WO2024032245A1 - Procédé de communication et appareil de communication - Google Patents

Procédé de communication et appareil de communication Download PDF

Info

Publication number
WO2024032245A1
WO2024032245A1 PCT/CN2023/104692 CN2023104692W WO2024032245A1 WO 2024032245 A1 WO2024032245 A1 WO 2024032245A1 CN 2023104692 W CN2023104692 W CN 2023104692W WO 2024032245 A1 WO2024032245 A1 WO 2024032245A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
sepp
network element
information
network
Prior art date
Application number
PCT/CN2023/104692
Other languages
English (en)
Chinese (zh)
Inventor
邵国强
石玺
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024032245A1 publication Critical patent/WO2024032245A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/02—Communication route or path selection, e.g. power-based or shortest path routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/24—Connectivity information management, e.g. connectivity discovery or connectivity update

Definitions

  • the embodiments of the present application relate to the field of communication, and more specifically, to a communication method and a communication device.
  • the service-oriented interface of the 5G core network carries a large amount of topology information. If this topology information is not processed, it may flow out of the control scope of the local network along with the roaming interface and interworking interface. Therefore, the topology information needs to be hidden when sending a message and restored when the message is received.
  • Embodiments of the present application provide a communication method and a communication device, which can correctly restore hidden topology information, thereby avoiding service failure caused by differences between the first SEPP and the second SEPP.
  • a communication method includes: in response to a first network element sending a first request message to a second network, the first security and border proxy network element SEPP according to the first algorithm and the first encryption
  • the key ID generates hidden information, which is the hidden topology information of the first network element
  • the first SEPP sends a first message to the second network, the first message includes the first request message and the hidden information, and the hidden information
  • the information carries the first key ID
  • the second SEPP receives the second message sent by the second network in response to the first message, the second message includes the first reply message and the hidden information, the first SEPP and the third
  • the two SEPPs belong to the first network, and the first SEPP and the second SEPP are preset with the first algorithm and the first key ID; the second SEPP restores the hidden information based on the first key ID, and then obtains the Topology information of the first network element, so as to route the first reply message to the first network element according to the topology information of the first network element.
  • the second SEPP recovers the hidden information according to the first key ID based on the first algorithm.
  • the first network element is any one of the access and mobility management function AMF, the session management function SMF, the unified data management UDM, the user plane function UPF, the authentication server function AUSF, and the short message service function SMSF.
  • the first SEPP and the second SEPP are the same SEPP.
  • SEPP by presetting the same algorithm and key ID information on SEPPs in the same network, the functions of mutual hiding and recovery of topology information between different SEPPs on the same network can be realized, thereby realizing the functions of all SEPPs in the same network.
  • SEPP receives the topology hidden information that needs to be restored, it can correctly restore the hidden topology information, thereby further routing the corresponding message to the correct address based on the topology information, and avoiding service failures caused by different SEPPs.
  • the first SEPP generates hidden information, including: the first SEPP receives a first request message sent by the first network element and the topology information of the first network element; A SEPP encrypts the topology information of the first network element according to the first algorithm and the first key ID, and then generates the hidden information.
  • encryption is used to hide the topology information in the message.
  • the topology information between different SEPPs on the same network can be mutually communicated. Hide and restore functionality.
  • the first SEPP sends a first message to the second network, including: the first SEPP generates a first fully qualified domain name FQDN, where the first FQDN includes the hidden information and the third A key ID; the first SEPP sends a first message to the second network, where the first message includes the first request message and the first FQDN.
  • the first FQDN also includes domain information of the first network element.
  • the hidden information carried by the message may exist in the FQDN, and the FQDN also includes the first network
  • the FQDN also includes the first network
  • a communication method in response to the first network element sending a first request message to the second network, the first security and border proxy network element SEPP sends the first request message to the second network.
  • the first message includes the first request message and first indication information, the first indication information is used to indicate that the routing category corresponding to the first SEPP is strict routing;
  • the first SEPP receives the response from the second network to The first message, the second message sent according to the first path, the second message includes the first reply message, the first path is generated by the second network according to the path of the first message, the first path includes a or multiple devices, each of the one or more devices corresponds to a routing category, and the routing category includes strict routing;
  • the first SEPP sends the first reply message to the first network element.
  • this route category also includes relaxed routes.
  • the routing category corresponding to a device included in the message path is strict routing, then the message sent along the message path must pass through the device; if the routing category corresponding to a device included in the message path is loose routing , then the message sent according to the message path may or may not pass through the device.
  • the first network element is any one of the access and mobility management function AMF, the session management function SMF, the unified data management UDM, the user plane function UPF, the authentication server function AUSF, and the short message service function SMSF.
  • the path of the request message is recorded, and the path of the reply message is generated based on the path, and the SEPP in the path is marked as strict routing, so that the reply message corresponding to the request message must go through the path marked as strict routing.
  • SEPP in this way, the message path can be controlled so that messages are sent and received through the same SEPP, thereby avoiding service failures caused by different SEPPs.
  • the first message further includes hidden information, the hidden information being the hidden topology information of the first network element
  • the second message further includes the hidden information
  • the third A SEPP sends the first reply message to the first network element, including: the first SEPP restores the hidden information to the topology information of the first network element; the first SEPP sends the first reply message to the first network element according to the topology information of the first network element.
  • the first network element sends the first reply message.
  • the first SEPP generates the hidden information by encrypting the topology information of the first network element.
  • the method further includes: the first SEPP receiving the first request message sent by the first network element and the topology information of the first network element.
  • messages with destination addresses hidden by SEPP can be routed to itself, thereby avoiding the situation where messages are routed to other SEPPs and cannot be recovered, thereby making the hidden Topology information can be restored correctly, avoiding service failures caused by different SEPPs.
  • a communication method includes: the second network element receives a first message sent by the first security and border proxy network element SEPP, where the first message includes a first request message and first indication information, The first indication information is used to indicate that the routing category corresponding to the first SEPP is strict routing; the second network element generates a first path according to the path of the first message, and the first path includes one or more devices. Or multiple devices each correspond to a routing category, and the routing category includes strict routing; in response to the first message, the second network element sends a second message to the first SEPP according to the first path, the second message includes the One reply message.
  • the second network element sends a second message to the first SEPP according to the routing category corresponding to the first path and the device on the first path, and the second message includes a first reply message.
  • the second network element records the path of the first message.
  • the second network element is any one of the access and mobility management function AMF, the session management function SMF, the unified data management UDM, the user plane function UPF, the authentication server function AUSF, and the short message service function SMSF.
  • the second network element arranges the paths of the first message in reverse order to generate the first path.
  • the path of the request message is recorded, and the path of the reply message is generated based on the path, and the SEPP in the path is marked as strict routing, so that the reply message corresponding to the request message must go through the path marked as strict routing.
  • SEPP in this way, the message path can be controlled so that messages are sent and received through the same SEPP, thereby avoiding service failures caused by different SEPPs.
  • the first message further includes hidden information
  • the hidden information is the hidden topology information of the first network element
  • the second message further includes the hidden information
  • messages with destination addresses hidden by SEPP can be routed to itself, thereby avoiding the situation where messages are routed to other SEPPs and cannot be recovered, thereby making the hidden Topology information can be restored correctly, avoiding service failures caused by different SEPPs.
  • a communication method in response to the first network element sending a first request message to the second network, the first security and border proxy network element SEPP sends the first request message to the second network.
  • the first message includes the first request message and the hidden information, the hidden information is the hidden topology information of the first network element; the second SEPP receives the second network in response to the first message.
  • the second message includes the first reply message and the hidden information; the second SEPP sends a second request message to the third network element, the second request message is used to request to obtain the topology of the first network element information, the second request message includes the hidden information; the second SEPP receives the second reply message sent by the third network element in response to the second request message, the second reply message includes the topology information of the first network element , so as to route the request reply message to the first network element according to the topology information of the first network element.
  • the first SEPP generates the hidden information by encrypting the topology information of the first network element.
  • the method further includes: the first SEPP receiving the first request message sent by the first network element and the topology information of the first network element.
  • the first network element is any one of AMF, SMF, UDM, UPF, AUSF, and SMSF.
  • the SEPP that receives the reply message requests other network elements to provide topology information recovery services.
  • the other network elements query the pre-hiding topology information through the hidden topology information, and then send the queried pre-hiding topology information.
