WO2023016298A1

WO2023016298A1 - Service awareness method, communication apparatus, and communication system

Info

Publication number: WO2023016298A1
Application number: PCT/CN2022/109737
Authority: WO
Inventors: 丁辉; 周凯; 韩文勇
Original assignee: 华为技术有限公司
Priority date: 2021-08-13
Filing date: 2022-08-02
Publication date: 2023-02-16
Also published as: CN115942362A

Abstract

The present application provides a service awareness method, a communication apparatus, and a communication system. The method comprises: a session management function network element sends a first request message to a user plane function network element, the first request message comprising a detection rule and a usage reporting rule, the detection rule comprising an identifier of an application service and packet detection feature information, the detection rule being used for detecting a service flow of the application service, the packet detection feature information being used for indicating a matching feature of the service flow of the application service, the usage reporting rule comprising an event identifier, the event identifier being used for indicating an event of reporting the service flow of the application service, and the event being an application start event or an application end event; and the session management function network element receives a first event report from the user plane function network element, the first event report being used for indicating the event. The technical solution can be used for effectively distinguishing packets of different application services.

Description

A service perception method, communication device and communication system

Cross References to Related Applications

This application claims the priority of the Chinese patent application submitted to the State Intellectual Property Office of China on August 13, 2021, with the application number 202110929598.2 and the application title "A Service Perception Method, Communication Device, and Communication System". References are incorporated in this application.

technical field

The present application relates to the technical field of wireless communication, and in particular to a service perception method, a communication device and a communication system.

Background technique

In the prior art, the application detection for business flow mainly depends on the plaintext domain name information carried in the packet header corresponding to the application identification (such as IP triplet, domain name, fully qualified domain name (fully qualified domain name, FQDN), etc.) Perform pre-configuration, perform application detection based on the plaintext domain name information carried in the packet header, and identify the service flow of which application the packet belongs to.

However, in actual scenarios, the application packets transmitted by the terminal equipment may be encrypted packets, or the same packet header may actually correspond to multiple different services. The messages can be effectively distinguished.

Contents of the invention

The present application provides a service perception method, a communication device and a communication system, which are used to effectively distinguish messages of different application services.

In the first aspect, the embodiment of the present application provides a service perception method, which can be executed by a session management function network element or a module (such as a chip) applied to the session management function network element.

The method includes: the session management function network element sends a first request message to the user plane function network element, the first request message includes a detection rule and a usage reporting rule, the detection rule includes an application service identifier and packet detection feature information, the The detection rule is used to detect the service flow of the application service in the session, the packet detection feature information is used to indicate the matching feature of the service flow of the application service, the usage reporting rule includes a first event identifier, and the first event identifier is used Instructing to report the event of the service flow of the application service, the event is an application start event or an application end event; the session management function network element receives the first event report from the user plane function network element, and the first event report is used to indicate An event of a service flow of the application service.

In the above technical solution, the session management functional network element may request the user plane functional network element to perform application detection by sending a request message, and provide packet detection characteristic information of the application service. The user plane functional network element can perform application detection on the received packet according to the packet detection feature information. In this way, packets of different application services can be effectively distinguished, and the accuracy of application detection can be effectively improved.

In a possible design of the first aspect, the method further includes: the session management function network element receives a second request message from the policy control function network element, the second request message is used to subscribe to the event, and the second The request message includes the identification of the application service, the packet detection feature information and the second event identification, and the second event identification is used to indicate the reporting of the event; the session management function network element sends the second event report to the policy control function network element , the second event report is used to indicate the event.

In a possible design of the first aspect, the packet detection feature information includes statistical features and/or packet header features of packets in the service flow of the application service.

The above technical solution can solve the problem of being unable to determine the service flow to which the message belongs and the type of the application service unable to be accurately determined due to the capability limitation of the plaintext domain name information in the packet header of the message. For example, when encrypted messages or messages of different application services have the same packet header, the messages of different application services can be accurately identified.

In a possible design of the first aspect, the detection rule further includes flow description information, and the flow description information is used to indicate the service flow to which the packet detection feature information is applicable; the flow description information is included in the second request message .

In the above technical solution, the packet detection feature information and flow description information are used together for application detection, which can effectively improve the accuracy of application detection.

In a possible design of the first aspect, the first event report includes the identifier of the application service and the first event identifier, and the second event report includes the identifier of the application service and the second event identifier.

In the second aspect, the embodiment of the present application provides a service perception method, which can be executed by a user plane functional network element or a module (such as a chip) applied to the user plane functional network element.

The method includes: a user plane function network element receives a first request message from a session management function network element, the first request message includes a detection rule and a usage reporting rule, the detection rule includes an application service identifier and packet detection feature information, The detection rule is used to detect the service flow of the application service in the session, the packet detection feature information is used to indicate the matching feature of the service flow of the application service, the usage reporting rule includes a first event identifier, and the first event identifier An event used to indicate to report the service flow of the application service, the event is an application start event or an application end event; the user plane functional network element performs application detection on the received packet in the session according to the packet detection characteristic information; if detected For an event of the service flow of the application service, the user plane functional network element sends a first event report to the session management functional network element, where the first event report is used to indicate the event.

In a possible design of the second aspect, the packet detection characteristic information includes statistical characteristics and/or packet header characteristics of packets in the service flow of the application service.

In a possible design of the second aspect, the detection rule includes flow description information, and the flow description information is used to indicate the service flow to which the packet detection characteristic information applies; Executing application detection on received packets includes: performing application detection on packets in the session that match the flow description information according to packet detection characteristic information.

In a possible design of the second aspect, the first event report includes the identifier of the application service and the identifier of the first event.

In the third aspect, the embodiment of the present application provides a service perception method, which can be executed by a network element with a policy control function or a module (such as a chip) applied to a network element with a policy control function.

The method includes: the policy control function network element receives a third request message from the application function network element, the third request message includes the identifier of the application service, packet detection characteristic information and a third event identifier, and the packet detection characteristic information is used for Indicate the matching feature of the service flow of the application service, the third event identifier is used to indicate the event of reporting the service flow of the application service, the event is an application start event or an application end event; the policy control function network element sends a session management The functional network element sends a second request message, the second request message is used to request to subscribe to the event, the second request message includes the identification of the application service, packet detection feature information and a second event identification, the second event The identifier is used to indicate the reporting of the event; the policy control function network element receives the second event report from the session management function network element, and the second event report is used to indicate the event; the policy control function network element sends the application function network element A third event report, the second event report is used to indicate the event.

In a possible design of the third aspect, the packet detection characteristic information includes statistical characteristics and/or packet header characteristics of packets in the service flow of the application service.

In a possible design of the third aspect, the second request message and the third request message further include flow description information, where the flow description information is used to indicate a service flow to which the packet detection feature information applies.

In a possible design of the third aspect, the second event report includes the identifier of the application service and a second event identifier, and the third event report includes the identifier of the application service and a third event identifier.

In a fourth aspect, the embodiment of the present application provides a service perception method, which can be executed by an application function network element or applied to a module (such as a chip) in the application function network element.

The method includes: the application function network element sends a third request message to the policy control function network element, the third request message includes the identifier of the application service, packet detection characteristic information and a third event identifier, and the packet detection characteristic information is used to indicate The matching feature of the service flow of the application service, the third event identifier is used to indicate the event of reporting the service flow of the application service, and the event is an application start event or an application end event; the application function network element receives the event from the policy control function A third event report of the network element, where the third event report is used to indicate the event.

In a possible design of the fourth aspect, the packet detection characteristic information includes statistical characteristics and/or packet header characteristics of packets in the service flow of the application service.

In a possible design of the fourth aspect, the third request message further includes flow description information, where the flow description information is used to indicate a service flow to which the packet detection characteristic information applies.

In a possible design of the fourth aspect, the third event report includes an identifier of the application service and a third event identifier.

In a possible design of the fourth aspect, the application start event is used to trigger a policy control function network element to initiate a configuration update process to the terminal device.

For the beneficial effect of any possible design of the above-mentioned second aspect to the fourth aspect, reference may be made to the corresponding description in the first aspect, and repeated descriptions will not be repeated.

In the fifth aspect, the embodiment of the present application provides a service perception method, which can be executed by a network element with a network data analysis function or a module (such as a chip) applied to a network element with a network data analysis function.

The method includes: the network data analysis function network element receives a fourth request message from the application function network element, the fourth request message is used to request to analyze the event of the service flow of the application service, the event is an application start event or an application end event, The fourth request message includes the identification of the application service and packet detection feature information, and the packet detection feature information is used to indicate the matching feature of the service flow of the application service; the network data analysis function network element sends the session management function network element Sending the fifth request message, the fifth request message is used to request forwarding the mirror image of the message in the session of the terminal device; the network data analysis function network element according to the packet detection feature information, the received from the session management function network element or the user plane The mirror image of the functional network element performs application detection; if an event of the service flow of the application service is detected, the network data analysis functional network element sends an event report to the application functional network element, and the event report is used to indicate the event.

In the above technical solution, the network data analysis function network element can obtain the mirror image of the message in the session of the terminal device from the user plane function network element through the session management function network element, and analyze the received packets according to the packet detection feature information provided by the application function network element. The mirror image of the message performs application detection, and returns a corresponding event report to the application function network element. In this way, packets of different application services can be effectively distinguished, and the accuracy of application detection can be effectively improved.

In a possible design of the fifth aspect, the packet detection feature information includes statistical features and/or packet header features of packets in the service flow of the application service.

In a possible design of the fifth aspect, the fourth request message further includes flow description information, and the flow description information is used to indicate the service flow to which the packet detection feature information is applicable; in the fifth request message It also includes flow description information, where the flow description information is used to indicate the mirroring of the packets matching the flow description information in the session of the forwarding terminal device.

In the above technical solution, the packet detection feature information and flow description information are used together for application detection, which can effectively improve the accuracy of application detection. Moreover, the network element with the network data analysis function can request to forward the mirror image of the message matching the flow description information in the session of the terminal device, without forwarding the mirror image of all messages, therefore, reducing the data volume of the message transmitted between network elements, Make full use of network resources.

In a possible design of the fifth aspect, the fifth request message further includes a mirroring destination address, where the mirroring destination address is an address of a network element with a network data analysis function that receives the mirroring. In this way, it is convenient for the session management function network element or the user plane function network element to forward the mirror image of the service flow in the session of the terminal device to the network data analysis function network element.

In a possible design of the fifth aspect, the fourth request message further includes an event identifier, and the event identifier is used to indicate reporting of the event; the event report includes the identifier of the application service and the event logo.

In a sixth aspect, the embodiment of the present application provides a service perception method, which can be executed by a session management function network element or a module (such as a chip) applied to the session management function network element.

The method includes: the session management function network element receives the fifth request message from the network data analysis function network element, and the fifth request message is used to request forwarding the mirror image of the message in the session of the terminal device; the session management function network element sends the user interface The functional network element sends a sixth request message, the sixth request message includes a detection rule and a forwarding rule, the detection rule is used to detect the service flow of the session of the terminal device, the forwarding rule includes a mirror forwarding indication, and the mirroring forwarding indication uses Instruct to forward the image.

