WO2022206462A1

WO2022206462A1 - Signaling message processing method, apparatus, and system

Info

Publication number: WO2022206462A1
Application number: PCT/CN2022/082102
Authority: WO
Inventors: 邵国强
Original assignee: 华为技术有限公司
Priority date: 2021-03-30
Filing date: 2022-03-21
Publication date: 2022-10-06
Also published as: CN115150820A

Abstract

Embodiments of the present application provide a signaling message processing method. In the signaling message processing method, an edge security gateway in a first operator network receives an edge security gateway information list of a second operator network, and selects one edge security gateway in the edge security gateway list as a third edge security gateway. The third edge security gateway may share a signaling message processing task with a second edge security gateway, so as to implement load balancing among a plurality of edge security gateways in the second operator network.

Description

A signaling message processing method, device and system

This application claims the priority of the Chinese patent application with the application number 202110342633.0 and the application title "A Signaling Message Processing Method, Device and System" submitted to the State Intellectual Property Office of China on March 30, 2021, the entire contents of which are approved by Reference is incorporated in this application.

technical field

The present application relates to the field of communication technologies, and in particular, to a signaling message processing method, system, and device.

Background technique

The ^3rd generation partnership project (3GPP) defines a security and edge protection proxy ( ^SEPP ) device as the edge security gateway of the 5th generation core network (5GC). SEPP acts as a proxy device for docking between operator networks, enabling the signaling interaction between the network function (NF) network element and the roaming partner (RP), through initiating SEPP (initiating SEPP) and responding SEPP (responding) The interaction between SEPP) is realized. Among them, the initiating SEPP and the responding SEPP are connected by the N32 interface.

Among them, the initiating SEPP and the responding SEPP need to negotiate the shared secret key and encryption algorithm through the handshake process. After the negotiation is completed, the signaling interaction is performed according to the N32 forwarding interface (N32-f) context. On the one hand, in a scenario where multiple SEPPs share a fully qualified domain name (FQDN), only one N32-f context is generated for multiple SEPPs. Each signaling message must carry a message sequence number, and the sequence number is not repeated in the same N32-f context. In the scenario where multiple SEPPs share the FQDN, there is only one N32-f context, which may limit the concurrent processing of signaling messages by SEPPs.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a signaling message processing method and apparatus, and the signaling message processing method can implement load balancing among multiple SEPPs in the same operator network.

In a first aspect, an embodiment of the present application provides a signaling message processing method, and the method is executed by a first border security gateway. The first border security gateway receives the border security gateway information list of the operator network where the second border security gateway is located, and selects a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located. The first border security gateway sends an encrypted signaling message to the third border security gateway. It can be seen that the border security gateway in the first operator's network can choose one from the list as the third border security gateway, and the third border security gateway can share the signaling message processing task with the second border complete gateway, so as to realize the second border security gateway. Load balancing among multiple border security gateways in a carrier network.

In one possible design, the first border security gateway sends a signaling message encrypted with the N32-f context to the third border security gateway, or sends a signaling message encrypted with a transport layer security key to the third border security gateway . It can be seen that, for different SEPP interconnection schemes, this embodiment defines an encryption method of signaling messages between SEPPs, which is beneficial to ensure the security of information transmission.

In a possible design, the first border security gateway sends a border security gateway information list of the operator network where the first border security gateway is located to the second border security gateway. Wherein, the border security gateway information list of the operator network where the first border security gateway is located includes the fourth border security gateway. The second border security gateway sends the signaling message using the N32-f context of the fourth border security gateway. It can be seen that the border security gateway in the second operator's network can send signaling messages to the pre-assigned border security gateways in the first operator's network (that is, the border security gateways in the list), so as to realize multiple borders in the first operator's network. Load balancing between security gateways. That is, the border security gateway in the first operator's network and the border security gateway in the second operator's network may implement similar functions.

In a possible design, if an associated N32-f context is not created between the first border security gateway and the third border security gateway, the first border security gateway negotiates with the third border security gateway to obtain the N32-f context, and The signaling message is sent using the N32-f context obtained through negotiation.

In a possible design, if an associated N32-f context has been created between the first border security gateway and the third border security gateway, the first border security gateway sends a signaling message by using the associated N32-f context.

In a possible design, the first border security gateway receives the first message from the second border security gateway when performing the N32-C handshake with the second border security gateway.

In one possible design, the encrypted signaling message is forwarded to the third border security gateway through the IPX device.

In one possible design, the border security gateway information list includes priorities for multiple border security gateways. The first border security gateway selects the third border security gateway with the highest priority from the border security gateway information list of the operator network where the second border security gateway is located. It can be seen that the pre-allocated border security gateway in the second operator network is the border security gateway with the highest priority, that is, the first border security gateway preferentially sends signaling messages to the third border security gateway with a high priority, which is conducive to balancing the network load .

In one possible design, the border security gateway information list includes weights for a plurality of border security gateways. The first border security gateway selects the third border security gateway with the highest weight from the border security gateway information list of the operator network where the second border security gateway is located. It can be seen that the pre-allocated border security gateway in the second operator network is the border security gateway with the highest weight, that is, the first border security gateway preferentially sends signaling messages to the third border security gateway with a high weight, which is conducive to balancing the network load.

In one possible design, the border security gateway information list includes identifiers of multiple border security gateways. The identifier of the border security gateway is any information that identifies a border security gateway, such as a fully qualified domain name, IP address, or serial number.

In a possible design, the first border security gateway receives the first message through the N32-c channel, where the first message includes the border security gateway information list of the operator network where the second border security gateway is located. The first message is an N32-c message.

In one possible design, the border security gateway information list includes a timestamp. If the first border security gateway has recorded the border security gateway information list, the first border security gateway updates the recorded border security gateway information list to the border security gateway information list of the operator network where the second border security gateway is located under the current timestamp . The first border security gateway sends a 200 OK message to the second border security gateway.

In a possible design, if the first border security gateway does not record the border security gateway information list, the first border security gateway records the border security gateway information list of the operator network where the second border security gateway is located under the current timestamp.

In a possible design, if the first border security gateway cannot identify the first message, or the first border security gateway cannot record the border security gateway information list of the operator network where the second border security gateway is located, the first border security gateway sends a message to the The second border security gateway sends an error response message.

In a possible design, the first border security gateway selects a third border security gateway with the least occupied load from the border security gateway information list of the operator network where the second border security gateway is located. It can be seen that the pre-allocated border security gateway in the second operator network is the border security gateway with the least occupied load, that is, the first border security gateway preferentially sends a signaling message to the third border security gateway with the least occupied load, there are Conducive to balancing network load.

In a possible design, the first border security gateway updates the load information of the third border security gateway in the border security gateway information list according to the traffic occupied by sending signaling messages. It can be seen that the third border security gateway can dynamically refresh the load information, so that the first border security gateway can dynamically adjust the load sent to the border security gateway in the second operator's network.

In a possible design, the first border security gateway uses the N32-f context of the third border security gateway to encrypt the signaling message, and sends the encrypted signaling message to the third border security gateway.

In a possible design, the N32-f context includes the context identifier, the N32-f peer information, and the N32-f security context. The context identifier is used to identify the N32-f context, and both the first border security gateway and the second border security gateway can find the corresponding N32-f context according to the context identifier after negotiating to generate the N32-f context. N32-f peer information includes peer SEPP information (SEPP identifier, address, operator network identifier). For example, the N32-f peer information in the local N32-f context of the first border security gateway includes the identifier and address of the second border security gateway and the identifier of the operator network where the second border security gateway is located. Correspondingly, the N32-f peer information in the local N32-f context of the second border security gateway includes the identifier and address of the first border security gateway and the identifier of the operator network where the first border security gateway is located.

In one possible design, the N32-f security context includes security-related information. For example, the N32-f security context includes a session key for communication between the first border security gateway and the second border security gateway, an algorithm suite negotiated between the first border security gateway and the second border security gateway, and a security information list of IP exchange services (IPX ID, public key, etc.). The first border security gateway may encrypt the signaling message using the session key in the N32-f security context, and then send the encrypted signaling message to the second border security gateway.

In a possible design, the first border security gateway receives the signaling message sent by the network function NF network element (or device). Subsequently, the first border security gateway encrypts the received signaling message, and sends the encrypted signaling message to the third border security gateway. Therefore, in the solution provided by this embodiment, the signaling message sent by the NF can be encrypted by the first border security gateway and sent to the third border security gateway for processing.

In a second aspect, the embodiment of the present application provides another signaling message processing method, and the method is executed by the first border security gateway. The first border security gateway receives signaling messages from the second border security gateway. The first border security gateway acquires the N32-f context shared among multiple border security gateways in the operator's network, and uses the shared N32-f context to process the received signaling message. Wherein, the plurality of border security gateways include the first border security gateway. It can be seen that the N32-f context can be shared among multiple border security gateways in the same operator network, so that signaling messages from the external operator network can be distributed evenly among the multiple border security gateways in the same operator network.

