立/修改请求，和其他应用的请求区分开，进而能对其采用相应的策略。也即，能够准确、有效地识别需要优化的应用的会话建立/修改请求，是运营商基于URSP为用户/客户提供服务诸如专用切片业务的必要条件。
由于应用服务提供商在实际部署应用的时候，会频繁变更所使用的目的服务器信息(包括IP和非IP)，也可能改变目标的域、DNN(Data Network Name，数据网络名称)等信息，因此，为了运营效率，使用应用程序身份验证是最合理的方式。
现有URSP相关标准中，采用OSid+OS app id方式进行应用程序的身份描述。
发明内容
根据本公开一方面，提出一种终端外发业务数据的路由选择方法，包括：获取用户路由选择策略URSP规则，其中，URSP规则中包括应用服务提供商提供的公钥；接收到包含应用信息的请求协议数据单元PDU会话的信息时，将应用信息与URSP规则进行匹配，其中，应用信息包括利用私钥生成的令牌；若应用信息与URSP规 则匹配，则确定检测出与URSP规则匹配的应用；以及向应用提供与URSP规则匹配的路由策略。
在一些实施例中，将应用信息与URSP规则进行匹配包括：利用URSP规则中的公钥，对应用信息中携带的令牌进行解密。
在一些实施例中，利用公钥对令牌解密后，判断解密后的令牌内容与应用信息中携带的生成令牌时所需参数中的至少一项是否匹配；以及若匹配，则确定应用信息中携带的令牌与URSP规则中的公钥匹配。
在一些实施例中，令牌根据应用标识符、IP三元组信息、非IP描述符、数据网络名称、连接能力和域名描述符中的至少一项生成。
根据本公开的另一方面，还提出一种终端，包括：规则获取单元，被配置为获取用户路由选择策略URSP规则，其中，URSP规则中包括应用服务提供商提供的公钥信息接收单元，被配置为接收包含应用信息的请求协议数据单元PDU会话的信息，其中，应用信息中包括利用私钥生成的令牌；规则匹配单元，被配置为将应用信息与URSP规则进行匹配，若应用信息与URSP规则匹配，则确定检测出与URSP规则匹配的应用；以及路由选择单元，被配置为向应用提供与URSP规则匹配的路由策略。
在一些实施例中，规则匹配单元被配置为利用URSP规则中的公钥，对应用信息中携带的令牌进行解密。
根据本公开的另一方面，还提出一种终端，包括：存储器；以及耦接至存储器的处理器，处理器被配置为基于存储在存储器的指令执行如上述的终端外发业务数据的路由选择方法。
根据本公开的另一方面，还提出一种终端外发业务数据的路由选择系统，包括：上述的终端；以及应用，被配置为向终端发送包含应用信息的请求协议数据单元PDU会话的信息，其中，应用信息中包括利用私钥生成的令牌。
在一些实施例中，令牌根据应用标识符、IP三元组信息、非IP描述符、数据网络名称、连接能力和域名描述符中的至少一项生成。
根据本公开的另一方面，还提出一种非瞬时性计算机可读存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现上述的终端外发业务数据的路由选择方法。
通过以下参照附图对本公开的示例性实施例的详细描述，本公开的其它特征及其优点将会变得清楚。
附图说明
构成说明书的一部分的附图描述了本公开的实施例，并且连同说明书一起用于解释本公开的原理。
参照附图，根据下面的详细描述，可以更加清楚地理解本公开，其中：
图1为本公开的终端外发业务数据的路由选择方法的一些实施例的流程示意图。
图2为本公开的终端外发业务数据的路由选择方法的另一些实施例的流程示意图。
图3为本公开的终端的一些实施例的结构示意图。
图4为本公开的终端的另一些实施例的结构示意图。
图5为本公开的终端外发业务数据的路由选择系统的一些实施例的结构示意图。
具体实施方式
现在将参照附图来详细描述本公开的各种示例性实施例。应注意到：除非另外具体说明，否则在这些实施例中阐述的部件和步骤的相对布置、数字表达式和数值不限制本公开的范围。
同时，应当明白，为了便于描述，附图中所示出的各个部分的尺寸并不是按照实际的比例关系绘制的。
以下对至少一个示例性实施例的描述实际上仅仅是说明性的，决不作为对本公开及其应用或使用的任何限制。
对于相关领域普通技术人员已知的技术、方法和设备可能不作详细讨论，但在适当情况下，所述技术、方法和设备应当被视为授权说明书的一部分。
在这里示出和讨论的所有示例中，任何具体值应被解释为仅仅是示例性的，而不是作为限制。因此，示例性实施例的其它示例可以具有不同的值。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步讨论。
为使本公开的目的、技术方案和优点更加清楚明白，以下结合具体实施例，并参照附图，对本公开进一步详细说明。
