WO2022206251A1 - 拒绝服务攻击的解决方法、装置、设备、介质和计算机程序产品 - Google Patents

拒绝服务攻击的解决方法、装置、设备、介质和计算机程序产品 Download PDF

Info

Publication number
WO2022206251A1
WO2022206251A1 PCT/CN2022/078319 CN2022078319W WO2022206251A1 WO 2022206251 A1 WO2022206251 A1 WO 2022206251A1 CN 2022078319 W CN2022078319 W CN 2022078319W WO 2022206251 A1 WO2022206251 A1 WO 2022206251A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
qer
upf
pdr
target data
Prior art date
Application number
PCT/CN2022/078319
Other languages
English (en)
French (fr)
Inventor
熊春山
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2022206251A1 publication Critical patent/WO2022206251A1/zh
Priority to US17/989,494 priority Critical patent/US20230088071A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • the embodiments of the present application relate to the field of mobile communications, and in particular, to a solution method, apparatus, device, medium and computer program product for a denial of service attack.
  • the Domain Name System (DNS) query sent by the User Equipment (UE) may be processed by the Edge Application Server Discovery Function (EASDF).
  • EASDF Edge Application Server Discovery Function
  • Session Management Function provides reporting (Reporting) rules and forwarding (Forwarding) rules to EASDF.
  • Reporting rules provide rules for EASDF to send reports to SMF, and forwarding rules provide rules for EASDF to forward messages.
  • the EASDF After the UE sends a DNS query to the EASDF, the EASDF will send a report to the SMF according to the reporting rules.
  • the EASDF In the case of a high uplink peak rate, if the UE frequently sends DNS queries to the EASDF in a malicious manner in a short period of time, the EASDF frequently sends reports to the SMF and triggers multiple subsequent signaling messages of the control plane, which will form a mobile communication system.
  • the signaling storm caused denial of service (DOS) attacks, and the mobile communication system was unable to serve all normal UEs.
  • DOS denial of service
  • a solution method, apparatus, device, medium and computer program product for a denial of service attack are provided, and the technical solutions are as follows:
  • a solution to a denial of service attack comprising:
  • the SMF sends a Packet Detection Rule (PDR) and a Quality of Service Enforcement Rule (Qos Enforcement Rule, QER) to the User Plane Function (UPF), where the PDR rules are used to identify the target data packets sent by the terminal , the QER rule is used to restrict the sending of the target data packet;
  • PDR Packet Detection Rule
  • QER Quality of Service Enforcement Rule
  • UPF User Plane Function
  • the target data packet is a data packet that triggers the target core network element to send a message to the SMF.
  • a solution to a denial of service attack comprising:
  • UPF receives PDR and QER sent by SMF
  • the UPF identifies the target data packet sent by the terminal according to the PDR;
  • the UPF restricts the sending of the target data packet according to the QER
  • the target data packet is a data packet that triggers the target core network element to initiate the denial of service attack on the SMF.
  • an apparatus for solving a denial of service attack comprising:
  • a sending module configured to send a PDR and a QER to the UPF, where the PDR is used to identify the target data packet sent by the terminal, and the QER is used to limit the sending of the target data packet;
  • the target data packet is a data packet that triggers the target core network element to initiate the denial of service attack on the SMF.
  • an apparatus for solving a denial of service attack comprising:
  • the receiving module is used to receive the PDR and QER sent by the SMF;
  • a processing module for identifying the target data packet sent by the terminal according to the PDR; and restricting the sending of the target data packet according to the QER;
  • the target data packet is a data packet that triggers the target core network element to initiate the denial of service attack on the SMF.
  • a network element device includes: a processor and a memory, the memory stores a computer program, and the computer program is loaded and executed by the processor to achieve the above The solution to the denial of service attack described.
  • a computer-readable storage medium stores a computer program, the computer program is loaded and executed by a processor to implement the above-mentioned denial-of-service attack solution method.
  • a computer program product comprising computer instructions stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the denial-of-service attack solution provided by the above aspects.
  • FIG. 1 is a block diagram of a mobile communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of N3/N9-based communication provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of N6-based communication provided by an embodiment of the present application.
  • FIG. 5 shows a flowchart of a solution to a denial of service attack provided by an embodiment of the present application
  • FIG. 6 shows a flowchart of a solution to a denial of service attack provided by another embodiment of the present application
  • FIG. 7 shows a flowchart of a solution to a denial of service attack provided by another embodiment of the present application.
  • FIG. 8 shows a flowchart of the UPF recovering the forwarding of the target data packet according to the instruction of the SMF provided by an embodiment of the present application
  • FIG. 9 shows a flowchart of the UPF self-recovery forwarding of the target data packet provided by another embodiment of the present application.
  • FIG. 10 shows a block diagram of an apparatus for solving a denial of service attack provided by an embodiment of the present application
  • FIG. 11 shows a block diagram of an apparatus for solving a denial of service attack provided by an embodiment of the present application
  • FIG. 12 shows a schematic structural diagram of a network element device provided by an embodiment of the present application.
  • the UE sends a PDU session establishment request to the SMF.
  • the SMF locates and selects an EASDF for the UE, and the SMF sends a message to the selected EASDF, which carries: the IP address of the UE, the callback uniform resource identifier (Uniform Resource Identifier, URI), and the rules for processing DNS messages.
  • the callback address refers to the target resource URI requested when the EASDF actively initiates a message to the SMF.
  • SMF provides reporting rules to EASDF, and EASDF's reports to SMF are sent under at least two of the following reporting rules:
  • the SMF can provide a reporting rule indication
  • the EASDF sends the EAS FQDN(s) to the SMF.
  • SMF then provides forwarding rules to EASDF.
  • EASDF forwards the DNS query to the local DNS or forwards the DNS query to the C-DNS after adding the ECS attribute.
  • the SMF provides reporting rules to direct the EASDF to report the EAS IP address/FQDN to the SMF if the EAS IP address in the DNS response matches the IP address range of the reporting rule, or the FQDN of the DNS response matches the FQDN of the DNS message reporting rule. Then the SMF may perform an operation of UL CL insertion, which will introduce more signaling interactions.
  • UE, RAN, AMF, I-UPF, L-PSA, etc. all participate in signaling interaction.
  • the SMF configures the reporting rules with the EASDF
  • the UE may cause the EASDF to send a report (or a report message) to the SMF.
  • This report will cause more subsequent signaling and messages.
  • the peak uplink rate of 5G can reach 300Mbps. That is, a UE can upload 300Mb data in one second.
  • 300M/8/1500 25000 DNS queries per second per UE.
  • 8 is the number of bits in a byte, and it is assumed that the length of a DNS query is 1500 bytes.
  • a DNS query can trigger the signaling interaction with SMF, and at the same time, it may trigger the signaling of SMF's Uplink Classifier (UL CL) insertion operation, thus forming a signaling storm in the mobile communication system, causing DOS attacks, mobile
  • UL CL Uplink Classifier
  • multiple UEs can simultaneously send DNS queries to EASDF through different cell cooperation. This may cause a DDOS attack and form a more serious attack, causing the mobile communication system to be almost unable to serve normal UEs.
  • the SMF can also implement the function of the DHCP service
  • the DHCP service is used to assign an IP address to the UE or assign IP-related parameters to the UE.
  • the UE can send a large number of DHCP request data packets to the SMF through the N4 interface, thereby generating a large number of N4 interface signaling between the UPF and the SMF.
  • the report to request SMF processing can occupy the time and resources of SMF processing DHCP, so as to achieve DOS attack.
  • a DDOS attack can be implemented.
  • the present application provides a solution to a denial of service attack to solve the above-mentioned technical problems.
  • FIG. 1 shows a block diagram of a mobile communication system provided by an exemplary embodiment of the present disclosure.
  • the mobile communication system can be an NR-based 5G system, and also includes a 5G system based on the Evolved UMTS Terrestrial Radio Access Network (e-UTRAN) and a subsequent evolution system of the 5G system.
  • the communication system is defined to support data connections and services to facilitate network deployment using technologies such as Network Functions Virtualization (NFV) and Software Defined Network (SDN).
  • NFV Network Functions Virtualization
  • SDN Software Defined Network
  • the communication system is mainly composed of Network Function (NF), which adopts distributed functions to deploy according to actual needs. The addition and withdrawal of new network functions does not affect the overall network function.
  • NF Network Function
  • the communication system includes: user equipment (named by 3GPP for mobile terminals) (User Equipment, UE), (wireless) access network ((R)AN), user plane function (User Plane Function, UPF), data network (Data network) Network, DN) and control plane functions.
  • user equipment named by 3GPP for mobile terminals
  • UE User Equipment
  • R wireless access network
  • UPF User Plane Function
  • UPF User Plane Function
  • DN data network
  • control plane functions control plane functions.
  • control plane functions include: access and mobility management function (Access and Mobility Management Function, AMF), session management function (Session Management Function, SMF), control policy function (Policy Control Function, PCF) and unified data management (Unified Data Management Function, SMF) Data Management, UDM).
  • AMF Access and Mobility Management Function
  • SMF Session Management Function
  • PCF Policy Control Function
  • UDM Unified Data Management Function
  • the UE communicates with the RAN over the air interface. Communication between the RAN and the UPF is through the first reference point N3. Communication between the two UPFs is through the second reference point N9. Communication between the PSA UPF and the DN is through the third reference point N6.
  • PSA UPF PDU Session Anchor User Plane Function
  • the communication between the UE and the AMF is through the fifth reference point N1.
  • Communication between the RAN and the AMF is through the sixth reference point N2.
  • Communication between UPF and SMF is through the seventh reference point N4.
  • N1 reference point between UE and AMF
  • N2 reference point between (R)AN and AMF;
  • N3 reference point between (R)AN and UPF;
  • N4 reference point between SMF and UPF
  • N6 reference point between PSA UPF and data network
  • N9 reference point between two UPFs
  • N14 reference point between two AMFs
  • N19 Reference point between two PSA UPFs for 5G LAN-type services (not shown in the figure).
  • Nsmf Service-based interface displayed by SMF
  • Npcf The service-based interface displayed by PCF
  • connection modes between the UE and the UE and between the UE and the UPF may include the following scenarios:
  • connection mode of the local exchange (based on the first reference point N3 or the second reference point N9);
  • the two UEs are connected to the same PSA UPF, and the data between the two UEs is directly exchanged within the PSA UPF without sending the data outside the third reference point N6, and then returning the data by an external router or switch.
  • UE1 communicates with RAN1, and RAN1 communicates with intermediate UPF1; UE2 communicates with RAN2, and RAN2 communicates with intermediate UPF2. Both UE1 and UE2 are connected to the same PSA UPF. When UE1 sends data packets, the data packets are exchanged directly inside the PSA UPF, so that the data packets are sent to UE2 without sending the data packets outside the third reference point N6. .
  • UE1 communicates with RAN1, RAN1 communicates with UPF1, and PSA UPF1 communicates with DN.
  • UE1 sends a data packet, it needs to transmit the data packet to device 3 on the DN through N6.