In a possible design, the first border security gateway establishes a transport layer security link with the first network function network element, encrypts the signaling message with the transport layer security key, and sends the encryption process to the first network function network element subsequent signaling messages. It can be seen that the border security gateway can use the transport layer security key to encrypt the signaling message, and send the encrypted signaling message to the destination network function network element of the signaling message.

In a third aspect, an embodiment of the present application provides a signaling message processing method, and the method is executed by a network function NF network element. The network function network element obtains a border security gateway information list of the operator's network, and selects a border security gateway (referred to as a fourth border security gateway in this aspect) from the border security gateway information list. Subsequently, the network function network element sends an encrypted signaling message to the fourth border security gateway. It can be seen that the NF can choose one from the list as the fourth border security gateway, that is, multiple border security gateways in the list can share the signaling message processing task, so as to realize the communication between multiple border security gateways in the operator network. load balancing.

In one possible design, the NF sends a signaling message encrypted with a transport layer security key to the fourth border security gateway. It can be seen that this embodiment uses the transport layer security key to encrypt the signaling message, which is beneficial to ensure the security of information transmission.

In one possible design, the NF selects the fourth border security gateway from the border security gateway information list in the same manner as the first border full gateway selects the third border security gateway from the border security gateway information list in the first aspect , such as selecting the border security gateway with the highest priority or weight. For a specific implementation manner, reference is made to the content of the above-mentioned first aspect, and details are not repeated here.

In a possible design, the NF may receive a list of border security gateway information of the operator's network where the first security border gateway is located. At this time, the NF and the first border security gateway belong to the same operator network.

In a possible design, the NF can obtain the list of border security gateway information of the operator's network where it is located from the local configuration or the network repository function (NRF). At this point, NF and NRF belong to the same operator network.

In one possible design, the border security gateway information list includes a timestamp. If the NF has recorded the border security gateway information list, the NF updates the recorded border security gateway information list to the border security gateway information list under the current timestamp, so that the local border security gateway information list of the NF is up-to-date.

In a possible design, if the NF does not record the border security gateway information list, the NF records the border security gateway information list of the operator network where the current timestamp is located.

In a possible design, if the NF cannot identify the first message, or the NF cannot record (update) the border security gateway information list, the NF sends an error response message to the first border security gateway.

In a possible design, the first border security gateway updates the load information of the fourth border security gateway in the border security gateway information list according to the traffic occupied by sending signaling messages. It can be seen that the fourth border security gateway can dynamically refresh the load information, so that the NF dynamically adjusts the load sent to the border security gateway of the local operator network.

In a fourth aspect, an embodiment of the present application provides a signaling message processing apparatus, where the signaling message processing apparatus includes a transceiver unit and a processing unit. The transceiver unit is configured to receive a first message from the second border security gateway, where the first message includes a border security gateway information list of the operator network where the second border security gateway is located. The processing unit is configured to select the third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located. The transceiver unit is further configured to send encrypted signaling messages to the third border security gateway.

In a possible design, the transceiver unit is configured to send encrypted signaling messages to the third border security gateway, including:

The signaling message encrypted using the N32-f context is sent to the third border security gateway or the signaling message encrypted using the transport layer security key is sent to the third border security gateway.

In a possible design, the transceiver unit is further configured to send a second message to the second border security gateway, where the second message includes a border security gateway information list of the operator network where the first border security gateway is located.

In a possible design, the transceiver unit is further configured to use the N32-f context of the third border security gateway to send a signaling message to the third border security gateway, including:

If the associated N32-f context is not established between the first border security gateway and the third border security gateway, the transceiver unit negotiates with the third border security gateway to obtain the N32-f context, and uses the negotiated N32-f context to send signaling information.

In a possible design, the border security gateway information list includes: priorities of multiple border security gateways. The processing unit is configured to select the third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

The third border security gateway with the highest priority is selected from the border security gateway information list of the operator network where the second border security gateway is located.

In a possible design, the border security gateway information list includes: weights of multiple border security gateways. The processing unit is configured to select the third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

The third border security gateway with the highest weight is selected from the border security gateway information list of the operator network where the second border security gateway is located.

In a possible design, the transceiver unit is configured to receive the first message from the second border security gateway, including:

The information list of the border security gateway of the operator network where the second border security gateway is located is received through the N32-c channel.

In one possible design, the border security gateway information list includes: a timestamp. The processing unit is further configured to, if the processing unit has recorded the border security gateway information list, update the recorded border security gateway information list to the border security gateway information list of the operator network where the second border security gateway is located under the current timestamp. The transceiver unit is further configured to send a 200 OK message to the second border security gateway.

In a possible design, the processing unit is further configured to send an error response to the second border security gateway if the processing unit cannot identify the first message, or cannot record the border security gateway information list of the operator network where the second border security gateway is located information.

In a possible design, the processing unit is configured to select the third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

The third border security gateway with the least occupied load is selected from the border security gateway information list of the operator network where the second border security gateway is located.

In a possible design, the processing unit is configured to update the load information of the third border security gateway in the border security gateway information list according to the traffic occupied by sending the signaling message.

In a possible design, the transceiver unit is configured to use the N32-f context of the third border security gateway to send a signaling message to the third border security gateway, including:

The signaling message is encrypted using the N32-f context of the third border security gateway, and the encrypted signaling message is sent to the third border security gateway.

In a possible design, the transceiver unit in the first border security gateway is further configured to receive a signaling message sent by the network function device, and the processing unit is further configured to encrypt the received signaling message. Further, the transceiver unit sends the encrypted signaling message to the third border security gateway.

In a fifth aspect, an embodiment of the present application provides a signaling message processing apparatus, where the signaling message processing apparatus may be a device or a chip or circuit provided in the device. The signaling message processing apparatus includes units and/or modules for executing the signaling message processing method provided in any one of the possible designs of the first, second, and third aspects, and thus can also implement the first aspect The provided signaling message processing method has the beneficial effects.

In a sixth aspect, embodiments of the present application provide a computer-readable storage medium, where the readable storage medium includes a program or an instruction, and when the program or instruction is run on a computer, causes the computer to execute the first, second, or third A method in any of the possible implementations of an aspect.

In a seventh aspect, an embodiment of the present application provides a chip or a chip system, the chip or chip system includes at least one processor and an interface, the interface and the at least one processor are interconnected through a line, and the at least one processor is used for running a computer program or instruction, to perform the method described in any one of the possible implementations of the first, second or third aspect.

Wherein, the interface in the chip may be an input/output interface, a pin or a circuit, or the like.

The chip system in the above aspects may be a system on chip (system on chip, SOC), or a baseband chip, etc., where the baseband chip may include a processor, a channel encoder, a digital signal processor, a modem, an interface module, and the like.

In a possible implementation, the chip or chip system described above in this application further includes at least one memory, where instructions are stored in the at least one memory. The memory may be a storage unit inside the chip, such as a register, a cache, etc., or a storage unit of the chip (eg, a read-only memory, a random access memory, etc.).

In an eighth aspect, the embodiments of the present application provide a computer program or a computer program product, including codes or instructions, when the codes or instructions are run on a computer, the computer may execute any one of the first, second, or third aspects. method in the implementation.

In a ninth aspect, this embodiment further provides a communication system, which includes the network function NF and a border security gateway as described above.

In the solution provided by any of the above aspects, the N32-f context may be an N32-f security context.

In the technical solution of any of the above aspects, the signaling message may be a roaming message.

In the technical solution of any of the above aspects, the signaling message may be a service discovery request or a network slicing request.

In any of the above technical solutions, the network function NF device may be a session management function (SMF), a user plane function (UPF), a policy control function (PCF), or a connection Access and mobility management function (AMF) and other equipment in the 5G core network.

Description of drawings

FIG. 1a and FIG. 1b are schematic diagrams of network scenarios provided by embodiments of the present application;

FIG. 2 is a schematic flowchart of a signaling message processing method provided by an embodiment of the present application;

3 is a schematic flowchart of another signaling message processing method provided by an embodiment of the present application;

4 is a schematic flowchart of still another signaling message processing method provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of another network scenario provided by an embodiment of the present application;

6 is a schematic flowchart of another signaling message processing method provided by an embodiment of the present application;

7 is a schematic flowchart of sharing N32-f context between border security gateways in the same operator network according to an embodiment of the present application;

FIG. 8 is another schematic flowchart of sharing N32-f context between border security gateways in the same operator network provided by an embodiment of the present application;

9 is a schematic diagram of a signaling message processing apparatus provided by an embodiment of the present application;

FIG. 10 is a schematic diagram of a server provided by an embodiment of the present application;

11 is a schematic diagram of another signaling message processing apparatus provided by an embodiment of the present application;

FIG. 12 is a schematic diagram of another server provided by an embodiment of the present application.

Detailed ways

In the embodiments of the present application, words such as "exemplary" or "for example" are used to represent examples, illustrations or illustrations. Any embodiments or designs described in the embodiments of the present application as "exemplary" or "such as" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present the related concepts in a specific manner.