In a possible design of the sixth aspect, the fifth request message includes flow description information, and the flow description information is used to indicate forwarding the image of the message matching the flow description information in the session of the terminal device; The flow description information is included in the above detection rules.

In a possible design of the sixth aspect, the detection rule includes wildcard indication information, and the wildcard indication information is used to forward images of all packets in the session of the terminal device.

In the above technical solution, by including the flow description information or wildcard indication information in the detection rule, the session management function network element can clearly inform the user plane function network element to indicate which packets in the session of the terminal device need to be forwarded, so that the user plane The functional network element performs corresponding processing.

In a possible design of the sixth aspect, the fifth request message further includes a mirroring destination address, where the mirroring destination address is an address of a network element with a network data analysis function that receives the mirroring.

In a possible design of the sixth aspect, the method further includes: the session management function network element receives the image from the user plane function network element, and sends the image to the network data analysis function network element according to the image destination address ; Or, the forwarding rule also includes a mirroring destination address.

In a seventh aspect, the embodiment of the present application provides a service perception method, which can be executed by a user plane functional network element or a module (such as a chip) applied to the user plane functional network element.

The method includes: the user plane function network element receives a sixth request message from the session management function network element, the sixth request message includes a detection rule and a forwarding rule, and the detection rule is used to detect the service flow in the session of the terminal device, The forwarding rule includes a mirroring forwarding indication, and the mirroring forwarding indication is used to indicate forwarding the mirroring of the message in the session of the terminal device; the user plane functional network element detects the message in the session of the terminal device according to the detection rule; the user plane The functional network element sends the image to the session management functional network element or the network data analysis functional network element according to the image forwarding instruction.

In a possible design of the seventh aspect, the detection rule includes flow description information; the method further includes: according to the flow description information, the user plane function network element sends a session management function network element or a network data analysis function network The mirror image of the message matching the flow description information in the session of the original sending terminal device.

In a possible design of the seventh aspect, the detection rule includes wildcard indication information; the method further includes: according to the wildcard indication information, the user plane function network element sends a session management function network element or network data analysis The functional network element sends the mirror image of all packets in the session of the terminal device.

In a possible design of the seventh aspect, the forwarding rule further includes the destination address of the image; the sending of the image by the user plane functional network element to the network data analysis function network element includes: the user plane functional network element according to The destination address of the image is used to send the image to the network element with the network data analysis function.

In an eighth aspect, the embodiment of the present application provides a service perception method, which can be executed by an application function network element or a module (such as a chip) applied to the application function network element.

The method includes: the application function network element sends a fourth request message to the network data analysis function network element, the fourth request message is used to request to analyze the event of the service flow of the application service, the event is an application start event or an application end event, the The fourth request message includes the identification of the application service and packet detection characteristic information, the packet detection characteristic information is used to indicate the matching characteristics of the service flow of the application service; the application function network element receives the network data analysis function network element An event report indicating the event.

In a possible design of the eighth aspect, the packet detection characteristic information includes statistical characteristics and/or packet header characteristics of packets in the service flow of the application service.

In a possible design of the eighth aspect, the fourth request message further includes flow description information, where the flow description information is used to indicate a service flow to which the packet detection feature information applies.

In a possible design of the eighth aspect, the fourth request message further includes an event identifier, and the event identifier is used to indicate reporting of the event; the event report includes the identifier of the application service and the event logo.

For the beneficial effects of any possible design of the sixth aspect to the eighth aspect, reference may be made to the corresponding description in the fifth aspect, and repeated descriptions will not be repeated.

In a ninth aspect, the embodiment of the present application provides a service perception method, which can be executed by an application function network element or a module (such as a chip) applied to the application function network element.

The method includes: the application function network element sends a seventh request message to the policy control function network element, the seventh request message is used to obtain the mirror image of the message in the session of the terminal device, the seventh request message includes a mirror destination address, the The destination address of the image is the address of the application function network element receiving the image; the application function network element receives the image from the user plane function network element; the application function network element performs application detection according to the image.

In the above technical solution, the application function network element can send forwarding rules to the user plane function network element through the policy control function network element and the session management function network element to obtain the mirror image of the message in the session of the terminal device, and then according to the received message mirror image for application detection. In this way, the application function network element can perceive the type of the application service actually initiated by the terminal device, and it is convenient for the AF to execute corresponding management decisions based on the application service currently initiated by the terminal device.

In a possible design of the ninth aspect, the seventh request message further includes flow description information, and the flow description information is used to indicate forwarding a mirror image of a packet matching the flow description information in a session of the terminal device.

In the above technical solution, by carrying the flow description information in the seventh request message, the application function network element can request to forward the mirror image of the message matching the flow description information in the session of the terminal device, without forwarding the mirror image of all messages, Therefore, the data volume of messages transmitted between network elements is reduced, and network resources are fully utilized.

In a tenth aspect, the embodiment of the present application provides a service awareness method, which can be executed by a network element with a policy control function or a module (such as a chip) applied to a network element with a policy control function.

The method includes: the policy control function network element receives a seventh request message from the application function network element, the seventh request message is used to obtain the mirror image of the message in the session of the terminal device, and the seventh request message includes a mirror destination address, The destination address of the image is the address receiving the image in the application function network element; the policy control function network element sends an eighth request message to the session management function network element, and the eighth request message is used to request forwarding of the image, the eighth The mirroring destination address is included in the request message.

In a possible design of the tenth aspect, the seventh request message further includes flow description information, where the flow description information is used to indicate forwarding the image of the packet matching the flow description information in the session of the terminal device; The eighth request message also includes the stream description information.

In an eleventh aspect, the embodiment of the present application provides a service perception method, which can be executed by a session management function network element or a module (such as a chip) applied to the session management function network element.

The method includes: the session management function network element receives an eighth request message from the policy control function network element, the eighth request message is used to request forwarding the mirroring of the message in the session of the terminal device, and the eighth request message includes the mirroring purpose address, the mirroring destination address is the address of the application function network element receiving the mirroring; the session management function network element sends a ninth request message to the user plane function network element, the ninth request message includes detection rules and forwarding rules, the The detection rule is used to detect the service flow in the session of the terminal device, and the forwarding rule is used to mirror and forward the message in the session of the terminal device. The forwarding rule includes a mirror forwarding indication and the mirror destination address, and the mirror forwarding The instruction is used to instruct to forward the image.

In a possible design of the eleventh aspect, the detection rule includes flow description information, and the flow description information is used to indicate the mirror image of the packet that matches the flow description information in the session of the forwarding terminal device.

In a possible design of the eleventh aspect, the detection rule includes wildcard indication information, and the wildcard indication information is used to forward images of all packets in the session of the terminal device.

In the above technical solution, by including flow description information or wildcard indication information in the detection rule, the session management function network element can clearly inform the user plane function network element which mirror images of the packets in the session of the terminal device need to be forwarded, so as to facilitate the user plane The functional network element performs corresponding processing.

In a twelfth aspect, the embodiment of the present application provides a service perception method, which can be executed by a user plane functional network element or a module (such as a chip) applied to the user plane functional network element.

The method includes: the user plane functional network element receives a detection rule and a forwarding rule from a session management functional network element, the detection rule is used to detect the service flow in the session of the terminal device, and the forwarding rule is used to detect the traffic flow in the session of the terminal device The packet is mirrored and forwarded. The forwarding rule includes a mirrored forwarding instruction and a mirrored destination address. The mirrored destination address is the address received in the application function network element; the user plane function network element detects the session of the terminal device according to the detection rule message: the user plane function network element sends the image to the application function network element according to the image forwarding instruction and the image destination address.

In a possible design of the twelfth aspect, the detection rule includes flow description information; the method further includes: the user plane function network element sends the session information of the terminal device to the application function network element according to the flow description information Mirroring of packets matching the flow description information.

In a possible design of the twelfth aspect, the detection rule includes wildcard indication information; the method further includes: the user plane functional network element sends the terminal device information to the application function network element according to the wildcard indication information Mirroring of all packets in the session.

For the beneficial effect of any possible design of the above tenth to twelfth aspects, reference may be made to the corresponding description in the ninth aspect, and repeated descriptions will not be repeated.

In the thirteenth aspect, the embodiment of the present application provides a communication device, which can have the function of implementing any of the above-mentioned aspects or any possible design application function network element, or can realize the above-mentioned aspects or aspects any possible design of the network element with the policy control function, or the function of the network element with the session management function in any of the above-mentioned aspects or aspects, or the function of the network element with the above-mentioned aspects or aspects The function of the user plane function network element in any possible design, or the function of the network data analysis function network element in any of the above aspects or any possible design of the aspects. The device may be a network device, or a chip included in the network device.

The above-mentioned functions of the communication device may be realized by hardware, or may be realized by executing corresponding software by hardware, and the hardware or software includes one or more modules or units or means corresponding to the above-mentioned functions.

In a possible design, the structure of the device includes a processing module and a transceiver module, wherein the processing module is configured to support the device to perform the corresponding functions of the application function network element in any design of the above aspects or aspects , or perform the corresponding functions of the policy control function network element in any design of the above aspects or aspects, or perform the corresponding functions of the session management function network element in any design of the above aspects or aspects, or perform the above The corresponding functions of the user plane function network element in any design of the aspects or any aspects of the aspects, or the corresponding functions of the network data analysis function network element in the above aspects or any design of the aspects. The transceiver module is used to support communication between the device and other communication devices. For example, when the device is a network element with a session management function, it can send a first request message to a network element with a user plane function. The communication device may also include a storage module, which is coupled to the processing module and stores necessary program instructions and data of the device. As an example, the processing module may be a processor, the communication module may be a transceiver, and the storage module may be a memory, and the memory may be integrated with the processor or configured separately from the processor.

In another possible design, the structure of the device includes a processor, and may also include a memory. The processor is coupled with the memory, and can be used to execute the computer program instructions stored in the memory, so that the apparatus performs the method in any one possible design of the above-mentioned aspects or aspects. Optionally, the device further includes a communication interface, and the processor is coupled to the communication interface. When the device is a network device, the communication interface may be a transceiver or an input/output interface; when the device is a chip included in the network device, the communication interface may be an input/output interface of the chip. Optionally, the transceiver may be a transceiver circuit, and the input/output interface may be an input/output circuit.

In a fourteenth aspect, the embodiment of the present application provides a chip system, including: a processor, the processor is coupled with a memory, and the memory is used to store programs or instructions, when the programs or instructions are executed by the processor When, make the system-on-a-chip implement the above-mentioned aspects or any one possible design method of the aspects.

Optionally, the chip system further includes an interface circuit, which is used for exchanging code instructions to the processor.

Optionally, there may be one or more processors in the chip system, and the processors may be implemented by hardware or by software. When implemented in hardware, the processor may be a logic circuit, an integrated circuit, or the like. When implemented by software, the processor may be a general-purpose processor implemented by reading software codes stored in a memory.

Optionally, there may be one or more memories in the chip system. The memory can be integrated with the processor, or can be set separately from the processor. Exemplarily, the memory may be a non-transitory processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip, or may be respectively disposed on different chips.

In the fifteenth aspect, the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when it is run on a communication device, any one of the above aspects or aspects A possible design approach is implemented.

In the sixteenth aspect, the embodiment of the present application also provides a computer program product, the computer program product includes computer programs or instructions, and when the computer program or instructions are run by the communication device, any one of the above-mentioned aspects or aspects is possible The method in the design is executed.