  • UE1 communicates with RAN1, and RAN1 communicates with intermediate UPF1; UE4 communicates with RAN2, and RAN2 communicates with intermediate UPF2.
  • UE1 and UE4 are respectively connected to different PSA UPFs: PSA UPF1 and PSA UPF2.
  • An N19 tunnel is established between the two PSA UPFs. When UE1 sends a data packet, it needs to pass through the N19 tunnel between the two PSA UPFs for packet transmission. exchange to send the packet to UE4.
  • FIG. 5 shows a flowchart of a solution to a denial of service attack provided by an exemplary embodiment of the present application. This embodiment is exemplified by the method being performed by SMF and UPF. The method includes:
  • Step 120 SMF sends PDR and QER to UPF
  • the PDR is used to identify the target data packet sent by the terminal, and the QER is used to restrict the terminal from sending the target data packet.
  • the target data packet is a data packet that triggers the target core network element to initiate a denial of service attack on the SMF.
  • Target data packets include but are not limited to at least one of the following two data packets:
  • DNS query packets are the packets that trigger EASDF to send a report to SMF.
  • the DHCP request packet is the packet that triggers the UPF to forward the message to the SMF.
  • the SMF sends the PDR and QER to the UPF if it recognizes a DOS attack. For example, the SMF sends the PDR and QER to the UPF when the reporting rate of the EASDF reaches the limit threshold. Alternatively, the SMF sends the PDR and QER to the UPF when the forwarding rate of the DHCP request of the UPF reaches the limit threshold.
  • Step 140 the UPF receives the PDR and QER sent by the SMF;
  • Step 160 UPF identifies the target data packet sent by the terminal according to the PDR;
  • the PDR includes at least one of a first PDR and a second PDR.
  • the first PDR is the PDR used to identify the DNS query packet.
  • the second PDR is the PDR used to identify the DHCP request packet.
  • Step 180 The UPF restricts the sending of the target data packet according to the QER.
  • the QER includes at least one of a first QER and a second QER.
  • the first QER is the QER that limits the upstream bit rate of the target packet.
  • the second QER is the QER that instructs the UPF to stop forwarding the target packet.
  • the second QER is a QER instructing the UPF to stop sending the terminal's DNS query packet to the EASDF, and/or the second QER is a QER instructing the UPF to stop sending the terminal's DHCP request packet to the SMF.
  • the above PDR and QER are configured for a single UE granularity.
  • the above PDR is configured for multiple UEs
  • the above QER is configured for a single UE or a PDU session within a single UE or a specific QoS flow within a single UE.
  • the specific QoS flow is a QoS flow dedicated to the target packet.
  • the above PDR and QER are both configured for multiple UEs.
  • the method provided in this embodiment enables the UPF to identify the target data packet based on the PDR and restrict the sending of the target data packet based on the QER by providing the PDR and QER to the UPF by the SMF, thereby preventing the DOS attack initiated by the abnormal UE. Or DDOS attack, as far as possible to ensure that the mobile communication system provides services for more UEs.
  • FIG. 6 shows a flowchart of a solution to a denial of service attack provided by an exemplary embodiment of the present application. This embodiment is exemplified by the method being performed by the SMF, the UPF and the UE. The method includes:
  • Step 220 the SMF sends the PDR and the first QER to the UPF;
  • the PDR is used to identify the target data packet sent by the terminal, and the first QER is used to limit the maximum upstream bit rate of the target data packet.
  • the target data packet includes at least one of a DNS query data packet and a DHCP request data packet.
  • the PDR includes at least one of the first PDR and the second PDR.
  • the first PDR is used to identify DNS query packets.
  • the second PDR is used to identify DHCP request packets.
  • the first PDR includes at least one of the following:
  • the packet type is UDP packet and the destination port number of the UDP packet is 53;
  • the data packet is a data packet in which the DNS protocol runs on the User Datagram Protocol (UDP), which is referred to as a DNS over 53 type of data packet.
  • UDP User Datagram Protocol
  • the data packet type is UDP data packet
  • the destination IP address of the UDP data packet is the IP address of EASDF
  • the destination port number of the UDP data packet is 53;
  • the packet is a DNS over53 type DNS packet (the destination IP address is EASDF).
  • the packet type is TCP packet and the destination port number of the TCP packet is 853;
  • the data packet is a data packet that the DNS runs on top of the Transport Layer Security (TLS) protocol, which is referred to as a DOT-type data packet.
  • TLS Transport Layer Security
  • the packet type is TCP packet
  • the destination IP address of the TCP packet is the IP address of EASDF
  • the destination port of the TCP packet is 853 or 443.
  • the packet is a DOT-type DNS packet (the destination IP address is EASDF); if the destination port is 443, the packet is DNS running on the HyperText Transfer Protocol (HTTP) DNS packets (destination IP address is EASDF).
  • HTTP HyperText Transfer Protocol
  • the second PDR includes at least one of the following:
  • the packet type is UDP packet and the destination port number of the UDP packet is 68.
  • the packet type is UDP packet, the destination port number of the UDP packet is 68, and the source port number is 67.
  • the data packet is a DHCP request data packet.
  • the packet type is UDP packet, the destination port number of the UDP packet is 67 and the source port number is 68.
  • the data packet is a DHCP response data packet.
  • the SMF sends the PDR and the first QER to the UPF when the reporting rate of the EASDF reaches the limit threshold.
  • the SMF sends the PDR and the first QER to the UPF when the DHCP request forwarded by the UPF reaches the limit threshold.
  • the DNS query data packet can be more generally identified as the data packet whose destination IP address is EASDF and the port number is 53/853/443. Or just all UDP and TCP packets whose destination IP address is EASDF can be identified as DNS query packets.
  • Step 240 the UPF receives the PDR and the first QER sent by the SMF;
  • Step 260 UPF identifies the target data packet sent by the terminal according to the PDR;
  • Step 280 The UPF limits the maximum upstream bit rate of the target data packet according to the first QER.
  • the UPF limits the maximum uplink bit rate when the terminal sends the target data packet according to the first QER. Or, the UPF limits the maximum upstream bit rate when it forwards the target data packet according to the first QER.
  • the target data packets include different types; the maximum upstream bit rates include at least two maximum upstream bit rates, and the at least two maximum upstream bit rates are respectively applicable to different types of target data packets.
  • the target data packets include: DNS query data packets and DHCP request data packets.
  • the maximum upstream bit rate includes: a first maximum upstream bit rate for limiting DNS query data packets, and a second maximum upstream bit rate for limiting DHCP request data packets.
  • the maximum upstream bit rate includes at least one of the following:
  • the aggregated maximum uplink bit rate of the UE (Aggregate Maximum Bit Rate, AMBR);
  • the maximum upstream bit rate (Maximum Bit Rate, MBR) of the quality of service (Quality of Service, QoS) flow is defined by MBR.
  • the UPF can limit the maximum uplink bit rate of the target data packet according to UE granularity, PDU granularity or QoS flow granularity.
  • the PDR and the first QER are provided to the UPF through the SMF, so that the UPF can identify the target data packet according to the UPF, and limit the maximum upstream bit rate of the target data packet according to the first QER, thereby preventing abnormality
  • the DOS attack or DDOS attack initiated by the UE ensures that the mobile communication system provides services for more UEs as much as possible.
  • FIG. 7 shows a flowchart of a solution to a denial of service attack provided by an exemplary embodiment of the present application. This embodiment is exemplified by the method being performed by the SMF, the UPF and the UE. The method includes:
  • Step 320 the SMF sends the PDR and the second QER to the UPF;
  • the PDR is used to identify the target data packet sent by the terminal, and the second QER is used to stop forwarding the target data packet.
  • the target data packet includes at least one of a DNS query data packet and a DHCP request data packet.
  • the PDR includes at least one of the first PDR and the second PDR.
  • the first PDR is used to identify DNS query packets.
  • the second PDR is used to identify DHCP request packets.
  • the first PDR includes at least one of the following:
  • the packet type is UDP packet and the destination port number of the UDP packet is 53;
  • the data packet type is UDP data packet
  • the destination IP address of the UDP data packet is the IP address of EASDF
  • the destination port number of the UDP data packet is 53;
  • the packet type is TCP packet and the destination port number of the TCP packet is 853;
  • the packet type is TCP packet
  • the destination IP address of the TCP packet is the IP address of EASDF
  • the destination port of the TCP packet is 853 or 443.
  • the second PDR includes:
  • the packet type is UDP packet and the destination port number of the UDP packet is 68.
  • the packet type is UDP packet, the destination port number of the UDP packet is 68, and the source port number is 67.
  • the SMF sends the PDR and the second QER to the UPF when the reporting rate of the EASDF reaches the limit threshold.
  • the SMF sends the PDR and the second QER to the UPF when the DHCP request forwarded by the UPF reaches the limit threshold.
  • the second QER further includes: a backoff time (optional), where the backoff time is a time period for instructing the UPF to stop forwarding the target data packet.
  • a backoff time is a time period for instructing the UPF to stop forwarding the target data packet.
  • Step 340 the UPF receives the PDR and the second QER sent by the SMF;
  • Step 360 UPF identifies the target data packet sent by the terminal according to the PDR;
  • Step 380 The UPF stops forwarding the target data packet according to the second QER.
  • the UPF stops forwarding the DNS query data packet to the EASDF according to the second QER, and/or stops forwarding the DHCP request data packet to the SMF according to the second QER. That is, depending on the configuration of the second QER, the forwarding of the DNS query data packet and the DHCP request data packet may be stopped at the same time, or only the forwarding of the DNS query data packet, or only the forwarding of the DHCP request data packet may be stopped.
  • the UPF stops forwarding the target data packet according to the second QER before the backoff time expires.
  • the message format of the PDR is provided in the communication protocol TS23.501 of the Third Generation Partnership Project (3GPP).
  • the following Table 1 shows the message format of the PDR as shown in Table 1:
  • the QER message format is provided in the communication protocol TS23.501 of 3GPP.
  • the following table 2 shows the message format of the QER:
  • the SMF After recognizing the DOS attack, the SMF sets the status of the upstream switch in the second QER to "off", and at the same time, optionally adds a fallback time (eg, 5 minutes) to the second QER. Because the upstream switch status is set to "off", UPF stops sending DNS query packets to the N6 interface or the N9 interface.
  • a fallback time eg, 5 minutes
  • Step 392 the SMF sends a third QER to the UPF, where the third QER is a QER used to instruct the UPF to resume forwarding the target data packet;
  • the SMF can send the N4 session modification request to the UPF again after a certain period of time, and the third QER contained in the message in the Gate Status UL is set to "On". In this way, the DNS interaction function between UE and EASDF is restored.
  • Step 394 the UPF receives the third QER sent by the SMF
  • Step 396 The UPF resumes forwarding the target data packet according to the third QER.
  • the UPF forwards the DNS query packet to the EASDF according to the third QER recovery, and/or forwards the DHCP request packet to the SMF according to the third QER recovery. That is, according to the different configuration modes of the third QER, forwarding of DNS query data packets and DHCP request data packets can be restored at the same time, or only the forwarding of DNS query data packets, or only the forwarding of DHCP request data packets can be restored.
  • Step 398 After the backoff time expires, the UPF resumes forwarding the target data packet.
  • the UPF In the case that the UPF does not receive the third QER sent by the SMF, the UPF automatically resumes forwarding the target data packet after the backoff time expires.