In the embodiments of the present application, the terms "second" and "first" are only used for description purposes, and cannot be understood as indicating or implying relative importance or implying the number of indicated technical features. Thus, a feature defined as "second" or "first" may expressly or implicitly include one or more of that feature. In the description of this application, unless stated otherwise, "plurality" means two or more.

In the embodiments of this application, the term "plurality" refers to two or more than two. For example, a plurality of first border security gateways refers to two or more first border security gateways.

It is to be understood that the terminology used in describing the various described examples herein is for the purpose of describing particular examples and is not intended to be limiting. As used in the description of the various described examples and the appended claims, the singular forms "a", "an")" and "the" are intended to include the plural forms as well, unless the context dictates otherwise. clearly instructed.

It should be understood that, in each embodiment of the present application, the size of the sequence number of each process does not mean the sequence of execution, and the execution sequence of each process should be determined by its function and internal logic, rather than the implementation of the embodiments of the present application The process constitutes any qualification.

It is to be understood that the terms "includes" (also referred to as "includes", "including", "comprises" and/or "comprising") when used in this specification designate the presence of stated features, integers, steps, operations, elements, and/or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groupings thereof.

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application.

The 3rd Generation Partnership Project defines the security and border proxy SEPP as the border security gateway of the fifth generation mobile communication core network. SEPP acts as a docking agent between operator networks, enabling the signaling interaction between network function NF network elements and roaming partners, through the interaction between initiating SEPP (initiating SEPP) and responding SEPP (responding SEPP). Among them, the interface between SEPPs is defined as the N32 interface, and all messages across the operator network during roaming need to be forwarded through the N32 interface. SEPP needs to provide information message access and security protection capabilities for roaming scenarios.

Among them, the initiating SEPP and the responding SEPP need to negotiate the shared secret key and encryption algorithm through the handshake process. After the negotiation is completed, the signaling interaction is performed according to the N32 forwarding interface (N32-f) context. Currently, there are two scenarios in which multiple SEPPs are deployed: scenarios where multiple SEPPs share fully qualified domain name FQDNs, and scenarios where multiple SEPPs use different FQDNs.

For example, in a scenario where multiple SEPPs share an FQDN, one N32-f context is generated for multiple SEPPs. Each message must carry a message sequence number, which does not repeat in the same N32-f context. There is only one N32-f context in the scenario where multiple SEPPs share the FQDN, which may limit the concurrent processing of signaling messages. For another example, in a scenario where multiple SEPPs do not share the FQDN, the initiating SEPP can only perform signaling interaction with the responding SEPP that negotiates to generate the N32-f context, which may result in different loads between SEPPs in the operator network where the responding SEPP is located. balanced.

In order to solve the above problem, an embodiment of the present application provides a signaling message processing method, which can implement load balancing of multiple SEPPs. This method can be applied to the network scenarios shown in Figure 1a and Figure 1b. The first border security gateway in the embodiment shown in FIG. 1a and FIG. 1b is the SEPP of the first operator's network, and the second border security gateway is the SEPP of the second operator's network. The first operator network and the second operator network may be different operator networks.

The network scenarios shown in Figures 1a and 1b include network functions in the first operator's network, a first border security gateway, an IP exchange service (IP exchange service, IPX), a second border security gateway, and a second operator Network functions in the network. The first border security gateway and the second border security gateway are connected in a direct connection mode or a forwarding mode.

For example, an N32 interconnection security protocol (protocol for N32 interconnect security, PRINS) is used for interaction between the first border security gateway and the second border security gateway in FIG. 1a. The connection between the first border security gateway and the second border security gateway in FIG. 1a is performed in a forwarding mode. The first border security gateway and the second border security gateway create a pair of directly connected transport layer security (TLS) links (tunnels) N32-c, complete mutual authentication with the help of the TLS mechanism, and export based on the TLS link Shared key. The N32-c handshake process is completed between the first border security gateway and the second border security gateway through the TLS link, and the PRINS context is negotiated. Confidentiality and integrity protection of application layer messages through context and shared secret key, and forwarded to peer SEPP through IPX.

For another example, the first border security gateway and the second border security gateway in FIG. 1b are connected in a direct connection mode. A TLS tunnel is established between the first border security gateway and the second border security gateway, and messages are transmitted to each other through the TLS tunnel, thereby ensuring the integrity and confidentiality of the message transmission process. Figures 1a and 1b include a first border security gateway and a second border security gateway, and this network scenario is just an example. In fact, the first operator network may have multiple border security gateways, and the second operator network may also have multiple border security gateways.

Wherein, the network function in the first operator's network and the network function in the second operator's network may include but are not limited to: access and mobility management function AMF, session management function SMF, policy control function PCF, network warehousing function (network warehousing function). repository function, NRF), network slice selection function (network slice selection function, NSSF), etc.

FIG. 2 is a schematic flowchart of a signaling message processing method according to an embodiment of the present application. The method flow is realized by the interaction between the first border security gateway and the second border security gateway, and includes the following steps:

201. The first border security gateway receives a first message from the second border security gateway, where the first message includes a border security gateway information list of the operator network where the second border security gateway is located;

202, the first border security gateway selects a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located;

203. The first border security gateway sends an encrypted signaling message to the third border security gateway.

In the following description, the border security gateway is abbreviated as SEPP. For example, the first border security gateway is the first SEPP, the second border security gateway is the second SEPP, and the border security gateway information list is the SEPP information list. In this embodiment, the first SEPP represents the SEPP in which the network of the first operator is interconnected with the network of the second operator, and the second SEPP represents the SEPP in which the network of the second operator is interconnected with the network of the first operator. It should be understood that the second operator network may further include one or more other SEPPs, and the SEPP information of the other one or more SEPPs is stored in the SEPP information list of the second operator network. The SEPP information list is carried in the first message and sent to the docked first SEPP through the second SEPP, that is, the SEPP information list sent by the second SEPP includes the SEPP information of all SEPPs in the second operator network.

Wherein, the first message includes the SEPP information list of the operator network where the second SEPP is located. The SEPP information list includes separate (respective) SEPP information of a plurality of SEPPs in the operator's network. The respective SEPP information of the plurality of SEPPs may include information indicating the capability of the respective SEPPs to handle the load. That is to say, when the first SEPP receives the first message, the information of multiple SEPPs in the operator network where the second SEPP is located can be obtained. The first SEPP can also select the SEPP to send the signaling message based on the information of the multiple SEPPs, thereby facilitating load balancing among the multiple SEPPs in the operator network where the second SEPP is located.

Wherein, the information of any SEPP in the second operator's network may include fields such as the identifier, priority, weight, etc. of the SEPP. The identity of a SEPP is any information that can identify a SEPP. For example, the identifier of the SEPP is a fully qualified domain name (FQDN) of the SEPP, or an IP address, or a serial number of the SEPP, or the like. The priority of the SEPP or the weight of the SEPP may be used to indicate the ability of the SEPP to handle the load. For example, when the second operator network deploys multiple SEPPs, each SEPP is pre-allocated with a certain processing load capability. The ability of each SEPP to handle the load is indicated by the SEPP's priority or weight. For example, the priority of the second SEPP is the second priority, and the priority of the third SEPP is the first priority. If the first priority is higher than the second priority, it means that the capability of the third SEPP to process the load is higher than the capability of the second SEPP to process the load. When the first SEPP selects to send a message to a certain SEPP from the SEPP information list of the second operator network, the first SEPP preferentially selects the third SEPP from the SEPP information list of the second operator network.

For example, Table 1 is a SEPP information list provided by this embodiment of the present application. In this embodiment, the operator network where the second SEPP is located includes three SEPPs, namely SEPP_1, SEPP_2 and SEPP_3. The identification, priority, and weight of each SEPP are shown in Table 1.

Table 1: A list of SEPP information

序号serial number	SEPP的标识SEPP logo	SEPP的优先级SEPP priority	SEPP的权重SEPP weight
SEPP_1SEPP_1	sepp1.comsepp1.com	第一优先级first priority	第一权重first weight
SEPP_2SEPP_2	sepp2.comsepp2.com	第二优先级second priority	第二权重second weight
SEPP_3SEPP_3	sepp3.comsepp3.com	第三优先级third priority	第三权重third weight

Wherein, Table 1 records information such as identifiers, priorities, and weights of the three SEPPs, so that the first SEPP obtains the respective load processing capabilities of the SEPPs in the second operator's network from Table 1.

Optionally, the SEPP information list further includes loads occupied by each SEPP. For example, the second SEPP may count the respective occupied loads of multiple SEPPs such as the second SEPP, the third SEPP, and the fourth SEPP in the SEPP information list at the current moment. The second SEPP records the respective occupied loads of the multiple SEPPs into the SEPP information list, so that the first SEPP preferentially selects a SEPP with less occupied load from the SEPP information list. For example, the SEPP information list shown in Table 1 can be updated to the SEPP information list shown in Table 2.