In the seventeenth aspect, the embodiment of the present application also provides a communication system, the communication system includes a session management function network element configured to execute the method in the third aspect or any possible design of the third aspect and a network element configured to A user plane function network element that executes the method in the fourth aspect or any possible design of the fourth aspect.

Optionally, the communication system may further include an application function network element configured to implement the first aspect or any method in a possible design of the first aspect and an application function network element configured to implement the second aspect or any of the second aspects. A possible design approach for policy control of functional network elements.

In the eighteenth aspect, the embodiment of the present application also provides a communication system, the communication system includes a network element with a network data analysis function and a user A network element with a session management function for performing the method in the seventh aspect or any possible design of the seventh aspect.

Optionally, the communication system may further include an application function network element configured to implement the method in the fifth aspect or any possible design of the fifth aspect and an application function network element configured to implement the eighth aspect or any of the eighth aspects. A possible design approach for user plane functional network elements.

In a nineteenth aspect, the embodiment of the present application further provides a communication system, the communication system includes an application function network element for performing the method in any possible design of the ninth aspect or the ninth aspect, and a network element configured to perform the above-mentioned first aspect The user plane functional network element of the method in the twelfth aspect or any possible design of the twelfth aspect.

Optionally, the communication system may further include a policy control function network element configured to implement the above tenth aspect or the method in any possible design of the tenth aspect, and a network element configured to implement the above eleventh aspect or the eleventh aspect Aspects of any one possible design of the method in the session management function network element.

Description of drawings

Figure 1a, Figure 1b and Figure 1c are schematic diagrams of a communication system provided by an embodiment of the present application;

Figure 2a is a schematic diagram of a 5G network architecture based on a service architecture;

Figure 2b is a schematic diagram of a 5G network architecture based on a point-to-point interface;

FIG. 3 is a schematic diagram of a service perception method provided by an embodiment of the present application;

FIG. 4 is a schematic diagram of another service perception method provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of another service perception method provided by the embodiment of the present application;

FIG. 6 and FIG. 7 are schematic structural diagrams of a communication device provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the application clearer, the application will be further described in detail below in conjunction with the accompanying drawings. The specific operation methods in the method embodiments can also be applied to the device embodiments or system embodiments.

In order to perform service perception accurately and effectively distinguish packets of different application services, the present application provides a communication system.

In a first implementation manner, as shown in FIG. 1a, the communication system may include a session management functional network element and a user plane functional network element. Optionally, the communication system may further include an application function network element and a policy control function network element. in,

The session management function network element is configured to send a first request message to the user plane function network element, the first request message includes a detection rule and a usage reporting rule, the detection rule includes the identification of the application service and packet detection feature information, the detection The rule is used to detect the service flow of the application service, the packet detection feature information is used to indicate the matching feature of the service flow of the application service, the usage reporting rule includes a first event identifier, and the first event identifier is used to indicate the reporting An event of the service flow of the application service, where the event is an application start event or an application end event; and used for receiving a first event report from a user plane functional network element, where the first event report is used to indicate the event. Optionally, it is also used to receive a second request message from a policy control function network element, the second request message is used to request to subscribe to the event, and the second request message includes the identification of the application service and the packet detection feature Information and a second event identifier, where the second event identifier is used to indicate reporting of the event; and, used to send a second event report to the policy control function network element, where the second event report is used to indicate the event. The user plane functional network element is configured to receive the first request message from the session management functional network element; perform application detection on the received packets in the session according to the packet detection characteristic information; if the service of the application service is detected If there is an event of the flow, a first event report is sent to the network element with the session management function.

Optionally, the policy control function network element is used to send the second request message to the session management function network element; and is used to receive the second event report from the session management function network element; The third request message of the application function network element, the third request message includes the identification of the application service, the packet detection characteristic information and the third event identification, and the third event identification is used to indicate to report the event; The application function network element sends a third event report, where the third event report is used to indicate the event.

Optionally, the application function network element is configured to send a third request message to the policy control function network element; and is configured to receive a third event report from the policy control function network element.

In a second implementation manner, as shown in FIG. 1b, the communication system may include a network element with a network data analysis function and a network element with a session management function. Optionally, the communication system may further include an application function network element and a user plane function network element. in,

The network data analysis function network element is used to receive the fourth request message from the application function network element, the fourth request message is used to request to analyze the event of the service flow of the application service, the event is an application start event or an application end event, the The fourth request message includes the identification of the application service and packet detection characteristic information, and the packet detection characteristic information is used to indicate the matching characteristics of the service flow of the application service; it is used to send the fifth request message to the session management function network element , the fifth request message is used to request forwarding the mirror image of the message in the session of the terminal device; it is used to receive the mirror image from the session management function network element or the user plane function network element; The mirror image executes application detection; and, if the event is detected, send an event report to the application function network element, where the event report is used to indicate the event. The session management function network element is used to receive the fifth request message from the network data analysis function network element; it is used to send the sixth request message to the user plane function network element, the sixth request message includes detection rules and forwarding rules, the The detection rule is used to detect the service flow of the session of the terminal device, and the forwarding rule includes a mirroring forwarding indication, and the mirroring forwarding indication is used to indicate forwarding of the mirroring.

Optionally, the application function network element is configured to send a fourth request message to the network data analysis function network element; and receive an event report from the network data analysis function network element.

Optionally, the user plane functional network element is used to receive the sixth request message from the session management functional network element; it is used to detect the service flow in the session of the terminal device according to the detection rule; the user plane functional network element forwards the instruction according to the image , sending the image to a network element with a session management function or a network element with a network data analysis function.

In a third implementation manner, as shown in FIG. 1c, the communication system may include an application function network element and a user plane function network element. Optionally, the communication system may further include a network element with a policy control function and a network element with a session management function. in,

The application function network element is used to send a seventh request message to the policy control function network element, the seventh request message is used to obtain the image of the message in the session of the terminal device, the seventh request message includes the image destination address, and the image The destination address is the address of the application function network element receiving the image; it is used for receiving the image from the user plane function network element; and performing application detection according to the image. The policy control function network element is used to receive the seventh request message from the application function network element; it is used to send the eighth request message to the session management function network element, and the eighth request message is used to request forwarding the image, the eighth The mirroring destination address is included in the request message.

Optionally, the session management functional network element is configured to receive an eighth request message from the policy control functional network element; and is configured to send a ninth request message to the user plane functional network element, where the ninth request message includes detection rules and forwarding A rule, the detection rule is used to detect the service flow in the session of the terminal device, the forwarding rule is used to mirror forward the message in the session of the terminal device, and the forwarding rule includes a mirroring forwarding indication and the mirroring destination address, The image forwarding indication is used to instruct to forward the image.

Optionally, the user plane function network element is used to receive the detection rule and the forwarding rule from the session management function network element; according to the detection rule, detect the message in the session of the terminal device; according to the mirroring forwarding instruction and the mirroring destination address, and send the image to the application function network element.

The system shown in Figure 1a, Figure 1b or Figure 1c can be used in the 5G network architecture shown in Figure 2a or Figure 2b, and can also be used in future network architectures, such as the sixth generation (6th generation, 6G) network architecture etc., this application does not make a limitation.

Figure 2a is a schematic diagram of a 5G network architecture based on a service-based architecture. The 5G network architecture shown in Figure 2a may include a data network (data network, DN) and an operator network. The functions of some of the network elements are briefly introduced and described below.

Wherein, the operator network may include one or more of the following network elements: authentication server function (authentication server function, AUSF) network element, network exposure function (network exposure function, NEF) network element, policy control function (policy control function (PCF) network element, unified data management (unified data management, UDM) network element, unified database (unified data repository, UDR) network element, network storage function (network repository function, NRF) network element, application function (application function) , AF) network elements, access and mobility management function (access and mobility management function, AMF) network elements, session management function (session management function, SMF) network elements, radio access network (radio access network, RAN) equipment And user plane function (UPF) network elements, network data analysis function (network data analysis function, NWDAF) network elements, network slice selection function (Network Slice Selection Function, NSSF) network elements, etc. In the above operator network, network elements or devices other than radio access network devices may be referred to as core network elements or core network devices.

The wireless access network equipment can be a base station (base station), an evolved base station (evolved NodeB, eNodeB), a transmission reception point (transmission reception point, TRP), and a next generation base station (next generation NodeB, gNB) in a 5G mobile communication system , a next-generation base station in a 6G mobile communication system, a base station in a future mobile communication system, or an access node in a wireless fidelity (Wireless Fidelity, WiFi) system, etc.; it can also be a module or unit that completes some functions of the base station, for example, It can be a centralized unit (central unit, CU) or a distributed unit (distributed unit, DU). The radio access network equipment may be a macro base station, a micro base station or an indoor station, or a relay node or a donor node. The embodiment of the present application does not limit the specific technology and specific equipment form adopted by the radio access network equipment.

The terminal communicating with the RAN may also be referred to as terminal equipment, user equipment (user equipment, UE), mobile station, mobile terminal, and so on. Terminals can be widely used in various scenarios, such as device-to-device (D2D), vehicle-to-everything (V2X) communication, machine-type communication (MTC), Internet of Things ( internet of things, IOT), virtual reality, augmented reality, industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wearables, smart transportation, smart city, etc. Terminals can be mobile phones, tablet computers, computers with wireless transceiver functions, wearable devices, vehicles, drones, helicopters, airplanes, ships, robots, robotic arms, smart home devices, etc. The embodiment of the present application does not limit the specific technology and specific device form adopted by the terminal.

Base stations and terminals can be fixed or mobile. Base stations and terminals can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; they can also be deployed on water; they can also be deployed on aircraft, balloons and artificial satellites in the air. The embodiments of the present application do not limit the application scenarios of the base station and the terminal.

The AMF network element performs functions such as mobility management and access authentication/authorization. In addition, it is also responsible for transferring user policies between the terminal and the PCF.

The SMF network element performs functions such as session management, execution of control policies issued by the PCF, selection of UPF, and allocation of Internet Protocol (IP) addresses for terminals.

The UPF network element, as an interface with the data network, completes functions such as user plane data forwarding, session/flow-based charging statistics, and bandwidth limitation.

The UDM network element performs functions such as managing subscription data and user access authorization.

UDR implements the access function of contract data, policy data, application data and other types of data.

NEF network elements are used to support the opening of capabilities and events.

The AF network element transmits the requirements from the application side to the network side, such as quality of service (quality of service, QoS) requirements or user status event subscription. The AF may be a third-party functional entity, or an application service deployed by an operator, such as an IP Multimedia Subsystem (IP Multimedia Subsystem, IMS) voice call service.

The PCF network element is responsible for policy control functions such as charging for sessions and service flow levels, QoS bandwidth guarantee, mobility management, and terminal policy decision-making.

The NRF network element is used to provide a network element discovery function, and provide network element information corresponding to a network element type based on requests from other network elements. NRF also provides network element management services, such as network element registration, update, de-registration, network element status subscription and push, etc.

The AUSF network element is responsible for authenticating users to determine whether users or devices are allowed to access the network.

The NSSF network element is used to select a network slice and count users in the network slice.

The NWDAF network element is responsible for performing analysis functions based on the input information collected from each node, and outputting corresponding analysis results for scenarios such as network operation and maintenance, policy decision-making, and user experience evaluation.

DN is a network outside the operator's network. The operator's network can access multiple DNs, and various services can be deployed on the DN, which can provide data and/or voice services for terminals. For example, DN is a private network of a smart factory. The sensors installed in the workshop of the smart factory can be terminals, and the control server of the sensors is deployed in the DN, and the control server can provide services for the sensors. The sensor can communicate with the control server, obtain instructions from the control server, and transmit the collected sensor data to the control server according to the instructions. For another example, DN is a company's internal office network. The mobile phone or computer of the company's employees can be a terminal, and the employee's mobile phone or computer can access information and data resources on the company's internal office network.

In Figure 2a, Nausf, Nnef, Npcf, Nudm, Naf, Namf, and Nsmf are the service interfaces provided by the above-mentioned AUSF, NEF, PCF, UDM, AF, AMF, and SMF, respectively, and are used to call corresponding service operations. N1, N2, N3, N4, and N6 are interface serial numbers. The meanings of these interface serial numbers may refer to the meanings defined in the 3rd generation partnership project (3rd generation partnership project, 3GPP) standard agreement, and there is no limitation here.

FIG. 2b is a schematic diagram of a 5G network architecture based on a point-to-point interface. The introduction of the functions of the network elements can refer to the introduction of the functions of the corresponding network elements in FIG. The main difference between Fig. 2b and Fig. 2a is that: the interface between each control plane network element in Fig. 2a is a service interface, and the interface between each control plane network element in Fig. 2b is a point-to-point interface.

In the architecture shown in Figure 2b, the interface names and functions between each network element are as follows:

1), N1: the interface between the AMF and the terminal, which can be used to transmit QoS control rules and the like to the terminal.

2), N2: the interface between the AMF and the RAN, which can be used to transfer radio bearer control information from the core network side to the RAN.

3), N3: the interface between the RAN and the UPF, mainly used to transfer the uplink and downlink user plane data between the RAN and the UPF.

4), N4: The interface between SMF and UPF, which can be used to transfer information between the control plane and the user plane, including controlling the distribution of forwarding rules, QoS control rules, traffic statistics rules, etc. Information reporting.

5), N5: the interface between the AF and the PCF, which can be used for sending application service requests and reporting network events.

6), N6: the interface between UPF and DN, used to transfer the uplink and downlink user data flow between UPF and DN.

7), N7: the interface between PCF and SMF, which can be used to deliver protocol data unit (protocol data unit, PDU) session granularity and service data flow granularity control policy.

8), N8: The interface between AMF and UDM, which can be used for AMF to obtain subscription data and authentication data related to access and mobility management from UDM, and for AMF to register terminal current mobility management related information with UDM.

9), N9: a user plane interface between UPF and UPF, used to transmit uplink and downlink user data flows between UPFs.

10), N10: the interface between SMF and UDM, which can be used for SMF to obtain session management-related subscription data from UDM, and for SMF to register terminal current session-related information with UDM.

11), N11: the interface between SMF and AMF, which can be used to transfer PDU session tunnel information between RAN and UPF, transfer control messages sent to terminals, transfer radio resource control information sent to RAN, etc.

12), N12: the interface between AMF and AUSF, which can be used for AMF to initiate an authentication process to AUSF, which can carry SUCI as a subscription identifier;

13), N13: the interface between UDM and AUSF, which can be used for AUSF to obtain user authentication vector from UDM to execute the authentication process.

14), N15: the interface between the PCF and the AMF, which can be used to issue terminal policies and access control-related policies.

15), N35: the interface between UDM and UDR, which can be used for UDM to obtain user subscription data information from UDR.

16), N36: the interface between the PCF and the UDR, which can be used for the PCF to obtain policy-related subscription data and application data-related information from the UDR.

It can be understood that the above-mentioned network element or function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualization function instantiated on a platform (for example, a cloud platform). Optionally, the foregoing network element or function may be implemented by one device, or jointly implemented by multiple devices, or may be a functional module in one device, which is not specifically limited in this embodiment of the present application.

The application function network element, policy control function network element, session management function network element, user plane function network element, and network data analysis function network element in this application can be AF, PCF, SMF, UPF in Figure 2a or Figure 2b respectively , NWDAF, or a network element having the above-mentioned functions of AF, PCF, SMF, UPF, and NWDAF in future communications such as 6G networks, which is not limited in this application. For ease of description, in the embodiments of this application, AF, PCF, SMF, UPF, and NWDAF will be used as application function network elements, policy control function network elements, session management function network elements, user plane function network elements, and network data network elements respectively. An example of an analysis function network element is used to introduce the technical solution provided by this application.

Embodiment one

Please refer to Figure 3, which is a service perception method provided by this application, which includes:

In step 301, the AF sends a request message 1 to the PCF, and the request message 1 includes application service ID, packet detection feature information and event ID 1.

Correspondingly, the PCF receives the request message 1 from the AF.

In the embodiment of the present application, the request message 1 is used to request to create or update the policy of the service flow of the application service. The request message 1 may be a policy authorization creation/update request message, or other messages, which are not limited in this application.

The packet detection feature information of the application service is used to indicate the matching feature of the service flow of the application service. The packet detection feature information can be understood as the matching feature provided by the AF to the core network (such as 5GC) for application detection. The packet detection feature information may include statistical features and/or packet header features of packets in the service flow of the application service. Among them, the statistical characteristics of the message may include message period, message size, etc., the message period can be used by UPF to judge whether there is a service flow of the application service based on the period characteristic of the received message, and the message size can be used by UPF Based on the interval distribution to which the size of the received packet belongs, it is judged whether there is a service flow of the application service. The description form of the packet header characteristics of the message can be a combination of other packet headers other than the conventional packet headers such as the original address, destination address, and protocol type defined in the current IP packet or Ethernet packet, for example, in the Profinet protocol header. The frame identifier Frame ID and the function code in the Modbus protocol header can be the target field and its corresponding value, or the matching feature composed of offset + field length + field value. This application does not limit this.

Event ID 1 (event ID) is used to indicate the event of reporting the service flow of the application service. The event can be an application start event (app start event) or an application end event (app stop event). The event ID 1 can be all The identifier of the application start event or the identifier of the application end event of the service flow of the above-mentioned application service. Wherein, the application start event may trigger the PCF to initiate a configuration update process to the terminal device, and the application end event may trigger the PCF to cancel the previous configuration information of the terminal device.

Optionally, the request message 1 may also include flow description information, where the flow description information is used to indicate the service flow to which the packet detection feature information is applicable, and may also be understood as used to identify the service flow to be matched. The flow description information may be in the form of an IP quintuple. If the request message 1 does not include the flow description information, it can be considered that all the service flows in the session of the terminal device corresponding to the request message 1 are the service flows to which the above-mentioned packet detection feature information applies (that is, the service flows to be matched).

In this application, there may be one or more service flows in the session of the terminal device, and different service flows may correspond to different application services, and each service flow may consist of one or more messages. The detection of a packet of a certain application service is the detection of the service flow of the application service, which may also be referred to as an application start event in which the service flow of the application service is detected. After a packet of an application service is detected, no packet of the application service is detected within a period of time, that is, the service flow of the application service is no longer detected, which can also be called detection of the application service The application end event of the business flow. In addition, the session of the terminal device may be a protocol data unit (protocol data unit, PDU) session, and correspondingly, the session establishment process may be a PDU session establishment process, which will not be described in detail below.

Optionally, the request message 1 may also include terminal device information, and the terminal device information may include the terminal device's IP address, terminal device identifier, data network name (data network name, DNN), single network slice selection assistance Information (single-network slice selection assistance information, S-NSSAI) and other information, such as the IP address of the terminal device, or the identification and DNN of the terminal device, or the identification of the terminal device and S-NSSAI wait. The above terminal device information can be used by the PCF to determine the session of the terminal device corresponding to the request message 1, or the session of the terminal device where the service flow of the application service is located, or the session of the terminal device to be detected. Optionally, the AF may only carry the above terminal device information in the policy authorization creation request message.

Optionally, before step 301 is performed, as shown in step 300, the terminal device may initiate a session establishment procedure to establish a session of the above-mentioned terminal device.

It should be noted that the AF may directly or indirectly send the request message 1 to the PCF. Wherein, the AF directly sends the request message 1 to the PCF means: the AF directly sends the request message 1 to the PCF without being forwarded by other network elements. AF sends request message 1 to PCF indirectly means: AF sends request message 1 to PCF through the forwarding of other network elements (such as NEF), for example, AF sends request message 1 to NEF, and NEF sends the request message 1 to PCF . Optionally, when the AF indirectly sends the request message 1 to the PCF through the NEF, if the request message 1 includes the information of the terminal device, the information of the terminal device can also be used by the NEF to find the PCF that provides services for the session of the terminal device .

Step 302, the PCF sends a request message 2 to the SMF, the request message 2 is used to request to subscribe to the event of the service flow of the application service, and the request message 2 includes the identification of the application service, packet detection feature information and event identification 2 .

Correspondingly, the SMF receives the request message 2 from the PCF.

In this embodiment of the application, the request message 2 may be an event subscription request message, or a policy association/control update notification message, or other messages, which are not limited in this application.

Optionally, the request message 2 may also include flow description information, where the flow description information is used to indicate the service flow to which the packet detection characteristic information applies.

Optionally, the request message 2 may also include a policy association identifier corresponding to the session of the terminal device, and the policy association identifier is used by the SMF to determine the session of the terminal device corresponding to the request message 2 and to search for the context of the session.

The event identifier 2 and the above event identifier 1 are used to indicate the same event, but the event identifier 2 and the event identifier 1 may be the same or different, which is not specifically limited in this application. In this application, the difference between the event identifier 2 and the event identifier 1 may mean that the description forms of the event identifiers are different, and the description forms may include APP_START/STOP character strings or indication information. If the event identifier 2 is the same as the event identifier 1, the event identifier 2 may be directly obtained by the PCF from the AF. If the event identifier 2 is different from the event identifier 1, the event identifier 2 may be determined by the PCF according to the event identifier 1 obtained from the AF, and there is a corresponding relationship between the event identifier 2 and the event identifier 1 .

One or more pieces of information such as the identification of the above application service, packet detection feature information or flow description information may be obtained by the PCF from the AF. For example, if the request message 1 includes the above one or multiple items of information, the PCF can obtain the above one or multiple items of information from the request message 1, and then include the above one or multiple items of information in the request message 2 and send it to SMF.

Exemplarily, when the PCF receives the request message 1, the PCF can execute a policy decision according to the request message 1, generate a corresponding policy and charging control (policy and charging control, PCC) rule, and pass the request message 2 to the PCC Rules are sent to SMF. The PCC rule may include the identifier of the application service, packet detection characteristic information and event identifier. Optionally, the PCC rule may also include flow description information.

Step 303, the SMF sends a request message 3 to the UPF, the request message 3 includes a detection rule and a usage reporting rule (usage reporting rule, URR), the detection rule is used to detect the service flow of the application service, and the detection rule includes the The above-mentioned identification of the application service and packet detection feature information, the URR includes event identification 3.

Correspondingly, the UPF receives the request message 3 from the SMF.

In this embodiment of the application, the request message 3 may be an event subscription request message, or an N4 session modification request message, or other messages, which are not limited in this application. It should be noted that the request message 3 has an N4 session granularity, and the request message 3 corresponds to a session of the terminal device one by one.

The detection rule may be a packet detection rule (packet detection rule, PDR). The PDR is used to detect the service flow of the application service in the session, that is, to detect the service flow of the application service in the session of the terminal device, or to detect the message of the application service in the session of the terminal device. The URR is configured to report the usage statistics of the service flow of the application service after the event of the service flow of the application service is detected.

Optionally, the PDR may also include flow description information, where the flow description information is used to indicate the service flow to which the packet detection feature information applies. The flow description information may be obtained by the SMF from the PCF.

Optionally, the URR may also include an event reporting indication, which is used to instruct the UPF to report a corresponding event report after detecting the event of the service flow of the application service. The event reporting indication can be understood as a special indication for reporting Instructions for app events.

The event identifier 3 and the above event identifier 2 are used to indicate the same event, but the event identifier 3 and the event identifier 2 may be the same or different, which is not specifically limited in this application. In this application, the difference between the event identifier 3 and the event identifier 2 may mean that the description forms of the event identifiers are different. If the event identifier 3 is the same as the event identifier 2, the event identifier 3 may be directly obtained by the SMF from the PCF. If the event identifier 3 is different from the event identifier 2, the event identifier 3 may be determined by the SMF according to the event identifier 2 obtained from the PCF, and there is a corresponding relationship between the event identifier 3 and the event identifier 2 .

One or more items of information such as the identification of the above application service, packet detection feature information, flow description information or event reporting indication may be obtained by the SMF from the PCF. For example, if the request message 2 includes one or more items of information above, the SMF can obtain the above one or more items of information from the request message, and then include the identification of the application service, packet detection feature information or flow description information in the PDR , include the event reporting indication in the URR, and then send the PDR and URR to the UPF through request message 3.

Exemplarily, after the SMF receives the PCC rule from the PCF, the SMF can generate the N4 rule according to the PCC rule, and then send the above N4 rule to the UPF through the request message 3 for execution. The N4 rule includes PDR and URR. Wherein, the PDR may include application service identification and packet detection feature information, and optionally, the PDR may also include flow description information. The URR may also include an event identifier 3, and optionally, the URR may also include an event reporting indication and the like.

In step 304, the UPF performs application detection on the received packets in the session according to the packet detection feature information.

In this embodiment of the application, when the UPF receives the PDR from the SMF, the UPF can perform application detection on the message in the session of the terminal device according to the PDR, which can also be understood as executing the application on the service flow in the session of the terminal device according to the PDR detection. The packet in the session of the terminal device refers to the packet of the terminal device transmitted by the user plane.

It should be understood that in this application, performing application detection on packets has a similar meaning to performing detection on service flows, and details are not described herein again. Executing application detection may refer to determining whether a packet of a certain application service is received or judging which application service the received packet belongs to (that is, judging the service flow of which application service the received packet belongs to).

Exemplarily, if the PDR includes packet detection characteristic information but does not include flow description information, the UPF may perform application detection on packets in the session of the terminal device according to the packet detection characteristic information. In other words, when the flow description information is not included in the PDR, the UPF can directly perform application detection on the packets in the session of the terminal device according to the packet detection characteristic information. Since UPF usually performs service flow matching according to the priority order of each PDR in the session of the terminal device, the packets of other service flows after the service flow matching the PDR with higher priority are removed in the session of the terminal device The application detection will be performed on the original packet as the characteristic information of the packet detection. In this case, the packets in the session of the terminal device that match the packet detection feature information can be considered as packets in the service flow that match the PDR.

If the PDR includes packet detection characteristic information and flow description information, the UPF may perform application detection on packets matching the flow description information in the session of the terminal device according to the packet detection characteristic information. In other words, when the flow description information is included in the PDR, UPF can first perform application detection on the packets in the session of the terminal device according to the flow description information, and then perform application detection on the packets that match the flow description information in the previous step according to the packet detection characteristic information. Application detection. In the session of the terminal device, the packets of other service flows except the service flows matching the higher priority PDR will be executed as the original packets of the packet detection characteristic information Application detection. In this case, the packets in the session of the terminal device that match both the flow description information and the packet detection characteristic information can be regarded as packets in the service flow that match the PDR.

Step 305, if an event of the service flow of the application service is detected, the UPF sends an event report 3 to the SMF, where the event report 3 is used to indicate the event.

Correspondingly, the SMF receives the event report 3 from the UPF.

In this embodiment of the present application, the UPF detecting the application start event of the service flow of the application service may refer to: the UPF detects that the above-mentioned packet detection characteristic information (or packet detection characteristic information and flow description information) is related to the session of the terminal device. matching message.

The UPF detects the application end event of the service flow of the application service may refer to: after the UPF detects a message that matches the above packet detection characteristic information (or packet detection characteristic information and flow description information) in the session of the terminal device, No more packets matching the above packet detection characteristic information (or packet detection characteristic information and flow description information) are detected within a period of time.

The event report 3 is used to report the event of the service flow of the application service, and the event report 3 may include the identifier of the application service and the event identifier 3 .

Optionally, if the URR sent by the SMF to the UPF includes an event reporting instruction, the UPF may send the above event report 3 to the SMF according to the event reporting instruction.

In step 306, the SMF sends event report 2 to the PCF.

Correspondingly, the PCF receives the event report 2 from the SMF.

The event report 2 is used to report the event of the service flow of the application service, and the event report 2 may include the identifier of the application service and the event identifier 2 .

In step 307, the PCF sends event report 1 to the AF.

Correspondingly, the AF receives event report 1 from the PCF.

The event report 1 is used to report the event of the service flow of the application service, and the event report 1 may include the identifier of the application service and the event identifier 1 .

Optionally, if the AF indirectly sends the request message 1 to the PCF, the PCF may also indirectly send the event report 1 to the AF. For example, the PCF may send the event report 1 to the NEF, and the NEF may send the event report 1 to the AF.

After the AF receives the event report 1 above, it can perform corresponding management actions on the terminal device based on the event report, such as notifying the adjustment of the encoding method, service packet sending cycle, and scheduled power-off.

It can be understood that, if the event ID 1 and the event ID 2 are the same, the event report 1 and the event report 2 may also be the same. Similarly, if the event ID 2 is the same as the event ID 3, the event report 2 and the event report 3 may also be the same.

In Embodiment 1 of the present application, the AF may subscribe to the PCF for application events, and provide packet detection feature information for application detection. The PCF can subscribe to the application event to the SMF, and the SMF instructs the UPF to perform application detection. UPF can perform application detection on the packets received in the session of the terminal device according to the packet detection characteristic information, and return corresponding event reports to AF through SMF and PCF.

Since the UPF can perform service detection on the packets in the session of the terminal device according to the packet detection feature information, the above technical solution can effectively distinguish the packets of different application services, and accurately determine the service flow of the application service to which the packets belong. judge. Furthermore, since the packet detection characteristic information can indicate the statistical characteristics and packet header characteristics of the packets in the service flow of the application service, compared with the technical solution in the prior art that only performs detection based on the plaintext domain name information in the packet header, the above-mentioned Technical solution In the scenario where packets of different application services have the same packet header (for example, encrypted packets or packets of different application services in industrial applications have the same packet header), it is also possible to Effectively differentiate, so as to accurately determine the type of application business.

Embodiment two

Please refer to Figure 4, which is another service perception method provided by this application, which includes:

Step 401, the AF sends a request message 4 to the NWDAF, the request message 4 is used to request to analyze the event of the service flow of the application service, the event is an application start event or an application end event, and the fourth request message includes the application service Identification and packet detection characteristic information, where the packet detection characteristic information is used to indicate the matching characteristics of the service flow of the application service.

Correspondingly, NWDAF receives request message 4 from AF.

In this embodiment of the application, the request message 4 may be an analysis subscription request message or other messages, which is not limited in this application.

The packet detection feature information of the application service may include statistical features and/or packet header features of packets in the service flow of the application service. Regarding the specific implementation manner of the packet detection feature information, reference may be made to the relevant description above, and details are not repeated here.

Optionally, the request message 4 may include flow description information, which is used to indicate the service flow to which the packet detection feature information is applicable, and can also be understood as used to identify the service flow to be matched. For the specific implementation manner of the stream description information, reference may be made to the relevant description above, and details are not repeated here.

Optionally, the request message 4 may include an event identifier, which is used to indicate the reporting of the event of the service flow of the application service, and the event identifier may be the identifier of the application start event of the service flow of the application service or the application The ID of the end event.

Optionally, the request message 1 may include terminal device information, and the terminal device information may be used by NWDAF to determine the session of the terminal device corresponding to the request message 4, or the session of the terminal device where the service flow of the application service is located, Or the session of the terminal device to be detected. For the specific implementation manner of the information of the terminal device, reference may be made to the relevant description above, and details are not repeated here.

After NWDAF receives the request message 4 from the AF, NWDAF can determine the session of the terminal device corresponding to the request message 4 and the SMF that provides services for the session of the terminal device according to the information of the above-mentioned terminal device, so as to request the SMF to obtain Mirroring of packets in the session of this end device.

Optionally, before step 401 is performed, as shown in step 400, the terminal device initiates a session establishment procedure to establish a session of the above-mentioned terminal device.

It should be noted that the AF may directly or indirectly send the request message 4 to the NWDAF. Wherein, the AF directly sending the request message 4 to the NWDAF refers to: the AF directly sends the request message 4 to the NWDAF without being forwarded by other network elements. AF sends request message 4 to NWDAF indirectly means: AF sends request message 4 to NWDAF through the forwarding of other network elements (such as NEF), for example, AF sends request message 4 to NEF, and NEF sends the request message 4 to NWDAF . Optionally, when the AF indirectly sends the request message 4 to the NWDAF through the NEF, if the request message 4 includes the information of the terminal device, the information of the terminal device can also be used by the NWDAF to find the NWDAF that provides services for the session of the terminal device .

In step 402, the NWDAF sends a request message 5 to the SMF, where the request message 5 is used to request forwarding the mirror image of the message in the session of the terminal device.

Correspondingly, the SMF receives the request message 5 from the NWDAF.

In this embodiment of the application, the request message 5 may be a message subscription request message, or an event subscription request message, or an event exposure message, or other messages, which are not limited in this application.

Optionally, the request message 5 may include flow description information, where the flow description information is used to indicate forwarding the image of the packet matching the flow description information in the session of the terminal device. The flow description information may be obtained by the NWDAF from the AF. For example, if the request message 4 includes the flow description information, the NWDAF obtains the flow description information from the request message 4, and may carry the flow description information in the request message 5 and send it to the SMF. If the request message 5 does not include the flow description information, it means that the mirror image of all packets in the session of the terminal device needs to be forwarded.

Optionally, the request message 5 may also include a mirroring destination address, which is the mirroring address of the message in the session receiving the terminal device in the NWDAF, and is used to instruct the SMF or UPF to forward the required message to the address The mirror image of (for example, the mirror image of the message matching the above-mentioned flow description information in the session of the terminal device), the mirror destination address can also be called the mirror report address or event notification address or event report address, etc., which is not limited in this application.

Optionally, the request message 5 may also include a mirroring forwarding indication, which may be used to indicate forwarding the mirroring of the packets in the session of the terminal device. The mirror forwarding indication can also be understood as indication information for instructing to forward the mirroring of the message in the session of the terminal device.

Step 403, the SMF sends a request message 6 to the UPF, which includes a detection rule and a forwarding rule, the detection rule is used to detect the service flow in the session of the terminal device, the forwarding rule includes a mirror forwarding indication, and the mirror forwarding Indicates the mirror image used to instruct forwarding the packets in the session of the terminal device.

Correspondingly, the UPF receives the request message 6 from the SMF.

In this embodiment of the application, the request message 6 may be an event subscription request message, or an N4 session modification request message, or other messages, which are not limited in this application. It should be noted that the request message 6 has an N4 session granularity, and the request message 6 corresponds to a session of the terminal device one by one.

The detection rule may be a packet detection rule (packet detection rule, PDR), and the forwarding rule may be a forwarding action rule (forwarding action rule, FAR), and the FAR may include the above mirroring forwarding indication.

The PDR may include flow description information or wildcard indication information. Wherein, the flow description information is used to indicate forwarding the image of the packet matching the flow description information in the session of the terminal device, and the wildcard indication information is used to forward the image of all packets in the session of the terminal device. If the SMF obtains the flow description information from NWDAF, for example, the request message 5 contains the flow description information, then the SMF can include the flow description information in the PDR, indicating that the UPF needs to report the mirror image of the packet matching the flow description information in the session of the terminal device . If SMF does not obtain flow description information from NWDAF, SMF can include wildcard indication information in PDR. This wildcard indication information can also be called match-all indication, indicating that UPF needs to report the mirror image of all packets in the session of the terminal device . Through the above method, the SMF can clearly inform the UPF which mirror image of the message needs to be forwarded, so that the UPF can perform corresponding processing.

Optionally, the FAR may also include a mirroring destination address, and the mirroring destination address is used by the UPF to directly forward the mirroring of the required packets to the NWDAF. The mirroring destination address may be obtained by the SMF from the NWDAF. For example, when the request message 5 includes the mirroring destination address, the SMF may include the mirroring destination address in the FAR. It should be noted that the mirror destination address may not be included in the FAR. If the FAR does not include the mirror destination address, it means that the UPF needs to forward the mirror image of the above message to NWDAF through the SMF, that is, the UPF can send the mirror image of the above message to the SMF, and the SMF will forward the mirror image of the above message according to the mirror destination address. The image is sent to SMF.

The image forwarding instruction sent by the SMF to the UPF may be the same as or different from the image forwarding instruction sent by the NWDAF to the SMF, which is not limited in this application. Wherein, the different mirroring forwarding indications may mean that the description forms of the two are different.

Exemplarily, after the SMF receives the request message 5, the SMF may generate the N4 rule according to the request message 5, and then send the N4 rule to the UPF through the request message 6 for execution. The N4 rule may include a PDR and a FAR, where the PDR may include flow description information or wildcard indication information, and the FAR may include a mirror forwarding indication. Optionally, the mirroring destination address may also be included in the FAR.

In step 404, the UPF detects the packets in the session of the terminal device according to the detection rule.

Step 405, the UPF sends the mirror image of the message in the session of the terminal device to the SMF or NWDAF according to the mirror forwarding instruction.

Correspondingly, the NWDAF receives the mirror image of the message in the session from the terminal device of the SMF or UPF.

Exemplarily, after the UPF receives the request message 6 from the SMF, it can perform packet matching according to the PDR in it, and then perform packet mirroring according to the mirror forwarding instruction in the FAR corresponding to the PDR, and report the session in the terminal device to The image of the file is sent directly or indirectly to NWDAF.

If the PDR includes the flow description information, the UPF may directly or indirectly send the image of the packet matching the flow description information in the session of the terminal device to the NWDAF. If the PDR includes wildcard indication information, the UPF may directly or indirectly send the images of all packets in the session of the terminal device to the NWDAF.

Wherein, the UPF directly sends the mirror image of the session message of the terminal device to the NWDAF may refer to: the FAR includes the mirroring destination address, and the mirroring destination address is the address of the mirror image receiving the session message of the terminal device in the NWDAF, and the UPF may according to The mirroring destination address directly sends the mirroring of the message in the session of the terminal device to NWDAF, without forwarding by SMF in the middle.

UPF indirectly sending the packet in the session of the terminal device to NWDAF can refer to: FAR does not include the mirroring destination address, and UPF can send the mirror image of the packet in the session of the terminal device to NWDAF through SMF forwarding, that is, UPF first sends the packet of the terminal device to NWDAF. The mirror image of the message in the session is sent to the SMF, and then the SMF forwards it to the NWDAF.

It can be understood that the mirroring of the foregoing packet may also be referred to as a mirroring packet. The mirroring of multiple packets can form the mirroring of a service flow, which can also be called a mirroring service flow. It should also be noted that the mirror forwarding process of the above message does not affect the forwarding of the original message by the UPF, that is, the UPF can still send the message in the session of the terminal device to the terminal device via the access network device as usual.

In step 406, the NWDAF performs application detection on the image of the received packet according to the packet detection characteristic information.

For the specific implementation manner of this step 406, please refer to the related description about the UPF performing application detection on the received packet according to the packet detection characteristic information in the above step 304, and details are not repeated here.

Step 407: If an event of the service flow of the application service is detected, the NWDAF sends an event report to the AF, where the event report is used to indicate the event.

Correspondingly, the AF receives the event report from the NWDAF.

The event report may include the identifier of the application service and an event identifier, the event identifier is used to indicate an event of the service flow of the application service, and the event identifier may be an application start event of the service flow of the application service The ID or ID of the application end event.

After receiving the event report, the AF can perform corresponding management actions on the terminal device based on the event report, such as notifying the adjustment of encoding mode, service message sending cycle, and scheduled power-off.

In Embodiment 2 of the present application, the AF may request the NWDAF to analyze the application event, and provide the NWDAF with packet detection feature information for application detection. NWDAF can obtain the image of the message in the session of the terminal device from the UPF through SMF, perform application detection on the image of the received message according to the packet detection characteristic information, and return the corresponding event report to AF.

Since NWDAF can perform service detection on the mirror image of the message in the session of the terminal device according to the packet detection feature information, the above technical solution can effectively distinguish the messages of different application services, and perform the service flow of the application service to which the message belongs. judge accurately. Furthermore, since the packet detection characteristic information can indicate the statistical characteristics and packet header characteristics of the packets in the service flow of the application service, compared with the technical solution in the prior art that only performs detection based on the plaintext domain name information in the packet header, the above-mentioned Technical solution In the scenario where packets of different application services have the same packet header (for example, encrypted packets or packets of different application services in industrial applications have the same packet header), it is also possible to Effectively differentiate, so as to accurately determine the type of application business.

Embodiment three

Please refer to Figure 5, which is another service perception method provided by this application, which includes:

Step 501, the AF sends a request message 7 to the PCF, the request message 7 is used to obtain the mirror image of the message in the session of the terminal device, the request message 7 includes the mirror destination address, and the mirror destination address is the AF receiving the mirror image address.

Correspondingly, the PCF receives the request message 7 from the AF.

In this embodiment of the application, the request message 7 may be a policy authorization creation/update request message, or other messages, which are not limited in this application.

Optionally, the request message 7 may include flow description information, and the flow description information is used to indicate forwarding the image of the packet matching the flow description information in the session of the terminal device. If the request message 7 does not include the flow description information, it means that the mirror image of all packets in the session of the terminal device needs to be forwarded. Regarding the specific implementation manner of the flow description information, reference may be made to the relevant description above, and details are not repeated here.

Optionally, the request message 7 may include terminal device information, and the terminal device information is used by the PCF to determine the session of the terminal device corresponding to the request message 7, or the session of the terminal device to be detected. For the specific implementation manner of the information of the terminal device, reference may be made to the relevant description above, and details are not repeated here.

Optionally, before step 501 is performed, as shown in step 500, the terminal device may initiate a session establishment process to establish a session of the above-mentioned terminal device.

It should be noted that the AF may directly or indirectly send the request message 7 to the PCF, which is similar to the sending of the request message 1 above and will not be repeated here.

In step 502, the PCF sends a request message 8 to the SMF, the request message 8 is used to request forwarding the mirroring of the message in the session of the terminal device, and the request message 8 includes the mirroring destination address.

Correspondingly, the SMF receives the request message 8 from the PCF.

In this embodiment of the application, the request message 8 may be a message subscription request message, or an event subscription request message, or a policy association/control update notification message, or other messages, which are not limited in this application.

Optionally, the request message 8 may include flow description information, and the flow description information is used to indicate forwarding the image of the packet matching the flow description information in the session of the terminal device. The flow description information may be obtained by the PCF from the AF, for example, if the request message 7 includes the flow description information, the PCF may obtain the flow description information from the request message 7, and then include the flow description information in the request message 8 Send to SMF.

Exemplarily, when the PCF receives the request message 7 from the AF, the PCF can execute policy decisions according to the request message 7, generate corresponding PCC rules, and send the PCC rules to the SMF through the request message 8. The PCC rule may include a mirroring destination address, and optionally flow description information, and is used to instruct the SMF to send a mirror image of a packet matching the flow description information in the session of the terminal device to the mirroring destination address.

Step 503, the SMF sends a request message 9 to the UPF, the request message 9 includes a detection rule and a forwarding rule, the detection rule is used to detect the service flow in the session of the terminal device, and the forwarding rule is used for the traffic The message is mirrored and forwarded, and the forwarding rule includes a mirroring forwarding indication and a mirroring destination address, and the mirroring forwarding indication is used to indicate forwarding the mirroring of the message in the session of the terminal device.

Correspondingly, the UPF receives the request message 9 from the SMF.

In this embodiment of the application, the request message 9 may be a message subscription request message, an event subscription request message, an N4 session modification request message, or other messages, which are not limited in this application. It should be noted that the request message 9 has an N4 session granularity, and the request message 9 corresponds to a session of the terminal device one by one.

The detection rule can be a PDR, and the forwarding rule can be a FAR or a packet mirror rule (packet mirror rule, PMR). The forwarding rule can also be called a mirroring rule, or a mirroring forwarding rule, etc.

The PDR may include flow description information or wildcard indication information, wherein the flow description information is used to indicate the mirror image of the message matching the flow description information in the session of the forwarding terminal device, and the wildcard indication information is used to indicate the forwarding terminal device Mirroring of all packets in the session. If the SMF obtains the flow description information from the PCF, for example, the request message 8 includes the flow description information, the SMF may include the flow description information in the PDR, indicating that the UPF needs to report the image of the packet matching the flow description information in the session of the terminal device. If SMF does not obtain flow description information from NWDAF, SMF can include wildcard indication information in PDR. This wildcard indication information can also be called match-all indication, indicating that UPF needs to report the mirror image of all packets in the session of the terminal device . Through the above method, the SMF can clearly inform the UPF which mirror image of the message needs to be forwarded, so that the UPF can perform corresponding processing.