  • the UPF In the case where the second QER carries the backoff time, when the timer corresponding to the backoff time expires, the UPF automatically sets the upstream switch status to "on", so that the UPF can continue to forward DNS to the N6 interface or the N9 interface.
  • Query data packets so that UE can send DNS query data packets to EASDF, and EASDF can also send reports to SMF.
  • the second QER carries a shared backoff time
  • the shared backoff time is a backoff time shared by at least two types of target data packets of the EASDF.
  • the UPF when the UPF does not receive the third QER sent by the SMF, the UPF automatically resumes forwarding the two target data packets after the shared backoff time expires.
  • the second QER carries at least one of the first backoff time and the second backoff time.
  • the first backoff time is the backoff time corresponding to the DNS query data packet
  • the second backoff time is the backoff time corresponding to the DHCP request data packet.
  • the UPF will automatically resume forwarding the DNS query data packet after the first fallback time expires; after the second fallback time expires, the UPF will Self-recovery forwarding of DHCP request packets.
  • the method provided in this embodiment sends a second QER-based stop instruction or a third QER-based start instruction to the UPF through the SMF, and actively controls the UPF to stop or resume forwarding of the target data packet based on the second QER. , or based on the third QER to actively control the UPF to resume and forward the target data packet, so that the SMF can actively control the forwarding of the target data packet in the core network, so as to prevent DOS attacks or DDOS attacks initiated by abnormal UEs, and ensure mobile communication as much as possible
  • the system serves more UEs.
  • SMF can actively restore the forwarding of DNS query data packets, thereby actively restoring the reporting mechanism of EASDF, which can ensure the normal use of functions such as UL CL insertion and BP insertion.
  • FIGS. 5, 6, 7, 8 and 9 are shown in sequence as indicated by arrows, these steps are not necessarily executed sequentially in the sequence indicated by arrows. Unless explicitly stated herein, the execution of these steps is not strictly limited to the order, and these steps may be performed in other orders. Moreover, at least a part of the steps in FIGS. 5, 6, 7, 8 and 9 may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but may be executed at different times , the execution order of these sub-steps or stages is not necessarily carried out sequentially, but may be executed alternately or implicitly with other steps or at least a part of sub-steps or stages of other steps.
  • FIG. 10 shows a block diagram of an apparatus for solving a denial of service attack provided by an exemplary embodiment of the present application.
  • the device can be implemented as an SMF, or a part of the SMF, or used in the SMF.
  • the device includes:
  • the sending module 1020 is configured to send the packet detection rule PDR and the quality of service flow enforcement rule QER to the user plane function UPF, where the PDR is used to identify the target data packet sent by the terminal, and the QER is used to restrict the sending of the target data packet ;
  • the target data packet is a data packet that triggers the target core network element to initiate the denial of service attack on the SMF.
  • the QER includes: a first QER; the first QER is a QER for limiting the maximum upstream bit rate of the target data packet.
  • the target data packets include different types; the maximum upstream bit rate includes at least two maximum upstream bit rates, and the at least two maximum upstream bit rates are respectively applicable to the target data packets of different types .
  • the maximum upstream bit rate includes at least one of the following: the aggregated maximum upstream bit rate AMBR of the terminal; the AMBR of the PDU session; and the maximum upstream bit rate MBR of the QoS flow.
  • the QER includes: a second QER; the second QER is a QER used to instruct the UPF to stop forwarding the target data packet.
  • the second QER further includes: a backoff time; the backoff time is a time period for instructing the UPF to stop forwarding the target data packet.
  • the sending module 1020 is further configured to send a third QER to the UPF, where the third QER is a QER used to instruct the UPF to resume forwarding the target data packet.
  • the target data packet includes: a DNS query data packet, and the PDR includes a first PDR, and the first PDR is used to identify the DNS query data packet.
  • the first PDR includes at least one of the following: the data packet type is a UDP data packet and the destination port number of the UDP data packet is 53; the data packet type is the UDP data packet, all The purpose IP address of the UDP data packet is the IP address of the EASDF and the purpose port number of the UDP data packet is 53; the data packet type is the TCP data packet and the purpose port number of the TCP data packet is 853; The data packet type is a TCP data packet, the destination IP address of the TCP data packet is the IP address of the EASDF, and the destination port of the TCP data packet is 853 or 443.
  • the target data packet includes a DHCP request data packet; the PDR includes a second PDR, and the second PDR is used to identify the DHCP request data packet.
  • the second PDR includes: a data packet type is a UDP data packet and a destination port number of the UDP data packet is 68.
  • the sending module 1020 is further configured to send the PDR and the QER to the UPF, including: the SMF sends the PDR and the QER to a protocol data unit session anchor PSA UPF, where the PSA UPF is associated with the data A UPF connected by a network DN; or, where there are at least two concatenated intermediate UPFs, the SMF sends the PDR and the QER to a first intermediate UPF, the first intermediate UPF being the at least two intermediate UPFs. any of the intermediate UPFs.
  • the PDR and the QER are carried in the N4 session establishment/modification request.
  • FIG. 11 shows a block diagram of an apparatus for solving a denial of service attack provided by an exemplary embodiment of the present application.
  • the apparatus may be implemented as a UPF or part of a UPF, or used in a UPF.
  • the device includes:
  • a receiving module 1120 configured to receive the packet detection rule PDR and the quality of service flow enforcement rule QER sent by the session management function SMF;
  • processing module 1140 for identifying the target data packet sent by the terminal according to the PDR; and restricting the sending of the target data packet according to the QER;
  • the target data packet is a data packet that triggers the target core network element to initiate the denial of service attack on the SMF.
  • the QER includes: a first QER; and the processing module 1140, configured to limit the maximum upstream bit rate of the target data packet according to the first QER.
  • the target data packets include different types; the maximum upstream bit rate includes at least two maximum upstream bit rates, and the at least two maximum upstream bit rates are respectively applicable to the target data packets of different types .
  • the maximum upstream bit rate includes at least one of the following: the aggregated maximum upstream bit rate AMBR of the terminal; the AMBR of the PDU session; and the maximum upstream bit rate MBR of the QoS flow.
  • the QER includes: a second QER; and the processing module 1140, a QER configured to stop forwarding the target data packet according to the second QER.
  • the second QER further includes: a backoff time; the processing module 1140 is configured to stop forwarding the target data packet before the backoff time expires.
  • the receiving module 1020 is further configured to receive a third QER sent by the SMF; the UPF resumes forwarding the target data packet according to the third QER.
  • the target data packet includes: a DNS query data packet, and the PDR includes a first PDR, and the first PDR is used to identify the DNS query data packet.
  • the first PDR includes at least one of the following: the data packet type is a UDP data packet and the destination port number of the UDP data packet is 53; the data packet type is the UDP data packet, all The purpose IP address of the UDP data packet is the IP address of the EASDF and the purpose port number of the UDP data packet is 53; the data packet type is the TCP data packet and the purpose port number of the TCP data packet is 853; The data packet type is a TCP data packet, the destination IP address of the TCP data packet is the IP address of the EASDF, and the destination port of the TCP data packet is 853 or 443.
  • the target data packet includes a DHCP request data packet; the PDR includes a second PDR, and the second PDR is used to identify the DHCP request data packet.
  • the second PDR includes: a data packet type is a UDP data packet and a destination port number of the UDP data packet is 68.
  • the UPF is a Protocol Data Unit Session Anchor PSA UPF
  • the PSA UPF is a UPF connected to a data network DN; or, the UPF is a first intermediate UPF, which is a concatenation Any one of the at least two intermediate UPFs.
  • the PDR and the QER are carried in the N4 session establishment/modification request.
  • the sending module is used to execute the steps related to sending in the above method embodiments; the receiving module is used to execute the steps related to receiving in the above method embodiments; the processing module is used to execute the steps in the above method embodiments The steps other than the sending and receiving steps will not be described in detail in this embodiment.
  • FIG. 12 shows a schematic structural diagram of a network element device provided by an embodiment of the present application.
  • the network element device may be used to implement the above-mentioned solution method for a denial of service attack.
  • the network element device 1200 may include: a processor 1201 , a receiver 1202 , a transmitter 1203 , a memory 1204 and a bus 1205 .
  • the processor 1201 includes one or more processing cores, and the processor 1201 executes various functional applications and information processing by running software programs and modules.
  • the receiver 1202 and the transmitter 1203 may be implemented as a transceiver 1206, which may be a communication chip.
  • the memory 1204 is connected to the processor 1201 through the bus 1205 .
  • the memory 1204 may be used to store a computer program, and the processor 1201 is used to execute the computer program to implement various steps performed by the network element device, access network entity, core network element or core network entity in the above method embodiments.
  • the transmitter 1203 is used to perform the steps related to sending in the above method embodiments; the receiver 1202 is used to perform the steps related to reception in the above method embodiments; the processor 1201 is used to perform the steps of removing the Steps other than the send and receive steps.
  • the memory 1204 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, and the volatile or non-volatile storage device includes but is not limited to: RAM (Random-Access Memory, random access memory) and ROM (Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory, Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory, Electrically Erasable Programmable Read-Only Memory) memory), flash memory or other solid-state storage technology, CD-ROM (Compact Disc Read-Only Memory), DVD (Digital Video Disc, high-density digital video disc) or other optical storage, tape cassettes, magnetic tapes, magnetic disks storage or other magnetic storage devices.
  • RAM Random-Access Memory, random access memory
  • ROM Read-Only Memory
  • EPROM Erasable Programmable Read-Only Memory
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • flash memory or other solid-
  • a network element device includes: a processor and a memory, the memory stores a computer program, and the computer program is loaded and executed by the processor to implement Workaround for a denial of service attack as described above.
  • the present application further provides a computer-readable storage medium, where at least one instruction, at least one piece of program, code set or instruction set is stored in the storage medium, the at least one instruction, the at least one piece of program, the code set or The instruction set is loaded and executed by the processor to implement the solution to the denial of service attack provided by the above method embodiments.
  • the present application also provides a computer program product, wherein the computer program product includes computer instructions, and the computer instructions are stored in a computer-readable storage medium.
  • the processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the denial-of-service attack solution provided by the above aspects.