Table 2: Alternative SEPP Information List

Among them, compared with Table 1, Table 2 adds the load field occupied by SEPP. This field is used to indicate the occupied load of each SEPP in the second operator's network, that is, to indicate the remaining capacity of each SEPP to handle the load.

Optionally, the SEPP information list further includes a timestamp field. The time stamp indicates the time when the first SEPP records the multiple SEPP information in the SEPP information list. For example, the first SEPP acquires multiple SEPP information of the operator network where the second SEPP is located, records multiple SEPP information of the operator network where the second SEPP is located, and records the current time as a timestamp. For another example, if the first SEPP has previously recorded multiple SEPP information of the operator network where the second SEPP is located, the first SEPP will re-record the multiple SEPP information of the operator network where the second SEPP is located (that is, overwrite the original record), and re-record the multiple SEPP information of the operator network where the second SEPP is located. Record the current moment as a timestamp (update timestamp).

In an implementation manner, the first SEPP may determine the third SEPP for sending the signaling message according to the respective priorities of the multiple SEPPs in the SEPP information list. For example, the first SEPP selects SEPP_1 with the highest priority from the SEPP information list (ie, SEPP_1 is the third SEPP), and uses the N32-f context of SEPP_1 to send a signaling message to SEPP_1. Wherein, the SEPP information list here also includes the second SEPP. If the second SEPP is the SEPP with the highest priority in the SEPP information list, the first SEPP sends a signaling message to the second SEPP by using the N32-f context of the second SEPP. For example, the first SEPP receives the first message from SEPP_1. When SEPP_1 is the SEPP with the highest priority in the SEPP information list, the first SEPP selects SEPP_1 preferentially, and uses the N32-f context of SEPP_1 to send a signaling message to SEPP_1.

In another implementation manner, the first SEPP may determine the third SEPP for sending the signaling message according to the respective weights of the multiple SEPPs in the SEPP information list. For example, the first SEPP selects SEPP_1 with the highest weight from the SEPP information list, and uses the N32-f context of SEPP_1 to send a signaling message to the third SEPP. Wherein, the SEPP information list here also includes the second SEPP. If the second SEPP is the SEPP with the highest weight in the SEPP information list, the first SEPP sends a signaling message to the second SEPP by using the N32-f context of the second SEPP.

Wherein, in the above two implementation manners, when the current load margin of the third SEPP with the highest priority or weight in the operator network where the second SEPP is located is lower than the preset first threshold (or the load is greater than the preset second threshold) ), the first SEPP may select the fourth SEPP with the second highest priority or weight in the operator network where the second SEPP is located, that is, the third SEPP is not selected. By analogy, when the current load margin of the fourth SEPP is lower than the preset first threshold, the first SEPP selects the fifth SEPP with the third highest priority or weight in the operator network where the second SEPP is located. In this manner, it can be avoided that the load processed by the SEPP in the operator network where the second SEPP is located exceeds the load that can be processed by itself, thereby avoiding network congestion.

In an implementation manner, the first SEPP determines the third SEPP for sending the signaling message according to the respective occupied loads of the multiple SEPPs in the SEPP information list. For example, the first SEPP selects SEPP_3 with the least occupied load from the SEPP information list, and sends a signaling message to SEPP_3 using the N32-f context of SEPP_3.

Wherein, in the above three implementation manners, the first SEPP sends an encrypted signaling message to the third SEPP, which may be sending an application layer encrypted signaling message or sending a transport layer encrypted signaling message. In an implementation manner, the first SEPP sends the application-layer encrypted roaming information to the third SEPP is that the first SEPP encrypts the signaling message using the security context in the N32-f context of the third SEPP, and sends the encrypted roaming information to the third SEPP. Encrypted signaling messages. For example, if the SEPP selected by the first SEPP from the SEPP information list is SEPP_1, the first SEPP encrypts the signaling message to be sent by using the security context in the N32-f context of SEPP_1, and sends the encrypted signaling message to SEPP_1. Correspondingly, SEPP_1 receives the encrypted signaling message sent by the first SEPP, and uses the security context in its own N32-f context (its own N32-f context corresponds to the N32-f context of the first SEPP) to the encrypted signaling message. Decrypt the message.

In another implementation manner, the first SEPP sends the transport layer encrypted roaming information to the third SEPP is that the first SEPP encrypts the signaling message with the transport layer security key, and sends the encrypted signaling message to the third SEPP. For example, if no TLS link is established between the first SEPP and the third SEPP, the first SEPP first establishes a TLS link with the third SEPP. The first SEPP then uses the TLS key to encrypt the signaling message, and sends the encrypted signaling message to the third SEPP through the TLS link with the third SEPP.

The signaling message in this embodiment refers to a message carrying a load. This message is a different message from the first message carrying the SEPP information list. For example, the first SEPP uses the N32-f context of the third SEPP to send a signaling message to the third SEPP, where the signaling message carries the load of the first SEPP.

The embodiment of the present application provides a signaling message processing method, and the method is implemented by interaction between SEPPs of two different operator networks. Wherein, the SEPP in the first operator's network selects a SEPP from the SEPP information list of the second operator's network, and sends an encrypted signaling message to the selected SEPP, so as to realize multiple SEPPs in the second operator's network load balancing between.

The application of the signaling message processing method provided by the embodiment of the present application to a static load balancing scenario or a dynamic load balancing scenario is described in detail below. FIG. 3 is a schematic flowchart of another signaling message processing method provided by an embodiment of the present application. The signaling message processing method is applied in a static load balancing scenario. The static load balancing scenario in this embodiment is a static load balancing scenario based on preset priorities or weights. The method flow is realized by the interaction between the first border security gateway and the second border security gateway, and includes the following steps:

301. When performing the N32-C handshake with the first border security gateway, the second border security gateway sends a first message to the first border security gateway, where the first message includes border security gateway information of the operator network where the second border security gateway is located list;

302, the first border security gateway receives and records the border security gateway information list of the operator network where the second border security gateway is located;

303, the first border security gateway sends a 200 OK message to the second border security gateway;

304, when the first border security gateway and the second border security gateway complete the N32-f context negotiation, the first border security gateway marks the second border security gateway in the border security gateway information list as an available border security gateway;

305, when the first border security gateway sends a signaling message to the second border security gateway, the first border security gateway selects a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located;

306. The first border security gateway sends a signaling message to the third border security gateway by using the N32-f context of the third border security gateway.

Wherein, the second SEPP sends the first message to the first SEPP, which may be that the second SEPP sends the first message to the first SEPP through the N32-c channel. That is to say, the first message in this embodiment is an N32-c message. For example, in the N32-c handshake phase, the second SEPP sends an Exchange-LoadControl message to the first SEPP, where the Exchange-LoadControl message includes a SEPP information list. For the SEPP information list, reference is made to the description of the SEPP information list in the embodiment of FIG. 2 , and details are not repeated here.

Optionally, before step 301, when multiple SEPPs are deployed in the operator network where the second SEPP is located, and the FQDNs of the SEPPs are different, different processing load capabilities may be allocated to different SEPPs in advance. For example, SEPP_1 , SEPP_2 and SEPP_3 are deployed in the operator network where the second SEPP is located, and SEPP_1 , SEPP_2 and SEPP_3 will be assigned different weights, as shown in Table 1. Based on the above-mentioned step of pre-allocating the processing load capability of each SEPP, the network of the operator where the second SEPP is located will determine the SEPP information list of the operator. Wherein, the SEPP information list of the operator network where the second SEPP is located obtained by the second SEPP may be information locally configured by the second SEPP, or may be information obtained through interaction between SEPPs in the operator network. For example, multiple SEPPs in the second operator's network send their respective SEPP information to each other. Any SEPP in the second operator's network (eg, the second SEPP) may record multiple SEPP information in the operator's network, thereby generating a SEPP information list.

The first SEPP receives the SEPP information list of the operator network where the second SEPP is located, and determines whether the SEPP information list of the operator network has been recorded locally. If the first SEPP has locally recorded the SEPP information list of the operator network, the first SEPP updates the SEPP information list of the operator network and records the time stamp. If the first SEPP does not record the SEPP information list of the operator's network locally, the first SEPP records the SEPP information list of the operator's network, and records the time stamp. Optionally, if the first SEPP cannot identify the first message, or the first SEPP cannot record the SEPP information list of the operator network where the second SEPP is located, the first SEPP sends an error response message to the second SEPP. For example, when the first SEPP cannot recognize the first message, the first SEPP sends a 4xx/5xx error response message to the second SEPP. The second SEPP receives the error response message, and will no longer perform the subsequent N32-c negotiation process with the first SEPP.