由于操作系统不限制具体使用的应用的来源，并且在绝大多数的日常使用环境中，应用开发和应用市场存在无法保证审核验证的可靠性的问题。因此，这种方式在实际 应用中，并不能唯一准确地将特定的应用标记出来，存在被冒用的可能，危害网络安全。并且，这种情况，在相当长的一段时间内，由于商业原因，可能无法得到改善。也即，基于现有URSP的标准和流程，无法从网络层面实现对应用程序身份的准确、可靠地标记，运营商也无法基于此开展可靠的服务。
图1为本公开的终端外发业务数据的路由选择方法的一些实施例的流程示意图。该实施例由终端执行。
在步骤110，获取URSP规则，其中，URSP规则中包括应用服务提供商提供的公钥。
在一些实施例中，有意愿使用运营商的如独立切片等特殊服务的应用服务提供商，提供给运营商一个公钥，用于建立URSP规则，该公钥将作为公钥验证条件。
在一些实施例中，公钥位于URSP规则的流量描述符中。
在步骤120，接收到包含应用信息的请求PDU会话的信息时，将应用信息与URSP规则进行匹配，其中，应用信息包括利用私钥生成的令牌。
在一些实施例中，Token(令牌)根据应用标识符、IP三元组信息、非IP描述符、数据网络名称、连接能力和域名描述符中的至少一项生成。
在一些实施例中，终端底层接收来自上层的请求PDU会话的信息，该信息中包含应用信息，该应用信息中携带Token。终端底层将应用信息与URSP规则中的描述信息进行匹配，从而能够生成正确的PDU会话请求。
在步骤130，若应用信息与URSP规则匹配，则确定检测出与URSP规则匹配的应用。
在一些实施例中，在进行URSP匹配时，将上述公钥验证条件及其匹配过程，作为匹配验证的条件之一，其他验证条件按照现有URSP匹配流程进行处理。
在一些实施例中，终端在评估应用信息是否与URSP规则匹配时，如果URSP规则包含与应用信息匹配的业务描述符，则按照业务描述符的优先级顺序将应用信息与URSP规则进行匹配。若应用信息与URSP规则匹配，则认为检测出了与URSP规则匹配的应用，并可以执行与该URSP规则相对应的路由策略。
在步骤140，向该应用提供与URSP规则匹配的路由策略。从而使得运营商向该应用提供服务。
例如，将应用的数据路由到一个已经建立的PDU会话，或者，将应用的数据负载迁移到PDU会话之外的non-3GPP接入上，或者，触发建立针对该应用的一个新 的PDU会话。
在上述实施例中，终端将接收到的应用信息中的令牌作为与URSP进行匹配的条件之一，在保证策略匹配的同时，保证应用合法性的验证，能够保证URSP所提供的服务仅向特定应用开放，并且，本申请利用令牌作为验证合法应用的条件之一，能够支持应用在不同时刻使用不同的目的IP地址/目的非IP信息建立修改PDU会话，而不会影响运营商对该应用使用相同的路径优化策略。
图2为本公开的终端外发业务数据的路由选择方法的另一些实施例的流程示意图。
在步骤210，运营商与应用服务提供商，对公钥和私钥的对应关系协商一致。
在步骤220，应用在建立连接时，利用私钥对应用标识符、IP三元组信息、非IP描述符、数据网络名称、连接能力和域名描述符等进行加密，生成Token。
在一些实施例中，加密的信息应该与请求中的某个约定好的明文信息数据保持一致。
在一些实施例中，应用对3GPP TS 23.503[2]中定义的一个或多个IP三元组，即目标IP地址、目标端口号和IP使用的协议进行加密生成Token。
在一些实施例中，应用对一个或多个非IP描述符，即非IP流量的目的地信息进行加密生成Token。
在一些实施例中，应用对一个或多个应用标识符进行加密生成Token。
在一些实施例中，应用对一个或多个数据网络名称进行加密生成Token。
在一些实施例中，应用对一个或多个连接能力进行加密生成Token。
在一些实施例中，应用对一个或多个域名描述符进行加密生成Token。
在步骤230，终端底层获取URSP规则，其中，URSP规则中包括应用服务提供商提供的公钥。
在步骤240，终端上层将生成的Token作为用于进行PDU会话请求的应用信息的一部分发送给终端底层。
在步骤250，终端底层执行现有URSP匹配流程，并利用公钥对Token进行解密。
在一些实施例中，若终端底层判断上层信息中不包含Token，则说明该请求不满足公钥验证条件。
在一些实施例中，若终端底层能够利用公钥解密出Token中的内容，则说明Token与URSP规则中的公钥匹配。
在步骤260，终端底层判断解密后的Token内容与应用信息中携带的生成令牌时 所需参数中的至少一项是否匹配。
在一些实施例中，若终端底层能够利用公钥解密出Token中的内容，但Token内容为空，则说明该请求不满足公钥验证条件。
在该步骤中，利用公钥对Token解密后，解密出的内容与对应的请求中的明文数据信息一致，则说明Token验证通过。
在步骤270，若解密后的Token内容与应用信息中携带的生成令牌时所需参数中的至少一项匹配，且上层信息中的其他参数与URSP规则匹配，则认为检测出了与URSP规则匹配的应用。
在步骤280，为该应用选择与URSP规则匹配的路由策略。
该实施例中，能够支持应用在不同时刻使用不同的目的IP地址/目的非IP信息建立修改PDU会话，而不会影响运营商对该应用使用相同的路径优化策略。另外，在URSP规则匹配过程，引入Token，能够同时提供匹配规则条件和用户合法性验证，提高了匹配的准确性和安全性，能够确保URSP所提供的服务只对特定应用开放，不会被其他应用冒用。
图3为本公开的终端的一些实施例的结构示意图。该终端包括规则获取单元310、信息接收单元320、规则匹配单元330和路由选择单元340。
规则获取单元310被配置为获取URSP规则，其中，所述URSP规则中包括应用服务提供商提供的公钥。
在一些实施例中，有意愿使用运营商的如独立切片等特殊服务的应用服务提供商提供给运营商一个公钥，用于建立URSP规则，该公钥将作为公钥验证条件。
信息接收单元320被配置为接收包含应用信息的请求PDU会话的信息，其中，所述应用信息中包括利用私钥生成的令牌。
在一些实施例中，Token根据应用标识符、IP三元组信息、非IP描述符、数据网络名称、连接能力和域名描述符中的至少一项生成。IP三元组信息包括目标IP地址、目标端口号和IP使用的协议。
规则匹配单元330被配置为将所述应用信息与所述URSP规则进行匹配，若所述应用信息与所述URSP规则匹配，则确定检测出与所述URSP规则匹配的应用。
在一些实施例中，利用所述URSP规则中的公钥，对所述应用信息中携带的令牌进行解密。
在一些实施例中，利用所述公钥对所述令牌解密后，判断解密后的令牌内容与所 述应用信息中携带的生成所述令牌时所需参数中的至少一项是否匹配；以及若匹配，则确定所述应用信息中携带的所述令牌与所述URSP规则中的公钥匹配。将上述公钥验证条件及其匹配过程，作为匹配验证的条件之一，能够使得URSP匹配中，将匹配与用户验证一次性完成，提高效率。
路由选择单元340被配置为向应用提供与URSP规则匹配的路由策略。从而使得运营商向该应用提供服务。
该实施例中，终端将接收到的应用信息中的令牌作为与URSP进行匹配的条件之一，在保证策略匹配的同时，保证应用合法性的验证，能够保证URSP所提供的服务仅向特定应用开放。
图4为本公开的终端的另一些实施例的结构示意图。该终端400包括存储器410和处理器420。其中：存储器410可以是磁盘、闪存或其它任何非易失性存储介质。存储器410用于存储图1-2所对应实施例中的指令。处理器420耦接至存储器410，可以作为一个或多个集成电路来实施，例如微处理器或微控制器。该处理器420用于执行存储器中存储的指令。
在一些实施例中，处理器420通过BUS总线430耦合至存储器410。该终端400还可以通过存储接口440连接至外部存储系统450以便调用外部数据，还可以通过网络接口460连接至网络或者另外一台计算机系统(未标出)。此处不再进行详细介绍。
在该实施例中，通过存储器存储数据指令，再通过处理器处理上述指令，能够保证URSP所提供的服务仅向特定应用开放，并且，即便应用使用不同的目的IP地址/目的非IP信息建立修改PDU会话，也不会影响运营商对该应用使用相同的路径优化策略。
图5为本公开的终端外发业务数据的路由选择系统的一些实施例的结构示意图。该系统包括终端510和应用520，其中，终端510已在上述实施例中进行了详细介绍，此处不再进一步阐述。
应用520被配置为向所述终端510发送包含应用信息的请求PDU会话的信息，其中，所述应用信息中包括利用私钥生成的令牌。令牌根据应用标识符、IP三元组信息、非IP描述符、数据网络名称、连接能力和域名描述符中的至少一项生成，即便应用使用不同的目的IP地址/目的非IP信息建立修改PDU会话，也不会影响运营商对该应用使用相同的路径优化策略。
在另一些实施例中，一种计算机可读存储介质，其上存储有计算机程序指令，该 指令被处理器执行时实现图1-2所对应实施例中的方法的步骤。本领域内的技术人员应明白，本公开的实施例可提供为方法、装置、或计算机程序产品。因此，本公开可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开可采用在一个或多个其中包含有计算机可用程序代码的计算机可用非瞬时性存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本公开是参照根据本公开实施例的方法、设备(系统)和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
至此，已经详细描述了本公开。为了避免遮蔽本公开的构思，没有描述本领域所公知的一些细节。本领域技术人员根据上面的描述，完全可以明白如何实施这里公开的技术方案。
虽然已经通过示例对本公开的一些特定实施例进行了详细说明，但是本领域的技术人员应该理解，以上示例仅是为了进行说明，而不是为了限制本公开的范围。本领域的技术人员应该理解，可在不脱离本公开的范围和精神的情况下，对以上实施例进行修改。本公开的范围由所附权利要求来限定。