Abstract

本申请公开了一种拒绝服务攻击的解决方法、装置、设备及介质，属于移动通信领域。方法包括：会话管理功能SMF向用户平面功能UPF发送包检测规则PDR和服务质量流实施规则QER，包检测规则PDR用于识别终端发送的目标数据包，服务质量流实施规则QER用于限制目标数据包的发送；其中，目标数据包是触发目标核心网网元向会话管理功能SMF发起拒绝服务攻击的数据包。

Description

拒绝服务攻击的解决方法、装置、设备、介质和计算机程序产品
本申请要求于2021年04月02日提交中国专利局，申请号为2021103638315，发明名称为“拒绝服务攻击的解决方法、装置、设备及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及移动通信领域，特别涉及一种拒绝服务攻击的解决方法、装置、设备、介质和计算机程序产品。
背景技术
在边缘计算场景下，用户设备(User Equipment，UE)发送的域名系统(Domain Name System，DNS)查询可能由边缘应用服务器发现功能(Edge Application Server Discovery Function，EASDF)来处理。
会话管理功能(Session Management Function，SMF)向EASDF提供报告(Reporting)规则和转发(Forwarding)规则。报告规则提供了EASDF向SMF发送报告的规则，转发规则提供了EASDF转发消息的规则。在UE向EASDF发送一个DNS查询后，EASDF会根据报告规则向SMF发送报告。
在上行峰值速率较高的情况下，若UE采用恶意方式在短时间内向EASDF频繁发送DNS查询，从而EASDF频繁向SMF发送报告并且触发控制平面的多个后续信令消息，会形成了移动通信系统的信令风暴，造成拒绝服务(Denial Of Service，DOS)攻击，导致移动通信系统无法为所有正常的UE的服务。
发明内容
根据本申请的各种实施例，提供了一种拒绝服务攻击的解决方法、装置、设备、介质和计算机程序产品，所述技术方案如下：
根据本申请的一个方面，提供了一种拒绝服务攻击的解决方法，所述方法包括：
SMF向用户平面功能(User Plane Function，UPF)发送包检测规则(Packet Detection Rule，PDR)和服务质量流实施规则(Qos Enforcement Rule，QER)，所述PDR规则用于识别终端发送的目标数据包，所述QER规则用于限制所述目标数据包的发送；
其中，所述目标数据包是触发目标核心网网元向所述SMF发送消息的数据包。
根据本申请的另一方面，提供了一种拒绝服务攻击的解决方法，所述方法包括：
UPF接收SMF发送的PDR和QER；
所述UPF根据所述PDR识别终端发送的目标数据包；
所述UPF根据所述QER限制所述目标数据包的发送；
其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
根据本申请的一个方面，提供了一种拒绝服务攻击的解决装置，所述装置包括：
发送模块，用于向UPF发送PDR和QER，所述PDR用于识别终端发送的目标数据包，所述QER用于限制所述目标数据包的发送；
其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
根据本申请的另一方面，提供了一种拒绝服务攻击的解决装置，所述装置包括：
接收模块，用于接收SMF发送的PDR和QER；
处理模块，用于根据所述PDR识别终端发送的目标数据包；以及根据所述QER限制所述目标数据包的发送；
其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
根据本申请的一个方面，提供了一种网元设备，所述网元设备包括：处理器和存储器，所述存储器存储有计算机程序，所述计算机程序由所述处理器加载并执行以实现如上所述的拒绝服务攻击的解决方法。
根据本申请的另一方面，提供了一种计算机可读存储介质，所述存储介质存储有计算机程序，所述计算机程序由处理器加载并执行以实现如上所述的拒绝服务攻击的解决方法。
根据本申请的另一方面，提供了一种计算机程序产品，所述计算机程序产品包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述方面提供的拒绝服务攻击的解决方法。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。本申请的其它特征和优点将从说明书、附图以及权利要求书变得明显。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1是本申请一个实施例提供的移动通信系统的框图；
图2是本申请一个实施例提供的基于N3/N9的通信示意图；
图3是本申请一个实施例提供的基于N6的通信示意图；
图4是本申请一个实施例提供的基于N19的通信示意图；
图5示出了本申请一个实施例提供的拒绝服务攻击的解决方法的流程图；
图6示出了本申请另一个实施例提供的拒绝服务攻击的解决方法的流程图；
图7示出了本申请另一个实施例提供的拒绝服务攻击的解决方法的流程图；
图8示出了本申请一个实施例提供的UPF根据SMF的指示恢复对目标数据包的转发的流程图；
图9示出了本申请另一个实施例提供的UPF自行恢复对目标数据包的转发的流程图；
图10示出了本申请一个实施例提供的拒绝服务攻击的解决装置的框图；
图11示出了本申请一个实施例提供的拒绝服务攻击的解决装置的框图；
图12示出了本申请一个实施例提供的网元设备的结构示意图。
具体实施方式
这里将详细地对示例性实施例进行说明，其示例表示在附图中。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性实施例中所描述的实施方式并不代表与本申请相一致的所有实施方式。相反，它们仅是与如所附权利要求书中所详述的、本申请的一些方面相一致的装置和方法的例子。
应当理解的是，在本文中提及的“若干个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
在边缘计算场景下，UE向SMF发送PDU会话建立请求。SMF为UE定位和选择一个EASDF，SMF向选择的EASDF发送消息，该消息中携带有：UE的IP地址，回调统一资源标识符(Uniform Resource Identifier，URI)，处理DNS消息的规则。其中，回调地址是指EASDF主动发起到SMF的消息时所请求的目标资源URI。
可选的，SMF向EASDF提供报告规则，EASDF向SMF的报告由以下至少两类报告规则下发送：
1.基于DNS查询触发的报告；
如果DNS查询中的边缘应用服务器(Edge Application Server,EAS)的全限定域名(s)(Fully Qualified Domain Name,FQDN)与报告规则中的FQDN(s)过滤器匹配，则SMF可以提供报告 规则指示EASDF将EAS FQDN(s)发送给SMF。然后，SMF向EASDF提供转发规则。然后EASDF向本地DNS转发DNS查询或增加ECS属性后向C-DNS转发DNS查询。
2.基于DNS响应触发的报告；
SMF提供报告规则来指导EASDF向SMF报告EAS IP地址/FQDN，如果DNS响应中的EAS IP地址匹配报告规则的IP地址范围，或DNS响应的FQDN与DNS消息报告规则的FQDN匹配。然后SMF可能会进行UL CL插入的操作，而这个操作将引入比较多的信令交互。特别是UE，RAN，AMF，I-UPF，L-PSA等都参与了信令交互。
由于SMF向EASDF配置了报告规则，导致若UE向EASDF发送一个DNS查询时，可能会引发EASDF向SMF发送报告(或报告消息)。该报告会引发较多的后续信令及消息。比如，5G的上行峰值速率可达到300Mbps.即一个UE可以在一秒内上传300Mb数据，计算一下：
300M/8/1500＝25000条DNS查询每秒每个UE。其中，8为一个字节里面的比特数量，同时假设一个DNS查询的长度是1500字节。
因一个DNS查询可以触发与SMF的信令交互，同时可能触发SMF的上行分类器(Uplink Classifier，UL CL)插入操作的信令，因而形成了移动通信系统的信令风暴，造成DOS攻击，移动通信系统无法为所有正常的UE的服务(因为5G系统的信令容易被DOS所占用，移动通信系统可能只有一部分正常的UE服务或完全无法为正常的UE服务)。
另外，多个UE可以通过不同的小区协作同时向EASDF发送DNS查询。这样可能造成DDOS攻击，形成更为严重的攻击，造成移动通信系统几乎无法为正常的UE服务。
除此之外，由于SMF还能够实现DHCP服务的功能，DHCP服务用于给UE分配IP地址或给UE分配IP相关的参数。UE利用用户面的高速率而能够发送大量的DHCP请求数据包包来通过N4接口发送到SMF，从而产生大量的UPF与SMF之间的N4接口的信令，同时通过这种大量的DHCP请求数据报来请求SMF处理，能够占据SMF处理DHCP的时间与资源，从而实现DOS的攻击。同样，多个UE通过协作，同时向一个UPF及SMF发送大量的DHCP请求数据包时，就可实现DDOS攻击。本申请提供了拒绝服务攻击的解决方案，以解决上述技术问题。
图1示出了本公开一个示例性实施例提供的移动通信系统的框图。该移动通信系统可以是基于NR的5G系统，也包含基于演进的UMTS陆地无线接入网(Evolved UMTS Terrestrial Radio Access Network，e-UTRAN)的5G系统以及5G系统的后续演进系统。该通信系统被定义为支持数据连接和服务，以便于网络部署时能够使用诸如网络功能虚拟化(Network  Functions Virtualization，NFV)和软件定义网络(Software Defined Network，SDN)之类的技术。该通信系统主要有网络功能(Network Function，NF)组成，采用分布式的功能来根据实际需要部署。新的网络功能的加入和撤出，并不影响整体网络的功能。该通信系统包括：用户设备(3GPP对移动终端的命名)(User Equipment，UE)、(无线)接入网络((R)AN)、用户平面功能(User Plane Function，UPF)、数据网络(Data Network，DN)和控制平面功能。
其中，控制平面功能包括：接入和移动管理功能(Access and Mobility Management Function，AMF)、会话管理功能(Session Management Function，SMF)、控制策略功能(Policy Control Function，PCF)和统一数据管理(Unified Data Management，UDM)。
UE通过空中接口与RAN通信。RAN与UPF之间通过第一参考点N3通信。两个UPF之间通过第二参考点N9通信。PSA UPF与DN之间通过第三参考点N6通信。
上述UE、RAN、UPF和DN均可能为多个。当UPF为多个时，存在一些UPF是UE的PDU会话锚用户平面功能(PSA UPF)。两个PDU会话锚用户平面功能(PSA UPF)之间通过第四参考点N19通信(图1中未示出)。
UE和AMF之间通过第五参考点N1通信。RAN和AMF之间通过第六参考点N2通信。UPF和SMF之间通过第七参考点N4通信。
在图1所示的网络架构中，包括如下参考点：
N1：UE和AMF之间的参考点；
N2：(R)AN和AMF之间的参考点；
N3：(R)AN和UPF之间的参考点；
N4：SMF和UPF之间的参考点；
N6：PSA UPF和数据网络之间的参考点；
N9：两个UPF之间的参考点；
N14：两个AMF之间的参考点；
N19：5G LAN型业务的两个PSA UPF之间的参考点(图中未示出)。
在图1所示的网络架构中，包括如下基于服务的接口：