The N32-f context negotiation is completed between the second SEPP and the first SEPP, and the first SEPP may mark the second SEPP as an available border security gateway. Similarly, N32-f context negotiation is completed between the third SEPP and the first SEPP, and the first SEPP may mark the third SEPP as an available border security gateway. Wherein, for the steps of completing the N32-f context negotiation between the second SEPP and the first SEPP, reference may be made to the relevant description in the protocol standard 3GPP TS 29.500, which will not be repeated here. For example, the SEPP information list of the operator network where the second SEPP is located includes SEPP_1, SEPP_2 and SEPP_3. When SEPP_1, SEPP_2 and SEPP_3 respectively complete N32-f context negotiation with the first SEPP, the first SEPP marks SEPP_1, SEPP_2 and SEPP_3 as available SEPPs. The first SEPP may subsequently send signaling messages to SEPP_1, SEPP_2 and SEPP_3.

When the first SEPP sends a signaling message to the second SEPP, the first SEPP selects the third SEPP from the locally recorded SEPP information list, and uses the context of the third SEPP to send the signaling message to the third SEPP. For a specific implementation manner, reference is made to the description of the corresponding steps in the embodiment of FIG. 2 , which is not repeated here. Wherein, when the first SEPP chooses to send a signaling message to the third SEPP, the signaling messages sent by the first SEPP to the network function in the second operator's network are encrypted and forwarded through the N32f context of the third SEPP.

In this embodiment, the first SEPP of the first operator network may select the designated SEPP according to the preset priority or weight in the SEPP information list of the second operator network, and use the N32-f context of the designated SEPP to communicate with each other. The message is encrypted and then sent, so as to finally achieve load balancing among multiple SEPPs in the second operator's network. It can be seen that in the static load balancing scenario, the signaling messages sent by the first SEPP to the second operator's network are all sent according to the load pre-allocated by the second operator's network.

FIG. 4 is a schematic flowchart of still another signaling message processing method provided by an embodiment of the present application. The signaling message processing method is applied in a dynamic load balancing scenario. The dynamic load balancing scenario in this embodiment is a dynamic load balancing scenario based on load control information (load control information, LCI). Among them, the load control mechanism enables the NF service producer (NF service producer) to send its load information to the NF service consumer (NF service consumer), and the load information reflects the resource operation status of the NF service provider. Similarly, the first SEPP and the second SEPP in this embodiment are regarded as a SEPP service consumer (cSEPP) and a SEPP service provider (pSEPP), respectively, and vice versa. The SEPP supports the 3gpp-Sbi-Lci header field, and load control information can be exchanged between the first SEPP and the second SEPP.

The flow of the signaling message processing method in this embodiment is realized by interaction among the first network function network element, the first border security gateway, the second border security gateway, and the second network function network element. When the first border security gateway is a SEPP service consumer and the second border security gateway is a SEPP service provider, the method includes the following steps:

401. The first border security gateway receives a service request message from a first network function network element, where the service request message includes service information of the first network function network element;

402, the first border security gateway determines the second border security gateway according to the locally recorded border security gateway information list and load control information of the second operator network;

403. The first border security gateway uses the N32-f context of the second border security gateway to send an N32-f request message to the second border security gateway, where the N32-f request message includes the boundary of the operator network where the first border security gateway is located. Security gateway information list and load control information, and service information of the first network function network element;

404, the second border security gateway receives the N32-f request message from the first border security gateway, and records the border security gateway information list of the operator network where the first border security gateway is located;

405. The second border security gateway sends the service information of the first network function network element to the second network function network element;

406. The second border security gateway receives a service response message from the second network function network element, where the service response message includes service response information of the second network function network element to the first network function network element;

407. The second border security gateway uses the N32-f context of the first border security gateway to send an N32-f response message to the first border security gateway, where the N32-f response message includes the boundary of the operator network where the second border security gateway is located. Security gateway information list and load control information, and service response information of the second network function network element to the first network function network element;

408, the first border security gateway receives the N32-f response message from the second border security gateway, and updates the border security gateway information list of the operator network where the second border security gateway is located;

409. The first border security gateway sends a service response of the second network function network element to the first network function network element to the first network function network element.

The information exchange between SEPP and NF in this embodiment is based on FQDN, that is, the information exchange between SEPP and NF carries SEPP FQDN and NF FQDN. For example, the first NF queries a domain name system (domain name system, DNS), or queries the NRF, to obtain the IP address corresponding to the first SEPP FQDN. For another example, the first NF directly configures the IP address corresponding to the FQDN locally. The first NF sends the service request message to the address corresponding to the first SEPP FQDN. For another example, the first NF carries the FQDN of the target NF (eg, the second NF) through the 3gpp-Sbi-Target-apiroot field in the service request message, and sends the service request message to the first SEPP. The first SEPP receives the service request message, and obtains the FQDN of the target NF according to 3gpp-Sbi-Target-apiroot in the service request message.

Optionally, according to the capabilities of the NF, the information exchange between the SEPP and the NF is based on FQDN routing. For example, configure FQDN routing on the first NF. The first NF establishes a route with the first SEPP based on the FQDN route. Then the first NF sends the service request message through the route with the first SEPP.

The first SEPP determines the operator network where the target NF is located according to the FQDN of the target NF, and queries whether the local record includes the SEPP information list and load control information of the operator network where the target NF is located (ie, the operator network where the second SEPP is located). When the local record includes the SEPP information list and load control information of the operator network where the second SEPP is located, the first SEPP determines the second SEPP according to the SEPP information list and the load control information. For a specific implementation manner, refer to the corresponding steps in the embodiment of FIG. 2 , which will not be repeated here. When the local record does not include the SEPP information list and load control information of the operator network where the second SEPP is located, the first SEPP sends a first request message to the second SEPP, where the first request message is used to request to obtain the operator network where the second SEPP is located List of SEPP information and load control information. For example, the first SEPP and the second SEPP perform a 32-c handshake process to obtain the SEPP information list and load control information of the operator network where the second SEPP is located.

In this embodiment, compared with the embodiment in FIG. 3 , the first SEPP can not only obtain the SEPP information list of the operator network where the second SEPP is located, but also can obtain the SEPP load control information (SEPP LCI) of the operator network where the second SEPP is located. . For the SEPP information list, reference is made to the corresponding description in the embodiment of FIG. 2 , and details are not repeated here. The load control information includes a load control timestamp (LCT) and a load metric (LM). The LCT parameter is used to indicate when the LCI is generated. For example, the receiver of the LCI uses the LCT to properly sort out the out-of-order LCI. The LM parameter is used to indicate the current load level within the LCI range. For example, the LM parameter of a SEPP is used to indicate the current load level for that SEPP, expressed as a percentage in the range 0 to 100, where 0 means no or 0% load and 100 means that maximum or 100% load has been reached (i.e. no further load available). Optionally, this embodiment chooses to use LCI-based dynamic load balancing, and can also be extended to use Oracle cloud infrastructure (Oracle cloud infrastructure, OCI) parameters for flow control. Based on OCI parameters, load balancing and traffic control in scenarios with excessive traffic can be implemented.

After the first SEPP determines (selects) the second SEPP, the first SEPP uses the N32-f context of the second SEPP to send an N32-f request message to the second SEPP. The N32f request message may also carry service information (load) of the first network function network element. For example, the first NF sends a service request message to the first SEPP, where the service request message includes service information of the first network function network element. Wherein, the first SEPP updates the locally recorded SEPP information list and load control information of the operator network where the second SEPP is located according to the load in the sent N32-f request message. For example, the first SEPP determines to send an N32-f request message to the second SEPP, and the load in the N32-f request message will occupy 10% of the load of the second SEPP. The first SEPP will update the locally recorded load occupied by the second SEPP, from the original 30% load to 40% load. It can be seen that in this embodiment, the cSEPP can update the load of the pSEPP recorded locally in real time, which is beneficial to the subsequent load distribution.

The first SEPP in this embodiment may be either cSEPP or pSEPP. When the first SEPP is pSEPP, the first SEPP can send the SEPP information list and load control information of the operator's network to the second SEPP through the N32-f request message, so that the second SEPP can obtain the SEPP of the operator where the first SEPP is located in advance Relevant information is helpful to achieve load balancing. That is, the second SEPP receives and records the SEPP information list of the operator network where the first SEPP is located in the N32-f request message.

Wherein, after receiving the N32-f request message from the first SEPP, the second SEPP can update the locally recorded SEPP information list of the operator network where the first SEPP is located according to the N32-f request message. For example, when the second SEPP receives the N32-f message from the first SEPP, the header part of the N32-f message carries the SEPP information list of the operator network where the first SEPP is located under the current timestamp. The second SEPP updates the locally recorded SEPP information list to the SEPP information list of the operator network where the first SEPP is located under the current timestamp. Optionally, when the second SEPP receives the N32-c message from the first SEPP, the body part of the N32-c message carries the SEPP information list of the operator network where the first SEPP is located under the current timestamp.