  • topology information recovery services are provided to each other through SEPP to realize the conversion from the hidden topology information to the pre-hidden topology information, so that the hidden topology information can be correctly restored, thereby avoiding the SEPP and reception of hidden topology information. Service failure caused by different SEPPs used to hide topology information.
  • the third network element is the first SEPP.
  • the function of SEPP is extended so that it can provide external services when receiving a recovery request message, query the topology information before hiding through the hidden topology information, and then query the topology information before hiding. Sent to the SEPP that issued the recovery request message.
  • topology information recovery services are provided to each other through SEPP to realize the conversion from the hidden topology information to the pre-hidden topology information, so that the hidden topology information can be correctly restored, thereby avoiding the SEPP and reception of hidden topology information. Service failure caused by different SEPPs used to hide topology information.
  • the third network element is the access and mobility management function AMF, the session management function SMF, the unified data management UDM, the user plane function UPF, the authentication server function AUSF, the short-term network element Any one of the message service functions SMSF.
  • the hiding and recovery service of topology information is provided by adding a new NF.
  • the newly added NF can query the topology information before hiding through the hidden topology information, and then query the topology information.
  • the topology information before hiding is sent to the SEPP that issued the recovery request message. In this way, the hidden topology information can be restored correctly, thereby avoiding service failure caused by the difference between the SEPP for sending the hidden topology information and the SEPP for receiving the hidden topology information.
  • a communication device which device includes a module for executing the method in the above-mentioned first aspect or any possible implementation of the first aspect; or, includes a module for executing the above-mentioned second aspect or the second aspect.
  • a communication device in a sixth aspect, includes a processor and an interface circuit.
  • the interface circuit is configured to receive signals from other communication devices other than the communication device and transmit them to the processor or to transmit signals from other communication devices.
  • the signal of the processor is sent to other communication devices other than the communication device, and the processor is used to implement any possible method in any one of the above first to fourth aspects through logic circuits or execution of code instructions. Methods in the implementation.
  • a communication device including a processor.
  • the processor is coupled to a memory and may be used to execute instructions in the memory to implement the method in any possible implementation manner of any one of the above-mentioned first to fourth aspects.
  • the device further includes memory.
  • the device further includes a communication interface, and the processor is coupled to the communication interface.
  • a computer-readable storage medium is provided.
  • Computer programs or instructions are stored in the computer-readable storage medium.
  • any one of the above-mentioned first to fourth aspects is implemented.
  • a computer program product containing instructions is provided. When the instructions are executed, the method in any possible implementation manner of any one of the above-mentioned first to fourth aspects is implemented.
  • a communication chip in which instructions are stored, and when run on a computer device, the communication chip causes the communication chip to execute the method in any possible implementation manner in the above-mentioned first to fourth aspects.
  • a communication system including AMF, NG-RAN and SEPP.
  • the communication system may also include SMF.
  • the communication system may also include UDM.
  • the communication system also includes other devices that communicate with the above network elements.
  • Figure 1 is an application architecture diagram of a roaming docking scenario provided by an embodiment of the present application
  • Figure 2 is a schematic diagram of two topological information hiding processes provided by embodiments of the present application.
  • FIG. 3 is a schematic diagram of the two topology information recovery processes provided by the embodiment of the present application.
  • Figure 4 is a solution for implementing topology hiding provided by an embodiment of the present application.
  • Figure 5 is a schematic interaction diagram of a topological information hiding method provided by an embodiment of the present application.
  • Figure 6 is a schematic flow chart of yet another method of hiding topology information provided by an embodiment of the present application.
  • Figure 7 is a schematic flow chart of a method for restoring topology information provided by an embodiment of the present application.
  • Figure 8 is a schematic flow chart of yet another method of hiding topology information provided by an embodiment of the present application.
  • Figure 9 is a schematic diagram of a topology hidden communication method provided by an embodiment of the present application.
  • Figure 10 is a schematic interaction diagram of a strict routing communication method provided by an embodiment of the present application.
  • Figure 11 is an information interaction diagram of a method for sending and receiving messages between SEPPs in different networks provided by the embodiment of the present application;
  • Figure 12 is a schematic diagram of yet another topology hidden communication method provided by an embodiment of the present application.
  • Figure 13 is a schematic interaction diagram of yet another topology information hiding communication method provided by an embodiment of the present application.
  • Figure 14 is a schematic interaction diagram of yet another topology information hiding communication method provided by an embodiment of the present application.
  • Figure 15 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • FIG. 16 is another possible structural schematic diagram of the communication device involved in the above embodiment provided by the embodiment of the present application.
  • the technical solution provided by this application can be applied to various communication systems, such as: new radio (NR) system, long term evolution (LTE) system, LTE frequency division duplex (FDD) system , LTE time division duplex (TDD) system, etc.
  • NR new radio
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD time division duplex
  • This application can also be applied to device-to-device (D2D) communication, vehicle-toeverything (V2X) communication, machine-to-machine (M2M) communication, machine type communication, MTC), and Internet of things (IoT) communication systems or other communication systems.
  • NR new radio
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD LTE time division duplex
  • IoT Internet of things
  • the part operated by the operator can be called the public land mobile network (PLMN), or the operator network, etc.
  • PLMN is a network established and operated by the government or its approved operators for the purpose of providing land mobile communication services to the public. It is mainly a public network where mobile network operators (MNOs) provide mobile broadband access services to users. .
  • MNOs mobile network operators
  • the PLMN described in the embodiments of this application may specifically be a network that meets the standard requirements of the 3rd generation partnership project (3GPP), referred to as a 3GPP network.
  • 3GPP networks generally include but are not limited to fifth-generation mobile communication (5th-generation, 5G) networks, fourth-generation mobile communication networks, and other future communication systems, such as sixth-generation mobile communication networks.
  • the embodiments of this application will take the PLMN or 5G network as an example for description.
  • the service based interface (SBI) of the 5G core network carries a large amount of topology information, including the IP address of the network function (NF), the fully qualified domain name (fully qualified domain name FQDN), the uniform resource identifier ( uniform resource identifier, URI), etc. If not processed, this information will flow out of the control scope of the network along with the roaming interface and interworking interface, which may cause harm that is difficult to control.
  • NF network function
  • FQDN fully qualified domain name
  • URI uniform resource identifier
  • the criminals may analyze the deployment of this network based on this information, thereby providing information for attacking this network; if the leaked information is obtained by competitors, Competitors can further identify the corresponding operator's business plan based on the network deployment situation of this network, such as how many AMFs have been deployed, and speculate on its target number of new 5G users in the next 3-5 years.
  • SEPP security and edge protection proxy
  • topology hiding Since the existing protocol only defines that SEPP needs to support the topology hiding function, it does not define an implementation solution for topology hiding. In actual applications, an operator may deploy multiple SEPPs, and these SEPPs may be purchased from different equipment vendors. Since the implementation of topology hiding is not defined in the standard, each equipment vendor may adopt different solutions. Topology hiding; at the same time, since hiding and restoring the same topology information are usually not completed in the same session, the subscription request and callback notification message belong to different HTTP transactions and may be processed by different SEPPs in the visited domain. Therefore, the topology information hidden by equipment vendor A's SEPP may not be restored on equipment vendor B's SEPP, causing service failure.
  • embodiments of the present application provide a communication method and a communication device. This method can avoid service failure due to topology hiding in different SEPP networking situations.
  • the solution of the embodiment of the present application is applied to message interaction scenarios between networks, for example, it can be used in roaming docking scenarios between 5G networks.
  • Network topology refers to the physical layout of various devices interconnected using transmission media.
  • Network topology can be expressed through a set of associated information, including the device's IP address, domain name, device type, name, correlation, number of sets, etc. This set of information used to express the network layout is called topology information.
  • the VIA header field of the forwarding path of the message records the address (FQDN/IP address) of the proxy through which the message passes, including router information and device interconnection information.
  • the FQDN of the server (5GC's cNF/pNF).
  • the FQDN usually carries the location, type, name and other information of the device deployment.
  • IP address of the server usually the IP address is the operator's internal private network IP address, which will expose the IP address planning rules within the network and provide attackers with a clear attack target or springboard.
  • the external device needs to route the message to SEPP, and SEPP forwards it to the network. As long as the external device can forward the message to the SEPP interface, there is no need to know the topology information in the network. Therefore, when sending messages from within the network to outside the network, SEPP can hide the topology information in the network and try to avoid the exposure of topology information without affecting roaming connection.
  • the network architecture involved in the embodiments of this application may be a fifth generation system (5th generation system, 5GS), and the network elements in 5GS may also be called 5G core network elements.
  • 5GS fifth generation system
  • 5G core network elements 5th generation core network elements
  • FIG 1 shows an application architecture diagram of the roaming docking scenario provided by the embodiment of the present application. The functions of each network element or device involved in the network architecture will be described below.
  • Terminal equipment which can also be called user equipment (UE), mobile station (MS), mobile terminal (MT), etc.
  • the terminal device may include a handheld device, a vehicle-mounted device, etc. with a wireless connection function.