Namf：AMF展示的基于服务的接口；
Nsmf：SMF展示的基于服务的接口；
Npcf：PCF展示的基于服务的接口；
Nudm：UDM展示的基于服务的接口。
在不同的实现场景中，UE与UE之间以及UE与UPF之间的连接方式可能包括如下场 景：
第一，本地交换的连接方式(基于第一参考点N3或第二参考点N9)；
两个UE连接到同一个PSA UPF，两个UE之间的数据直接在PSA UPF内部进行交换，而无需将数据发送到第三参考点N6之外，再被外部路由器或交换机将数据返回来。
结合参考图2，UE1与RAN1通信，RAN1与中间UPF1通信；UE2与RAN2通信，RAN2与中间UPF2通信。UE1和UE2均连接到同一个PSA UPF，当UE1发送数据包时，直接在PSA UPF内部进行数据包的交换，从而将数据包发送至UE2，无需将数据包发送到第三参考点N6之外。
第二，基于第三参考点N6的方式；
一个UE和DN上的一个设备通信时，对于UE和设备之间的广播数据需要通过N6来交换。
结合参考图3，UE1与RAN1通信，RAN1与UPF1通信，PSA UPF1与DN通信。当UE1发送数据包时，需要通过N6将数据包传递至DN上的设备3。
第三，基于第四参考点N19的方式。
两个UE连接到不同PSA UPF时，两个UE之间的数据需要通过第四参考点N19来交换，两个PSA UPF之间建立有N19隧道。
结合参考图4，UE1与RAN1通信，RAN1与中间UPF1通信；UE4与RAN2通信，RAN2与中间UPF2通信。UE1和UE4分别连接到不同的PSA UPF：PSA UPF1和PSA UPF2，两个PSA UPF之间建立有N19隧道，当UE1发送数据包时，需要经过两个PSA UPF之间的N19隧道进行数据包的交换，从而将数据包发送至UE4。
图5示出了本申请一个示例性实施例提供的拒绝服务攻击的解决方法的流程图。本实施例以该方法由SMF和UPF执行来举例说明。所述方法包括：
步骤120：SMF向UPF发送PDR和QER；
PDR用于识别终端发送的目标数据包，QER用于限制终端对目标数据包的发送。
其中，目标数据包是触发目标核心网网元向SMF发起拒绝服务攻击的数据包。目标数据包包括但不限于如下两种数据包至少之一：
·DNS查询数据包；
DNS查询数据包是触发EASDF向SMF发送报告的数据包。
·DHCP请求数据包；
DHCP请求数据包是触发UPF向SMF转发消息的数据包。
可选地，SMF在识别到DOS攻击的情况下，向UPF发送PDR和QER。比如，SMF在EASDF的报告速率达到限制门限的情况下，向UPF发送PDR和QER。或者，SMF在UPF的DHCP请求的转发速率达到限制门限的情况下，向UPF发送PDR和QER。
步骤140：UPF接收SMF发送的PDR和QER；
步骤160：UPF根据PDR识别终端发送的目标数据包；
PDR包括第一PDR和第二PDR中的至少一种。
·第一PDR是用于识别DNS查询数据包的PDR。
·第二PDR是用于识别DHCP请求数据包的PDR。
步骤180：UPF根据QER限制目标数据包的发送。
QER包括第一QER和第二QER中的至少一种。
·第一QER是限制目标数据包的上行比特速率的QER。
·第二QER是指示UPF停止对目标数据包进行转发的QER。
也即，第二QER是指示UPF停止将终端的DNS查询数据包发送给EASDF的QER，和/或，第二QER是指示UPF停止将终端的DHCP请求数据包发送给SMF的QER。
可选地，上述PDR和QER是针对单个UE粒度来配置的。或者，上述PDR是针对多个UE来配置的，上述QER是针对单个UE或单个UE内的PDU会话或单个UE内的特定QoS流来配置的。该特定QoS流是目标数据包专用的QoS流。或者，上述PDR和QER均为针对多个UE来配置的。
综上所述，本实施例提供的方法，通过由SMF向UPF提供PDR和QER，使得UPF能够基于PDR识别目标数据包，以及基于QER限制目标数据包的发送，从而防御异常UE发起的DOS攻击或DDOS攻击，尽可能保障移动通信系统为更多的UE提供服务。
针对第一QER：
图6示出了本申请一个示例性实施例提供的拒绝服务攻击的解决方法的流程图。本实施例以该方法由SMF、UPF和UE执行来举例说明。所述方法包括：
步骤220：SMF向UPF发送PDR和第一QER；
PDR用于识别终端发送的目标数据包，第一QER用于限制目标数据包的最大上行比特速率。
目标数据包包括DNS查询数据包和DHCP请求数据包中的至少一种。相应的，PDR包括第一PDR和第二PDR中的至少一种。第一PDR用于识别DNS查询数据包。第二PDR用于识别DHCP请求数据包。
示例性的，第一PDR包括如下至少之一：
·数据包类型为UDP数据包且UDP数据包的目的端口号为53；
此时，数据包为DNS协议运行在用户数据报协议(User Datagram Protocol，UDP)之上的数据包，简称DNS over 53类型的数据包。
·数据包类型为UDP数据包、UDP数据包的目的IP地址为EASDF的IP地址且UDP数据包的目的端口号为53；
此时，数据包为DNS over53类型的DNS数据包(目的IP地址为EASDF)。
·数据包类型为TCP数据包且TCP数据包的目的端口号为853；
此时，数据包为DNS运行在传输层安全性协议(Transport Layer Security，TLS)之上的数据包，简称DOT类型的数据包。
·数据包类型为TCP数据包、TCP数据包的目的IP地址为EASDF的IP地址、且TCP数据包的目的端口为853或443。
若目的端口为853，则数据包为DOT类型的DNS数据包(目的IP地址为EASDF)；若目的端口为443，则数据包为DNS运行在超文本传输协议(HyperText Transfer Protocol，HTTP)之上的DNS数据包(目的IP地址为EASDF)。
示例性的，第二PDR包括如下至少之一：
数据包类型为UDP数据包且UDP数据包的目的端口号为68。或者，数据包类型为UDP数据包、UDP数据包的目的端口号为68且源端口号为67。此时，数据包为DHCP请求数据包。
数据包类型为UDP数据包、UDP数据包的目的端口号为67且源端口号为68。此时，数据包为DHCP响应数据包。
可选地，SMF在EASDF的上报速率达到限制门限的情况下，向UPF发送PDR和第一QER。或者，SMF在UPF转发的DHCP请求达到限制门限的情况下，向UPF发送PDR和第一QER。
在一些实施例中，若EASDF只是用于DNS业务，则可以更加通用地识别DNS查询数据包为目的IP地址为EASDF，且端口号为53/853/443的数据包。或仅仅是目的IP地址为EASDF的所有UDP与TCP数据包均可识别为DNS查询数据包。
步骤240：UPF接收SMF发送的PDR和第一QER；
步骤260：UPF根据PDR识别终端发送的目标数据包；
在满足第一PDR的情况下，认为识别到DNS查询数据包。
在满足第二PDR的情况下，认为识别到DHCP请求数据包。
步骤280：UPF根据第一QER限制目标数据包的最大上行比特速率。
可选地，UPF根据第一QER限制终端发送目标数据包时的最大上行比特速率。或，UPF根据第一QER限制自身转发目标数据包时的最大上行比特速率。
在一个实施例中，目标数据包包括不同类型；最大上行比特速率包括至少两个最大上行比特速率，至少两个最大上行比特速率分别适用于不同类型的目标数据包。比如，目标数据包包括：DNS查询数据包和DHCP请求数据包。
最大上行比特速率包括：用于限制DNS查询数据包的第一最大上行比特速率，和用于限制DHCP请求数据包的第二最大上行比特速率。
在一个实施例中，最大上行比特速率包括如下至少之一：
UE的聚合最大上行比特速率(Aggregate Maximum Bit Rate，AMBR)；
协议数据单元(Protocol Data Unit，PDU)会话的AMBR；
服务质量(Quality of Service，QoS)流的最大上行比特速率(Maximum Bit Rate，MBR)。
也即，UPF可以按照UE粒度、PDU粒度或QoS流粒度来限制目标数据包的最大上行比特速率。
综上所述，本实施例提供的方法，通过SMF向UPF提供PDR和第一QER，使得UPF能够根据UPF识别目标数据包，根据第一QER限制目标数据包的最大上行比特速率，从而防御异常UE发起的DOS攻击或DDOS攻击，尽可能保障移动通信系统为更多的UE提供服务。
针对第二QER：
图7示出了本申请一个示例性实施例提供的拒绝服务攻击的解决方法的流程图。本实施例以该方法由SMF、UPF和UE执行来举例说明。所述方法包括：
步骤320：SMF向UPF发送PDR和第二QER；
PDR用于识别终端发送的目标数据包，第二QER用于停止对目标数据包进行转发。
目标数据包包括DNS查询数据包和DHCP请求数据包中的至少一种。相应的，PDR包括第一PDR和第二PDR中的至少一种。第一PDR用于识别DNS查询数据包。第二PDR用于识别DHCP请求数据包。
示例性的，第一PDR包括如下至少之一：
·数据包类型为UDP数据包且UDP数据包的目的端口号为53；
·数据包类型为UDP数据包、UDP数据包的目的IP地址为EASDF的IP地址且UDP数 据包的目的端口号为53；
·数据包类型为TCP数据包且TCP数据包的目的端口号为853；
·数据包类型为TCP数据包、TCP数据包的目的IP地址为EASDF的IP地址、且TCP数据包的目的端口为853或443。
示例性的，第二PDR包括：
数据包类型为UDP数据包且UDP数据包的目的端口号为68。或者，数据包类型为UDP数据包、UDP数据包的目的端口号为68且源端口号为67。
可选地，SMF在EASDF的上报速率达到限制门限的情况下，向UPF发送PDR和第二QER。或者，SMF在UPF转发的DHCP请求达到限制门限的情况下，向UPF发送PDR和第二QER。
可选地，第二QER还包括：回退时间(可选项)，回退时间是指示所述UPF停止对所述目标数据包进行转发的时长。
步骤340：UPF接收SMF发送的PDR和第二QER；
步骤360：UPF根据PDR识别终端发送的目标数据包；
在满足第一PDR的情况下，认为识别到DNS查询数据包。
在满足第二PDR的情况下，认为识别到DHCP请求数据包。
步骤380：UPF根据第二QER停止对目标数据包的转发。
可选地，UPF根据第二QER停止将DNS查询数据包转发至EASDF，和/或，根据第二QER停止将DHCP请求数据包转发至SMF。也即，根据第二QER的配置方式的不同，可以同时停止DNS查询数据包和DHCP请求数据包的转发，或者仅停止DNS查询数据包的转发，或者仅停止DHCP请求数据包的转发。
在第二QER包括回退时间的情况下，UPF在回退时间超时前，根据第二QER停止对目标数据包的转发。
第三代合作伙伴项目(Third Generation Partnership Project，3GPP)的通信协议TS23.501内提供了PDR的报文格式。下述表一示出了该PDR的报文格式如表一所示：
表一
Figure PCTCN2022078319-appb-000001
Figure PCTCN2022078319-appb-000002
Figure PCTCN2022078319-appb-000003
对应的，3GPP的通信协议TS23.501内提供了QER的报文格式。下述表二示出了该QER的报文格式：
表二
Figure PCTCN2022078319-appb-000004
Figure PCTCN2022078319-appb-000005
SMF在识别到DOS攻击后，将第二QER中的上行开关状态设置为“关闭”，同时，可选地在第二QER中新增一个回退时间(如5分钟)。因上行开关状态设置为“关闭”，因此UPF停止向N6接口或N9接口发送DNS查询数据包。