Wherein, after receiving the N32-f request message from the first SEPP, the second SEPP may update the locally recorded load information of the first SEPP according to the N32-f request message. For example, when the second SEPP receives the N32-f message from the first SEPP, the body part of the N32-f message carries the load information of the first SEPP under the current timestamp. The second SEPP updates the locally recorded load information of the first SEPP to the load information of the first SEPP under the current timestamp.

The second SEPP sends the service information of the first NF to the second NF in the operator's network. Similar to the interaction process between the first NF and the first SEPP, the information exchange between the second SEPP and the second NF is also based on FQDN, or based on FQDN routing. For example, the second SEPP sends the service information of the first NF and the second SEPP FQDN to the second NF. After processing the service information of the first NF, the second NF sends a service response message to the second SEPP. For example, when the service information sent by the first NF is a request to access a new terminal device, the service response information of the second NF for the first NF is the access resources pre-allocated by the second NF for the new terminal device.

After receiving the service response message from the second NF, the second SEPP sends the N32-f response message to the first SEPP by using the N32-f context of the first SEPP. Wherein, the N32-f response message includes the service response of the second NF to the first NF. In addition, the N32-f response message may also include the SEPP information list and load control information of the operator network where the second SEPP is located under the current timestamp, so that the first SEPP updates the locally recorded SEPP of the operator network where the second SEPP is located Information list and load control information. The first SEPP acquires the service response in the N32-f response message, and sends the service response to the first NF.

In an implementation manner, the signaling message processing method in this embodiment may be applied between SEPP and NF. The NF obtains the SEPP information list from the NRF or the SEPP. When the NF sends a message to the SEPP, the NF selects a designated SEPP according to the SEPP information list, and sends a message to the designated SEPP. That is to say, NF achieves load balancing between SEPP and NF by obtaining the SEPP information list in advance. In another implementation manner, the NF directly pre-configures a SEPP information list locally, where the SEPP information list includes multiple SEPPs available to the NF in the same operator network, and parameters such as the priority or weight of each SEPP.

In this embodiment, the network scenario shown in FIG. 1a is used as an example. When the first SEPP and the second SEPP are connected in a PRINS manner, the specific steps to be executed are as shown in steps 401-409. In the network scenario shown in FIG. 1b, when the first SEPP and the second SEPP are connected in a direct connection manner, the specific steps performed are similar to steps 401-409. The difference is that the first SEPP and the second SEPP in the direct connection mode no longer transmit the N32-f message by encrypting the message through the N32-f context. For example, in step 403, the first SEPP performs encryption by using the transport layer security key, and sends the encrypted request message to the second SEPP. The other steps are also similar and will not be repeated here.

In this embodiment, the first SEPP of the first operator network selects a designated SEPP based on the SEPP information list of the second operator network and dynamic load control information, and uses the N32-f context of the designated SEPP to pair signaling messages After encryption processing is performed, the data is sent to achieve load balancing among multiple SEPPs in the second operator's network. It can be seen that in the dynamic load balancing scenario, cSEPP dynamically adjusts the traffic sent to different pSEPPs according to the load control information of the second operator's network, which can improve the message processing efficiency of SEPP as a whole.

FIG. 5 is another network scenario provided by an embodiment of the present application. The first operator network in FIG. 5 includes three SEPPs, namely SEPP_1, SEPP_2 and SEPP_3. Figure 5 also includes multiple pSEPPs and multiple roaming partners. Multiple SEPPs in the first operator's network are connected to multiple pSEPPs through IPX, and IPX is used to balance the load of the first operator's network. Optionally, multiple SEPPs in the first operator's network are connected to multiple pSEPPs through a pre-load balancer, and the pre-load balancer is also used to balance the load of the first operator's network.

In the network scenario provided by this embodiment, the signaling message processing method shares the N32-f context among SEPPs of the operator's network, that is, SEPP_1 to SEPP_3 can use the same N32-f context to process messages.

The method is executed by the first SEPP of the first operator network, and the method flow is shown in Figure 6, including the following steps:

601. The first border security gateway receives a signaling message from the second border security gateway;

602. The first border security gateway acquires the N32-f context shared among multiple border security gateways in the operator network, and uses the shared N32-f context to process the received signaling message.

In this embodiment, contexts may be shared among multiple SEPPs in the operator's network. For example, SEPP internal database synchronization to achieve shared context. For another example, SEPPs in the operator's network send subscription messages to each other to implement shared context. In this embodiment, the FQDN may be shared among multiple SEPPs in the local operator network, or different FQDNs may be used. After receiving signaling messages sent by SEPPs of other operator networks, the SEPPs of the local operator network may Obtain the shared N32-f context corresponding to the destination SEPP in the signaling message, and then use the shared context to process the signaling message.

For example, the first SEPP may be SEPP_1, SEPP_2 or SEPP_3 in the first operator network shown in FIG. 5 . The second SEPP may be the pSEPP of roaming partner 1, the pSEPP of roaming partner 2, or the pSEPP of roaming partner 3 shown in FIG. 5 . When the context is shared among multiple SEPPs in the operator network where the first SEPP is located, the multiple SEPPs can acquire the N32-f contexts recorded by the respective SEPPs. SEPP_1 in Figure 5 negotiates with pSEPP of roaming partner 1 and records N32-f context 1, SEPP_2 negotiates with pSEPP of roaming partner 2 and records N32-f context 2, SEPP_3 negotiates with pSEPP of roaming partner 3 and records N32-f context 3. The N32-f context is shared among SEPP_1 to SEPP_3 of the first operator network, that is, SEPP_1 to SEPP_3 all record the N32-f context 1 to N32-f context 3. The pSEPP of roaming partner 2 sends a signaling message to SEPP_2, which can be processed by SEPP_1. At this time, SEPP_1 acquires the shared context (N32-f context 2) corresponding to the destination SEPP (ie, SEPP_2) in the signaling message, and then uses the N32-f context 2 to process the signaling message.

Wherein, the IPX or the pre-load balancer receives signaling messages sent by different roaming partners, and distributes the signaling messages according to the load situation of each SEPP in the first operator's network. For example, the IPX in FIG. 5 receives the signaling message sent by the pSEPP of roaming partner 2. The IPX selects to send the signaling message to SEPP_1 according to the load control information (including the load index) of each SEPP in the first operator's network under the current timestamp. It can be seen that after the N32-f context is shared among multiple SEPPs in the first operator's network, each SEPP can process all N32-f traffic, and the load balancing of the first operator's network can be achieved through IPX.

The first SEPP selects to use the corresponding N32-f context to parse the received signaling message according to the shared N32-f context. For example, SEPP_1 in FIG. 5 receives a signaling message sent by pSEPP of roaming partner 2, where the signaling message is a message processed (encrypted) by pSEPP of roaming partner 2 using N32-f context 2. Since the shared N32-f context recorded by SEPP_1 includes N32-f context 2, SEPP_1 uses N32-f context 2 to process (decrypt) the signaling message.

In an implementation manner, a TLS link is established between the first SEPP and the first NF, and a TLS key is used to encrypt the signaling message, and the encrypted signaling message is sent to the first NF. For example, the destination NF of the signaling message sent by the pSEPP of roaming partner 2 is NF_1 in FIG. 5 . SEPP_1 encrypts the signaling message sent by the pSEPP of roaming partner 2 according to the TLS key with NF_1, and sends the encrypted signaling message to NF_1. It can be seen that the SEPP can use the TLS key between the SEPP and the NF to encrypt the signaling message, and send the encrypted signaling message to the destination NF of the signaling message.

Taking SEPP_1 and SEPP_2 in FIG. 5 as an example, the steps of sharing context among multiple SEPPs in the operator's network will be described in detail below. The mutual subscription of the N32-f context is initiated between SEPP_1 and SEPP_2 in the first operator network. For example, SEPP_2 sends an N32-f context request message to SEPP_1. The N32-f context request message is used to request subscription to the N32-f context of SEPP_1. For example, SEPP_1 negotiated N32-f context 1 with pSEPP of roaming partner 1, then SEPP_2 requests to subscribe to N32-f context 1 of SEPP_1. In response to the N32-f context request message, SEPP_1 sends an N32-f context response message to SEPP_2, as shown by the solid line flow in FIG. 7 . The N32-f context response message includes the N32-f context 1 recorded by SEPP_1.

Similarly, SEPP_1 sends an N32-f context request message to SEPP_2. The N32-f context request message is used to request subscription to the N32-f context of SEPP_2. Correspondingly, SEPP_2 sends an N32-f context response message to SEPP_1, where the N32-f context response message includes the N32-f context 2 recorded by SEPP_2, as shown in the dashed flow in FIG. 7 .