Exemplarily, after receiving the PCC rule from the PCF, the SMF can generate the N4 rule according to the PCC rule, and then send the N4 rule to the UPF through the request message 9 for execution. The N4 rule includes PDR and FAR, or includes PDR and PMR. Wherein, the PDR includes flow description information or wildcard indication information, and the FAR or PMR includes a mirroring forwarding indication and a mirroring destination address.

In step 504, the UPF detects the packets in the session of the terminal device according to the detection rule.

In step 505, the UPF sends the mirror image of the message in the session of the terminal device to the AF according to the mirror forwarding instruction and the mirror destination address.

Correspondingly, the AF receives the mirror image of the message in the session from the terminal device of the UPF.

Exemplarily, after the UPF receives the request message 9 from the SMF, it can perform message matching according to the PDR therein, and then perform message mirroring according to the mirroring forwarding indication and the mirroring destination address in the FAR corresponding to the PDR, and the terminal The mirror image of the packet in the session of the device is sent to the AF. The mirroring of the message may also be called a mirroring message, and the mirroring of multiple messages may constitute a mirroring of a service flow, which may also be called a mirroring service flow.

If the PDR includes flow description information, UPF can send the mirror image of the message matching the flow description information in the session of the terminal device to AF; if the PDR includes wildcard indication information, UPF can send all A mirror image of the message is sent to the AF. It should be noted that the above message mirroring forwarding process does not affect the forwarding of the original message by the UPF.

In step 506, the AF performs application detection according to the image of the received message.

Thereafter, the AF can determine the type of the application service according to the received image of the message in the session of the terminal device, and send a corresponding management command to the terminal device.

In the third embodiment of the present application, the AF can send the forwarding rules of the message to the UPF through the PCF and SMF, obtain the image of the message in the session of the terminal device, and then perform application detection according to the image of the received message, and perform subsequent management decisions. The above technical solution opens the application detection capability to the AF, so that the AF can perceive the type of the application service actually initiated by the terminal device, so as to facilitate the AF to execute corresponding management decisions based on the application service currently initiated by the terminal device.

In this technical solution, the AF may directly communicate with the terminal device, or may only serve as a management device for the terminal device without directly communicating with the terminal device.

FIG. 6 and FIG. 7 are schematic structural diagrams of possible communication devices provided by the embodiments of the present application. These communication devices can be used to implement the functions of the application function network element, the policy control function network element, the session management function network element, the user plane function network element or the network data analysis function network element in the above method embodiment, so the above method can also be implemented Beneficial effects possessed by the embodiment. In the embodiment of the present application, the communication device may be an application function network element, a policy control function network element, a session management function network element, a user plane function network element, or a network data analysis function network element, or it may be an application function network element Modules (such as chips) of network elements, policy control function network elements, session management function network elements, user plane function network elements, or network data analysis function network elements.

As shown in FIG. 6 , a communication device 600 includes a processing unit 610 and a transceiver unit 620 . The communication device 600 is used to implement the application function network element, the policy control function network element, the session management function network element, the user plane function network element or the network data analysis in any of the method embodiments shown in Fig. 3, Fig. 4 to Fig. 5 above. Functional network element function.

When the communication device 600 is used to realize the function of the session management function network element in the method embodiment shown in FIG. 3: the transceiver unit 620 is configured to send a first request message to the user plane function network element, and the first request message includes A detection rule and a usage reporting rule, the detection rule includes the identification of the application service and packet detection feature information, the detection rule is used to detect the service flow of the application service in the session, and the packet detection feature information is used to indicate the application service The matching feature of the service flow, the usage reporting rule includes a first event identifier, the first event identifier is used to indicate the event of reporting the service flow of the application service, and the event is an application start event or an application end event; the transceiver unit 620, It is further used for receiving a first event report from a user plane functional network element, where the first event report is used to indicate an event of the service flow of the application service.

When the communication device 600 is used to implement the functions of the user plane function network element in the method embodiment shown in FIG. 3: the transceiver unit 620 is configured to receive a first request message from the session management function network element, in which Including a detection rule and a usage reporting rule, the detection rule includes the identification of the application service and packet detection feature information, the detection rule is used to detect the service flow of the application service in the session, and the packet detection feature information is used to indicate that the application service The matching feature of the service flow of the application service, the usage reporting rule includes a first event identifier, the first event identifier is used to indicate the event of reporting the service flow of the application service, and the event is an application start event or an application end event; the processing unit 610 , configured to perform application detection on the received packets in the session according to the packet detection feature information; if an event of the service flow of the application service is detected, the transceiver unit 620 is used to send the session management function network element A first event report is sent, the first event report indicating the event.

When the communication device 600 is used to realize the function of the policy control function network element in the method embodiment shown in FIG. 3: the transceiver unit 620 is configured to receive a third request message from the application function network element, the third request message includes An application service identifier, packet detection feature information, and a third event identifier, where the packet detection feature information is used to indicate the matching feature of the service flow of the application service, and the third event identifier is used to indicate reporting of the service flow of the application service event, the event is an application start event or an application end event; the transceiver unit 620 is further configured to send a second request message to the session management function network element, where the second request message is used to request to subscribe to the event, and the second request The message includes the identifier of the application service, packet detection feature information, and a second event identifier, and the second event identifier is used to indicate reporting of the event; the transceiver unit 620 is also configured to receive the second event identifier from the session management function network element An event report, where the second event report is used to indicate the event; the transceiver unit 620 is further configured to send a third event report to the application function network element, where the third event report is used to indicate the event.

When the communication device 600 is used to implement the functions of the application function network element in the method embodiment shown in FIG. 3: the transceiver unit 620 is configured to send a third request message to the policy control function network element, the third request message includes A service identifier, packet detection characteristic information, and a third event identifier, where the packet detection characteristic information is used to indicate the matching characteristics of the service flow of the application service, and the third event identifier is used to indicate the reporting of the service flow of the application service An event, where the event is an application start event or an application end event; the transceiver unit 620 is further configured to receive a third event report from a network element with a policy control function, where the third event report is used to indicate the event.

When the communication device 600 is used to realize the function of the network element with the network data analysis function in the method embodiment shown in FIG. An event that requests to analyze the service flow of the application service, the event is an application start event or an application end event, the fourth request message includes the identification of the application service and packet detection characteristic information, and the packet detection characteristic information is used to indicate the The matching feature of the service flow of the application service; the transceiver unit 620 is also configured to send a fifth request message to the session management function network element, and the fifth request message is used to request forwarding the mirror image of the message in the session of the terminal device; the processing unit 610, configured to perform application detection on the image received from the session management function network element or the user plane function network element according to the packet detection characteristic information; if the event of the service flow of the application service is detected, the transceiver unit 620 It is also used to send an event report to the application function network element, where the event report is used to indicate the event.

When the communication device 600 is used to implement the function of the session management function network element in the method embodiment shown in FIG. 4: the transceiver unit 620 is configured to receive the fifth request message from the network data analysis function network element, the fifth request message It is used to request forwarding of the mirror image of the message in the session of the terminal device; the transceiver unit 620 is also used to send a sixth request message to the user plane functional network element, the sixth request message includes a detection rule and a forwarding rule, and the detection rule uses For detecting the service flow of the session of the terminal device, the forwarding rule includes a mirroring forwarding indication, and the mirroring forwarding indication is used to indicate the mirroring.

When the communication device 600 is used to implement the functions of the user plane function network element in the method embodiment shown in FIG. 4: the transceiver unit 620 is configured to receive a sixth request message from the session management function network element, in which Including a detection rule and a forwarding rule, the detection rule is used to detect the service flow in the session of the terminal device, the forwarding rule includes a mirroring forwarding indication, and the mirroring forwarding indication is used to indicate forwarding the mirroring of the message in the session of the terminal device; processing The unit 610 is configured to detect the message in the session of the terminal device according to the detection rule; the transceiver unit 620 is also configured to send the image to the session management function network element or the network data analysis function network element according to the image forwarding instruction .

When the communication device 600 is used to realize the function of the application function network element in the method embodiment shown in FIG. 4: the transceiver unit 620 is configured to send a fourth request message to the network data analysis function network element, the fourth request message is used for An event requesting to analyze the service flow of the application service, the event is an application start event or an application end event, the fourth request message includes the identification of the application service and packet detection characteristic information, and the packet detection characteristic information is used to indicate the The matching feature of the service flow of the application service; the transceiver unit 620 is further configured to receive an event report from a network element with a network data analysis function, where the event report is used to indicate the event.

When the communication device 600 is used to realize the function of the application function network element in the method embodiment shown in FIG. For the mirroring of the message in the session of the terminal device, the seventh request message includes the mirroring destination address, and the mirroring destination address is the address receiving the mirroring in the application function network element; the transceiver unit 620 is also used to receive the The image of the network element; a processing unit 610, configured to perform application detection according to the image.

When the communication device 600 is used to realize the function of the policy control function network element in the method embodiment shown in FIG. 5: the transceiver unit 620 is configured to receive the seventh request message from the application function network element, the seventh request message is used Obtain the mirror image of the message in the session of the terminal device, the seventh request message includes the mirror image destination address, and the mirror image destination address is the address receiving the mirror image in the application function network element; the transceiver unit 620 is also used to report to the session management function The network element sends an eighth request message, where the eighth request message is used to request forwarding of the image, and the eighth request message includes the image destination address.

When the communication device 600 is used to realize the function of the session management function network element in the method embodiment shown in FIG. For requesting forwarding of the mirroring of the message in the session of the terminal device, the eighth request message includes the mirroring destination address, and the mirroring destination address is the address receiving the mirroring in the application function network element; the transceiver unit 620 is also used to send the user The surface function network element sends a ninth request message, the ninth request message includes a detection rule and a forwarding rule, the detection rule is used to detect the service flow in the session of the terminal device, and the forwarding rule is used for the traffic flow in the session of the terminal device The message is mirrored and forwarded, and the forwarding rule includes a mirroring forwarding indication and the mirroring destination address, and the mirroring forwarding indication is used to instruct forwarding of the mirroring.

When the communication device 600 is used to realize the functions of the user plane function network element in the method embodiment shown in FIG. 5: the transceiver unit 620 is used to receive the detection rule and the forwarding rule from the session management function network element. Detect the service flow in the session of the terminal device. The forwarding rule is used to mirror and forward the packets in the session of the terminal device. The forwarding rule includes a mirror forwarding instruction and a mirror destination address. The mirror destination address is the application function network element Receive the address of the mirror image; the processing unit 610 is used to detect the message in the session of the terminal device according to the detection rule; the transceiver unit 620 is used to send the mirror image to the application function network element according to the mirror forwarding instruction and the mirror destination address.

The processing unit 610 involved in the communication device may be realized by at least one processor or processor-related circuit components, and the transceiver unit 620 may be realized by at least one transceiver or transceiver-related circuit components or a communication interface. Optionally, the communication device may further include a storage unit, which may be used to store data and/or instructions, and the transceiver unit 620 and/or the processing unit 610 may read the data and/or instructions in the storage unit, thereby The communication device is made to implement a corresponding method. The storage unit can be realized, for example, by at least one memory. The above-mentioned storage unit, processing unit and transceiver unit may exist separately, or may be integrated in whole or in part, for example, the storage unit is integrated with the processing unit, or the processing unit is integrated with the transceiver unit.

The operations and/or functions of each unit in the communication device are to implement the corresponding processes of the methods shown in FIG. 3 to FIG. 5 , and for the sake of brevity, details are not repeated here.

As shown in FIG. 7 , a communication device 700 includes a processor 710 and an interface circuit 720 . The processor 710 and the interface circuit 720 are coupled to each other. It can be understood that the interface circuit 720 may be a transceiver or an input-output interface. Optionally, the communication device 700 may further include a memory 730 for storing instructions executed by the processor 710, or storing input data required by the processor 710 to execute the instructions, or storing data generated by the processor 710 after executing the instructions.

When the communication device 700 is used to implement the methods shown in FIGS. 3 to 5 , the processor 710 is used to implement the functions of the processing unit 610 , and the interface circuit 720 is used to implement the functions of the transceiver unit 620 .

It can be understood that the processor in the embodiments of the present application can be a central processing unit (central processing unit, CPU), and can also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), application-specific integrated circuits (application specific integrated circuit, ASIC), field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. A general-purpose processor can be a microprocessor, or any conventional processor.

The method steps in the embodiments of the present application may be implemented by means of hardware, or may be implemented by means of a processor executing software instructions. Software instructions can be composed of corresponding software modules, and software modules can be stored in random access memory, flash memory, read-only memory, programmable read-only memory, erasable programmable read-only memory, electrically erasable programmable read-only Memory, registers, hard disk, removable hard disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. Of course, the storage medium may also be a component of the processor. The processor and storage medium can be located in the ASIC. In addition, the ASIC can be located in the base station or the terminal. Certainly, the processor and the storage medium may also exist in the base station or the terminal as discrete components.

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer programs or instructions. When the computer program or instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are executed in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, a base station, user equipment or other programmable devices. The computer program or instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be downloaded from a website, computer, A server or data center transmits to another website site, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrating one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; and it may also be a semiconductor medium, such as a solid state disk. The computer readable storage medium may be a volatile or a nonvolatile storage medium, or may include both volatile and nonvolatile types of storage media.

In each embodiment of the present application, if there is no special explanation and logical conflict, the terms and/or descriptions between different embodiments are consistent and can be referred to each other, and the technical features in different embodiments are based on their inherent Logical relationships can be combined to form new embodiments.

In this application, "at least one" means one or more, and "multiple" means two or more. "And/or" describes the association relationship of associated objects, indicating that there may be three types of relationships, for example, A and/or B, which can mean: A exists alone, A and B exist simultaneously, and B exists alone, where A, B can be singular or plural. In the text description of this application, the character "/" generally indicates that the contextual objects are an "or" relationship; in the formulas of this application, the character "/" indicates that the contextual objects are a "division" Relationship.

It can be understood that the various numbers involved in the embodiments of the present application are only for convenience of description, and are not used to limit the scope of the embodiments of the present application. The size of the serial numbers of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic.

Claims

A service perception method, characterized in that the method comprises:

Send a first request message to the user plane functional network element, the first request message includes a detection rule and a usage reporting rule, the detection rule includes the identification of the application service and packet detection feature information, and the detection rule is used to detect session In the service flow of the application service, the packet detection feature information is used to indicate the matching feature of the service flow of the application service, and the usage reporting rule includes a first event identifier, and the first event identifier is used to indicate the reporting An event of the service flow of the application service, where the event is an application start event or an application end event;

receiving a first event report from the user plane functional network element, where the first event report is used to indicate the event of the service flow of the application service.
The method according to claim 1, further comprising:

receiving a second request message from a policy control function network element, where the second request message is used to subscribe to the event, and the second request message includes the identifier of the application service, the packet detection feature information, and the second An event identifier, where the second event identifier is used to indicate to report the event;

Sending a second event report to the policy control function network element, where the second event report is used to indicate the event.
The method according to claim 1 or 2, wherein the packet detection feature information includes statistical features and/or packet header features of packets in the service flow of the application service.
The method according to any one of claims 1 to 3, wherein the detection rule further includes flow description information, and the flow description information is used to indicate a service flow to which the packet detection feature information applies.
A service perception method, characterized in that the method comprises:

Receive a first request message from a session management function network element, the first request message includes a detection rule and a usage reporting rule, the detection rule includes an application service identifier and packet detection feature information, and the detection rule is used to detect The service flow of the application service in the session, the packet detection feature information is used to indicate the matching feature of the service flow of the application service, the usage reporting rule includes a first event identifier, and the first event identifier is used to indicate Reporting an event of the service flow of the application service, where the event is an application start event or an application end event;

performing application detection on received packets in the session according to the packet detection feature information;

If the event of the service flow of the application service is detected, a first event report is sent to the session management function network element, where the first event report is used to indicate the event.
The method according to claim 5, wherein the packet detection feature information includes statistical features and/or packet header features of packets in the service flow of the application service.
The method according to claim 5 or 6, wherein the detection rule further includes flow description information, and the flow description information is used to indicate the service flow to which the packet detection characteristic information is applicable;

Perform application detection on the received message according to the packet detection feature information, including:

According to the packet detection feature information, application detection is performed on packets matching the flow description information in the session.
A communication system, characterized in that the system includes a session management function network element and a user plane function network element;

The session management function network element is configured to send a first request message to the user plane function network element, the first request message includes a detection rule and a usage reporting rule, and the detection rule includes an application service identifier and packet Detection feature information, the detection rule is used to detect the service flow of the application service in the session, the packet detection feature information is used to indicate the matching feature of the service flow of the application service, and the usage reporting rule includes the first event An identifier, the first event identifier is used to indicate an event for reporting the service flow of the application service, and the event is an application start event or an application end event;

The user plane functional network element is configured to receive the first request message from the session management functional network element, perform application detection on the received packets in the session according to the packet detection characteristic information, and if detected For the event of the service flow of the application service, send a first event report to the session management function network element, where the first event report is used to indicate the event;

The session management functional network element is further configured to receive the first event report from the user plane functional network element.
The system according to claim 8, further comprising a network element with a policy control function;

The policy control function network element is configured to send a second request message to the session management function network element, the second request message is used to request to subscribe to the event, and the second request message includes the application service The identification of the packet detection feature information and the second event identification, the second event identification is used to report the event;

The session management function network element is further configured to receive the second request message from the policy control function network element, and send a second event report to the policy control function network element, and the second event report uses on the events mentioned in the instructions;

The policy control function network element is further configured to receive the second event report from the session management function network element.
The system according to claim 9, further comprising an application function network element;

The application function network element is configured to send a third request message to the policy control function network element, where the third request message includes the identifier of the application service, the packet detection feature information, and a third event identifier, The third event identifier is used to report the event;

The policy control function network element is further configured to receive the third request message from the application function network element, and send a third event report to the application function network element, where the third event report is used to indicate said event;

The application function network element is further configured to receive the third event report from the policy control function network element.
A service perception method, characterized in that the method comprises:

Receive a fourth request message from an application function network element, the fourth request message is used to request to analyze the event of the service flow of the application service, the event is an application start event or an application end event, and the fourth request message includes The identification of the application service and packet detection feature information, the packet detection feature information is used to indicate the matching feature of the service flow of the application service;

Sending a fifth request message to the session management function network element, where the fifth request message is used to request forwarding the image of the message in the session of the terminal device;

performing application detection on the received image of the session management function network element or the user plane function network element according to the packet detection feature information;

If the event of the service flow of the application service is detected, an event report is sent to the application function network element, where the event report is used to indicate the event.
The method according to claim 11, wherein the packet detection feature information includes statistical features and/or packet header features of packets in the service flow of the application service.
The method according to claim 11 or 12, wherein the fourth request message further includes flow description information, and the flow description information is used to indicate the service flow to which the packet detection characteristic information is applicable;

The fifth request message includes the flow description information, and the flow description information is used to instruct forwarding the image of the packet matching the flow description information in the session of the terminal device.
The method according to any one of claims 11 to 13, wherein the fifth request message further includes a mirroring destination address, and the mirroring destination address is a network element with a network data analysis function that receives the mirroring address.
The method according to any one of claims 11 to 14, wherein the fourth request message also includes an event identifier, and the event identifier is used to indicate to report the event;

The event report includes the identifier of the application service and the event identifier.
A service perception method, characterized in that the method comprises:

receiving a fifth request message from a network element with a network data analysis function, where the fifth request message is used to request forwarding the mirror image of the message in the session of the terminal device;

Send a sixth request message to the user plane functional network element, the sixth request message includes a detection rule and a forwarding rule, the detection rule is used to detect the service flow of the session of the terminal device, and the forwarding rule includes a mirror image A forwarding indication, where the image forwarding indication is used to instruct forwarding the image.
The method according to claim 16, wherein the fifth request message includes flow description information, and the flow description information is used to instruct forwarding the packets matching the flow description information in the session of the terminal device. the mirror image of the text;

The detection rule includes the flow description information.
The method according to claim 16, wherein the detection rule includes wildcard indication information, and the wildcard indication information is used to forward mirror images of all messages in the session of the terminal device.
The method according to any one of claims 16 to 18, wherein the fifth request message further includes a mirroring destination address, and the mirroring destination address is the The address of the mirror.
The method according to claim 19, further comprising:

receiving the image from the user plane functional network element, and sending the image to the network data analysis function network element according to the image destination address; or,

The mirroring destination address is also included in the forwarding rule.
A communication system, characterized in that the system includes a network data analysis function network element and a session management function network element; wherein,

The network data analysis function network element is used to receive a fourth request message from the application function network element, the fourth request message is used to request to analyze the event of the service flow of the application service, and the event is an application start event or an application An end event, the fourth request message includes the identification of the application service and packet detection characteristic information, the packet detection characteristic information is used to indicate the matching characteristics of the service flow of the application service; and, to the session management The functional network element sends a fifth request message, where the fifth request message is used to request forwarding the mirror image of the message in the session of the terminal device;

The session management function network element is configured to receive a fifth request message from the network data analysis function network element, and send a sixth request message to the user plane function network element, and the sixth request message includes detection rules and A forwarding rule, the detection rule is used to detect the service flow in the session of the terminal device, the forwarding rule includes a mirroring forwarding indication, and the mirroring forwarding indication is used to indicate forwarding of the mirroring;

The network data analysis function network element is further configured to receive the image from the session management function network element or the user plane function network element, perform application detection on the image according to the packet detection characteristic information, and report to all The application function network element sends an event report, where the event report is used to indicate the event.
The system according to claim 21, further comprising the application function network element;

The application function network element is configured to send the fourth request message to the network data analysis function network element, and receive the event report from the network data analysis function network element.
The system according to claim 21 or 22, wherein the system further comprises the user plane functional network element;

The user plane functional network element is configured to receive the sixth request message from the session management functional network element, detect the message in the session of the terminal device according to the detection rule, and forward the instruction according to the mirroring , sending the image to the network element with the session management function or the network element with the network data analysis function.
A communication device, characterized by comprising a module for performing the method according to any one of claims 1 to 4, or comprising a module for performing the method according to any one of claims 16 to 20.
A communication device, characterized by comprising a module for performing the method according to any one of claims 5 to 7.
A communication device, characterized by comprising a module for performing the method according to any one of claims 11-15.