在UPF停止对目标数据包进行转发后，还可以根据SMF的指示恢复对目标数据包的转发。可选地，如图8所示：
步骤392：SMF向UPF发送第三QER，第三QER是用于指示UPF恢复对目标数据包进行转发的QER；
在第二QER未携带有回退时间或者回退时间对应的定时器未超时的情况下，则SMF在一定的时间后，可以再次向UPF发送N4会话修改请求，该消息中包含的第三QER中的Gate Status UL设置为“开启”。这样，UE与EASDF的DNS交互功能被恢复。
步骤394：UPF接收SMF发送的第三QER；
步骤396：UPF根据第三QER恢复对目标数据包进行转发。
可选地，UPF根据第三QER恢复将DNS查询数据包转发至EASDF，和/或，根据第三QER恢复将DHCP请求数据包转发至SMF。也即，根据第三QER的配置方式的不同，可以同时恢复DNS查询数据包和DHCP请求数据包的转发，或者仅恢复DNS查询数据包的转发，或者仅恢复DHCP请求数据包的转发。
在UPF停止对目标数据包进行转发后，还可以自行恢复对目标数据包的转发。可选地，如图9所示：
步骤398：UPF在回退时间超时后，恢复对目标数据包进行转发。
在UPF没有接收到SMF发送的第三QER的情况下，UPF在回退时间超时后，自行恢复对目标数据包进行转发。
在第二QER携带有回退时间的情况下，当回退时间对应的定时器超时后，UPF自动将上行开关状态设置为“开启”，这样，UPF就可以继续向N6接口或N9接口转发DNS查询数据包，从而UE可以向EASDF发送DNS查询数据包，EASDF也就可以向SMF发送报告了。
可选地，第二QER携带有共享回退时间，共享回退时间是EASDF的至少两类目标数据包共用的回退时间。在该种情况下，UPF没有接收到SMF发送的第三QER的情况下，UPF在共享回退时间超时后，自行恢复对两种目标数据包进行转发。
可选地，第二QER携带有第一回退时间和第二回退时间中的至少一种。第一回退时间是DNS查询数据包对应的回退时间，第二回退时间是DHCP请求数据包对应的回退时间。
在该种情况下，UPF没有接收到SMF发送的第三QER的情况下，UPF在第一回退时间超时后，自行恢复对DNS查询数据包的转发；UPF在第二回退时间超时后，自行恢复对DHCP请求数据包的转发。
综上所述，本实施例提供的方法，通过SMF向UPF发送基于第二QER的停止指示或基于第三QER的开始指示，基于第二QER主动控制UPF对目标数据包的停止转发或恢复转发，或基于第三QER主动控制UPF对目标数据包的恢复转发，从而使得SMF能够主动控制目标数据包在核心网中的转发，从而防御异常UE发起的DOS攻击或DDOS攻击，尽可能保障移动通信系统为更多的UE提供服务。
而且，SMF可以通过主动恢复DNS查询数据包的转发，从而主动恢复EASDF的报告机制，能够保障UL CL插入、BP插入等功能的正常使用。
应该理解的是，虽然图5、6、7、8和9的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图5、6、7、8和 9中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交底地执行。
图10示出了本申请一个示例性实施例提供的拒绝服务攻击的解决装置的框图。该装置可以实现成为SMF，或者SMF的一部分，或者应用于SMF中。所述装置包括：
发送模块1020，用于向用户平面功能UPF发送包检测规则PDR和服务质量流实施规则QER，所述PDR用于识别终端发送的目标数据包，所述QER用于限制所述目标数据包的发送；
其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
在一个实施例中，所述QER包括：第一QER；所述第一QER是用于限制所述目标数据包的最大上行比特速率的QER。
在一个实施例中，所述目标数据包包括不同类型；所述最大上行比特速率包括至少两个最大上行比特速率，所述至少两个最大上行比特速率分别适用于不同类型的所述目标数据包。
在一个实施例中，所述最大上行比特速率包括如下至少之一：终端的聚合最大上行比特速率AMBR；PDU会话的AMBR；QoS流的最大上行比特速率MBR。
在一个实施例中，所述QER包括：第二QER；所述第二QER是用于指示所述UPF停止对所述目标数据包进行转发的QER。
在一个实施例中，所述第二QER还包括：回退时间；所述回退时间是指示所述UPF停止对所述目标数据包进行转发的时长。
在一个实施例中，所述发送模块1020还用于向所述UPF发送第三QER，所述第三QER是用于指示所述UPF恢复对所述目标数据包进行转发的QER。
在一个实施例中，所述目标数据包包括：DNS查询数据包，所述PDR包括第一PDR，所述第一PDR用于识别所述DNS查询数据包。
在一个实施例中，所述第一PDR包括如下至少之一：数据包类型为UDP数据包且所述UDP数据包的目的端口号为53；所述数据包类型为所述UDP数据包、所述UDP数据包的目的IP地址为所述EASDF的IP地址且所述UDP数据包的目的端口号为53；所述数据包类型为TCP数据包且所述TCP数据包的目的端口号为853；所述数据包类型为TCP数据包、所述TCP数据包的目的IP地址为所述EASDF的IP地址、且所述TCP数据包的目的端口为 853或443。
在一个实施例中，所述目标数据包包括DHCP请求数据包；所述PDR包括第二PDR，所述第二PDR用于识别所述DHCP请求数据包。
在一个实施例中，所述第二PDR包括：数据包类型为UDP数据包且所述UDP数据包的目的端口号为68。
在一个实施例中，所述发送模块1020还用于向UPF发送PDR和QER，包括：所述SMF向协议数据单元会话锚PSA UPF发送所述PDR和所述QER，所述PSA UPF是与数据网络DN连接的UPF；或，在存在串接的至少两个中间UPF的情况下，所述SMF向第一中间UPF发送所述PDR和所述QER，所述第一中间UPF是所述至少两个中间UPF中的任意一个UPF。
在一个实施例中，所述PDR和所述QER携带在N4会话建立/修改请求中。
图11示出了本申请一个示例性实施例提供的拒绝服务攻击的解决装置的框图。该装置可以实现成为UPF或UPF的一部分，或者应用于UPF中。所述装置包括：
接收模块1120，用于接收会话管理功能SMF发送的包检测规则PDR和服务质量流实施规则QER；
处理模块1140，用于根据所述PDR识别终端发送的目标数据包；以及根据所述QER限制所述目标数据包的发送；
其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
在一个实施例中，所述QER包括：第一QER；所述处理模块1140，用于根据所述第一QER限制所述目标数据包的最大上行比特速率。
在一个实施例中，所述目标数据包包括不同类型；所述最大上行比特速率包括至少两个最大上行比特速率，所述至少两个最大上行比特速率分别适用于不同类型的所述目标数据包。
在一个实施例中，所述最大上行比特速率包括如下至少之一：终端的聚合最大上行比特速率AMBR；PDU会话的AMBR；QoS流的最大上行比特速率MBR。
在一个实施例中，所述QER包括：第二QER；所述处理模块1140，用于根据所述第二QER停止对所述目标数据包进行转发的QER。
在一个实施例中，所述第二QER还包括：回退时间；所述处理模块1140，用于在所述回退时间超时前，停止对所述目标数据包进行转发。
在一个实施例中，所述接收模块1020，还用于接收所述SMF发送的第三QER；所述UPF 根据所述第三QER恢复对所述目标数据包进行转发。
在一个实施例中，所述目标数据包包括：DNS查询数据包，所述PDR包括第一PDR，所述第一PDR用于识别所述DNS查询数据包。
在一个实施例中，所述第一PDR包括如下至少之一：数据包类型为UDP数据包且所述UDP数据包的目的端口号为53；所述数据包类型为所述UDP数据包、所述UDP数据包的目的IP地址为所述EASDF的IP地址且所述UDP数据包的目的端口号为53；所述数据包类型为TCP数据包且所述TCP数据包的目的端口号为853；所述数据包类型为TCP数据包、所述TCP数据包的目的IP地址为所述EASDF的IP地址、且所述TCP数据包的目的端口为853或443。
在一个实施例中，所述目标数据包包括DHCP请求数据包；所述PDR包括第二PDR，所述第二PDR用于识别所述DHCP请求数据包。
在一个实施例中，所述第二PDR包括：数据包类型为UDP数据包且所述UDP数据包的目的端口号为68。
在一个实施例中，所述UPF是协议数据单元会话锚PSA UPF，所述PSA UPF是与数据网络DN连接的UPF；或，所述UPF是第一中间UPF，所述第一中间UPF是串联的至少两个中间UPF中的任意一个UPF。
在一个实施例中，所述PDR和所述QER携带在N4会话建立/修改请求中。
需要说明的是，发送模块用于执行上述各个方法实施例中与发送相关的步骤；接收模块用于执行上述各个方法实施例中与接收相关的步骤；处理模块用于执行上述各个方法实施例中除发送和接收步骤之外的其它步骤，本实施例不再一一赘述。
图12示出了本申请一个实施例提供的网元设备的结构示意图，例如，该网元设备可以用于执行上述拒绝服务攻击的解决方法。具体来讲：该网元设备1200可以包括：处理器1201、接收器1202、发射器1203、存储器1204和总线1205。
处理器1201包括一个或者一个以上处理核心，处理器1201通过运行软件程序以及模块，从而执行各种功能应用以及信息处理。
接收器1202和发射器1203可以实现为一个收发器1206，该收发器1206可以是一块通信芯片。
存储器1204通过总线1205与处理器1201相连。
存储器1204可用于存储计算机程序，处理器1201用于执行该计算机程序，以实现上述 方法实施例中的网元设备、接入网实体、核心网网元或核心网实体执行的各个步骤。
其中，发射器1203用于执行上述各个方法实施例中与发送相关的步骤；接收器1202用于执行上述各个方法实施例中与接收相关的步骤；处理器1201用于执行上述各个实施例中除发送和接收步骤之外的其它步骤。
此外，存储器1204可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，易失性或非易失性存储设备包括但不限于：RAM(Random-Access Memory，随机存储器)和ROM(Read-Only Memory，只读存储器)、EPROM(Erasable Programmable Read-Only Memory，可擦写可编程只读存储器)、EEPROM(Electrically Erasable Programmable Read-Only Memory，电可擦写可编程只读存储器)、闪存或其他固态存储其技术，CD-ROM(Compact Disc Read-Only Memory，只读光盘)、DVD(Digital Video Disc，高密度数字视频光盘)或其他光学存储、磁带盒、磁带、磁盘存储或其他磁性存储设备。
在示例性实施例中，还提供了一种网元设备，所述网元设备包括：处理器和存储器，所述存储器存储有计算机程序，所述计算机程序由所述处理器加载并执行以实现如上所述的拒绝服务攻击的解决方法。
本申请还提供一种计算机可读存储介质，所述存储介质中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由处理器加载并执行以实现上述方法实施例提供的拒绝服务攻击的解决方法。
可选地，本申请还提供了一种计算机程序产品，所述计算机程序产品包括计算机指令，该计算机指令存储在计算机可读存储介质中。计算机设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该计算机设备执行上述方面提供的拒绝服务攻击的解决方法。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (31)