In an implementation manner, if the N32-f context on any SEPP changes (including creation, deactivation, etc., the process of creation and deactivation refers to the protocol standard 3GPP TS 29.573, which will not be repeated), then the N32-f context changes. The SEPP notifies other SEPPs in the operator's network through the callback interface. For example, a new N32-f context 3 is created between SEPP_1 and the pSEPP of roaming partner 3 through the N32-c handshake process, then SEPP_1 will record the N32-f context 3. SEPP_1 sends an N32-f context update message to SEPP_2, where the update message includes the N32-f context 3 newly created by SEPP_1. SEPP_2 receives and records the N32-f context 3 newly created by SEPP_1. SEPP_2 sends an N32-f context update response message to SEPP_1. The N32-f context update response message is used to indicate that SEPP_2 has recorded the N32-f context 3 newly created by SEPP_1, as shown in the solid line flow in FIG. 8 .

Similarly, the N32-f context 3 is newly created between SEPP_2 and the pSEPP of the roaming partner 3 through the N32-c handshake process, then SEPP_2 will use the N32-f context 3. SEPP_2 sends an N32-f context update message to SEPP_1, where the update message includes the N32-f context 3 newly created by SEPP_2. SEPP_1 receives and records the N32-f context 3 newly created by SEPP_2. SEPP_1 sends an N32-f context update response message to SEPP_2. The N32-f context update response message is used to indicate that SEPP_1 has recorded the N32-f context 3 newly created by SEPP_2, as shown in the virtual flow in FIG. 8 .

Wherein, the solid line process or the dotted line process in the above-mentioned FIG. 7 or FIG. 8 has no sequence, and only represents two different process steps.

When the N32-f context of SEPP_1 or SEPP_2 is deactivated, SEPP_1 or SEPP_2 notifies other SEPPs in the operator's network to deactivate the corresponding N32-f context through a process similar to FIG. 7 or FIG. 8 , which is not repeated here.

In this embodiment, the N32-f context is shared among multiple SEPPs in the same operator network. After the N32-f context is shared between SEPPs, any SEPP can process messages processed by different N32-f contexts in the network. The load balancing between SEPPs in the operator's network is realized by means of IPX or a pre-load balancer.

The signaling message processing method according to the embodiment of the present application is described in detail above with reference to FIG. 2 to FIG. 8 . The signaling message processing apparatus according to the embodiment of the present application will be described in detail below with reference to FIG. 9 to FIG. 12 . It should be understood that the signaling message processing apparatus and server shown in FIG. 9 to FIG. 12 can implement one or more steps in the method flow shown in FIG. 2 to FIG. 8 . In order to avoid repetition, detailed description is omitted here.

FIG. 9 is a schematic diagram of a signaling message processing apparatus according to an embodiment of the present application. The signaling message processing apparatus shown in FIG. 9 is used to implement the method performed by the first border security gateway in the embodiments shown in FIG. 2 to FIG. 4 . The signaling message processing apparatus includes a transceiver unit 901 and a processing unit 902 . The transceiver unit 901 is configured to receive a first message from the second border security gateway, where the first message includes a border security gateway information list of the operator network where the second border security gateway is located. The processing unit 902 is configured to select a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located. The transceiver unit 901 is further configured to send an encrypted signaling message to the third border security gateway.

In an implementation manner, the transceiver unit 901 is further configured to send a signaling message encrypted with the N32-f context to the third border security gateway, or send a signaling message encrypted with the transport layer security key to the third border security gateway .

In an implementation manner, the transceiver unit 901 is further configured to send a second message to the second border security gateway, where the second message includes a border security gateway information list of the operator network where the first border security gateway is located.

In an implementation manner, the transceiver unit 901 is further configured to use the N32-f context of the third border security gateway to send a signaling message to the third border security gateway, including:

If the associated N32-f context is not established between the first border security gateway and the third border security gateway, the transceiver unit 901 negotiates with the third border security gateway to obtain the N32-f context, and uses the negotiated N32-f context to send a message order message.

In an implementation manner, the border security gateway information list includes: priorities of multiple border security gateways. The processing unit 902 is configured to select the third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

In an implementation manner, the border security gateway information list includes: weights of multiple border security gateways. The processing unit 902 is configured to select the third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

In an implementation manner, the transceiver unit 901 is configured to receive the first message from the second border security gateway, including:

In an implementation manner, the processing unit 902 is further configured to update the recorded border security gateway information list to the border security gateway information list of the operator network where the second border security gateway is located under the current timestamp;

The transceiver unit 901 is further configured to send a 200 OK message to the second border security gateway. In an implementation manner, the transceiver unit 901 is further configured to send a message to the first border security gateway if the first border security gateway cannot identify the first message, or the first border security gateway cannot record the border security gateway information list of the operator network where the second border security gateway is located. The second border security gateway sends an error response message.

In an implementation manner, the processing unit 902 is configured to select the third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

In an implementation manner, the processing unit 902 is further configured to update the load information of the third border security gateway in the border security gateway information list according to the traffic occupied by the signaling message sending.

In an implementation manner, the transceiver unit 901 is configured to use the N32-f context of the third border security gateway to send a signaling message to the third border security gateway, including:

In an implementation manner, the related functions implemented by each unit in FIG. 9 may be implemented by a transceiver and a processor. FIG. 10 is a schematic diagram of a server according to an embodiment of the present application. The server may be a device (eg, a chip) capable of executing the signaling message processing method in the embodiments shown in FIG. 2 to FIG. 4 . The server may include a transceiver 1001 , at least one processor 1002 and memory 1003 . The transceiver 1001, the processor 1002 and the memory 1003 may be connected to each other through one or more communication buses, or may be connected to each other in other ways.

The transceiver 1001 may be used for sending data or receiving data. It is understood that the transceiver 1001 is a general term and may include a receiver and a transmitter. For example, the receiver is configured to receive the first message from the second border security gateway. For another example, the transmitter is configured to send a signaling message to the second border security gateway.

The processor 1002 may be used to process data of the server. The processor 1002 may include one or more processors, for example, the processor 1002 may be one or more central processing units (CPUs), network processors (NPs), hardware chips, or any combination thereof . In the case where the processor 1002 is a CPU, the CPU may be a single-core CPU or a multi-core CPU.

Among them, the memory 1003 is used for storing program codes and the like. The memory 1003 may include a volatile memory (volatile memory), such as random access memory (RAM); the memory 1003 may also include a non-volatile memory (non-volatile memory), such as a read-only memory (read- only memory, ROM), flash memory (flash memory), hard disk drive (HDD) or solid-state drive (solid-state drive, SSD); the memory 1003 may also include a combination of the above-mentioned types of memory.

The above-mentioned processor 1002 and memory 1003 may be coupled through an interface, or may be integrated together, which is not limited in this embodiment.

The transceiver 1001 and the processor 1002 described above can be used to execute the signaling message processing methods in the embodiments shown in FIG. 2 to FIG. 4 , and the specific implementation methods are as follows:

The transceiver 1001 is configured to receive a first message from the second border security gateway, where the first message includes a border security gateway information list of the operator network where the second border security gateway is located;

The processor 1002 is configured to select a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located;

The transceiver 1001 is also used for sending signaling messages to the third border security gateway.

In an implementation manner, the transceiver 1001 is further configured to send a signaling message encrypted with the N32-f context to the third border security gateway, or send a signaling message encrypted with a transport layer security key to the third border security gateway.

In an implementation manner, the transceiver 1001 is further configured to send a second message to the second border security gateway, where the second message includes a border security gateway information list of the operator network where the first border security gateway is located.

In an implementation manner, the transceiver 1001 is further configured to use the N32-f context of the third border security gateway to send a signaling message to the third border security gateway, including:

If the associated N32-f context is not established between the first border security gateway and the third border security gateway, the transceiver 1001 negotiates with the third border security gateway to obtain the N32-f context, and uses the negotiated N32-f context to send a message order message.

In an implementation manner, the border security gateway information list includes: priorities of multiple border security gateways. The processor 1002 is configured to select a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

In an implementation manner, the border security gateway information list includes: weights of multiple border security gateways. The processor 1002 is configured to select a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

In one implementation, the transceiver 1001 is configured to receive the first message from the second border security gateway, including:

In an implementation manner, the processor 1002 is further configured to update the recorded border security gateway information list to the border security gateway information list of the operator network where the second border security gateway is located under the current timestamp;

The transceiver 1001 is also used to send a 200 OK message to the second border security gateway.

In an implementation manner, the transceiver 1001 is further configured to send a message to the first border security gateway if the first border security gateway cannot identify the first message, or the first border security gateway cannot record the border security gateway information list of the operator network where the second border security gateway is located. The second border security gateway sends an error response message.

In an implementation manner, the processor 1002 is configured to select the third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, including:

In an implementation manner, the processor 1002 is further configured to update the load information of the third border security gateway in the border security gateway information list according to the traffic occupied by sending the signaling message.

In an implementation manner, the transceiver 1001 is configured to use the N32-f context of the third border security gateway to send a signaling message to the third border security gateway, including:

The signaling message is encrypted using the N32-f context of the third border security gateway, and the encrypted signaling message is sent to the third border security gateway. Wherein, the second border security gateway and the first border security gateway in the embodiments shown in FIG. 2 to FIG. 4 may implement similar functions. Then the second border security gateway may also be the device and server shown in FIG. 9 and FIG. 10 .

FIG. 11 is a schematic diagram of another signaling message processing apparatus provided by an embodiment of the present application. The signaling message processing apparatus shown in FIG. 11 is used to implement the methods performed by the first border security gateway in the embodiments shown in the foregoing FIGS. 6 to 8 . The signaling message processing apparatus includes a transceiver unit 1101 and a processing unit 1102 . The transceiver unit 1101 is configured to receive a signaling message from the second border security gateway. The processing unit 1102 is configured to acquire the N32-f context shared among multiple border security gateways in the operator's network, and use the shared N32-f context to process the received signaling message.

In one implementation, the processing unit 1102 is further configured to encrypt the signaling message using the transport layer security key. The transceiver unit 1101 is further configured to send the encrypted signaling message to the first network function network element.

In an implementation manner, the related functions implemented by each unit in FIG. 11 may be implemented by a transceiver and a processor. FIG. 12 is a schematic diagram of another server provided by an embodiment of the present application. The server may be a device (eg, a chip) capable of executing the signaling message processing method in the embodiments shown in FIG. 6 to FIG. 8 . The server may include a transceiver 1201 , at least one processor 1202 and memory 1203 . The transceiver 1201, the processor 1202 and the memory 1203 may be connected to each other through one or more communication buses, or may be connected to each other in other ways.

The transceiver 1201 may be used for sending data or receiving data. It can be understood that the transceiver 1201 is a general term and may include a receiver and a transmitter.

The processor 1202 may be used to process the data of the server. The processor 1202 may include one or more processors, for example, the processor 1202 may be one or more central processing units (CPUs), network processors (NPs), hardware chips, or any combination thereof . In the case where the processor 1202 is a CPU, the CPU may be a single-core CPU or a multi-core CPU.

Among them, the memory 1203 is used for storing program codes and the like. The memory 1203 may include volatile memory, such as random access memory (RAM). The memory 1203 may also include non-volatile memory (non-volatile memory), such as read-only memory (ROM), flash memory (flash memory), hard disk drive (HDD) or solid state hard disk ( solid-state drive, SSD); storage 1203 may also include a combination of the above-mentioned types of storage.

The above-mentioned processor 1202 and memory 1203 may be coupled through an interface, or may be integrated together, which is not limited in this embodiment.

The transceiver 1201 and the processor 1202 described above can be used to execute the signaling message processing methods in the embodiments shown in FIG. 6 to FIG. 8 , and the specific implementation is as follows:

The transceiver 1201 is configured to receive a signaling message from the second border security gateway;

The processor 1202 is configured to acquire the N32-f context shared among multiple border security gateways in the operator's network, and use the shared N32-f context to process the received signaling message.

In one implementation, the processor 1202 is further configured to encrypt signaling messages with transport layer security keys. The transceiver 1201 is further configured to send the encrypted signaling message to the first network function network element.

An embodiment of the present application provides a communication system, where the communication system includes the first communication device and the second communication device described in the foregoing embodiments.

An embodiment of the present application provides a computer-readable storage medium, where a program or an instruction is stored in the computer-readable storage medium, and when the program or instruction is executed on a computer, the computer can execute the signaling message processing in the embodiment of the present application. method.

An embodiment of the present application provides a chip or a chip system, the chip or chip system includes at least one processor and an interface, the interface and the at least one processor are interconnected by a line, and the at least one processor is used to run a computer program or instruction to perform the present application The signaling message processing method in the embodiment.

In an implementation manner, the chip or chip system described above in this application further includes at least one memory, where instructions are stored in the at least one memory. The memory may be a storage unit inside the chip, such as a register, a cache, etc., or a storage unit of the chip (eg, a read-only memory, a random access memory, etc.).

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented in software, it can be implemented in whole or in part in the form of a computer program product. A computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device. Computer instructions may be stored on or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server, or data center over a wire (e.g. coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg infrared, wireless, microwave, etc.) means to transmit to another website site, computer, server or data center. A computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media. The available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, high-density digital video discs (DVDs)), or semiconductor media (eg, solid state disks, SSD)) etc.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. Interchangeability, the above description has generally described the components and steps of each example in terms of function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited to this. should be covered within the scope of protection of this application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

A method for processing signaling messages, comprising:

The first border security gateway receives a first message from the second border security gateway, where the first message includes a border security gateway information list of the operator network where the second border security gateway is located;

The first border security gateway selects a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, and sends an encrypted signaling message to the third border security gateway.
The method according to claim 1, wherein the sending an encrypted signaling message to the third border security gateway comprises:

Sending a signaling message encrypted with an N32-f context to the third border security gateway or a signaling message encrypted with a transport layer security key to the third border security gateway.
The method according to claim 1, wherein the method further comprises:

The first border security gateway sends a second message to the second border security gateway, where the second message includes a border security gateway information list of the operator network where the first border security gateway is located.
The method according to claim 1, wherein the first border security gateway uses the N32-f context of the third border security gateway to send a signaling message to the third border security gateway, comprising:

If an associated N32-f context is not created between the first border security gateway and the third border security gateway, the first border security gateway negotiates with the third border security gateway to obtain an N32-f context, and The signaling message is sent using the N32-f context obtained through the negotiation.
The method according to claim 1 or 3, wherein the border security gateway information list includes: priorities of multiple border security gateways, and the first border security gateway operates from the location where the second border security gateway is located. Select the third border security gateway from the border security gateway information list of the commercial network, including:

The first border security gateway selects a third border security gateway with the highest priority from the border security gateway information list of the operator network where the second border security gateway is located.
The method according to claim 1 or 3, wherein the border security gateway information list comprises: weights of a plurality of border security gateways, the first border security gateway is obtained from an operator where the second border security gateway is located Select the third border security gateway from the network border security gateway information list, including:

The first border security gateway selects a third border security gateway with the highest weight from the border security gateway information list of the operator network where the second border security gateway is located.
The method according to claim 1, wherein the first border security gateway receives the first message from the second border security gateway, comprising:

The first border security gateway receives, through the N32-c channel, the border security gateway information list of the operator network where the second border security gateway is located.
The method according to claim 7, wherein the method further comprises:

If the first border security gateway cannot identify the first message, or the first border security gateway cannot record the border security gateway information list of the operator network where the second border security gateway is located, the first border security gateway The gateway sends an error response message to the second border security gateway.
The method according to claim 1, wherein the first border security gateway selects a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located, comprising:

The first border security gateway selects a third border security gateway with the least occupied load from the border security gateway information list of the operator network where the second border security gateway is located.
The method according to claim 9, wherein the method further comprises:

The first border security gateway updates the load information of the third border security gateway in the border security gateway information list according to the traffic occupied by sending the signaling message.
The method according to any one of claims 1 to 10, wherein the first border security gateway sends a signaling message to the third border security gateway by using the N32-f context of the third border security gateway ,include:

The first border security gateway encrypts the signaling message by using the N32-f context of the third border security gateway, and sends the encrypted signaling message to the third border security gateway.
The method according to any one of claims 1 to 10, wherein before the first border security gateway sends the encrypted signaling message to the third border security gateway, the method further comprises:

The first border security gateway receives the signaling message sent by the network function device, and encrypts the signaling message.
A signaling message processing device, comprising:

a transceiver unit, configured to receive a first message from a second border security gateway, where the first message includes a border security gateway information list of an operator network where the second border security gateway is located;

a processing unit, configured to select a third border security gateway from the border security gateway information list of the operator network where the second border security gateway is located;

The transceiver unit is further configured to send an encrypted signaling message to the third border security gateway.
The device according to claim 13, wherein the transceiver unit is further configured to:

Send a second message to the second border security gateway, where the second message includes a border security gateway information list of the operator network where the first border security gateway is located.
The apparatus according to claim 13, wherein the transceiver unit is further configured to use the N32-f context of the third border security gateway to send a signaling message to the third border security gateway, comprising:

If an associated N32-f context is not established between the first border security gateway and the third border security gateway, the transceiver unit negotiates with the third border security gateway to obtain an N32-f context, and adopts the N32-f context. The N32-f context obtained through negotiation sends signaling messages.
The apparatus according to claim 13 or 14, wherein the border security gateway information list includes: priorities of multiple border security gateways, and the processing unit is configured to obtain information from an operator where the second border security gateway is located Select the third border security gateway from the network border security gateway information list, including:

The third border security gateway with the highest priority is selected from the border security gateway information list of the operator network where the second border security gateway is located.
The apparatus according to claim 13 or 14, wherein the transceiver unit is further configured to receive a signaling message sent by a network function device, and the processing unit is further configured to encrypt the received signaling message .
A signaling message processing device, comprising a memory and a processor;

the memory for storing instructions;

the processor for executing the instructions such that the method of any one of claims 1 to 12 is performed.
A computer-readable storage medium, characterized by comprising a program or an instruction, when the program or the instruction is run on a computer, the method according to any one of claims 1 to 12 is performed.