Claims (10)

  1. 一种终端外发业务数据的路由选择方法，包括：
    获取用户路由选择策略URSP规则，其中，所述URSP规则中包括应用服务提供商提供的公钥；
    接收到包含应用信息的请求协议数据单元PDU会话的信息时，将所述应用信息与所述URSP规则进行匹配，其中，所述应用信息包括利用私钥生成的令牌；
    若所述应用信息与所述URSP规则匹配，则确定检测出与所述URSP规则匹配的应用；以及
    向所述应用提供与所述URSP规则匹配的路由策略。
  2. 根据权利要求1所述的路由选择方法，其中，将所述应用信息与所述URSP规则进行匹配包括：
    利用所述URSP规则中的公钥，对所述应用信息中携带的令牌进行解密。
  3. 根据权利要求2所述的路由选择方法，其中，
    利用所述公钥对所述令牌解密后，判断解密后的令牌内容与所述应用信息中携带的生成所述令牌时所需参数中的至少一项是否匹配；以及
    若匹配，则确定所述应用信息中携带的所述令牌与所述URSP规则中的公钥匹配。
  4. 根据权利要求1至3任一所述的路由选择方法，其中，
    所述令牌根据应用标识符、IP三元组信息、非IP描述符、数据网络名称、连接能力和域名描述符中的至少一项生成。
  5. 一种终端，包括：
    规则获取单元，被配置为获取用户路由选择策略URSP规则，其中，所述URSP规则中包括应用服务提供商提供的公钥；
    信息接收单元，被配置为接收包含应用信息的请求协议数据单元PDU会话的信息，其中，所述应用信息中包括利用私钥生成的令牌；
    规则匹配单元，被配置为将所述应用信息与所述URSP规则进行匹配，若所述应 用信息与所述URSP规则匹配，则确定检测出与所述URSP规则匹配的应用；以及
    路由选择单元，被配置为向所述应用提供与所述URSP规则匹配的路由策略。
  6. 根据权利要求5所述的终端，其中，
    所述规则匹配单元被配置为利用所述URSP规则中的公钥，对所述应用信息中携带的令牌进行解密。
  7. 一种终端，包括：
    存储器；以及
    耦接至所述存储器的处理器，所述处理器被配置为基于存储在所述存储器的指令执行如权利要求1至4任一项所述的终端外发业务数据的路由选择方法。
  8. 一种终端外发业务数据的路由选择系统，包括：
    权利要求5至7任一所述的终端；以及
    应用，被配置为向所述终端发送包含应用信息的请求协议数据单元PDU会话的信息，其中，所述应用信息中包括利用私钥生成的令牌。
  9. 根据权利要求8所述的路由选择系统，其中，
    所述令牌根据应用标识符、IP三元组信息、非IP描述符、数据网络名称、连接能力和域名描述符中的至少一项生成。
  10. 一种非瞬时性计算机可读存储介质，其上存储有计算机程序指令，该指令被处理器执行时实现权利要求1至4任一项所述的终端外发业务数据的路由选择方法。
PCT/CN2021/133151 2020-12-10 2021-11-25 终端外发业务数据的路由选择方法、系统和终端 WO2022121696A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011434535.1 2020-12-10
CN202011434535.1A CN114630316A (zh) 2020-12-10 2020-12-10 终端外发业务数据的路由选择方法、系统和终端