  • the terminal device can be: mobile phone, tablet computer, notebook computer, handheld computer, mobile Internet device (mobile internet device, MID), wearable device, virtual reality (VR) device, augmented reality device Augmented reality (AR) equipment, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical surgery, smart grid ), wireless terminals in transportation safety, wireless terminals in smart cities, or wireless terminals in smart homes, etc.
  • the terminal device described in Figure 1 is shown as UE, which is only used as an example and does not limit the terminal device.
  • Access management network element mainly used for mobility management and access management.
  • the access management network element can be the access and mobility management function (AMF), as shown in Figure 1, for example, which mainly performs mobility management, access authentication/authorization, etc. Function.
  • AMF access and mobility management function
  • PCF policy control function
  • NAS non-access stratum
  • MM mobility management
  • SM session management
  • Relevant signaling for example, base station granular N2 (next generation, NG) 2 interface
  • the AMF network element can receive a location service request related to the target UE from a 5G core network (5GC) location services (LCS) entity, or the AMF itself can also initiate some location services on behalf of a specific target UE. , and forwards the location service request to the location management network element. After obtaining the location information returned by the UE, the relevant location information is returned to the 5GC LCS entity.
  • 5GC 5G core network
  • LCS location services
  • the access management network element can still be an AMF network element, or have other names, which is not limited in this application.
  • Session management network element Mainly used for session management, Internet protocol (IP) address allocation and management of user equipment, selection of endpoints for manageable user plane functions, policy control and charging function interfaces, and downlink data Notifications etc.
  • IP Internet protocol
  • SMF session management function
  • Network storage network element Provides storage and selection functions for network function entity information for other core network elements.
  • the network element can be a network function repository function (NRF), which mainly includes the following functions: service discovery function, maintaining NF of available network function (NF) instances texts and the services they support.
  • NRF network function repository function
  • the above functional network elements can be either network elements in hardware devices, software functions running on dedicated hardware, or virtualization functions instantiated on a platform (for example, a cloud platform).
  • the above functional network elements can be divided into one or more services. Furthermore, there may also be services that exist independently of network functions.
  • instances of the above-mentioned functional network elements, or instances of services included in the above-mentioned functional network elements, or service instances that exist independently of network functions may be called service instances.
  • Unified data management network element responsible for the management of user identification, contract data, authentication data, and user service network element registration management.
  • the unified data management network element can be unified data management (UDM), which mainly includes the following functions: unified data management, support for authentication credentials processing in the 3GPP authentication and key agreement mechanism, user Identity processing, access authorization, registration and mobility management, subscription management and short message management, etc.
  • UDM unified data management
  • This network element can be a security and edge protection proxy (SEPP) security edge protection proxy. It is an important part of the 5G roaming security architecture and is used for user roaming and communication with other operators. Communication interworking is responsible for message filtering and policy management on the control plane interfaces between operators, and mainly serves as the border gateway between the control planes of the operators' core networks. As a non-transparent proxy node, SEPP can provide application layer control plane security and realize secure communication between network function consumers and network function providers across operators.
  • SEPP security and edge protection proxy
  • SEPP's security features include message filtering, access control, topology hiding, and error detection and handling.
  • the two SEPPs at the network boundary establish a connection through the N32 interface and implement protection policies to process each control plane message in cross-network signaling.
  • UPF User plane function
  • UPF network functions include data packet routing and transmission, data packet detection, business usage reporting, quality of service (QoS) processing, legal interception, uplink data packet detection, downlink data packet storage and other user plane functions.
  • QoS quality of service
  • PCF Policy control function
  • AUSF Authentication server function
  • AUSF is a control plane function provided by the operator, and is usually used for authentication between the terminal device 110 (subscriber) and the operator's network.
  • the AUSF network function can authenticate and/or authorize the contracted user through the authentication information and/or authorization information stored in the UDM network function, or generate the authentication and/or authorization of the contracted user through the UDM network function. or authorization information.
  • the AUSF network function can feedback authentication information and/or authorization information to contract users.
  • Access network equipment can also be called access equipment.
  • (R)AN can manage wireless resources and provide access services for user equipment. Complete For the forwarding of user equipment data between the user equipment and the core network, (R)AN can also be understood as a base station in the network.
  • Network slice selection function network element responsible for selecting network slices for UE.
  • the application network element can be a network slice selection function (NSSF) network element.
  • NSSF can be understood as network slicing selection Select the naming of functional network elements in the 5G architecture.
  • the network slice selection function network element mainly includes the following functions: selecting a group of network slice instances for the UE, determining the allowed network slice selection assistance information (NSSAI), and determining the AMF set that can serve the UE.
  • NSSAI network slice selection assistance information
  • SEPP is used for the docking of two 5GC networks.
  • the interface between SEPPs is defined as the N32 interface. All messages across PLMNs during roaming need to be forwarded through the N32 interface. SEPP needs to provide message access and security protection capabilities in roaming scenarios.
  • SEPP when SEPP forwards the request message to the N32 interface, it needs to hide the topology information in the message first; when SEPP receives the message from the N32 interface, if there is hidden topology information in it, it needs to restore it to the original Topological information.
  • system architecture involved in Figure 1 may also include other network elements, such as unified data repository (UDR) and other network elements or equipment, without specific limitations.
  • UDR unified data repository
  • interfaces or service-oriented interfaces between network elements shown in Figure 1 are only an example. In 5G networks and other future networks, the interfaces or service-oriented interfaces between network elements may not be as shown in the figure. interface, this application does not limit this.
  • each network element shown in Figure 1 is only a name, and the name does not limit the function of the network element itself.
  • each of the above network elements may also have other names, which are not specifically limited in the embodiments of this application.
  • some or all of the above-mentioned network elements may use the terminology used in 5G, or may be named by other names, etc., which will be described uniformly here and will not be described in detail below.
  • a communication system to which the present application may be applied may include more or fewer network elements or devices.
  • the equipment or network elements in Figure 1 can be hardware, functionally divided software, or a combination of the above two.
  • the devices or network elements in Figure 1 can communicate with each other through other devices or network elements.
  • Figure 2 shows a schematic diagram of two topological information hiding processes provided by embodiments of the present application.
  • FIG. 2 shows a schematic diagram of the topology information hiding process provided by the embodiment of the present application when two SEPPs directly use transport layer security (TLS) to connect (using the HTTPS protocol).
  • TLS transport layer security
  • the protocol consists of two layers: TLS record protocol (TLS record) and TLS handshake protocol (TLS handshake).
  • TLS record TLS record protocol
  • TLS handshake TLS handshake protocol
  • S201a The client sends the original message to cSEPP in the local network through the Nx interface.
  • the original message includes a message part and a topology information part.
  • the topology information refers to the information related to the NF that sent the message.
  • cSEPP After receiving the original message, cSEPP obtains the operator information and topology hiding identifier of the local network, hides the topology information, and then generates a new message.
  • the new message includes the above message part and the hidden topology information part.
  • S203a cSEPP sends the above new message to pSEPP on the opposite end network through the N32 interface, and pSEPP forwards the new message to the server.
  • FIG. 2 Parallel to (a) in Figure 2, (b) in Figure 2 shows that the embodiment of the present application provides a docking method when two SEPPs use IPX device relay (using the N32 interconnection security protocol (protocol for N32 interconnect security, PRINS) mode), a schematic diagram of the topological information hiding process.
  • the process of topological information hiding can be as follows:
  • S201b The client sends the original message to cSEPP in the local network through the Nx interface.
  • the original message includes a message part and a topology information part.
  • the topology information refers to the information related to the NF that sent the message.
  • cSEPP After receiving the original message, cSEPP obtains the operator information and topology hiding identifier of the local network, hides the topology information, and then generates a new message.
  • the new message includes the above message part and the hidden topology information part.
  • S203b cSEPP sends the above new message to pSEPP on the opposite end network through the N32 interface and Internet Packet Exchange Protocol (IPX), and pSEPP forwards the new message to the server.
  • IPX Internet Packet Exchange Protocol
  • IPX operators provide group addressing and routing functions to ensure reliable arrival, which is equivalent to the function of datagram; at the same time, IPX operators also provide roaming services, such as roaming optimization and welcome text messages.
  • Fig. 3 shows a schematic diagram of two types of topology information recovery processes provided by embodiments of the present application.
  • FIG. 3 shows a schematic diagram of the topology information recovery process provided by the embodiment of the present application when two SEPPs directly connect using TLS (using the HTTPS protocol).
  • the specific process of topology information recovery can be:
  • S301a The pSEPP on the server sends the original message to the cSEPP in the opposite network through the N32 interface.
  • the original message includes a message part and a hidden topology information part.
  • the topology information refers to the information related to the NF that sends the message on the client side.
  • cSEPP After receiving the original message, cSEPP obtains the operator information and topology hidden identifier of the local network, restores the topology information, and then generates a new message.
  • the new message includes the above message part and the topology information part.
  • FIG. 3 Parallel to (a) in Figure 3, (b) in Figure 3 shows the topology information recovery process provided by the embodiment of the present application when two SEPPs adopt the IPX device relay docking method (using PRINS mode).
  • S301b The pSEPP on the server sends the original message to the cSEPP in the opposite network through the N32 interface and IPX.
  • the original message includes a message part and a hidden topology information part.