  1. 一种拒绝服务攻击的解决方法，执行于会话管理功能，其特征在于，所述方法包括：
    会话管理功能SMF向用户平面功能UPF发送包检测规则PDR和服务质量流实施规则QER，所述PDR用于识别终端发送的目标数据包，所述QER用于限制所述目标数据包的发送；
    其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
  2. 根据权利要求1所述的方法，其特征在于，所述QER包括：第一QER；
    所述第一QER是用于限制所述目标数据包的最大上行比特速率的QER。
  3. 根据权利要求2所述的方法，其特征在于，所述目标数据包包括不同类型；
    所述最大上行比特速率包括至少两个最大上行比特速率，所述至少两个最大上行比特速率分别适用于不同类型的所述目标数据包。
  4. 根据权利要求2所述的方法，其特征在于，所述最大上行比特速率包括如下至少之一：
    终端的聚合最大上行比特速率AMBR；
    协议数据单元PDU会话的AMBR；
    服务质量QoS流的最大上行比特速率MBR。
  5. 根据权利要求1所述的方法，其特征在于，所述QER包括：第二QER；
    所述第二QER是用于指示所述UPF停止对所述目标数据包进行转发的QER。
  6. 根据权利要求5所述的方法，其特征在于，所述第二QER还包括：回退时间；所述回退时间是指示所述UPF停止对所述目标数据包进行转发的时长。
  7. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    所述SMF向所述UPF发送第三QER，所述第三QER是用于指示所述UPF恢复对所述目标数据包进行转发的QER。
  8. 根据权利要求1至7任一所述的方法，其特征在于，所述目标数据包包括域名系统DNS查询数据包，所述PDR包括第一PDR，所述第一PDR用于识别所述DNS查询数据包。
  9. 根据权利要求8所述的方法，其特征在于，所述第一PDR包括如下至少之一：
    数据包类型为用户数据报协议UDP数据包且所述UDP数据包的目的端口号为53；
    所述数据包类型为所述UDP数据包、所述UDP数据包的目的网际互连协议IP地址为所述EASDF的IP地址且所述UDP数据包的目的端口号为53；
    所述数据包类型为传输控制协议TCP数据包且所述TCP数据包的目的端口号为853；
    所述数据包类型为TCP数据包、所述TCP数据包的目的IP地址为所述EASDF的IP地址、且所述TCP数据包的目的端口为853或443。
  10. 根据权利要求1至7任一所述的方法，其特征在于，所述目标数据包包括DHCP请求数据包；所述PDR包括第二PDR，所述第二PDR用于识别所述DHCP请求数据包。
  11. 根据权利要求10所述的方法，其特征在于，所述第二PDR包括：
    数据包类型为用户数据报协议UDP数据包且所述UDP数据包的目的端口号为68。
  12. 根据权利要求1至11任一所述的方法，其特征在于，所述SMF向UPF发送PDR和QER，包括：
    所述SMF向协议数据单元会话锚PSA UPF发送所述PDR和所述QER，所述PSA UPF是与数据网络DN连接的UPF；
    或，
    在存在串接的至少两个中间UPF的情况下，所述SMF向第一中间UPF发送所述PDR和所述QER，所述第一中间UPF是所述至少两个中间UPF中的任意一个UPF。
  13. 根据权利要求1至11任一所述的方法，其特征在于，所述PDR和所述QER携带在N4会话建立请求中或N4会话修改请求中。
  14. 一种拒绝服务攻击的解决方法，执行于用户平面功能，其特征在于，所述方法包括：
    用户平面功能UPF接收会话管理功能SMF发送的包检测规则PDR和服务质量流实施规则QER；
    所述UPF根据所述PDR识别终端发送的目标数据包；
    所述UPF根据所述QER限制所述目标数据包的发送；
    其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
  15. 根据权利要求14所述的方法，其特征在于，所述QER包括：第一QER；所述UPF根据QER限制所述目标数据包的发送，包括：
    所述UPF根据所述第一QER限制所述目标数据包的最大上行比特速率。
  16. 根据权利要求15所述的方法，其特征在于，所述目标数据包包括不同类型；
    所述最大上行比特速率包括至少两个最大上行比特速率，所述至少两个最大上行比特速率分别适用于不同类型的所述目标数据包。
  17. 根据权利要求15所述的方法，其特征在于，所述最大上行比特速率包括如下至少之一：
    终端的聚合最大上行比特速率AMBR；
    协议数据单元PDU会话的AMBR；
    服务质量QoS流的最大上行比特速率MBR。
  18. 根据权利要求14所述的方法，其特征在于，所述QER包括：第二QER；
    所述UPF根据QER限制所述目标数据包的发送，包括：
    所述UPF根据所述第二QER停止对所述目标数据包进行转发。
  19. 根据权利要求18所述的方法，其特征在于，所述第二QER还包括：回退时间；
    所述UPF根据所述第二QER停止对所述目标数据包进行转发，包括：
    所述UPF在所述回退时间超时前，停止对所述目标数据包进行转发。
  20. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    所述UPF接收所述SMF发送的第三QER；
    所述UPF根据所述第三QER恢复对所述目标数据包进行转发。
  21. 根据权利要求14至20任一所述的方法，其特征在于，所述目标数据包包括域名系统DNS查询数据包，所述PDR包括第一PDR，所述第一PDR用于识别所述DNS查询数据包。
  22. 根据权利要求21所述的方法，其特征在于，所述第一PDR包括如下至少之一：
    数据包类型为用户数据报协议UDP数据包且所述UDP数据包的目的端口号为53；
    所述数据包类型为所述UDP数据包、所述UDP数据包的目的网际互联协议IP地址为所述EASDF的IP地址且所述UDP数据包的目的端口号为53；
    所述数据包类型为传输控制协议TCP数据包且所述TCP数据包的目的端口号为853；
    所述数据包类型为TCP数据包、所述TCP数据包的目的IP地址为所述EASDF的IP地址、且所述TCP数据包的目的端口为853或443。
  23. 根据权利要求14至20任一所述的方法，其特征在于，所述目标数据包包括DHCP请求数据包；所述PDR包括第二PDR，所述第二PDR用于识别所述DHCP请求数据包。
  24. 根据权利要求23所述的方法，其特征在于，所述第二PDR包括：
    数据包类型为用户数据报协议UDP数据包且所述UDP数据包的目的端口号为68。
  25. 根据权利要求14至24任一所述的方法，其特征在于，
    所述UPF是协议数据单元会话锚PSA UPF，所述PSA UPF是与数据网络DN连接的UPF；
    或，
    所述UPF是第一中间UPF，所述第一中间UPF是串联的至少两个中间UPF中的任意一 个UPF。
  26. 根据权利要求14至24任一所述的方法，其特征在于，所述PDR和所述QER携带在N4会话建立请求中或N4会话修改请求中。
  27. 一种拒绝服务攻击的解决装置，其特征在于，所述装置包括：
    发送模块，用于向用户平面功能UPF发送包检测规则PDR和服务质量流实施规则QER，所述PDR用于识别终端发送的目标数据包，所述QER用于限制所述目标数据包的发送；
    其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
  28. 一种拒绝服务攻击的解决装置，其特征在于，所述装置包括：
    接收模块，用于接收会话管理功能SMF发送的包检测规则PDR和服务质量流实施规则QER；
    处理模块，用于根据所述PDR识别终端发送的目标数据包；以及根据所述QER限制所述目标数据包的发送；
    其中，所述目标数据包是触发目标核心网网元向所述SMF发起所述拒绝服务攻击的数据包。
  29. 一种网元设备，其特征在于，所述网元设备包括：处理器和存储器，所述存储器存储有计算机程序，所述计算机程序由所述处理器加载并执行以实现如权利要求1至26任一所述的拒绝服务攻击的解决方法。
  30. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，所述计算机程序由处理器加载并执行以实现如权利要求1至26任一所述的拒绝服务攻击的解决方法。
  31. 一种计算机程序产品，包括计算机程序，其特征在于，该计算机程序被处理器执行时实现权利要求1至26中任一项所述的方法的步骤。
PCT/CN2022/078319 2021-04-02 2022-02-28 拒绝服务攻击的解决方法、装置、设备、介质和计算机程序产品 WO2022206251A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/989,494 US20230088071A1 (en) 2021-04-02 2022-11-17 Method and apparatus for solving denial-of-service attack, device, medium, and computer program product