Publications (1)

Publication Number Publication Date
WO2022121696A1 true WO2022121696A1 (zh) 2022-06-16

Family

ID=81895508

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/133151 WO2022121696A1 (zh) 2020-12-10 2021-11-25 终端外发业务数据的路由选择方法、系统和终端

Country Status (2)

Country Link
CN (1) CN114630316A (zh)
WO (1) WO2022121696A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4322480A1 (en) * 2022-08-09 2024-02-14 Nokia Technologies Oy Secure identification of applications in communication network

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110149670A (zh) * 2018-02-13 2019-08-20 华为技术有限公司 一种数据路由选择的方法及装置
US10602422B1 (en) * 2018-12-10 2020-03-24 Verizon Patent And Licensing Inc. Application-based user equipment route selection policy mapping
CN111314475A (zh) * 2020-02-21 2020-06-19 北京紫光展锐通信技术有限公司 会话创建方法及相关设备
CN111580996A (zh) * 2020-05-13 2020-08-25 展讯通信(天津)有限公司 Ursp规则的多运营商选择方法及相关设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110149670A (zh) * 2018-02-13 2019-08-20 华为技术有限公司 一种数据路由选择的方法及装置
US10602422B1 (en) * 2018-12-10 2020-03-24 Verizon Patent And Licensing Inc. Application-based user equipment route selection policy mapping
CN111314475A (zh) * 2020-02-21 2020-06-19 北京紫光展锐通信技术有限公司 会话创建方法及相关设备
CN111580996A (zh) * 2020-05-13 2020-08-25 展讯通信(天津)有限公司 Ursp规则的多运营商选择方法及相关设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI, HISILICON: "Discussion on Application Descriptor", 3GPP DRAFT; S2-2002124, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. e-meeting; 20200224 - 20200227, 18 February 2020 (2020-02-18), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051855511 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4322480A1 (en) * 2022-08-09 2024-02-14 Nokia Technologies Oy Secure identification of applications in communication network

Also Published As

Publication number Publication date
CN114630316A (zh) 2022-06-14

Similar Documents

Publication Publication Date Title
US11811740B2 (en) Content security at service layer
US10083290B2 (en) Hardware-based device authentication
KR102018971B1 (ko) 네트워크 액세스 디바이스가 무선 네트워크 액세스 포인트를 액세스하게 하기 위한 방법, 네트워크 액세스 디바이스, 애플리케이션 서버 및 비휘발성 컴퓨터 판독가능 저장 매체
JP5889988B2 (ja) Ｈｔｔｐベースの認証
JP6651530B2 (ja) ユーザｉｄを識別するための方法及び装置
US9237168B2 (en) Transport layer security traffic control using service name identification
US9197420B2 (en) Using information in a digital certificate to authenticate a network of a wireless access point
US20170289185A1 (en) Device assisted traffic anomaly detection
US11303431B2 (en) Method and system for performing SSL handshake
WO2019062666A1 (zh) 一种实现安全访问内部网络的系统、方法和装置
WO2019199836A1 (en) Secure communication using device-identity information linked to cloud-based certificates
US9258278B2 (en) Unidirectional deep packet inspection
US10277576B1 (en) Diameter end-to-end security with a multiway handshake
WO2018120913A1 (zh) 一种获取证书、鉴权的方法及网络设备
CN112688773A (zh) 一种令牌的生成和校验方法及装置
WO2020146081A1 (en) Private exchange of encrypted data over a computer network
US10893414B1 (en) Selective attestation of wireless communications
WO2018099407A1 (zh) 账户认证登录方法及装置
WO2022121696A1 (zh) 终端外发业务数据的路由选择方法、系统和终端
CN112039857A (zh) 一种公用基础模块的调用方法和装置
CN114978741B (zh) 一种系统间认证方法及系统
CN115002768B (zh) 一种请求消息处理方法、装置及系统
WO2022183694A1 (zh) 主叫信息认证方法、装置和系统
CN110881040B (zh) 一种呼叫方法及装置
JP7139635B2 (ja) 認証システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21902403

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 22.09.2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21902403

Country of ref document: EP

Kind code of ref document: A1