  • the topology information refers to the information related to the NF that sends the message on the client side.
  • cSEPP After receiving the original message, cSEPP obtains the operator information and topology hidden identifier of the local network, restores the topology information, and then generates a new message.
  • the new message includes the above message part and the topology information part.
  • Figure 4 shows a solution for implementing topology hiding provided by the embodiment of the present application, which is applied to the user data change scenario on the AMF subscription UDM.
  • the solution includes the following steps:
  • S401 The AMF in the visited domain sends a subscription request message to SEPP-a on the same side.
  • the subscription request message carries CallbackURIA, where CallbackURIA refers to unhidden AMF-related topology information.
  • SEPP-a of the visited domain hides CallbackURIA, sends a subscription request message to SEPP-1 on the opposite side, and further sends the subscription request message to UDM.
  • the subscription request message carries CallbackURIA1, where CallbackURIA1 refers to the hidden CallbackURIA.
  • AMF related topology information is included in the subscription request message.
  • SEPP-b After receiving the notification request message carrying CallbackURIA1, SEPP-b restores CallbackURIA1 to CallbackURIA. To facilitate routing of notification request messages to AMF based on CallbackURIA.
  • step S404 since the algorithms of SEPP-a and SEPP-b may be different, SEPP-b may be unable to restore CallbackURIA1 to CallbackURIA, resulting in service failure.
  • FIG. 5 shows a schematic interaction diagram of a topological information hiding method 500 provided by the embodiment of the present application.
  • the method 500 is applied to the scenario of sending and receiving messages across the first network element and the second network element of the network.
  • the method 500 includes:
  • the first network element sends a first request message to the first SEPP.
  • the first request message is used to request to subscribe to target information from the second network element, or the first request message is used to request to obtain the target from the second network element. information.
  • first network element described in all embodiments of this application refers to the network element that generates and sends the first request message, and is not an intermediate network element.
  • the first network element while sending the first request message to the first SEPP, the first network element also sends the topology information of the first network element.
  • the first network element may send the topology information of the first network element in a manner carried by the first request information, may be sent individually, may be sent in a package, or may be sent by This application does not limit the forwarding methods of other devices or network elements.
  • the topology information of the first network element may be one or more of the IP address, FQDN, and URI of the first network element, or other topology information, which is not limited in this application.
  • the first SEPP After receiving the first request message, the first SEPP obtains the topology information of the first network element and Topological information is hidden and hidden information is generated.
  • the hidden information refers to the hidden topological information of the first network element.
  • the first SEPP encrypts the topology information of the first network element according to the first algorithm and the first key ID, and then generates hidden information.
  • the first SEPP sends a first message to the third SEPP located in the second network.
  • the first message includes the first request message and hidden information.
  • the above hidden information may be sent by being carried by the first request message, may be sent individually, may be packaged and sent, or may be forwarded by other devices or network elements. , this application does not limit this.
  • the first message also includes a first key ID.
  • the second network element In response to the received first message, the second network element sends a second message to the third SEPP on the same side, where the second message includes the first reply message and hidden information.
  • the first reply message is a message sent by the second network element in response to the first request message.
  • the above-mentioned hidden information may be sent by being carried by the first reply message, may be sent individually, may be packaged and sent, or may be forwarded by other devices or network elements. , this application does not limit this.
  • the second message also includes the first key ID.
  • the second message carries a topology information recovery request message, which is used to request recovery of the hidden information it carries.
  • S506 The third SEPP forwards the above-mentioned second message to the second SEPP located in the first network.
  • the second SEPP After receiving the second message, the second SEPP obtains the hidden information in the second message and restores the hidden information to the topology information of the first network element in the unhidden state.
  • the second SEPP restores the hidden information to the topology information of the first network element in the unhidden state according to the first key ID.
  • SEPP in S503 and S507 can be the same SEPP or different SEPPs.
  • the second SEPP sends the first reply message to the first network element according to the topology information of the first network element.
  • encryption can be used to hide the topology information in the message.
  • topology information between different SEPPs on the same network can be realized.
  • the mutual recovery function enables all SEPPs in the same network to correctly recover the hidden topology information when receiving a request message requiring topology recovery, thus avoiding service failures caused by different SEPPs.
  • FIG. 6 shows a schematic diagram of a SEPP method 600 for hiding topology information provided by the embodiment of the present application.
  • sexual flow chart As shown in Figure 6, the method 600 includes:
  • the first SEPP encrypts the topology information of the first network element according to the first algorithm and the first key ID.
  • S602 Convert the encrypted topology information into characters allowed by FQDN.
  • S603 Convert ciphertext, encryption material and domain information into an FQDN according to the specified format.
  • the ciphertext refers to the encrypted topology information (converted into characters allowed by FQDN) (ie: hidden information), the encryption material includes the first key ID, and the domain information refers to the domain information corresponding to the topology information.
  • the type of topology information is the FQDN of the first network element.
  • the first SEPP takes out the topology information part in the FQDN, encrypts it according to the first algorithm and the first key ID, and then converts the encrypted topology information are the characters allowed by FQDN; finally, the ciphertext, encryption material, and domain information in the original FQDN are formatted into a new FQDN according to the specified format.
  • the FQDN before hiding is: topology information to be hidden + domain information;
  • the hidden FQDN is: CP+ciphertext+encrypted material+domain information.
  • CP is the prefix, indicating that the encrypted string follows.
  • the type of topology information is the IP address of the first network element.
  • the first SEPP encrypts the IP address according to the first algorithm and the first key ID, and then converts the encrypted IP address into an IP address allowed by the FQDN. characters; finally, the ciphertext, encryption material, and domain information in the original FQDN are formatted into a new FQDN according to the specified format.
  • the FQDN before hiding is: the topology information to be hidden;
  • the hidden FQDN is: CP+ciphertext+encrypted material+domain information.
  • CP is the prefix, indicating that the encrypted string follows.
  • FIG. 7 shows a SEPP recovery hidden topology provided by the embodiment of the present application.
  • the second SEPP obtains the encryption material and ciphertext part from the FQDN that hides the topology information.
  • the encryption material includes the first key ID, and the ciphertext is the hidden topological information (that is, hidden information).
  • S702 The second SEPP decrypts the ciphertext according to the first key ID and obtains unhidden topology information.
  • the recovery process of the topology information may also include the following steps:
  • S703 The second SEPP splices the decrypted topology information and the domain information in the original FQDN to restore the original FQDN.
  • FIG. 8 shows a schematic flow chart of a method 800 for hiding topology information provided by an embodiment of the present application.
  • This method takes the topology information type as FQDN as an example, as shown in Figure 8.
  • the method 800 includes:
  • SEPP obtains the topology information to be hidden from the original FQDN.
  • the original FQDN consists of the topology information and domain information to be hidden.
  • the original FQDN is:
  • AES is a symmetric encryption algorithm
  • 256 represents the ciphertext block length
  • GCM is the encryption mode.
  • BASE32 refers to an encoding technology that converts binary code streams into visual characters.
  • the encryption material includes the first key ID and VI value (in order for other SEPPs to query the local configuration and obtain the real key).
  • the CP prefix indicates that it is followed by an encrypted string, and the domain information is the domain included in the original FQDN. information.
  • the new FQDN obtained is:
  • the encryption algorithm in the embodiment of this application can be any reversible secure encryption algorithm and is not limited to AES_GCM.
  • a universal encryption algorithm is provided to hide topology information, so that different SEPPs can mutually recover each other's hidden topology information as long as their preset encryption algorithms and key information are the same.
  • the encryption process of this method uses well-known algorithms in the industry, which can prevent brute force cracking and quantum-level attacks. Because the encryption result (ciphertext) is different each time, it cannot be cracked through repeated attempts. It is safe and reliable; and, different encryption results (ciphertext) on the same network are different.
  • SEPP can be used in all SEPPs and has strong versatility; and because the SKIDs in different network conditions are different, even if other networks use the same solution, they cannot be resolved.
  • this method can deploy a configuration , can cover all FQDNs, thereby avoiding misconfiguration or under-configuration, and facilitating operation and maintenance; using non-mapping algorithms (such as SEPP to locally maintain one-to-many mapping relationships) will not cause an increase in configuration due to future increases in NF or FQDN.
  • non-mapping algorithms such as SEPP to locally maintain one-to-many mapping relationships
  • Figure 9 exemplarily shows a schematic diagram of a method 900 for implementing topology hidden communication provided by an embodiment of the present application.
  • the method 900 is applied to user data changes on AMF subscription UDM. Scenes.
  • the solution includes the following steps:
  • S901 The AMF in the visited domain sends a subscription request message to SEPP-a on the same side.
  • the subscription request message carries CallbackURIA, where CallbackURIA refers to unhidden AMF-related topology information.
  • SEPP-a of the visited domain hides CallbackURIA, sends a subscription request message to SEPP-1 on the opposite side, and further sends the subscription request message to UDM.
  • the subscription request message carries CallbackURIA1, where CallbackURIA1 refers to the hidden CallbackURIA.
  • AMF related topology information is included in the subscription request message.
  • S904 After receiving the notification request message carrying CallbackURIA1, SEPP-a restores CallbackURIA1 to CallbackURIA. To facilitate routing of notification request messages to AMF based on CallbackURIA.
  • the SEPP path during the sending process of the subscription request message is the same as the SEPP path during the receiving process of the notification request message.
  • the hiding and recovery of the topology information can be completed by the same SEPP, so that after hiding The topology information can be restored correctly, thereby avoiding service failures caused by different SEPPs for hiding topology information and restoring topology information.
  • Figure 10 shows a schematic interaction diagram of a method 1000 for strictly routing communications provided by an embodiment of the present application.
  • the method 1000 is applied to the scenario of sending and receiving messages across the first network element and the second network element of the network.
  • the method 1000 includes:
  • the first network element sends a first request message to the first SEPP.
  • the first request message is used to request to subscribe to target information from the second network element, or the first request message is used to request to obtain the target from the second network element. information.
  • the first network element while sending the first request message to the first SEPP, the first network element also sends the topology information of the first network element.
  • the first network element may send the topology information of the first network element in a manner carried by the first request information, may be sent individually, may be sent in a package, or may be sent by This application does not limit the forwarding methods of other devices or network elements.
  • the topology information of the first network element may be one or more of the IP address, FQDN, and URI of the first network element, or other topology information, which is not limited in this application.
  • the first SEPP obtains the topology information of the first network element, hides the topology information of the first network element, and generates hidden information.
  • the hidden information refers to the hidden topological information of the first network element.
  • the first SEPP sends a first message to the third SEPP located in the second network.
  • the first message includes a first request message and first indication information.
  • the first indication information is used to indicate the routing category corresponding to the first SEPP. For strict routing.
  • the first message also includes the above hidden information.
  • the above hidden information may be sent in a manner carried by the first request message, may be sent individually, may be sent in a package, or may be forwarded by other devices or network elements.
  • this application does not limit this.
  • the second network element After receiving the first message, the second network element generates a first path, and the first path is generated based on the path of the first message.
  • the first path includes one or more devices, each of the one or more devices corresponds to a routing category, and the routing category includes strict routing and may also include loose routing.
  • the parameter mark of strict routing can be sr, which means that the message must pass through the device corresponding to the strict route; the loose route can be represented by no mark, which means that the message may or may not pass through the device corresponding to the loose route.
  • the second network element records the path of the first message.
  • the second network element arranges the paths of the first message in reverse order to generate the first path.
  • the second network element In response to the received first message, the second network element sends a second message to the third SEPP on the same side according to the first path, where the second message includes the first reply message.
  • the first reply message is a message sent by the second network element in response to the first request message.
  • the second message also includes the above hidden information.
  • the above-mentioned hidden information may be sent in a manner carried by the first reply message, may be sent individually, may be sent in a package, or may be forwarded by other devices or network elements.
  • this application does not limit this.
  • the second message carries a topology information recovery request message, which is used to request recovery of the hidden information it carries.
  • S1006 The third SEPP forwards the above-mentioned second message to the first SEPP.
  • the routing category corresponding to the first SEPP is strict routing, the second message will definitely pass through the first SEPP.
  • the first SEPP acquires the hidden information in the second message and restores the hidden information to the topology information of the first network element in the unhidden state.
  • the first SEPP sends the first reply message to the first network element according to the topology information of the first network element.
  • SEPP can control that messages with its hidden address as the destination address can be routed to itself, thereby avoiding the situation where messages are routed to other SEPPs and cannot be recovered, thereby enabling the hidden topology information to be correctly recovered. This avoids business failure due to different SEPPs.
  • Figure 11 shows inter-SEPP implementation messages (involving topology hiding and recovery) in different networks provided by the embodiments of the present application.
  • Information interaction diagram of the sending and receiving method 1100 is
  • the first network includes cNF (the first network element), cSCP and cSEPP, and the second network includes pNF (as the first network element), pSCP and pSEPP.
  • the network elements in the first network have the prefix c
  • the network elements in the second network have the prefix p.
  • the first request message is the initial request message
  • the first reply message is the callback. Taking the request message as an example for illustration, the method 1100 includes:
  • the cNF sends an initial request message to the cSCP.
  • the initial request message is used to request to obtain the target information from the pNF, or the initial request message is used to request to subscribe to the pN for the target information.
  • the initial request message carries cNF topology information.
  • topology information of cNF carried in the initial request message is represented in Figure 11 as: callbackURI:cNF.
  • cSCP forwards the initial request message as a proxy, and synchronously puts its own topology information (which can be the FQDN of cSCF) into the via header field, and indicates loose routing.
  • topology information of cSCP carried in the initial request message forwarded by cSCP is represented in Figure 11 as: Via:cSCP.
  • cSCP processes the initial request message as a proxy, it indicates whether it is strict routing (the indication mark can be sr) through the extended parameter in the added via: header field. If it is strict routing, it indicates the subsequent request message or the callback request message. Must go through the proxy.
  • the sr parameter is used to indicate strict routing, and no parameters are carried to indicate loose routing.
  • Loose routing and strict routing can be determined according to the actual situation or needs. marking method.
  • cSEPP After receiving the initial request message sent by cSCP, cSEPP hides the topology information of cNF, converts the callback address from cNF to cNFA, deletes the FQDN of cSCP in via, and puts its own FQND into via, indicating strict Route (indicator tag can be sr). Then, the initial request message is sent to pSEPP in the peer network.
  • the suffix letter A indicates that the information is hidden information.
  • callbackURI cNFA
  • Via cSEPP
  • sr the information carried in the initial request message sent by cSEPP to pSEPP.
  • S1104 After receiving the initial request message sent by cSEPP, pSEPP puts its FQND into via, indicating strict routing. It further forwards the initial request message to pSCP.
  • callbackURI cNFA
  • S1105 After receiving the initial request message sent by pSEPP, pSCP puts its FQND into via, indicating loose routing. The initial request message is further forwarded to pNF.
  • callbackURI cNFA
  • pNF on the server side After receiving the initial request message sent by pSCP, pNF on the server side records the callback address cNFA and via header field for subsequent sending of callback request messages (usually using the notify method); and generates a response message and sends the response message to pSEPP. .
  • the response message carries the Location header field, and pNF converts the via header field into the record-route header field and puts it into the response message.
  • the information carried in the response message sent by pNF to pSEPP is represented in Figure 11 as: Location: pNF; Record-route: cSEPP; sr; Record-route: pSEPP; sr; Record-route: pSCP.
  • pSEPP After pSEPP receives the response message sent by pNF, it deletes the pSCP information in the record-route header field, converts the address in the location header field from pNF to pNFA, and then further forwards the response message to cSEPP.
  • the information carried in the response message forwarded by pSEPP to cSEPP is represented in Figure 11 as: Location: pNFA; Record-route: cSEPP; sr; Record-route: pSEPP; sr.
  • the suffix letter A indicates that the information is hidden information.
  • cSEPP After receiving the response message forwarded by pSEPP, cSEPP puts the cSCP information into the record-route header field, and then further forwards the response message to cNF.
  • the information carried in the response message forwarded by cSEPP to cNF is shown in Figure 11 as: Location: pNFA; Record-route: cSCP; Record-route: cSEPP; sr; Record-route: pSEPP; sr.
  • cNF After receiving the response message forwarded by cSEPP, cNF records the address pNFA in the location header field as the target address of the subsequent request, and records the information in the record-route header field as the route of the subsequent request, and generates a subsequent request message to cSCP sends this subsequent request message.
  • cNF converts the location header field into a URI header field, and converts the record-route header field into a route header field and puts them into the subsequent request message.
  • the recorded record-route is put into the route field of the subsequent request message as the route for the subsequent request message.
  • URI pNFA
  • route cSCP
  • route cSEPP
  • sr route: pSEPP
  • sr route: pSEPP
  • cSCP After receiving the subsequent request message sent by cNF, cSCP deletes its own address from the route according to the route instructions, and further forwards the subsequent request message to cSEPP.
  • the information carried in the subsequent request message forwarded by cSCP to cSEPP is represented in Figure 11 as: URI: pNFA; route: cSEPP; sr; route: pSEPP; sr.
  • the intermediate proxy routes according to the route instructions. If the indication is strict routing, it cannot be skipped; the intermediate proxy deletes its own address from the route one by one when processing subsequent requests.
  • cSEPP After receiving the subsequent request message forwarded by cSCP, cSEPP deletes its own address from the route according to the route instructions, and further forwards the subsequent request message to pSEPP.
  • URI pNFA
  • route pSEPP
  • sr the information carried in the subsequent request message forwarded by cSEPP to pSEPP.
  • pSEPP After receiving the subsequent request message, pSEPP restores the pNFA in the URI header field to pNF; deletes its own address from the route, and further forwards the subsequent request message to pNF through pSCP according to the restored pNF address.
  • restoring the pNFA in the URI header field to pNF means restoring the topology information of the hidden pNF so that subsequent request messages can be routed to the pNF according to the topology information of the pNF.
  • the information carried in the subsequent request message forwarded by pSEPP to pNF is represented in Figure 11 as: URI:pNF.
  • step S1113 After receiving the subsequent request message, pNF uses the callback address cNFA to initiate a callback request message.
  • the via header field recorded in step S1106 is placed in the route header field of the callback request message in reverse order, as This callback requests the routing of the message.
  • pNF sends the callback request to pSCP.
  • the information carried in the callback request message sent by pNF to pSCP is represented in Figure 11 as: URI: cNFA; route: Pscp; route: pSEPP; sr; route: cSEPP; sr.
  • pSCP After pSCP receives the callback request message sent by pNF, it deletes its own address from the route according to the route instructions, and further forwards the subsequent request message to pSEPP.
  • the information carried in the subsequent request message forwarded by pSCP to pSEPP is represented in Figure 11 as: URI: cNFA; route: pSEPP; sr; route: cSEPP; sr.
  • the intermediate proxy routes according to the route instructions. If the indication is strict routing, it cannot be skipped; the intermediate proxy deletes its own address from the route one by one when processing subsequent requests.
  • pSEPP After pSEPP receives the callback request message sent by pSCP, it deletes its own address from the route according to the route instructions, and further forwards the subsequent request message to cSEPP.
  • the information carried in the subsequent request message forwarded by pSEPP to cSEPP is represented in Figure 11 as: URI: cNFA; route: cSEPP; sr.
  • cSEPP After receiving the callback request message, cSEPP restores the cNFA in the URI header field to cNF; deletes its own address from the route, and further forwards the callback request message to cNF based on the restored cNF address.
  • restoring the cNFA in the URI header field to cNF means restoring the topology information of the hidden cNF so that subsequent request messages can be routed to the cNF based on the topology information of the cNF.
  • the information carried in the callback request message forwarded by cSEPP to pSEPP is represented in Figure 11 as: URI:cNF.
  • the pNF may send a response message to the cNF for the subsequent request message.
  • cNF can send a response message to the callback request message to pNF.
  • header field naming in the embodiment of this application is a reference naming, which does not constitute any limitation on the solution of this application, and can also be replaced with other naming.
  • routing scheme proposed in the embodiment of this application can also be used on other HTTP proxies such as SCP to achieve routing control, and is not limited to SEPP.
  • the HTTP extension header fields record-route and route are added, which are used to carry the route of subsequent request messages and the route of this message (callback request message) respectively.
  • the route header field supports carrying parameters to identify whether it is a strict route.
  • SEPP can control that messages with its hidden address as the destination address can be routed to itself, thereby avoiding the situation where messages are routed to other SEPPs and cannot be recovered, thereby enabling the hidden topology information to be correctly recovered, avoiding the problem of SEPP Business failure caused by differences; and, by improving the routing mechanism of SBI interface messages, the proxy can control the sending path of the associated request messages.
  • it solves the problem of topology hiding from different manufacturers, and it can also provide a mechanism for business processing of subsequent associated sessions.
  • Figure 12 shows a schematic diagram of yet another method 1200 for implementing topology hidden communication provided by the embodiment of the present application.
  • This method 1200 is applied to AMF subscription UDM.
  • the solution includes the following steps:
  • S1201 The AMF in the visited domain sends a subscription request message to SEPP-a on the same side.
  • the subscription request message carries CallbackURIA, where CallbackURIA refers to unhidden AMF-related topology information.
  • S1202 SEPP-a of the visited domain hides CallbackURIA, sends a subscription request message to SEPP-1 on the opposite side, and further sends the subscription request message to UDM.
  • the subscription request message carries CallbackURIA1, where CallbackURIA1 refers to the hidden CallbackURIA.
  • AMF related topology information is included in the subscription request message.
  • SEPP-b After receiving the notification request message carrying CallbackURIA1, SEPP-b calls the service provided by SEPP-a to query the restored address information callbackURIA of callbackURIA1.
  • SEPP-b after SEPP-b receives the notification request message carrying CallbackURIA1, it can send a second request message to SEPP-a.
  • the second request message is used to request SEPP-a to restore CallbackURIA1 to CallbackURIA; and then responds to the received In the second request message, SEPP-a sends a second reply message to SEPP-b, and the second reply message is CallbackURIA.
  • SEPP-b replaces the target address in the notification request message with callbackURIA, so that the notification request message is routed to the AMF according to the CallbackURIA.
  • this embodiment takes SEPP-a hiding and SEPP-b recovery in the first network as an example.
  • SEPP-1 and SEPP-2 also need to provide each other with the above-mentioned similar query services.
  • the function of SEPP is extended so that it can provide external services.
  • the topology information before hiding can be queried through the hidden topology information, and the queried topology information before hiding can be sent to the requester who issued the request message.
  • SEPP SEPP.
  • topology information recovery services are provided to each other through SEPP to realize the conversion from the hidden topology information to the pre-hidden topology information, so that the hidden topology information can be correctly restored, thereby avoiding the SEPP and reception of hidden topology information. Service failure caused by different SEPPs used to hide topology information.
  • Figure 13 shows a schematic interaction diagram of yet another topology information hiding communication method 1300 provided by the embodiment of the present application.
  • the method 1300 is applied to the scenario of sending and receiving messages across the first network element and the second network element of the network.
  • the method 1300 includes:
  • the first network element sends a first request message to the first SEPP.
  • the first request message is used to request to subscribe to target information from the second network element, or the first request message is used to request to obtain the target from the second network element. information.
  • the first network element while sending the first request message to the first SEPP, the first network element also sends the topology information of the first network element.
  • the first network element may send the topology information of the first network element in a manner carried by the first request information, may be sent individually, may be sent in a package, or may be sent by This application does not limit the forwarding methods of other devices or network elements.
  • the topology information of the first network element may be one or more of the IP address, FQDN, and URI of the first network element, or other topology information, which is not limited in this application.
  • the first SEPP After receiving the first request message, the first SEPP obtains the topology information of the first network element, hides the topology information of the first network element, and generates hidden information.
  • the hidden information refers to the hidden topological information of the first network element.
  • the first SEPP sends a first message to the third SEPP located in the second network.
  • the first message includes the first request message and hidden information.
  • the above hidden information may be sent by being carried by the first request message, may be sent individually, may be packaged and sent, or may be forwarded by other devices or network elements. , this application does not limit this.
  • the second network element In response to the received first message, the second network element sends a second message to the third SEPP on the same side, where the second message includes the first reply message and hidden information.
  • the first reply message is a message sent by the second network element in response to the first request message.
  • the above-mentioned hidden information may be sent by being carried by the first reply message, may be sent individually, may be packaged and sent, or may be forwarded by other devices or network elements. , this application does not limit this.
  • the second message carries a topology information recovery request message, which is used to request recovery of the hidden information it carries.
  • S1306 The third SEPP forwards the above-mentioned second message to the second SEPP located in the first network.
  • the second SEPP After receiving the second message, the second SEPP sends a second request message to the first SEPP.
  • the second request message is used to request to obtain the restored hidden message, and the second request message carries the hidden information.
  • the first SEPP In response to receiving the second request message, the first SEPP restores the hidden message to the unhidden topology information, and then sends the restored topology information of the first network element to the second SEPP.
  • the second SEPP sends the first reply message to the first network element according to the topology information of the first network element.
  • the function of SEPP is extended so that it can provide external services.
  • the topology information before hiding can be queried through the hidden topology information, and the queried topology information before hiding can be sent to the requester who issued the request message.
  • SEPP SEPP.
  • topology information recovery services are provided to each other through SEPP to realize the conversion from the hidden topology information to the pre-hidden topology information, so that the hidden topology information can be correctly restored, thereby avoiding the SEPP and reception of hidden topology information. Service failure caused by different SEPPs used to hide topology information.
  • FIG. 14 shows a schematic interaction diagram of yet another method 1400 for topological information hiding communication provided by an embodiment of the present application.
  • the method 1400 is applied to the scenario of sending and receiving messages across the first network element and the second network element of the network.
  • the method 1400 includes:
  • the first network element sends a first request message to the first SEPP.
  • the first request message is used to request to subscribe to target information from the second network element, or the first request message is used to request to obtain the target from the second network element. information.
  • the first network element while sending the first request message to the first SEPP, the first network element also sends the topology information of the first network element.
  • the first network element may send the topology information of the first network element in a manner carried by the first request information, may be sent individually, may be sent in a package, or may be sent by This application does not limit the forwarding methods of other devices or network elements.
  • the topology information of the first network element may be one or more of the IP address, FQDN, and URI of the first network element, or other topology information, which is not limited in this application.
  • the first SEPP After receiving the first request message, the first SEPP obtains the topology information of the first network element, hides the topology information of the first network element, and generates hidden information.
  • the hidden information refers to the hidden topological information of the first network element.
  • the first SEPP sends a first message to the third SEPP located in the second network.
  • the first message includes the first request message and hidden information.
  • the above hidden information may be sent by being carried by the first request message, may be sent individually, may be packaged and sent, or may be forwarded by other devices or network elements. , this application does not limit this.
  • the second network element In response to the received first message, the second network element sends a second message to the third SEPP on the same side, where the second message includes the first reply message and hidden information.
  • the first reply message is a message sent by the second network element in response to the first request message.
  • the above-mentioned hidden information may be sent by being carried by the first reply message, may be sent individually, may be packaged and sent, or may be forwarded by other devices or network elements. , this application does not limit this.
  • the second message carries a topology information recovery request message, which is used to request recovery of the hidden information it carries.
  • S1406 The third SEPP forwards the above-mentioned second message to the second SEPP located in the first network.
  • the second SEPP After receiving the second message, the second SEPP sends a second request message to the third network element located on the same side.
  • the second request message is used to request to obtain the restored hidden message.
  • the second request message carries the hidden information. .
  • the third network element In response to receiving the second request message, the third network element restores the hidden message to the unhidden topology information, and then sends the restored topology information of the first network element to the second SEPP.
  • S1409 The second SEPP sends the first reply message to the first network element according to the topology information of the first network element.
  • topology information hiding and recovery services are provided by adding a new NF.
  • the newly added NF can query the pre-hiding topology information through the hidden topology information, and then send the queried pre-hiding topology information to SEPP that issued the request message.
  • the hidden topology information can be restored correctly, thereby avoiding service failure caused by the difference between the SEPP for sending the hidden topology information and the SEPP for receiving the hidden topology information.
  • FIG 15 is a schematic block diagram of a communication device 1500 provided by an embodiment of the present application.
  • the device 1500 includes a receiving module 1501, which can be used to implement corresponding receiving functions.
  • the receiving module 1501 may also be called a receiving unit.
  • the device 1500 also includes a processing module 1502, which can be used to implement corresponding processing functions, such as hiding the topology information of the first network element or restoring the topology information of the first network element.
  • a processing module 1502 can be used to implement corresponding processing functions, such as hiding the topology information of the first network element or restoring the topology information of the first network element.
  • the device 1500 also includes a sending module 1503, which can be used to implement corresponding sending functions.
  • the sending module 1503 can also be called a sending unit.
  • the device 1500 also includes a storage unit, which can be used to store instructions and/or data, and the processing unit 1502 can read the instructions and/or data in the storage unit, so that the device implements each of the foregoing method embodiments. the actions of related devices.
  • a storage unit which can be used to store instructions and/or data
  • the processing unit 1502 can read the instructions and/or data in the storage unit, so that the device implements each of the foregoing method embodiments. the actions of related devices.
  • the device 1500 can be used to perform the actions performed by the network equipment (such as AMF, UDM or SEPP) in each of the above method embodiments.
  • the device 1500 can be a component of the network equipment, and the receiving module 1501 is used to perform
  • the processing module 1502 is used to perform operations related to the reception of the network device in the above method embodiment, and the sending module 1503 is used to perform the sending operation of the network device in the above method embodiment. related operations.
  • the device 1500 is used to perform actions performed by any network element or any device in each of the above method embodiments.
  • the communication device may be used to perform operations of the network equipment (for example, the first network element, the second network element, the third network element or the SEPP) in FIGS. 4 to 14 described above.
  • the network equipment for example, the first network element, the second network element, the third network element or the SEPP
  • the receiving module 1501 is configured to receive a first request message and send a first request message to the first SEPP.
  • the first request message is used to request to subscribe to the target information from the second network element, or the first request message is used to request from the second network element. Obtain target information at the second network element.
  • the receiving module 1501 while sending the first request message to the first SEPP, the receiving module 1501 also sends the topology information of the first network element.
  • the processing module 1502 is configured to obtain the topology information of the first network element, hide the topology information of the first network element, and generate hidden information.
  • the hidden information refers to the hidden topological information of the first network element.
  • the sending module 1503 is configured to send a first message to the third SEPP located in the second network, where the first message includes the first request message and hidden information.
  • the above hidden information may be sent by being carried by the first request message, may be sent individually, may be packaged and sent, or may be forwarded by other devices or network elements. , this application does not limit this.
  • the receiving module 1501, the processing module 1502 and the sending module 1503 in the communication device can also implement other operations or functions of the network device in the above method, which will not be described again here.
  • the receiving module 1501, the processing module 1502 and the sending module 1503 in the communication device can also implement the operations or functions of other devices in the above method, which will not be described again here.
  • Figure 16 shows another possible structural diagram of the communication device involved in the above embodiment.
  • the communication device includes a processor 1601.
  • the communication device may also include at least one memory 1602 for storing program instructions and/or data.
  • Memory 1602 and processor 1601 are coupled.
  • the coupling in the embodiment of this application is an indirect coupling or communication connection between devices, units or modules, which may be in electrical, mechanical or other forms, and is used for information interaction between devices, units or modules.
  • Processor 1601 may cooperate with memory 1602.
  • Processor 1601 may execute program instructions stored in memory 1602. At least one of the at least one memory may be included in the processor.
  • the communication device may also include a transceiver 1603 for communicating with other devices over a transmission medium so that the device may Communicate with other devices.
  • the transceiver 1603 may be an interface, a bus, a circuit, or a device capable of implementing transceiver functions.
  • transceiver 1603 may include a receiver and a transmitter.
  • connection medium between the above-mentioned processor 1601, memory 1602 and transceiver 1603 is not limited in the embodiment of the present application.
  • the processor 1601, the memory 1602 and the transceiver 1603 are connected through a bus 1604 in Figure 16.
  • the bus is represented by a thick line in Figure 16.
  • the connection methods between other components are only schematically explained. , is not limited.
  • the bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one thick line is used in Figure 16, but it does not mean that there is only one bus or one type of bus.
  • processor 1601 is configured for other operations or functions of the network device.
  • the transceiver 1603 is used to implement communication between the communication device and other network elements/devices (such as UE/gNB).
  • the processor can be used to execute the program instructions and implement the above method flow.
  • the processor may include but is not limited to at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller unit (MCU), or artificial intelligence
  • CPU central processing unit
  • DSP digital signal processor
  • MCU microcontroller unit
  • Each computing device may include one or more cores for executing software instructions to perform calculations or processing.
  • the processor can be built into an SoC (system on a chip) or an application specific integrated circuit (ASIC), or it can be an independent semiconductor chip.
  • the processor can further include necessary hardware accelerators, such as field programmable gate array (FPGA), PLD (programmable logic device) , or a logic circuit that implements dedicated logic operations.
  • FPGA field programmable gate array
  • PLD programmable logic device
  • the hardware can be a CPU, microprocessor, DSP, MCU, artificial intelligence processor, ASIC, SoC, FPGA, PLD, dedicated digital circuit, hardware accelerator or non-integrated discrete device Any one or any combination thereof, which can run necessary software or not rely on software to perform the above method process.
  • the above modules or units When the above modules or units are implemented using software, they may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with the embodiments of the present invention are generated in whole or in part.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another, e.g., the computer instructions may be transferred from a website, computer, server, or data center Transmission to another website, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that contains one or more available media integrated.
  • the available media may be magnetic media (eg, floppy disk, hard disk, magnetic tape), optical media (eg, DVD), or semiconductor media (eg, solid state disk (SSD)), etc.
  • the present application also provides a computer program product.
  • the computer program product includes: computer program code.
  • the computer program code When the computer program code is run on a computer, it causes the computer to execute the first step in the foregoing method embodiment.
  • One network element side method When the computer program code is run on a computer, it causes the computer to execute the first step in the foregoing method embodiment.
  • One network element side method When the computer program code is run on a computer, it causes the computer to execute the first step in the foregoing method embodiment.
  • One network element side method One network element side method.
  • the present application also provides a computer program product.
  • the computer program product includes: computer program code.
  • the computer program code When the computer program code is run on a computer, it causes the computer to execute the first step in the foregoing method embodiment. Method on the second network element side.
  • the present application also provides a computer program product.
  • the computer program product includes: computer program code.
  • the computer program code When the computer program code is run on a computer, it causes the computer to execute the SEPP in the foregoing method embodiment. side method.
  • the present application also provides a computer-readable medium.
  • the computer-readable medium stores program code.
  • the program code When the program code is run on a computer, it causes the computer to execute the first step in the foregoing method embodiment.
  • One network element side method One network element side method.
  • the present application also provides a computer-readable medium.
  • the computer-readable medium stores program code.
  • the program code When the program code is run on a computer, it causes the computer to execute the first step in the foregoing method embodiment. Method on the second network element side.
  • the present application also provides a computer-readable medium.
  • the computer-readable medium stores program code.
  • the program code When the program code is run on a computer, it causes the computer to execute the SEPP in the foregoing method embodiment. side method.
  • An embodiment of the present application also provides a processing device, including a processor and an interface; the processor is configured to execute the communication method in any of the above method embodiments.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Les modes de réalisation de la présente demande concernent un procédé de communication et un appareil de communication. Le procédé comprend les étapes suivantes : en réponse à l'envoi par un premier élément de réseau d'un premier message de demande à un second réseau, un premier SEPP envoie un premier message au second réseau, le premier message comprenant le premier message de demande et des informations cachées et les informations cachées étant des informations topologiques d'un premier élément de réseau caché ; un deuxième SEPP reçoit un second message envoyé par le second réseau, le second message comprenant un premier message de réponse et les informations cachées ; et le deuxième SEPP récupère les informations cachées, de façon à acheminer le premier message de réponse au premier élément de réseau. Le cas 1 implique que le premier SEPP et le deuxième SEPP aient le même algorithme prédéfini ; le cas 2 implique que le premier SEPP soit le même que le deuxième SEPP ; et le cas 3 implique le deuxième SEPP demande à un autre dispositif de réseau de récupérer les informations topologiques. Les trois solutions peuvent toutes récupérer correctement des informations topologiques cachées, de telle sorte qu'une défaillance de service provoquée par un premier SEPP différent d'un deuxième SEPP puisse être évitée.
PCT/CN2023/104692 2022-08-08 2023-06-30 Procédé de communication et appareil de communication WO2024032245A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210943273.4 2022-08-08
CN202210943273.4A CN117580030A (zh) 2022-08-08 2022-08-08 通信方法和通信装置

Publications (1)

Publication Number Publication Date
WO2024032245A1 true WO2024032245A1 (fr) 2024-02-15

Family

ID=89850676

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/104692 WO2024032245A1 (fr) 2022-08-08 2023-06-30 Procédé de communication et appareil de communication

Country Status (2)

Country Link
CN (1) CN117580030A (fr)
WO (1) WO2024032245A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103023865A (zh) * 2011-09-28 2013-04-03 中兴通讯股份有限公司 拓扑隐藏网络中路径参数的恢复、隐藏方法及装置
CN110290161A (zh) * 2018-03-19 2019-09-27 中国移动通信有限公司研究院 一种拓扑隐藏方法、节点、功能实体和计算机存储介质
CN113940103A (zh) * 2019-06-10 2022-01-14 瑞典爱立信有限公司 用于处置网络功能的网络节点及其中执行的方法
US20220030413A1 (en) * 2018-11-05 2022-01-27 Telefonaktiebolaget Lm Ericsson (Publ) Fully qualified domain name handling for service interactions in 5g

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103023865A (zh) * 2011-09-28 2013-04-03 中兴通讯股份有限公司 拓扑隐藏网络中路径参数的恢复、隐藏方法及装置
CN110290161A (zh) * 2018-03-19 2019-09-27 中国移动通信有限公司研究院 一种拓扑隐藏方法、节点、功能实体和计算机存储介质
US20220030413A1 (en) * 2018-11-05 2022-01-27 Telefonaktiebolaget Lm Ericsson (Publ) Fully qualified domain name handling for service interactions in 5g
CN113940103A (zh) * 2019-06-10 2022-01-14 瑞典爱立信有限公司 用于处置网络功能的网络节点及其中执行的方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
CHINA TELECOM: "New KI on Topology Hiding in Data and Analytics Exchange", 3GPP DRAFT; S3-220738, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20220516 - 20220520, 9 May 2022 (2022-05-09), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052195070 *
CHINA TELECOM: "New solution on topology hiding in data and analytics exchange in roaming case", 3GPP DRAFT; S3-221369, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG3, no. e-meeting; 20220627 - 20220701, 20 June 2022 (2022-06-20), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP052195690 *

Also Published As

Publication number Publication date
CN117580030A (zh) 2024-02-20

Similar Documents

Publication Publication Date Title
US11765150B2 (en) End-to-end M2M service layer sessions
RU2760728C1 (ru) Защита сообщения, передаваемого между доменами базовой сети
WO2021017381A1 (fr) Systèmes et procédés de prise en charge de direction de trafic par l'intermédiaire d'une chaîne de fonctions de service
WO2017197273A1 (fr) Connexion à des réseaux centraux mobiles virtualisés
WO2018208295A1 (fr) Connectivité, découverte et mise en réseau de dispositifs d'iot
US11284254B2 (en) Service-based 5G core authentication endpoints
WO2022088029A1 (fr) Procédé d'acquisition de clé et appareil de communication
JP2020517132A (ja) ポリシ制御を実装するための方法、装置、およびシステム
US20210219137A1 (en) Security management between edge proxy and internetwork exchange node in a communication system
WO2024032245A1 (fr) Procédé de communication et appareil de communication
WO2022179218A1 (fr) Procédé et appareil de communication
WO2021233235A1 (fr) Procédé, appareil et système servant à établir une connexion
EP4367867A1 (fr) Autorisation d'un équipement utilisateur à accéder à une ressource
EP3989522A1 (fr) Compression de charge utile
WO2023160390A1 (fr) Procédé et appareil de communication
WO2022237838A1 (fr) Procédé de communication et dispositif de communication
WO2022100197A1 (fr) Procédé et appareil d'obtention de service périphérique
WO2024001524A1 (fr) Procédé et appareil de communication
WO2021136301A1 (fr) Procédé et appareil de communication
CN116888946A (zh) 边缘应用服务器发现的方法和设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23851472

Country of ref document: EP

Kind code of ref document: A1