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110363831.5A CN113114649B (zh) 2021-04-02 2021-04-02 拒绝服务攻击的解决方法、装置、设备及介质
CN202110363831.5 2021-04-02

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/989,494 Continuation US20230088071A1 (en) 2021-04-02 2022-11-17 Method and apparatus for solving denial-of-service attack, device, medium, and computer program product

Publications (1)

Publication Number Publication Date
WO2022206251A1 true WO2022206251A1 (zh) 2022-10-06

Family

ID=76713851

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/078319 WO2022206251A1 (zh) 2021-04-02 2022-02-28 拒绝服务攻击的解决方法、装置、设备、介质和计算机程序产品

Country Status (3)

Country Link
US (1) US20230088071A1 (zh)
CN (2) CN117579376A (zh)
WO (1) WO2022206251A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117579376A (zh) * 2021-04-02 2024-02-20 腾讯科技（深圳）有限公司 拒绝服务攻击的解决方法、装置、设备及介质
CN116527792B (zh) * 2023-06-21 2023-09-12 亚信科技（中国）有限公司 识别报文的方法、装置、设备、可读存储介质及程序产品

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111431882A (zh) * 2020-03-18 2020-07-17 惠州Tcl移动通信有限公司 数据处理方法、装置及存储介质
CN111526132A (zh) * 2020-04-08 2020-08-11 上海沪景信息科技有限公司 攻击转移方法、装置、设备及计算机可读存储介质
CN112105053A (zh) * 2019-06-17 2020-12-18 华为技术有限公司 一种拥塞控制方法及装置
WO2021001051A1 (en) * 2019-07-03 2021-01-07 Telefonaktiebolaget Lm Ericsson (Publ) Establishing a packet forwarding control protocol session
CN112314032A (zh) * 2018-06-22 2021-02-02 华为技术有限公司 通过使多个策略以信息元素为条件优化用户设备操作
CN113114649A (zh) * 2021-04-02 2021-07-13 腾讯科技（深圳）有限公司 拒绝服务攻击的解决方法、装置、设备及介质

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106534048A (zh) * 2015-09-11 2017-03-22 中国电信股份有限公司 一种防范sdn拒绝服务攻击的方法、交换机和系统
DK3306887T3 (da) * 2016-10-10 2021-01-04 Ntt Docomo Inc Fremgangsmåde til etablering af en forbindelse af en mobilterminal til et mobilradiokommunikationsnetværk og kommunikationsnetværksindretning
CN108934007B (zh) * 2017-05-25 2022-03-25 中兴通讯股份有限公司 一种upf重选的策略控制方法、pcf及smf
US10681072B2 (en) * 2017-08-31 2020-06-09 Blackberry Limited Method and system for user plane traffic characteristics and network security
CN110048873A (zh) * 2018-01-16 2019-07-23 华为技术有限公司 多锚点协议数据单元会话的策略控制的方法和通信装置
US10887944B2 (en) * 2018-08-20 2021-01-05 Telefonaktiebolaget Lm Ericsson (Publ) User plane function control of control plane-user plane separation
US11330667B2 (en) * 2019-05-03 2022-05-10 Ofinno, Llc Group communication signaling overload mitigation
CN112437456B (zh) * 2020-12-07 2023-05-26 中国联合网络通信集团有限公司 一种非公共网络中的通信方法及设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112314032A (zh) * 2018-06-22 2021-02-02 华为技术有限公司 通过使多个策略以信息元素为条件优化用户设备操作
CN112105053A (zh) * 2019-06-17 2020-12-18 华为技术有限公司 一种拥塞控制方法及装置
WO2021001051A1 (en) * 2019-07-03 2021-01-07 Telefonaktiebolaget Lm Ericsson (Publ) Establishing a packet forwarding control protocol session
CN111431882A (zh) * 2020-03-18 2020-07-17 惠州Tcl移动通信有限公司 数据处理方法、装置及存储介质
CN111526132A (zh) * 2020-04-08 2020-08-11 上海沪景信息科技有限公司 攻击转移方法、装置、设备及计算机可读存储介质
CN113114649A (zh) * 2021-04-02 2021-07-13 腾讯科技（深圳）有限公司 拒绝服务攻击的解决方法、装置、设备及介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
HUAWEI: "Aligning "MO Exception data" handling with stage 2 - UPF", 3GPP DRAFT; C4-203012, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. CT WG4, no. E-Meeting; 20200602 - 20200612, 13 May 2020 (2020-05-13), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France , XP051882735 *

Also Published As

Publication number Publication date
CN113114649B (zh) 2024-01-05
CN113114649A (zh) 2021-07-13
US20230088071A1 (en) 2023-03-23
CN117579376A (zh) 2024-02-20

Similar Documents

Publication Publication Date Title
US10979893B2 (en) Identifying and controlling remote user equipment on network side
US20210219105A1 (en) Communications method and apparatus
TWI816160B (zh) 在傳訊平面上傳送小資料ｎａｓ協定之增強的裝置及方法
WO2022206251A1 (zh) 拒绝服务攻击的解决方法、装置、设备、介质和计算机程序产品
JP2020025366A (ja) ＰｒｏＳｅ通信のための優先度ハンドリング
CN113114651B (zh) 报告控制方法、装置、设备及介质
CN108601043B (zh) 用于控制无线接入点的方法和设备
JP2017121081A (ja) ネットワークへの接続性を制御する方法および装置
WO2021184783A1 (zh) 实现网络能力开放的方法、装置、电子设备和存储介质
US9906450B2 (en) Method and system for handling error indications
TW201644238A (zh) 用於服務－使用者平面方法的使用網路符記的高效策略實施
WO2022206252A1 (zh) 一种网络攻击的处理方法、装置、设备、计算机可读存储介质及计算机程序产品
WO2014186964A1 (zh) 数据传输方法、装置及系统
WO2014094432A1 (zh) 深度报文检测结果扩散方法及装置
TW200926668A (en) A method of performing polling procedure in a wireless communication system
WO2021244449A1 (zh) 一种数据处理方法及装置
EP3637703B1 (en) Message transmission methods and proxy servers
WO2012048656A1 (zh) Eps系统的会话管理过程的重发起方法和设备
EP4156770A1 (en) Communication method, apparatus and system
GB2493130A (en) SIP server overload control
US20210168614A1 (en) Data Transmission Method and Device
WO2009026824A1 (fr) Procédé, dispositif et système pour transférer des messages multiplex
WO2023133691A1 (zh) Drx配置方法、装置、设备及介质
WO2023174100A1 (zh) 通信方法及通信装置
KR102650241B1 (ko) 세션 제어 장치 및 데이터 전송 장치, 그 장치에서 수행되는 QoS 제어 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22778436

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE