WO2020088598A1 - 类别信息的确定方法及装置 - Google Patents

类别信息的确定方法及装置 Download PDF

Info

Publication number
WO2020088598A1
WO2020088598A1 PCT/CN2019/114760 CN2019114760W WO2020088598A1 WO 2020088598 A1 WO2020088598 A1 WO 2020088598A1 CN 2019114760 W CN2019114760 W CN 2019114760W WO 2020088598 A1 WO2020088598 A1 WO 2020088598A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
terminal
category information
category
network element
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/114760
Other languages
English (en)
French (fr)
Inventor
胡力
陈璟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP19878522.2A priority Critical patent/EP3863317B1/en
Publication of WO2020088598A1 publication Critical patent/WO2020088598A1/zh
Priority to US17/245,570 priority patent/US12425861B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/2866—Architectures; Arrangements
    • H04L67/30—Profiles
    • H04L67/303—Terminal profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/52—Network services specially adapted for the location of the user terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/06—Access restriction performed under specific conditions based on traffic conditions

Definitions

  • the present application relates to the field of mobile communication technology, and in particular to a method and device for determining category information.
  • some terminals are usually simple to implement, have poor security protection, are easily attacked by attackers, and become devices controlled by attackers.
  • An example of an attack is that an attacker can use virus software to quickly control a large number of terminals to form a botnet that he controls. When the scale reaches a certain value, the attacker can control these terminals to initiate a large number of connections to a server at the same time, making the server overwhelmed and down, resulting in a distributed denial of service (DDoS) attack.
  • DDoS distributed denial of service
  • a method of controlling terminal attacks is that the base station performs terminal access control according to the granularity of the terminal's business urgency, that is, the access category (Subscriber Identity Module, SIM) card of the terminal is pre-written in the access category (access (class, AC), different ACs have different business urgency.
  • the base station When the base station is overloaded due to the attack, it sends broadcast data packets to limit the terminal's access. After receiving the broadcast data packet, the terminal judges whether it is necessary to restrict its access to the base station according to the AC in the SIM card, so as to realize the access control terminal.
  • the access category Subscriber Identity Module
  • the drawbacks of the above method are: 1) The AC of the terminal is written into the SIM card in advance, so the flexibility is not enough; 2) The AC can only reflect the business urgency of the terminal, so the classification method of the terminal is not flexible.
  • the present application provides a method for determining category information, a method and a device for controlling terminal access, to implement flexible classification of terminals, and control access to terminals based on the classification.
  • the present application provides a method for determining category information.
  • the method includes: for N terminals accessing a network, a core network element obtains information of the N terminals; for each of the N terminals For each terminal, the core network element determines the terminal type information based on the terminal information.
  • the terminal information includes some or all of the following information:
  • the function information of the terminal which is used to indicate the capability information of the terminal;
  • the user information is used to indicate the owner information of the terminal;
  • Device information of the terminal which is used to indicate the manufacturing information of the terminal
  • the location information is used to indicate the location of the terminal.
  • the core network element assigns categories to the terminals, and the terminals are assigned categories based on the terminal information, so the classification method is more flexible.
  • the classification method of the present application is more flexible.
  • the function information of the terminal includes network capabilities, mobile station network capabilities, mobile station category mask 2, mobile station category mask 3, supported encoding, added update category, voice domain preference ⁇ Terminal usage settings, terminal device performance, and some or all parameters in the network features supported by the mobile station.
  • the user information of the terminal includes some or all parameters in the group ID, administrator ID, and company ID
  • the device information includes some or all parameters in the category assignment number of the device identification code of the terminal and the software version number.
  • the core network element determines the terminal category information based on the terminal information, including: the core network element determines the first category of the terminal category information based on the terminal location information; the core network network The yuan determines the second category in the category information of the terminal based on part or all of the terminal function information, user information, or device information.
  • the core network element updates the first category in the category information of the terminal according to the updated location information.
  • the core network element sends the category information of the terminal to the communication device.
  • the communication device includes some or all of the following devices: terminal, access network device, mobility management network element, and session management network. Element, policy control network element, user plane network element.
  • the core network element receives the indication information, and the indication information is used to indicate the determination of the category information of the terminal.
  • the core network element is a mobility management element or a policy control element.
  • the core network element is a policy control element
  • the policy control network element For each of the N terminals, the policy control network element stores the correspondence between the category information of the terminal and the identifier of the terminal.
  • the present application provides a method for controlling terminal access.
  • the method includes: a policy control network element receives an identity list of abnormal terminals from a security detection network element, and the identity list is used to indicate one or more abnormal terminals.
  • the policy control network element determines the abnormal category information according to the local policy, the identity list, and the correspondence between the terminal category information and the terminal's identification; the policy control network element sends the abnormal category information.
  • the terminal can be controlled based on the abnormal category information, and thus the terminal access can be controlled according to the granularity of the category information, the function of controlling the access of multiple terminals at a time can be realized, and the control signaling is reduced.
  • the policy control network element determines the abnormal category information according to the local policy, the identity list, and the correspondence between the category information of the terminal and the terminal identifier, including:
  • the control strategy network element determines candidate abnormal category information corresponding to the identity list according to the correspondence between the identity list, the category information of the terminal and the terminal identifier, wherein the identity list has the same category information
  • the terminal corresponds to the same candidate abnormal category information
  • the candidate abnormal category information is abnormal category information
  • the candidate abnormal category information For each candidate abnormal category information, if the number of terminals attributed to the candidate abnormal category information in the identity list is greater than a preset number threshold, it is determined that the candidate abnormal category information is abnormal category information.
  • the policy control network element sends category information, including: the policy control network element sends abnormal category information to the access network device.
  • the policy control network element sends the abnormal category information, including: the policy control network element sends the abnormal category information to the user plane network element; the policy control network element also sends the flow matching information and the user plane network element Stream processing method, the flow matching information is used to match the user plane traffic, and the stream processing method is used to control the user plane flow of the matching flow matching information sent by the terminal matching the abnormal category information.
  • the present application provides a method for controlling terminal access.
  • the method includes: the safety detection network element determines abnormal category information according to the terminal's flow data; the safety detection network element sends the abnormal category information. Based on this solution, the terminal can be controlled based on the abnormal category information, and thus the terminal access can be controlled according to the granularity of the category information, the function of controlling the access of multiple terminals at a time can be realized, and the control signaling is reduced.
  • the method further includes: the security detection network element sends a data collection service request message to the network device, and the data collection service request message includes data collection Unit and data collection range, the data collection unit is used to indicate the format of the reported data, and the data collection range is used to indicate the collection according to the type information of the terminal; the security detection network element receives the data collection service response message sent by the network device, and the data collection service The response message includes category information and traffic data corresponding to the category information, and the traffic data of the terminal indicated by the category information meets the reporting conditions.
  • the data collection service request message further includes a reporting condition, and the reporting condition is used to indicate a condition that triggers reporting of traffic data.
  • the network device includes some or all of the following devices: a mobility management network element, a session management network element, a policy control network element, and a user plane network element.
  • the safety detection network element determines the abnormal category information according to the terminal's flow data, which includes: the safety detection network element detects the flow data corresponding to the category information according to the safety detection algorithm to determine the abnormal category information.
  • the present application provides a method for controlling terminal access.
  • the method includes: a user plane network element receives abnormal category information, flow matching information, and a flow processing method; if the user plane traffic matches the flow matching information, and the user is sent If the terminal of the face traffic matches the abnormal category information, the user plane network element performs control of the user plane traffic according to the flow processing method.
  • the terminal can be controlled based on the abnormal category information, and thus the terminal access can be controlled according to the granularity of the category information, the function of controlling the access of multiple terminals at a time can be realized, and the control signaling is reduced.
  • the user plane network element performs control of the user plane traffic according to the flow processing method, including: if the flow processing method includes a discard operation, the user plane network element discards the user plane traffic; or, if the flow processing The method includes the service quality modification operation, and the user plane network element modifies the service quality of user plane traffic.
  • the present application provides a method for controlling terminal access.
  • the method includes: an access network device receives abnormal category information from a core network element; an access network device sends a broadcast data packet, and the broadcast data packet includes the abnormal category information , The broadcast data packet is used to restrict the access of terminals matching the abnormal category information.
  • the terminal can be controlled based on the abnormal category information, and thus the terminal access can be controlled according to the granularity of the category information, the function of controlling the access of multiple terminals at a time can be realized, and the control signaling is reduced.
  • the access network device before the access network device sends the broadcast data packet, the access network device further includes: the access network device receives a restriction instruction, and the restriction instruction is used to indicate that the terminal is matched with the abnormal category information according to the restriction instruction Access.
  • the method further includes: the access network device starts a timer.
  • the access network device sends broadcast data packets, including: if the timer does not expire, the access network device sends broadcast data packets.
  • the present application provides a method for controlling terminal access.
  • the method includes: a terminal receives a broadcast data packet from an access network device, where the broadcast data packet includes abnormal category information; if the category information of the terminal and the received If the abnormal category information matches, the terminal restricts access of the terminal, wherein the category information of the terminal is received by the terminal from the core network element.
  • the terminal can be controlled based on the abnormal category information, and thus the terminal access can be controlled according to the granularity of the category information, the function of controlling the access of multiple terminals at a time can be realized, and the control signaling is reduced.
  • the terminal also receives category information of the terminal from a core network element, the category information of the terminal is generated based on information of the terminal, and the information of the terminal includes the following information Part or all of the information in:
  • Function information of the terminal where the function information is used to indicate capability information of the terminal;
  • the user information is used to indicate owner information of the terminal;
  • Device information of the terminal where the device information is used to indicate manufacturing information of the terminal;
  • Location information of the terminal where the location information is used to indicate the location of the terminal.
  • the terminal may also release the connection with the access network device.
  • the present application provides an apparatus, which may be an access network device, a terminal device, a security function network element, or a chip.
  • the device has the functions of implementing the embodiments of any one of the first aspect, the second aspect, the third aspect, or the fourth aspect.
  • This function can be realized by hardware, and can also be realized by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above functions.
  • an apparatus including: a processor and a memory; the memory is used to store computer-executed instructions, and when the apparatus is running, the processor executes the computer-executed instructions stored in the memory to cause the apparatus to execute
  • the method for determining category information as described in the first aspect or any one of the first aspects above, or the apparatus is configured to execute the method for controlling terminal access as described in the second aspect or any one of the second aspects above, or To cause the apparatus to perform the method for controlling terminal access as described in the third aspect or any of the third aspect, or to cause the apparatus to execute the control terminal as described in the fourth aspect or any of the fourth aspect
  • the method of access, or the apparatus to perform the method of controlling terminal access as described in the fifth aspect or any of the fifth aspect above, or the apparatus to perform any of the sixth aspect or the sixth aspect described above A method for controlling terminal access.
  • the present application also provides a computer-readable storage medium that stores instructions, which when executed on a computer, causes the computer to perform the methods described in the above aspects.
  • the present application also provides a computer program product including instructions, which when executed on a computer, causes the computer to perform the method described in the above aspects.
  • the present application further provides a system including the policy control network element in the second aspect or any embodiment of the second aspect, and the third aspect or any embodiment of the third aspect Security detection network element, the user plane network element in the above fourth aspect or any embodiment of the fourth aspect. Further, the system may further include the terminal in the sixth aspect or any embodiment of the sixth aspect.
  • the present application further provides a system including the security detection network element in the third aspect or any embodiment of the third aspect and the fifth aspect or any embodiment of the fifth aspect Access network equipment. Further, the system may further include the terminal in the sixth aspect or any embodiment of the sixth aspect.
  • FIG. 1 is a schematic diagram of a possible network architecture provided by this application.
  • FIG. 3 is a flowchart of another method for controlling UE access in the prior art
  • FIG. 5 is a flowchart of another method for determining category information of a UE provided by this application.
  • FIG. 6 is a flowchart of another method for determining category information of a UE provided by this application.
  • FIG. 7 is a flowchart of yet another method for determining category information of a UE provided by this application.
  • FIG. 10 is a flow chart of a method for collecting traffic of a network device provided by this application.
  • FIG. 11 is a flowchart of a method for controlling UE access provided by this application.
  • FIG. 13 is a schematic diagram of a device provided by the application.
  • FIG. 14 is a schematic diagram of another device provided by the present application.
  • the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly explain the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. With the evolution of the architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
  • the network architecture includes access network equipment and core network elements.
  • the network architecture also includes security function network elements.
  • the access network device can communicate with the terminal in a wired or wireless manner.
  • the terminal may communicate with the core network element through a non-access stratum (NAS) message, for example, through the N1 interface.
  • NAS non-access stratum
  • the core network elements include some or all of the network elements that may include mobility management network elements, session management network elements, policy control network elements, user plane network elements, and data management network elements.
  • the core network element may classify the terminal according to the terminal information.
  • the mobility management network element may classify the terminal, or the policy control network element may classify the terminal, or the mobility management network element and the policy control network element may classify the terminal.
  • the terminal is a device with wireless transceiver function.
  • the terminal can be deployed on land, including indoor or outdoor, handheld, or vehicle-mounted; it can also be deployed on the water (such as ships, etc.); it can also be deployed in the air (such as Airplanes, balloons and satellites etc.).
  • the terminal may be a mobile phone, a tablet computer, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, an industrial control (industrial control) Wireless terminal in self-driving, wireless terminal in self-driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety,
  • Terminals can also be cellular phones, cordless phones, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistants (personal digital assistants, PDAs), and wireless communication functions Handheld devices, computing devices, or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in the 5th generation (5G) network in the future, or public land mobile communication networks that will evolve in the future (public land, mobile network, PLMN) terminal equipment, etc.
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDAs personal digital assistants
  • Handheld devices computing devices, or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in the 5th generation (5G) network in the future, or public land mobile communication networks that will evolve in the future (public land, mobile network, PLMN) terminal equipment, etc.
  • 5G 5th generation
  • PLMN public land mobile communication networks
  • Terminals are sometimes referred to as terminal equipment, user equipment (UE), access terminal equipment, vehicle-mounted terminals, industrial control terminals, UE units, UE stations, mobile stations, mobile stations, remote stations, remote terminal equipment, mobile Equipment, UE terminal equipment, terminal equipment, wireless communication equipment, UE agents or UE devices, etc.
  • the terminal may also be fixed or mobile.
  • the embodiments of the present application are not limited thereto.
  • An access network device also known as a radio access network (radio access network, RAN) device, is a device that provides wireless communication functions for terminals.
  • Access network equipment includes, but is not limited to, 5G next-generation base stations (gNodeB, gNB), evolved node B (evolved node B, eNB), radio network controller (radio network controller, RNC), node B ( node B, NB), base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved node B, or home node B, HNB), baseband unit (baseBand unit) , BBU), transmitting point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), mobile switching center, etc.
  • 5G next-generation base stations gNodeB, gNB
  • evolved node B evolved node B
  • eNB radio network controller
  • RNC radio network controller
  • node B node B, NB
  • BSC base station controller
  • the access network device may also be a wireless controller, a centralized unit (CU), and / or a distributed unit (DU) in a cloud radio access network (CRAN) scenario, or this
  • the network device may be a relay station, an access point, a vehicle-mounted device, a wearable device, a network device in a future 5G network, or a network device in a future evolved PLMN network.
  • the terminal can communicate with multiple access network devices of different technologies. For example, the terminal can communicate with an access network device that supports long-term evolution (LTE) networks, and can also communicate with an access network device that supports 5G networks. It can also support dual connection with the access network equipment of LTE network and the access network equipment of 5G network.
  • LTE long-term evolution
  • 5G 5G network
  • the user plane network element is mainly responsible for processing user packets, such as forwarding, charging, and lawful interception.
  • the user plane network element may be a user plane function (UPF) network element.
  • UPF user plane function
  • future communications such as the 6th generation (6th generation, 6G) network
  • the user plane network element may still be a UPF network element , Or have other names, this application is not limited.
  • the session management network element is mainly used for session management in a mobile network, such as session creation, modification, and release. Specific functions include, for example, assigning Internet protocol (IP) addresses to users, and selecting user plane network elements that provide message forwarding functions.
  • IP Internet protocol
  • the session management network element may be a session management function (SMF) network element.
  • SMF session management function
  • future communications such as a 6G network
  • the session management network element may still be an SMF network element, or have another name.
  • the application is not limited.
  • the mobility management network element is mainly used for the registration, mobility management, and tracking area update processes of terminals in the mobile network.
  • the mobility management network element terminates NAS messages, completes registration management, connection management and reachability management, allocation tracking area list (TA, list) and mobility management, etc., and transparent routing session management (session management, SM ) Message to the session management network element.
  • the mobility management network element may be an access and mobility management function (access and mobility management function, AMF) network element.
  • AMF access and mobility management function
  • future communications such as a 6G network, the mobility management network element may still be an AMF network element , Or have other names, this application does not limit.
  • the data management network element is mainly used to manage contracted data. When the contracted data is modified, it is responsible for notifying the corresponding network element.
  • the data management network element may be a unified data management (unified data management, UDM) network element.
  • UDM unified data management
  • future communications such as 6G, the data management network element may still be a UDM network element, or have another name. This application does not Be limited.
  • the policy control network element includes user subscription information management function, policy control function, charging policy control function, quality of service (QoS) control, etc.
  • the policy control network element may be a policy control function (PCF) network element.
  • PCF policy control function
  • future communications such as 6G networks, the policy control network element may still be a PCF network element, or have other names. The application is not limited.
  • the security detection network element in this application has a security function, which can analyze the traffic data of the terminal and find malicious traffic therein, that is, a terminal in which abnormal behavior is found.
  • the security detection network element may be referred to as a security detection function (Security Detection Function, SEDF) network element, or have another name.
  • SEDF Security Detection Function
  • the security detection network element may be a separate network element, or integrated in a NetWork Data Analysis Function (NWDAF) entity, or integrated in operation, management and maintenance (Operation, Administration and Maintenance, OAM) ) Entity, or integrated in the Application Function (AF) entity.
  • NWDAF NetWork Data Analysis Function
  • OAM Opera, management and maintenance
  • AF Application Function
  • the OAM entity can also be called a network management system, used to provide a set of network management functions, including fault monitoring, fault reporting, fault location, and fault repair.
  • the NWDAF entity is used to provide big data analysis services.
  • the entity can collect data from the 3rd generation partnership (3GPP) network and perform big data analysis to provide better strategies.
  • the AF entity is used to provide application services. This application service may be provided by a third party or an operator.
  • the above function may be a network element in a hardware device, or a software function running on dedicated hardware, or a virtualized function instantiated on a platform (for example, a cloud platform).
  • the terminal is the UE
  • the access network equipment is the base station
  • the user plane network element is the UPF network element
  • the session management network element is called the SMF network element
  • the mobility management network element is the AMF network element.
  • the control network element is a PCF network element
  • the data management network element is a UDM network element
  • the security detection network element is a SEDF network element.
  • the UPF network element is referred to as UPF
  • the session management network element is referred to as SMF
  • the AMF network element is referred to as AMF
  • the PCF network element is referred to as PCF
  • the UDM network element is referred to as UDM
  • SEDF network element is referred to as SEDF.
  • the UPF described later in this application can be replaced by user plane network elements
  • SMF can be replaced by session management network elements
  • AMF can be replaced by mobility management network elements
  • UDM can be replaced by data management network elements
  • SEDF It can be replaced with a security detection network element
  • the UE can be replaced with a terminal
  • the base station can be replaced with an access network device.
  • 5G is mainly oriented to three major business scenarios, enhanced mobile broadband (Enhanced Mobile Broadband, eMBB), enhanced machine type communication (Enhanced Machine Type Communication, eMTC) and ultra-reliable and very low-latency communication (Ultra-Reliable and Low-Latency Communication) , URLLC).
  • eMTC is mainly for Internet of Things (IoT) devices. Such devices are usually simple to implement, have poor security protection, are easily attacked by attackers, and become devices controlled by attackers.
  • IoT Internet of Things
  • An example of an attack is that an attacker can use virus software to quickly control a large number of IoT devices to form a botnet that he controls. When the scale reaches a certain value, the attacker can control these devices to initiate a large number of connections to a server at the same time, making the server overwhelmed and down, causing a DDoS attack.
  • FIG. 2 it is a method for controlling UE access in the prior art.
  • the method includes the following steps:
  • step 201 the SEDF determines that the UE has abnormal behavior.
  • the UE with abnormal behavior here may be one or more UEs.
  • step 202 the SEDF sends the second identifier of the UE to the base station, and the second identifier is used to indicate the UE that has abnormal behavior.
  • Step 203 the base station releases the connection with the UE according to the second identifier.
  • Step 204 The first UE initiates the connection and carries the first identifier, and the first identifier is used to indicate the UE.
  • step 205 the base station matches the first identifier and the second identifier.
  • Step 206 the base station restricts the access of the first UE.
  • the base station restricts the access of the first UE.
  • the base station also sends a reason for rejection to the first UE, for example, the reason for rejection is a security reason.
  • Step 207 After waiting for the set duration, the first UE attempts to access again.
  • access control is performed on UEs with abnormal behavior at the granularity of UE.
  • the number of UEs with abnormal behavior is many, for example, tens of thousands of levels. Tens of thousands of signalings cause great signaling overhead.
  • FIG. 3 it is another method for controlling UE access provided in the prior art.
  • This embodiment is applicable to the overload control of the base station.
  • the base station may trigger this process.
  • the method includes the following steps:
  • Step 301 the base station is overloaded.
  • the cause of the overload of the base station may be that there are too many UEs currently connected, or too many messages sent by the UE, or that the CPU of the base station is overloaded.
  • Step 302 The base station sends a broadcast data packet.
  • the broadcast data packet includes three parameters: ac-BarringFactor, ac-BarringTime, and ac-BarringForSpecialAC.
  • ac-BarringFactor is a value between 0 and 1. Before each attempt to access, the UE will generate a random number between 0 and 1. If the generated random number is less than ac-BarringFactor, you can directly Access, otherwise do not access, and wait for a while to try again.
  • ac-BarringTime is used to indicate the time to block access.
  • the UE decides not to access, it waits for ac-BarringTime.
  • ac-BarringForSpecialAC is used to indicate one or more access classes (access class, AC).
  • Access Class indicates the access class of the UE and is configured on the SIM card of the UE.
  • ac-BarringForSpecialAC can indicate 11-15 AC, and when the parameter ac-BarringForSpecialAC exists, the UE of the indicated AC also needs to start AC BarringCheck.
  • Step 303 After receiving the broadcast data packet, the UE determines the corresponding access mode according to the AC in the SIM card.
  • the UE When the AC in the SIM card belongs to 0-9, the UE directly performs AC Barring Check according to ac-BarringFactor and ac-BarringTime. When the AC in the SIM card belongs to 11-15, according to ac-BarringForSpecialAC, decide whether to perform AC Barring Check.
  • the overload mechanism of the embodiment shown in FIG. 3 is to perform access control of the UE according to the granularity of the service urgency of the UE (indicating the service urgency by AC).
  • the defects of this method are: 1) The AC of the UE is written in advance The SIM card is not flexible enough; 2) The overload mechanism only works for UEs trying to connect, and cannot control UEs that have been connected to the base station; 3) The overload mechanism is implemented spontaneously by the base station, but the detection mechanism is simple and cannot be controlled. Advanced attacks.
  • the present application provides a method for determining UE category information and a method for controlling UE access. Each is explained below.
  • FIG. 4 it is a method for determining category information of a UE provided by the present application. This method can be used to classify UEs. The method includes the following steps:
  • Step 401 For N UEs accessing the network, the core network element obtains information about the N UEs, where N is a positive integer.
  • the core network element here may be, for example, AMF, or PCF, or AMF and PCF.
  • the UE information here includes some or all of the following information:
  • Function information of the UE which is used to indicate the capability information of the UE, and may indicate functions supported by the UE.
  • the function information of the UE may include UE's network capability (UE Network Capability), mobile station network capability (MS Network) Capability, mobile station class mask 2 (Mobile Station Class Mask 2), mobile station class mask 3 (Mobile Station Class Mask 3) ), Supported Codecs, Additional Update Types, Voice Domain Preferences and UE Usage Settings (Voice Domain Preference and UE's Usage Settings), Device Performance (Device Properties), Mobile Station Support Network Features (MS, Network, Feature, Support) and some other parameters.
  • the user information is used to indicate the owner information of the UE.
  • the user information of the UE may include some or all of the parameters such as group ID, administrator ID, and company ID.
  • the device information of the UE may be the type allocation number (Type Allocation Code, TAC), software version number (SV) of the UE device identification code, etc. .
  • the location information of the UE is used to indicate the location of the UE.
  • the location information of the UE may be the cell identity, location area, etc. where the UE is currently located.
  • Step 402 For any one of the N UEs, the core network element determines the category information of the UE according to the information of the UE.
  • what information of the core network element according to the UE and how to determine the category information to which the UE belongs can be determined according to a preset strategy.
  • the preset strategy can also be adjusted by the operator as needed. For example, in the scenario of preventing potential attacks, when the UE information is used to classify the UE, the corresponding UE information may be selected to classify the UE according to different attack methods.
  • the ways for an attacker to attack the UE include:
  • Attack method Use application software / communication protocol / operating system / firmware vulnerability to attack.
  • the types of vulnerabilities can be divided into application software, communication protocol, and operating system vulnerabilities according to the different locations of the vulnerabilities.
  • vulnerabilities caused by application software design defects are called application software vulnerabilities, such as buffer overflow vulnerabilities in WeChat; due to communication protocols Vulnerabilities caused by design defects are called communication protocol vulnerabilities, such as the heart bleeding vulnerabilities in the Transport Layer Security (TLS) protocol; vulnerabilities caused by operating system design defects are called operating system vulnerabilities, such as Android buffer overflow vulnerabilities; due to drivers Vulnerabilities caused by programming defects are called firmware vulnerabilities.
  • an attacker can usually carefully construct an attack packet and send it to a UE with such vulnerabilities. Due to the flaw, the attacker can gain control of the UE through the vulnerability.
  • Application software vulnerability attacks are usually related to UE user information.
  • IoT devices have a single function and usually require special application software to be pre-installed.
  • Such application software can be reflected by UE user information.
  • the shared bicycles owned by company A need to be pre-installed with an APP developed by company A, while company B
  • the shared bicycle of the company needs to be pre-installed with the APP developed by the company B.
  • the shared bicycle of the company A may have security risks.
  • UE's group ID or company ID can distinguish different companies. In this case, the classification information of the UE may be determined according to the user information of the UE.
  • Communication protocol vulnerability attacks are usually related to UE functional information and / or device information. For example, when the IoT device is shipped from the factory, the communication chip is determined, then the communication protocol can be reflected by the UE's function information and device information. For example, the chip of the electric meter produced by company A implements the communication protocol A, while the chip of the electric meter produced by company B The communication protocol A is not implemented. If there is a loophole in the communication protocol A, the electric meter produced by the company A that implements the communication protocol A may have a security risk.
  • the UE can reflect the UE manufacturer and device model, and the capabilities of the UE The information can reflect whether the UE implements a vulnerable communication protocol. In this case, the classification information of the UE may be determined according to the function information and / or device information of the UE.
  • IMEI International Mobile Equipment Identity
  • PEI Permanent Equipment Identifier
  • Type Allocation Code TAC
  • Operating system vulnerability attacks are usually related to UE device information. For example, when an IoT device is shipped with an operating system pre-installed, the operating system can be reflected in the device information of the UE. For example, the medical device produced by company A is pre-installed with version A of the Android system, and the company B produces a pre-installed version. For the Apple system of B, if there is a vulnerability in the Android system of version A, the medical equipment of the Android system pre-installed by company A may have security risks.
  • the UE can reflect the UE manufacturer and device model, software version number ( Software (Version, SV) can reflect the operating system version number of the UE.
  • the classification information of the UE may be determined according to the device information of the UE.
  • Firmware vulnerability attacks are usually related to UE device information.
  • the driver is pre-installed when the IoT device is shipped, then the driver can be reflected by the device information of the UE.
  • the medical device produced by company A is pre-installed with driver A
  • the medical device produced by company B is pre-installed with driver B
  • driver A If there is a loophole in driver A, the medical equipment pre-installed by driver A may have security risks.
  • the UE ’s International Mobile Equipment Identity (IMEI) / Permanent Equipment Identifier (PEI) type allocation code (Type Allocation Code, TAC) can reflect the UE manufacturer and device model. In this case, the classification information of the UE may be determined according to the device information of the UE.
  • Management vulnerability attacks are usually related to the UE ’s device information, which can be obtained through the UE ’s International Mobile Equipment Identity (IMEI) / Permanent Equipment Identifier (PEI) type allocation code (Type Allocation Code, TAC) Reflect UE manufacturer and equipment model.
  • IMEI International Mobile Equipment Identity
  • PEI Permanent Equipment Identifier
  • Type Allocation Code, TAC Reflect UE manufacturer and equipment model.
  • the classification information of the UE may be determined according to the device information of the UE.
  • Attack method three Physical attack: This type of attack requires the attacker to attack near the terminal, for example, side channel attack, hardware attack, etc. For example, an attacker can move to an area and attack all data collectors in the area to achieve the purpose of tampering with the collected data.
  • the physical attack method is usually related to the location information of the UE, and the location of the UE can be reflected by the location identifier of the UE, such as CGI, TAI, and so on. In this case, the classification information of the UE may be determined according to the location information of the UE.
  • the embodiment of the present application selects the above-mentioned UE information to determine the category information of the UE, which can be associated with the attacking means of the attacker, thereby reflecting that there is a type of terminal with the same potential attack, so that it can be beneficial to control the terminal by category effect.
  • the core network element directly determines the category information of the UE based on the information of the UE.
  • the category information of the UE is determined according to part or all of the UE's function information, user information, device information, and location information.
  • the user information of the UE includes a group ID and the device information of the UE includes TAC and SV as an example.
  • the user information indication of the UE is group ID and the device information indications are TAC1 and SV1
  • the UE is assigned category 1 and is recorded as C1.
  • the user information of the UE indicates group ID and the device information indicates TAC1 and SV2
  • the UE is assigned category 2 and is recorded as C2.
  • the UE is assigned category 3, which is recorded as C3. And so on.
  • the UE is classified, and the resulting classification information may be, for example:
  • UE1 C1 (that is, UE1 belongs to category 1);
  • UE2 C2 (ie UE2 belongs to category 2);
  • UE3 C2 (ie UE3 belongs to category 2);
  • UE4 C3 (ie UE4 belongs to category 3);
  • the category information of the UE is determined based on all the information of the UE. If the information of all the UEs of the two UEs belong to the same category, the category information determined by the core network element for the two UEs is the same. However, if the information of any one of the two UEs does not belong to the same category, the category information determined by the core network element for the two UEs is different.
  • the core network element determines the first category in the category information of the UE according to the dynamic information of the UE, and determines the second category in the category information of the UE according to the static information of the UE.
  • the dynamic information of the UE represents information of the UE that may be changed within a first preset time (usually a shorter time), for example, it may be location information of the UE.
  • the static information of the UE represents the information of the UE that does not change within the second preset time (generally a long time), and may be part or all of the function information, user information, or device information of the UE.
  • the first category may also be called dynamic category information
  • the second category may also be called static category information.
  • the duration of the first preset time is less than or equal to the duration of the second preset time.
  • the first category of UE can be classified according to TAI or CGI.
  • TAI Track Area Identity
  • CGI Cell Global Identification
  • the first category of the UE needs to be updated from C11 to C12.
  • the first category may not need to be updated.
  • the first category of the UE remains C13.
  • the first category 1 is assigned to the UE, which is denoted as C11.
  • the UE is assigned the first category 2, which is denoted as C12.
  • the UE When the UE is in CGI3, the UE is assigned the first category 3, which is denoted as C13. And so on. It should be noted that when the UE moves to a new CGI, for example, the UE moves from CGI1 to CGI2, the first category of the UE needs to be updated from C11 to C12. Of course, when the UE moves to a new CGI, the first category may not need to be updated. For example, if the UE moves from CGI1 to CGI4, the first category of the UE remains C11. In practical applications, one of TAI or CGI is selected to allocate the second category to the UE. Of course, TAI and CGI can also be combined to allocate the second category to the UE.
  • the second category in the category information of the UE is determined according to part or all of the UE function information, user information, or device information.
  • the following category is used to determine the UE category according to the UE function information, user information, and device information Take the second category in the information as an example.
  • the user information of the UE indicates that the company belongs to ofo
  • the device information indicates that the manufacturer is GIANT
  • the function information indicates that the device supports the NB-IOT CP protocol
  • the UE1 is assigned a second category 1, which is denoted as C21.
  • the device information of the UE indicates that the company is Mobike
  • the device information indicates the manufacturer is PHOENIX
  • the function information indicates that the device function supports the NB-IOT CP protocol
  • the second category 2 is assigned to the UE2 and is denoted as C22. And so on.
  • the UE is classified, and the resulting classification information may be, for example:
  • UE1 C11, C22, (ie UE1 belongs to the first category 1 and the second category 2);
  • UE2 C11, C21, (ie UE2 belongs to the first category 1 and the second category 1);
  • UE3 C12, C23, (ie UE3 belongs to the first category 2 and the second category 3);
  • UE4 C12, C24, (ie UE4 belongs to the first category 2 and the second category 4);
  • UE5 C13, C21, (ie UE5 belongs to the first category 3 and the second category 1);
  • the first category to which the UE belongs can be changed, that is, if the location information of the UE is updated, the core network element updates the first category in the category information of the UE according to the updated location information.
  • the first category and the second category to which the UE belongs can change, depending on actual needs, this application does not limit it.
  • the core network element determines different categories according to the information of different UEs, for example, the core network element determines the first category of the UE category information according to the location information of the UE, and determines it according to the function information of the UE The second category in the category information of the UE determines the third category in the category information of the UE according to the user information of the UE, and determines the fourth category in the category information of the UE according to the device information of the UE.
  • the core network element may also determine only some of the above four categories.
  • the first category of UE can be classified according to TAI or CGI.
  • TAI Track Area Identity
  • CGI Cell Global Identification
  • the first category of the UE needs to be updated from C11 to C12.
  • the first category may not need to be updated.
  • the first category of the UE remains C13.
  • the first category 1 is assigned to the UE, which is denoted as C11.
  • the UE is assigned the first category 2, which is denoted as C12.
  • the UE When the UE is in CGI3, the UE is assigned the first category 3, which is denoted as C13. And so on. It should be noted that when the UE moves to a new CGI, for example, the UE moves from CGI1 to CGI2, the first category of the UE needs to be updated from C11 to C12. Of course, when the UE moves to a new CGI, the first category may not need to be updated. For example, if the UE moves from CGI1 to CGI4, the first category of the UE remains C11. In practical applications, one of TAI or CGI is selected to allocate the second category to the UE. Of course, TAI and CGI can also be combined to allocate the second category to the UE.
  • the second category in the category information of the UE is determined according to the function information of the UE. For example, when the function information of the UE indicates that the device function supports the NB-IOT CP protocol, the second category 1 is assigned to the UE, which is recorded as C21. As another example, when the function information of the UE indicates that the device function supports the NB-IOT UP protocol, the second category 2 is assigned to the UE, which is denoted as C22, and so on.
  • the third category in the category information of the UE is determined according to the user information of the UE. For example, when the user information of the UE indicates that the company it belongs to is ofo, the UE is assigned a third category 1, which is denoted as C31. As another example, when the company to which the user information of the UE belongs is Mobike, the third category 2 is assigned to the UE, which is denoted as C32. And so on.
  • the fourth category in the category information of the UE is determined according to the device information of the UE. For example, when the device information of the UE indicates that the manufacturer is a model A device produced by GIANT, the UE is assigned a fourth category 1, which is denoted as C41. As another example, when the device information of the UE indicates that the manufacturer is a model B device produced by PHOENIX, the UE is assigned a fourth category 2 and is referred to as C42. And so on.
  • the UE is classified, and the resulting classification information may be, for example:
  • UE1 C11, C22, C31, C42, (ie UE1 belongs to the first category 1, second category 2, third category 1, fourth category 2);
  • UE2 C11, C21, C32, C42 (ie UE2 belongs to the first category 1, second category 1, third category 2, fourth category 2);
  • UE3 C12, C23, C31, C42 (ie UE3 belongs to the first category 2, the second category 3, the third category 1, the fourth category 2);
  • UE4 C12, C22, C32, C41, (ie UE4 belongs to the first category 2, the second category 2, the third category 2, the fourth category 1);
  • UE5 C13, C21, C31, C41, (ie UE5 belongs to the first category 3, the second category 1, the third category 1, the fourth category 1);
  • the first category to which the UE belongs can be changed, that is, if the location information of the UE is updated, the core network element updates the first category in the category information of the UE according to the updated location information.
  • the second category, the third category, and the fourth category to which the UE belongs do not change.
  • the core network element may assign a category to the UE, and the terminal may be assigned a category based on part or all of the UE's function information, user information, device information, and location information.
  • the classification method is more flexible.
  • the embodiment of the present application selects the above-mentioned UE information to determine the category information of the UE, which can be associated with the attacking means of the attacker, thereby reflecting a type of terminal with the same potential attack, so that the beneficial effects of controlling the terminal by category can be implemented.
  • the classification method of the present application is more flexible.
  • the core network element may also send the category information of the UE to the communication device.
  • the AMF may send the category information of the UE to the following communication devices: UE, base station, SMF, PCF, or UPF.
  • the PCF may send the category information of the UE to the following communication devices: UE, base station, AMF, SMF, or UPF.
  • AMF and PCF jointly determine the category information of the UE, for example, AMF determines the first category of the UE and PCF determines the second category of the UE; or AMF determines the first category of the UE and PCF determines the second category of the UE , The third category and the fourth category, based on this implementation, after determining the first category of the UE, the AMF sends the first category of the UE to the PCF, and then the PCF can send the category information of the UE to the following communication devices: UE , Base station, AMF, SMF or UPF.
  • the core network element receives indication information, which is used to indicate the determination of the category information of the UE. That is, the core network element determines the category information of the UE after receiving the indication information.
  • the indication information may be sent by the network management system, for example, or may also be sent by the UE, which is not limited in this application.
  • the AMF determines the category information of the UE.
  • the method includes the following steps:
  • step 501 the UE sends a registration request (registration request) message to the base station.
  • the message includes UE capability information (UECapability).
  • UECapability may include UE network capability (UENetworkCapability), mobile station network capability (MSNetworkCapability), mobile station category mask 2 (Mobile Station Classmask2), Mobile Station Classmask 3 (Mobile Station Classmask3), Supported Codecs (Supported Codecs), Added Update Type (Additional Update) Type, Voice Domain Preferences, and UE Usage Settings (Voice Domain Preference and UE's Usage Settings) , Device performance (DeviceProperities), mobile station support network features (MS) Network Features (Support) and some or all of the parameters.
  • the capability information of the UE may also be called the function information of the UE.
  • the base station sends an initial UE message (Initial UE message) to the AMF.
  • the Initial UE message includes location information of the UE, a registration request message, and the like.
  • the above Initial UE message is an N2 message.
  • AMF can obtain the location information of the UE from the N2 message, such as CGI, TAI, etc., where CGI reflects the location of the cell where the UE is located, and TAI reflects the location of the tracking area where the UE is located.
  • CGI reflects the location of the cell where the UE is located
  • TAI reflects the location of the tracking area where the UE is located.
  • AMF can also obtain UE capability information from the registration request message.
  • the AMF uses the NAS security mode completed (SMP) message process to obtain the device information of the UE from the UE, such as TAC and SV in IMEI / PEI.
  • SMP NAS security mode completed
  • AMF can obtain a permanent equipment identifier (Permanent Equipment Identifier, PEI) from the UE through the NAS SMP process.
  • PEI can reflect equipment-related information such as the equipment manufacturer.
  • Step 504 the AMF obtains the user information of the UE from the UDM through the Nudm_SDM_Get process.
  • the user information of the UE may specifically be SIM card related information, for example, the SIM card related information obtained from the UDM through the Nudm_SDM_Get process includes group identification (group ID), administrator ID, company ID and other information, where group ID can reflect the UE In the group category, the administrator ID can reflect the user information of the UE, and the company ID can reflect the information of the company to which the UE belongs.
  • group ID group ID
  • administrator ID can reflect the user information of the UE
  • company ID can reflect the information of the company to which the UE belongs.
  • Step 505 the AMF determines the category information of the UE according to the information of the UE.
  • the AMF stores the category information of the UE in the context of the UE.
  • Step 506 The AMF sends the category information of the UE to some or all of the communication devices in the UDM, PCF, UE, and base station.
  • the AMF may send the category information of the UE to the PCF by calling the service interface opened by the PCF.
  • the services provided by the PCF can include Npcf_AMPolicyControl.
  • the AMF can send the UE's category information to the UDM by invoking the UDM open service interface.
  • the services provided by UDM can include Subscriber Data Management, UE Context Management Service, etc.
  • the AMF may send the UE category information to the UE through a NAS message, for example, the NAS message is a registration acceptance message (Registration Accept).
  • the NAS message is a registration acceptance message (Registration Accept).
  • the AMF may send the category information of the UE to the base station through an N2 message, for example, the N2 message is an initial context establishment message.
  • Step 507 The communication device that obtains the category information of the UE stores the category information of the UE.
  • the PCF stores the obtained category information of the UE in the context information of the UE.
  • UDM stores the obtained category information of the UE in the context information of the UE.
  • the base station stores the obtained category information of the UE in the context information of the UE.
  • the UE stores the obtained category information of the UE locally.
  • the above steps 501 and 502 may also carry indication information, which is used to indicate the determination of the category information of the UE, so that when the AMF receives the indication information, it may perform the above step 505 according to the indication information.
  • the AMF may also receive the above indication information from other network elements, such as an AF network element, so that when receiving the indication information, the AMF performs the above step 505 according to the indication information.
  • other network elements such as an AF network element
  • the AMF may send the category information of the UE to some or all of the devices in the PCF, UDM, base station, and UE:
  • Case 1 AMF sends the category information of the UE to the PCF and UDM, and the AMF stores the category information of the UE, so that the AMF can store the category information of the UE in the context of the UE, and the PCF can store the UE in the context of the UE UDM can store the category information of the UE in the context of the UE.
  • the AMF only sends the category information of the UE to the UDM or PCF.
  • the UDM or PCF may store the category information of the UE in the context of the UE, and the AMF does not store the category information of the UE.
  • AMF sends the UE's category information to UDM and PCF, and AMF does not store the UE's category information, then UDM can store the UE's category information in the context of the UE, and PCF can store the UE's category information in the context of the UE UE category information.
  • AMF sends the category information of the UE to the base station, the UE and the PCF, and the AMF also stores the category information of the UE, so that the AMF can store the category information of the UE in the context of the UE, and the PCF can be in the context of the UE Store the category information of the UE, the base station may store the category information of the UE in the context of the UE, and the UE may store the category information of the UE.
  • the AMF determines the category information of the UE
  • some or all devices in the core network element, the UE, and the base station can obtain the category information of the UE.
  • the UE's category information can be stored locally and can be obtained locally when it is needed later, and for other devices that have not obtained the UE's category information, it can be used later Obtained from a device that stores information of this category.
  • the communication device when the communication device stores the category information of the UE, it may store the correspondence or mapping relationship between the identifier of the UE and the category information of the UE.
  • the PCF determines the category information of the UE.
  • the method includes the following steps:
  • Steps 601 to 604 are the same as steps 501 to 504 shown in FIG. 5, and reference may be made to the foregoing description, which will not be repeated here.
  • step 605 the AMF sends the UE information to the PCF.
  • the AMF sends the above UE information to the UE by invoking the service interface of the PCF, where the UE information may include UE function information, UE location information, UE user information, UE device information, and so on.
  • the service provided by the PCF may be Npcf_AMPolicyControl.
  • step 606 the PCF determines the category information of the UE according to the information of the UE.
  • the PCF also stores the category information of the UE in the context of the UE.
  • the specific implementation manner for the PCF to determine the category information of the UE is the same as the method for determining the category information of the UE in step 505 of the embodiment shown in FIG. 5, and reference may be made to the foregoing description.
  • Step 607 the PCF sends the category information of the UE to the AMF.
  • step 608 the AMF sends the category information of the UE to some or all of the communication devices in the UDM, the UE, and the base station.
  • the AMF can send the UE's category information to the UDM by invoking the UDM open service interface.
  • the services provided by UDM can include Subscriber Data Management, UE Context Management Service, etc.
  • the AMF may send the UE category information to the UE through a NAS message, for example, the NAS message is a registration acceptance message.
  • the AMF may send the category information of the UE to the base station through an N2 message, for example, the N2 message is an initial context establishment message.
  • Step 609 The communication device that obtains the category information of the UE stores the category information of the UE.
  • UDM stores the obtained category information of the UE in the context information of the UE.
  • the base station stores the obtained category information of the UE in the context information of the UE.
  • the UE stores the obtained category information of the UE locally.
  • the above steps 601, 602, and 605 may also carry indication information used to indicate the determination of the category information of the UE, so that when the PCF receives the indication information, the above step 606 is performed according to the indication information .
  • the PCF may also receive the above-mentioned instruction information from other network elements, such as an AF network element, so that when receiving the instruction information, the PCF performs the above step 606 according to the instruction information.
  • other network elements such as an AF network element
  • the PCF may send the category information of the UE to some or all of the AMF, UDM, base station, and UE:
  • Case 1 The PCF sends the category information of the UE to both AMF and UDM, and the PCF also stores the category information of the UE, so that the PCF can store the category information of the UE in the context of the UE, and the UDM can store the category information of the UE in the context of the UE
  • the AMF may store the category information of the UE in the context of the UE.
  • the PCF only sends the category information of the UE to the UDM, and the PCF does not store the category information of the UE, then the UDM may store the category information of the UE in the context of the UE.
  • the PCF sends the category information of the UE to the UDM, and the PCF stores the category information of the UE, then the UDM can store the category information of the UE in the context of the UE, and the PCF can store the category of the UE in the context of the UE information.
  • PCF sends the category information of the UE to the base station, the UE and the AMF, then the base station can store the category information of the UE in the context of the UE, the UE can store the category information of the UE, and the AMF can store the context information of the UE For the category information of the UE, the PCF stores the category information of the UE in the context of the UE.
  • the PCF determines the category information of the UE
  • some or all devices in the core network element, the UE, and the base station can obtain the category information of the UE.
  • the UE's category information can be stored locally and can be obtained locally when it is needed later, and for other devices that have not obtained the UE's category information, it can be used later Obtained from a device that stores information of this category.
  • the communication device when the communication device stores the category information of the UE, it may store the correspondence or mapping relationship between the identifier of the UE and the category information of the UE.
  • AMF and PCF jointly determine the category information of the UE.
  • the method includes the following steps:
  • Steps 701 to 704 are the same as steps 501 to 504 shown in FIG. 5, and reference may be made to the foregoing description, which will not be repeated here.
  • Step 705 the AMF determines the dynamic category information of the UE according to the dynamic information of the UE.
  • the dynamic information of the UE may be, for example, the location information of the UE, and the dynamic category information refers to the first category of the UE, that is, the AMF determines the first category of the UE according to the location information of the UE.
  • step 706 the AMF sends the static information and the dynamic category information of the UE to the PCF.
  • the static information here refers to part or all of the user information of the UE, the function information of the UE, and the device information of the UE.
  • AMF sends the static information and dynamic category information of the UE to the UE by calling the service interface of the PCF.
  • the service provided by the PCF may be Npcf_AMPolicyControl.
  • step 707 the PCF determines the static category information of the UE according to the static information of the UE.
  • the static category information here has different meanings in different classification methods. For example, if the second category is determined based on part or all of the user information of the UE, the function information of the UE, and the device information of the UE, the static category information here refers to the second category of the UE. For another example, if the second category in the UE category information is determined according to the UE function information, the third category in the UE category information is determined according to the UE user information, and the fourth category in the UE category information is determined according to the UE device information Category, the static category information here refers to the second category, the third category, and the fourth category of the UE.
  • the PCF can determine the static category information of the UE on the one hand and the dynamic category information of the UE from the AMF on the other hand, so that the PCF can obtain the category information of the UE (including the static category information of the UE and the dynamic category information of the UE).
  • the PCF also stores the category information of the UE in the context of the UE.
  • step 708 the PCF sends the category information of the UE to the AMF.
  • the AMF sends the category information of the UE to some or all of the communication devices in the UDM, the UE, and the base station.
  • the AMF can send the UE's category information to the UDM by invoking the UDM open service interface.
  • the services provided by UDM can include Subscriber Data Management, UE Context Management Service, etc.
  • the AMF may send the UE category information to the UE through a NAS message, for example, the NAS message is a registration acceptance message.
  • the AMF may send the category information of the UE to the base station through an N2 message, for example, the N2 message is an initial context establishment message.
  • Step 710 The communication device that obtains the category information of the UE stores the category information of the UE.
  • UDM stores the obtained category information of the UE in the context information of the UE.
  • the base station stores the obtained category information of the UE in the context information of the UE.
  • the UE stores the obtained category information of the UE locally.
  • the above steps 706-710 can also be replaced by: the AMF determines the dynamic category information of the UE and sends the dynamic category information of the UE to other communication devices, and the PCF determines the static category information of the UE Other communication devices send the static category information of the UE.
  • the above steps 706-710 can also be replaced by: the AMF determines the dynamic category information of the UE and sends the dynamic category information of the UE to the PCF, and the PCF determines the static category information of the UE and then The category information and the dynamic category information determine the category information of the UE, and then the PCF sends the category information of the UE to other communication devices.
  • the above steps 701, 702, and 706 may also carry indication information, which is used to indicate the determination of the category information of the UE, so that when the AMF receives the indication information, the above step 705 is performed according to the indication information
  • the PCF receives the instruction information, it performs the above step 707 according to the instruction information.
  • the AMF and PCF may also receive the above indication information from other network elements, such as the AF network element, so that when the AMF and PCF receive the indication information, the above steps 705 and 707 are performed according to the indication information.
  • the category information of the UE can be sent to other devices. For example, based on the implementation of the embodiment shown in FIG.
  • the AMF can send the UE category information to some or all of the communication devices in the UE, base station, and UDM, and the PCF can Store or not store the category information of the UE, described separately below:
  • Case 1 AMF sends the category information of the UE to UDM, and AMF stores the category information of the UE, so that AMF can store the category information of the UE in the context of the UE, and UDM can store the category of the UE in the context of the UE information.
  • the PCF also stores the category information of the UE in the context of the UE.
  • the AMF only sends the category information of the UE to the UDM.
  • the UDM may store the category information of the UE in the context of the UE, and the AMF does not store the category information of the UE.
  • the PCF does not store the category information of the UE.
  • the AMF sends the category information of the UE to the UDM, and the AMF does not store the category information of the UE, then the UDM may store the category information of the UE in the context of the UE.
  • the PCF also stores the category information of the UE in the context of the UE.
  • AMF sends the category information of the UE to the base station and the UE, and the AMF also stores the category information of the UE, so that the AMF can store the category information of the UE in the context of the UE, and the base station can store the category information of the UE in the context of the UE UE category information, the UE may store the UE category information.
  • the PCF also stores the category information of the UE.
  • the AMF and the PCF jointly determine the category information of the UE, some or all devices in the core network element, the UE, and the base station can obtain the category information of the UE.
  • the UE's category information can be stored locally and can be obtained locally when it is needed later, and for other devices that have not obtained the UE's category information, it can be used later Obtained from a device that stores information of this category.
  • the communication device when the communication device stores the category information of the UE, it may store the correspondence or mapping relationship between the identifier of the UE and the category information of the UE.
  • the specific implementation of the category information obtained by the SMF and UPF to the UE is described below. As shown in FIG. 8, it is a method for sending UE category information provided by this application. The method includes the following steps:
  • Step 801 the UE initiates a protocol data unit (protocol, data, unit, PDU) session establishment process, and the UE sends a PDU session establishment request to the AMF.
  • protocol data unit protocol, data, unit, PDU
  • the UE When initiating communication, the UE needs to first initiate the registration process in Figure 5-7 to establish NAS communication, and subsequently needs to initiate the PDU session establishment process shown in Figure 8 to request the network side to establish communication resources for it. Therefore, this process occurs after the process of FIGS. 5-7, and the core network elements (such as AMF in FIG. 5, PCF in FIG. 6, or AMF & PCF in FIG. 7) have determined the category information of the UE.
  • the core network elements such as AMF in FIG. 5, PCF in FIG. 6, or AMF & PCF in FIG. 7 have determined the category information of the UE.
  • Step 802 SMF obtains the category information of the UE.
  • SMF can obtain the category information of the UE in any of the following ways.
  • Method 1 SMF obtains UE category information from AMF.
  • AMF can send UE's category information to SMF by calling the service interface opened by SMF.
  • the services provided by SMF to AMF may include Create SM Context service, SMContextStatusNotify service and so on.
  • the AMF can obtain the category information of the UE through the method of any of the embodiments in FIG. 5 to FIG. 7.
  • the AMF may obtain the category information of the UE.
  • Method 2 SMF obtains UE category information from UDM.
  • SMF can obtain the category information of UE by inquiring UDM by calling the service interface opened by UDM.
  • the services provided by UDM to SMF may include Subscriber Data Management Service, UE Context Management Service, etc.
  • the UDM can obtain the category information of the UE by using the method in any of the embodiments in FIG. 5 to FIG. 7.
  • UDM may obtain the category information of the UE.
  • Method 3 SMF obtains the category information of the UE from the PCF.
  • the SMF can obtain the category information of the UE by inquiring the PCF by calling the service interface opened by the PCF.
  • the service provided by the PCF to the SMF may include the Npcf_SMPolicyControl service.
  • the PCF may obtain the category information of the UE through the method in any of the embodiments of FIG. 5 to FIG. 7.
  • the PCF may obtain the category information of the UE through the situation one or the situation two or the situation three or the situation four in the embodiment of FIG. 5.
  • the PCF may obtain the category information of the UE through scenario 1 or scenario 3 or scenario 4 of the embodiment of FIG. 6.
  • the PCF may obtain the category information of the UE through scenario 1 or scenario 3 or scenario 4 of the embodiment of FIG. 7.
  • step 803 SMF stores the category information of the UE in the corresponding UE context.
  • This step is optional.
  • step 804 the SMF sends the category information of the UE to the UPF.
  • the SMF may allocate a UPF to the PDU session requested by the UE to establish according to the prior art, and send the category information of the UE to the allocated UPF.
  • SMF can send UE category information to UPF through N4 Session Establishment (N4Session Establishment) message, or N4 Session Modification Request (N4Session Modification Request) message.
  • N4 Session Establishment N4 Session Establishment
  • N4Session Modification Request N4 Session Modification Request
  • the SMF may also send the identity of the UE to the UPF, and the identity may be the source IP of the UE.
  • step 805 the UPF stores the category information of the UE in the corresponding UE context.
  • the UPF may also bind the category information of the UE with the identifier of the UE.
  • the UPF may map the identifier of the UE with the category information of the UE to form a mapping table or corresponding relationship, for example, in the form of group1: IP1, IP2, group2: IP3, group3: IP4, and IP5.
  • the SMF obtains the category information of the UE, and sends the category information of the UE to the UPF serving the PDU session of the UE.
  • each network element in the network such as UE, base station, AMF, SMF, PCF, UPF, Some or all of the network elements in UDM can obtain the category information of the UE and store it, so that the category information of the UE can be used later, such as performing access control on the UE according to the category information of the UE, which will be described in detail later.
  • the core network element may re-determine the first category in the category information of the UE according to the updated location information of the UE, or according to the UE The updated dynamic information re-determines the dynamic category information in the category information of the UE.
  • the first category in the category information of the UE needs to be re-determined.
  • the following uses the method for determining the category information of the UE based on FIG. 5 as an example.
  • the first category in the category information of the UE may be newly determined according to the following method.
  • FIG. 9 it is a method for updating UE category information provided by the present application.
  • the method includes the following steps:
  • step 901 the UE sends a registration request message to the base station.
  • the UE when the location of the UE is updated, the UE is triggered to send a registration request message to the AMF.
  • the registration request message is used to update the location area.
  • the registration request message includes a new TAI.
  • the registration request message may be carried in the NAS message.
  • Step 902 the base station sends a registration request message to the AMF.
  • Step 903 the AMF updates the first category in the category information of the UE.
  • the AMF first re-determines the first category in the category information of the UE according to the new location information of the UE. If the re-determined first category is the same as the original first category of the UE, there is no need to perform this step 903 and subsequent steps related to updating the first category of the UE. If the re-determined first category is different from the original first category of the UE, it is necessary to perform this step 903 and subsequent steps related to updating the first category of the UE.
  • step 904 the AMF sends the updated first category of the UE to each communication device.
  • the AMF can send the updated first category of the UE to the UDM by calling the service interface opened by UDM, such as the Nudm_SDM_Get service.
  • the AMF may send an updated first category of UE to the PCF through a policy association establishment process (Policy, Association, Procedure).
  • Policy Policy, Association, Procedure
  • the AMF may send the updated first category of the UE to the base station and the UE through a registration acceptance message (Registration Accept) message.
  • Registration Accept Registration Accept
  • this step 904 may also be replaced by: AMF sends the updated category information to each communication device, that is, the updated first category and the original static category information need to be sent to each communication device.
  • each network element updates the first category in the category information of the UE according to the updated first category.
  • step 906 the PCF triggers the update of the category information on the SMF, and the SMF triggers the update of the category information on the UPF.
  • the PCF can send the category information of the UE to the SMF by calling the service interface opened by the SMF.
  • the services provided by SMF may include the Nsmf_EventExposure service. Therefore, the SMF may update the first category in the category information of the UE according to the updated first category. And, SMF can trigger the update of category information on UPF.
  • each communication device can update the category information of the UE.
  • each communication device can obtain the category information of the UE.
  • the following describes a method for the network side to control the attack behavior based on the category information of the UE when the UE attacks. That is, the network side can control access to the UE at the granularity of the category of the UE according to the category information of the UE.
  • the method includes:
  • Step 1001 SEDF sends a data collection service request message to the network device.
  • the data collection service request message sent by SEDF may be a subscription data collection event.
  • the network device here may be AMF, SMF, PCF, UPF, AF, etc.
  • SEDF can call a data collection subscription service, that is, SEDF sends a data collection service request message to AMF, UDM, and PCF respectively.
  • UDM, PCF report relevant data information.
  • communication between the SEDF and a network element with a service interface such as SMF and NEF can be transferred.
  • the data collection service request message may include the data collection unit and the collection scope.
  • the data collection unit is used to indicate the format of the reported data, and the collection range is used to indicate the granularity at which the data is collected.
  • the collection range is collection by category information.
  • the data collection service request message may also include a reporting condition (or called a trigger condition).
  • the reporting condition is used to indicate a condition that triggers the reporting of traffic data.
  • the reporting condition may be a threshold parameter or a time interval parameter, where the threshold parameter is used to indicate Data indicators that meet the reporting conditions. At this time, if some data indicators exceed the specified threshold, the network device will need to report the data information indicated by the data collection unit.
  • the time interval is used to indicate the interval time for periodic data reporting. At this time, the network device will report the data information indicated by the data collection unit at regular intervals.
  • Step 1002 the network device collects traffic data and sends a data collection service response message to SEDF.
  • the data collection service response message includes category information and traffic data corresponding to the category information, and the traffic data of the UE indicated by the category information meets the reporting conditions.
  • the data collection unit instructs to collect information such as the number of flows, average packet size, packet size variance, and average packet interval per unit time of the target IP user plane flow, and the collection range indicates to collect all types of information.
  • the reporting condition is the time interval, and its value is T. Then UPF will perform periodic statistics on the user plane information of all categories of information.
  • the UPF has 100 types of information (note that it can be in the form of type, it can also be in the form of ⁇ type1, type2 ⁇ , or in the form of ⁇ type1, type2, type3, type 4 ⁇ ), then UPF can 100 types of information are counted once every T time periods to obtain information such as the number of streams, average packet size, packet size variance, and average packet interval per unit time of different target IPs corresponding to 100 types, and send data collection services to SEDF A response message, the data collection service response message includes category information and traffic data corresponding to the category information.
  • the above network device can obtain the category information of the UE through the method of any of the embodiments shown in FIG. 5 to FIG. 7, and then can report traffic data according to the category information.
  • a network device that receives a data collection service request message from SEDF if the network device has obtained the category information of the UE, it can directly report the traffic data according to the category information.
  • the network device that receives the data collection service request message from the SEDF if the network device does not have the category information of the UE, the network device may obtain the category information of the UE from other network devices with the category information of the UE.
  • the data collection unit instructs to collect information such as the number of flows of the control plane flow per unit time, the average packet interval, and the collection range indicates that all types of information are collected.
  • the reporting condition is triggered by a threshold, such as when The event is triggered when the number of streams exceeds the threshold A.
  • AMF will make periodic statistics on the control plane information of all categories of information. For example, if AMF has a total of 100 categories of information, AMF performs real-time statistics on these 100 categories of information.
  • AMF sends a data collection service response message to SEDF.
  • the collection service response message includes category information and traffic data corresponding to the category information.
  • the specific implementation method for the network device to report the category information and the traffic data corresponding to the category information can be, for example, for network devices such as AMF and UDM that have a service interface with SEDF, you can directly report the category information by calling the prompt function of the data collection service and Corresponding flow data to SEDF. For network elements that do not have a service interface with SEDF, such as UPF and AF, you can relay the communication between SEDF and network elements with service interface such as SMF and NEF, that is, report the category information and the traffic data corresponding to the category information.
  • the above network device can obtain the category information of the UE through the method of any of the embodiments shown in FIG. 5 to FIG. 7, and then can report traffic data according to the category information.
  • a network device that receives a data collection service request message from SEDF if the device has obtained the category information of the UE, such as scenario 1 or scenario 3 in FIG. 5 to FIG. 7, the traffic data can be directly reported based on the category information.
  • the network device may access the network with other category information of the UE The category information of the UE is obtained from the device.
  • Step 1003. The SEDF determines the abnormal category information according to the traffic data of the UE.
  • SEDF detects the flow data corresponding to the category information according to the security detection algorithm to determine the abnormal category information.
  • these parameters can be used as input features to detect DDoS attacks. After these parameters are input into SEDF, it can be obtained whether the combination of data information is abnormal through a security detection algorithm (such as a machine learning algorithm). Therefore, it can be concluded that the data information corresponds to Is there any abnormality in the category information. That is, it is recognized which type of information indicates the terminal caused the attack.
  • a security detection algorithm such as a machine learning algorithm
  • AMF or UDM reports the above parameters to SEDF.
  • SEDF the security detection algorithm
  • the security detection algorithm can determine whether there is an abnormality in the combination of the data information, and therefore, whether there is an abnormality in the category information corresponding to the data information. That is, it is recognized what kind of attack is caused by the terminal indicated by the category information.
  • SEDF implements the process of analyzing security threats by category information granularity based on category information and data information.
  • the analysis speed is faster than that by UE level analysis, and there is less signaling interaction.
  • the SEDF can send the abnormal category information, so that the network element that receives the abnormal category information can control the access of the UE according to the abnormal category information.
  • the network element that receives the abnormal category information can control the access of the UE according to the abnormal category information.
  • Different implementations for controlling UE access are given below.
  • the method is to control a UE with abnormal behavior through a control plane.
  • the method includes the following steps:
  • SEDF detects an abnormal UE (ie, a UE with abnormal behavior), and outputs an identifier of the abnormal UE.
  • the identifier of the abnormal UE may be abnormal category information, or may be an identity list of the abnormal UE, for example, a list of permanent subscription identifier (Subscription, Permanent Identifier, SUPI), etc.
  • SEDF can notify the AMF or PCF of abnormal UE identification.
  • SEDF sends abnormal category information to AMF.
  • SEDF can detect one or more abnormal category information in the manner of the embodiment shown in FIG. 10.
  • SEDF can send all the detected abnormal category information to AMF, and AMF implements access control for the terminal that matches the abnormal category information according to the abnormal category information.
  • SEDF may also send only part of the abnormal category information in all the obtained category information to the AMF. For example, if 100 abnormal category information is obtained, the preset ratio may be 30%, for example.
  • the top 30% of the abnormal category information of the UEs included in the 100 abnormal category information is sent to the AMF, or, according to a preset fixed number such as 50, the top UEs included in the 100 abnormal category information may be Fifty abnormal category information is sent to AMF, and AMF implements access control to the terminal matching the abnormal category information according to the abnormal category information.
  • the SEDF sends an abnormal UE identity list to the PCF, such as SUPI list.
  • the PCF maps one or more abnormal category information according to the SUPI list, and then the PCF sends the abnormal category information to the AMF.
  • the SEDF sends an abnormal UE identity list to the AMF, such as a SUPI list, and the AMF maps one or more abnormal category information according to the SUPI list.
  • SEDF may be based on the method of the prior art and obtain the identity list of the abnormal UE based on the UE granularity (per UE).
  • step 1102 the AMF or PCF maps the identity list to category information.
  • This step is optional.
  • the SEDF sends the UE's identity list to the PCF in the above step 1101, this step 1102 is executed.
  • the AMF or PCF maps the identity list to category information, which may specifically determine the category information to which each terminal in the identity list belongs; according to the category information to which each terminal in the identity list belongs, determine abnormal category information.
  • determining the abnormal type information may include the following implementation manners:
  • the AMF or PCF may determine the abnormal category information according to the local strategy, and the local strategy may include an absolute strategy and a relative strategy.
  • the absolute strategy can determine whether to output the corresponding category information as abnormal category information according to the preset absolute threshold. For example, 100 SUPIs are obtained, of which 60 SUPIs belong to category A, 30 SUPIs belong to category B, and 10 SUPIs belong to In category C, the administrator sets the absolute threshold to 30, because the number of SUPIs in category A and category B is greater than or equal to 30, so category A and category B are finally determined to be abnormal category information. Since category C is less than the absolute threshold, it is determined not to The output category C is abnormal category information.
  • category A, category B, and category C are candidate abnormal category information
  • category A and category B are output abnormal category information.
  • the relative strategy can determine whether to output the corresponding category information as abnormal category information according to the relative proportion of the output information. For example, 100 SUPIs are obtained, of which 60 SUPIs belong to category A, 30 SUPIs belong to category B, and 10 SUPIs belong to In category C, the administrator sets the relative proportion to 30%. Since the number of SUPIs in category A and category B accounts for more than or equal to 30% of the total number, category A and category B are finally determined to be abnormal category information, because category C accounts for the overall The number is less than 30%, so it is determined that category C is not output as abnormal category information.
  • categories A, B, and C are candidate abnormal category information
  • category A and category B are output abnormal category information.
  • the AMF or PCF may determine candidate abnormal category information corresponding to the identity list according to the identity list and the correspondence between the category information of the terminal and the terminal's identity, wherein the identity Terminals with the same category information in the list correspond to the same candidate abnormal category information; for each candidate abnormal category information, if the number of terminals attributable to the candidate abnormal category information in the identity list corresponds to the candidate abnormal category information If the ratio of the number of all terminals is greater than a preset ratio threshold, it is determined that the candidate abnormal category information is abnormal category information.
  • the identity list includes 100 SUPIs, which are mapped to three candidate abnormal category information, namely category A, category B and category C.
  • the number of abnormal UEs corresponding to category A is 30, and the number of abnormal UEs corresponding to category B is 30.
  • step 1103 the AMF sends category information to the base station, informing the base station to restrict terminal access according to the category information.
  • AMF can decide to restrict terminal access by category information according to local policies, and AMF can also restrict terminal access by category information according to notifications from other network elements (such as PCF, SEDF, etc.).
  • This category information is used to indicate UEs that have abnormal behavior.
  • the AMF may also send a restriction instruction to the base station, where the restriction instruction is used to notify the base station to restrict terminal access according to category information.
  • the AMF also sends a timer to the base station, where the timer is used to indicate the limit expiration time.
  • Step 1104 the base station constructs a broadcast data packet according to the category information.
  • the broadcast data packet includes the following parameters:
  • the restriction factor may also be referred to as a restriction indication, and is used to restrict access of UEs matching the category information.
  • the limiting factor may be similar to ac-BarringFactor in the embodiment shown in FIG. 3.
  • the limited time may be similar to ac-BarringTime in the embodiment shown in FIG. 3.
  • the category information is obtained by the base station from AMF.
  • the category information may include one or more categories of information. For example, if the abnormal category information determined in step 1102 includes a plurality, the broadcast data packet sent by the base station to the UE may include the multiple abnormal category information.
  • step 1105 the base station sends the broadcast data packet.
  • a timer can also be stored on the base station.
  • the timer may be generated by the base station itself according to a strategy, or may be provided by SEDF or AMF.
  • the base station After receiving the category information, the base station starts a timer. If the timer does not expire, the base station broadcasts and broadcasts the broadcast data packet. When the timer expires, the base station stops sending the broadcast data packet.
  • Step 1106 All UEs under the base station receive broadcast data packets. If the category information of the UE matches the category information in the broadcast data packet, the UE restricts the UE's access.
  • the category information stored by a UE is (C11, C22)
  • the category information included in the broadcast data sent by the base station is the category (C11, C22; C12, C21)
  • the category information included in the broadcast data packet includes the UE stored Category information, so the category information of the UE matches the category information in the broadcast data packet, then the UE restricts the access of the UE.
  • the category information included in the broadcast data sent by the base station is the category (C11, C22; C12, C21), because the category information included in the broadcast data packet does not include the UE The stored category information, so the category information of the UE does not match the category information in the broadcast data packet, then the UE does not restrict the access of the UE.
  • ac-BarringFactor is a value between 0 and 1. Before each attempt to access, the UE generates a random number between 0 and 1. If the generated random number is less than ac-BarringFactor, you can directly connect Enter, otherwise do not connect, and wait for a while to try again.
  • ac-BarringTime is used to indicate the time to block access. When the UE decides not to access, it waits for ac-BarringTime.
  • step 1107 the connection between the UE and the base station is released.
  • This step is optional.
  • the UE may actively release the connection with the base station when it determines to restrict the access of the UE.
  • the base station may determine that the UE is a UE requiring restricted access according to the category information of the UE, and then the base station releases the connection with the UE of the corresponding category information. For example, the base station may send a release message to the corresponding UE.
  • the release message may include a cause value.
  • the cause value may indicate that the UE is released for security reasons.
  • the UE may wait for a period of time before attempting to initiate a connection. At this time, the base station needs to store the category information of the UE in the context information of the UE in advance.
  • the category information may be obtained by the base station in a radio resource control (RRC) message when the UE is connected to the base station, or may be When the base station interacts with the network side, it is provided by the network side to the base station through the S1 connection or the N2 connection (as shown in the embodiments shown in FIGS. 5-7 above), or when X2 or Xn interaction is performed between Provided by the base station.
  • RRC radio resource control
  • the PCF or AMF can obtain the category information of the UE through the method of any of the embodiments shown in FIGS. 5-7, so that the PCF or AMF can list the received identity list (that is, one or more UE ’s (Identification) is mapped to the category information of the UE.
  • the PCF or AMF has obtained the category information of the UE, for example, cases 1 or 3 in FIGS. 5 to 7, that is, the context of multiple UEs is stored on the PCF or AMF, and the context of one UE is stored in the context of one UE.
  • the category information and the identifier of the UE so that after receiving the identity list, the PCF or AMF can obtain the category information corresponding to the identity list.
  • the PCF or AMF can send the identity list to other network devices with the category information of the UE, and then The category information of the UE is received in the network device.
  • the UE or the base station can obtain the category information of the UE through the method of any of the embodiments shown in FIG. 5 to FIG. 7, so that the UE or the base station can restrict the access of the terminal according to the received category information.
  • the UE or the base station can already obtain the category information of the UE according to scenario 4 of FIGS. 5-7.
  • SEDF notifies the process of controlling UE access according to category information granularity according to category information.
  • it can realize the function of controlling multiple UE access at once , Reducing control signaling.
  • a timer can be added to provide a way to recover from false alarms and prevent the UE from being blocked from accessing the network for a long time.
  • the base station can release the connection with the UE, thereby achieving the function of controlling the connected UE.
  • the method is to control the UE with abnormal behavior through the user plane.
  • the method includes the following steps:
  • SEDF detects an abnormal UE (ie, a UE with abnormal behavior), and outputs an identifier of the abnormal UE.
  • the identifier of the UE may be abnormal category information, or may be an identity list of the abnormal UE, such as SUPI list.
  • SEDF can notify the AMF or PCF of abnormal UE identification.
  • SEDF sends abnormal category information to the PCF.
  • PCF abnormal category information
  • the SEDF sends an abnormal UE identity list to the PCF, such as a SUPI list, and the PCF maps one or more abnormal category information according to the SUPI list.
  • SEDF may be based on the method of the prior art and obtain the identity list of the abnormal UE based on the UE granularity (per UE). For a specific implementation manner, reference may be made to the relevant description of step 1101 in the embodiment shown in FIG. 11.
  • SEDF also sends the victim ID to the PCF to identify the attacked target, such as IP address and port number.
  • step 1202 the PCF maps the identity list to category information.
  • This step is optional.
  • the SEDF sends the identity list of the UE to the PCF in the above step 1201, this step 1202 is executed.
  • Step 1203 the PCF generates stream matching information and a stream processing method, which are used to control the UE that has abnormal behavior.
  • the PCF can decide to generate flow matching information and flow processing methods according to the category information according to local policies, and the PCF can also generate flow matching information and flow processing methods according to notifications from other network elements (such as SEDF).
  • the flow matching information is used to match user plane traffic, and may contain flow quintuples, such as source IP, source port, destination IP, destination port, and protocol type.
  • the stream processing method is used to control the user plane traffic of the matching stream matching information sent by the UE matching the category information.
  • the category information is obtained from SEDF or PCF mapping.
  • the flow matching information can be generated based on the victim ID.
  • the victim ID is an IP address and a port number
  • the source IP is a wildcard
  • the source port is a wildcard
  • the target IP is the victim's IP address
  • the target port is Victim's port number
  • protocol type is wildcard flow matching information.
  • the PCF may generate a control strategy, which includes the above-mentioned flow matching information and flow processing method.
  • the control policy may be a special policy and a charging control (Policy and Charging Control, PCC) rule.
  • PCC Policy and Charging Control
  • the PCF generates a PCC rule with a lower quality of service (QoS) and a flow matching template, which is used to instruct the UPF to match the flow matching template and implement the corresponding QoS if the UE whose current flow belongs to category information is sent control.
  • the PCF generates a PCC rule including a gate and a flow matching template, which is used to instruct the UPF to match the flow matching template and discard the related traffic if the current flow belongs to the UE with category information.
  • the flow matching template can be used to identify the traffic that accesses the victim ID. In this way, the overall flow corresponding to the entire category information can be controlled in the UPF.
  • the control strategy may also include the aforementioned category information.
  • step 1204 the PCF sends category information, stream matching information, and stream processing method to the SMF.
  • the PCF sends category information and control strategies to the SMF.
  • the control strategies include flow matching information and flow processing methods.
  • the PCF sends a control strategy to the SMF.
  • the control strategy includes category information, stream matching information, and stream processing methods.
  • the PCF also sends a timer to the SMF.
  • step 1205 the SMF sends the category information, stream matching information, and stream processing method to the UPF.
  • SMF sends category information and control strategy to UPF, the control strategy includes flow matching information and flow processing method.
  • the SMF sends a control strategy to the UPF.
  • the control strategy includes category information, flow matching information, and flow processing methods.
  • SMF also sends a timer to UPF.
  • the UPF controls user plane traffic according to the category information, flow matching information, and flow processing method.
  • the UPF monitors user plane traffic, and when the traffic matches the flow matching information and the traffic belongs to the UE corresponding to the category information, the UPF executes the control instruction according to the flow processing method. If the flow processing method includes a discard operation, the UPF discards user plane traffic. If the stream processing method includes a service quality modification operation, UPF modifies the service quality of user plane traffic.
  • the UPF uses a locally stored mapping table that stores the correspondence between the source IP and category information.
  • One source IP is used to identify a UE.
  • UPF looks at the source IP, and UPF obtains the category information of the source IP according to the mapping table. If the category information corresponding to the source IP matches the received category information, UPF performs the corresponding Stream processing methods, such as discarding the user plane traffic.
  • a timer can be saved on the UPF.
  • the timer may be generated by the UPF itself according to a strategy, or may be provided by SEDF or PCF. This timer is used to indicate the time to perform user plane flow control.
  • the PCF can obtain the category information of the UE through the method of any of the embodiments shown in FIGS. 5-7, so that the PCF can map the received identity list (that is, the identities of one or more UEs) to UE category information.
  • the PCF has obtained the category information of the UE, for example, scenario 1 or scenario 3 in FIGS. 5-7, the context of multiple UEs is stored on the PCF, and the category information of the UE and the UE are stored in the context of a UE The identity of the UE, so that after receiving the identity list, the PCF can obtain category information corresponding to the identity list.
  • the PCF may send an identity list to other network devices with the category information of the UE, and then receive it from other network devices with the category information of the UE UE category information.
  • the SMF or UPF can obtain the category information of the UE through the method shown in FIG. 8, so that the SMF or UPF can restrict the access of the terminal according to the received category information.
  • the SEDF notifies the PCF to implement the process of restricting UE access according to the granularity of the category information according to the category information.
  • the traffic of multiple UEs can be controlled at a time, reducing In addition to control signaling, it also reduces the number of policies on the UPF, and can also accurately control the type of anomaly.
  • a timer can be added to provide a way to recover from false alarms and prevent the UE from being blocked from accessing the network for a long time.
  • each network element described above includes a hardware structure and / or a software module corresponding to performing each function.
  • the present invention can be implemented in the form of hardware or a combination of hardware and computer software in combination with the units and algorithm steps of the examples described in the embodiments disclosed herein. Whether a function is executed by hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.
  • FIG. 13 shows a possible exemplary block diagram of the device involved in the embodiment of the present invention.
  • the device 1300 may exist in the form of software, hardware, or It exists in the form of software and hardware, and the embodiments of the present application are not limited.
  • the device 1300 may include a processing unit 1302 and a communication unit 1303.
  • the communication unit 1303 may include a receiving unit and / or a sending unit.
  • the processing unit 1302 is used to control and manage the device 1300.
  • the communication unit 1303 is used to support communication between the device 1300 and other network entities.
  • the device 1300 may further include a storage unit 1301 for storing program codes and data of the device 1300.
  • the processing unit 1302 may be a processor or a controller, such as a general-purpose central processing unit (CPU), general-purpose processor, digital signal processing (DSP), application-specific integrated circuit (application-specific integrated) circuits, ASIC), field programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It can implement or execute various exemplary logical blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present invention.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, DSP and microprocessor combinations, and so on.
  • the communication unit 1303 may be a communication interface, a transceiver, or a transceiver circuit, etc., where the communication interface is a general term, and in a specific implementation, the communication interface may include multiple interfaces.
  • the storage unit 1301 may be a memory.
  • the apparatus 1300 may be the access network device in any of the foregoing embodiments, or may be a chip in the access network device.
  • the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, a transceiver, and the transceiver includes a radio frequency circuit, and optionally, the storage unit may be, for example, a memory.
  • the processing unit 1302 may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin, or a circuit.
  • the processing unit 1302 can execute computer-executed instructions stored in a storage unit.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc.
  • the storage unit may also be located in the access network device.
  • the storage unit outside the chip such as read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM), etc.
  • the communication unit 1303 includes a sending unit and a receiving unit: the receiving unit is used to receive abnormal category information from the core network element; the sending unit is used to transmit broadcast data packets, and the broadcast data packet includes the abnormal category information and broadcast data The packet is used to restrict the access of terminals matching the abnormal category information.
  • the receiving unit is further configured to receive a restriction indication from the core network element before the sending unit sends the broadcast data packet, and the restriction indication is used to indicate that the restriction indication is restricted to all The access of the terminal matching the abnormal category information.
  • the processing unit is further configured to start a timer after the receiving unit receives the abnormal category information.
  • the sending unit is specifically used to send a broadcast data packet if the timer has not timed out.
  • the device 1300 may be the terminal in any of the foregoing embodiments, or may be a chip in the terminal.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, a transceiver
  • the transceiver includes a radio frequency circuit
  • the storage unit may be, for example, a memory.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, an input / output interface, a pin, or a circuit.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit located outside the chip in the terminal, such as a ROM or other device that can store static information and instructions Types of static storage devices, RAM, etc.
  • the receiving unit is configured to receive broadcast information from an access network device, the broadcast information includes abnormal category information, and the broadcast data packet is used to limit Access to terminals matching category information.
  • the processing unit is configured to restrict access of the terminal if the category information of the terminal matches the received abnormal category information, and the terminal category information is received by the terminal from the core network element.
  • the receiving unit is further configured to receive the category information of the terminal from the core network element, the category information of the terminal is generated based on the information of the terminal, and the terminal
  • the information includes some or all of the following information:
  • Function information of the terminal where the function information is used to indicate capability information of the terminal;
  • the user information is used to indicate owner information of the terminal;
  • Device information of the terminal where the device information is used to indicate manufacturing information of the terminal;
  • Location information of the terminal where the location information is used to indicate the location of the terminal.
  • the processing unit is also used to release the connection with the access network device.
  • the device 1300 may be the core network element in any of the foregoing embodiments, or may be a chip in the core network element, where the core network element may be a mobility management element or a strategy Control the network element.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, a transceiver
  • the transceiver includes a radio frequency circuit
  • the storage unit may be, for example, a memory.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, an input / output interface, a pin, or a circuit.
  • the storage unit is a storage unit within the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit within the core network element located outside the chip, such as a ROM or static information and Instruction of other types of static storage devices, RAM, etc.
  • the processing unit is configured to acquire information of the N terminals for N terminals accessing the network, where N is a positive integer; wherein, the information of one terminal includes Some or all of the following information:
  • the function information of the terminal which is used to indicate the capability information of the terminal;
  • the user information is used to indicate the owner information of the terminal;
  • Device information of the terminal which is used to indicate the manufacturing information of the terminal
  • the location information is used to indicate the location of the terminal.
  • the processing unit is also used to determine the category information of the terminal according to the terminal information for each of the N terminals.
  • the function information of the terminal includes network capabilities, mobile station network capabilities, mobile station category mask 2, mobile station category mask 3, supported encoding, added update category, voice domain preference ⁇ Terminal usage settings, terminal device performance, and some or all parameters in the network features supported by the mobile station.
  • the user information of the terminal includes some or all parameters in the group ID, administrator ID, and company ID
  • the device information includes some or all parameters in the category assignment number of the device identification code of the terminal and the software version number.
  • the processing unit is configured to determine the category information of the terminal based on the information of the terminal, which specifically includes: determining the first category of the category information of the terminal according to the location information of the terminal; and according to the function information of the terminal , Part or all of the user information or device information, to determine the second category in the category information of the terminal.
  • the processing unit is further configured to update the first category in the category information of the terminal according to the updated location information if the location information of the terminal is updated.
  • the sending unit is used to send the category information of the terminal to the communication device.
  • the communication device includes some or all of the following devices: terminal, access network device, mobility management network element, and session management Network element, policy control network element, user plane network element.
  • the receiving unit is configured to receive indication information, and the indication information is used to indicate the determination of the category information of the terminal.
  • the core network element is a policy control element
  • the policy control element includes a storage unit
  • the storage unit is configured to target each of the N terminals, The correspondence between the category information of the terminal and the identifier of the terminal is stored.
  • the device 1300 may be the policy control network element in any of the foregoing embodiments, or may be a chip in the policy control network element.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, a transceiver.
  • the transceiver includes a radio frequency circuit
  • the storage unit may be, for example, a memory.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, an input / output interface, a pin, or a circuit.
  • the storage unit is a storage unit within the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit within the policy control network element located outside the chip, such as a ROM or static information and Instruction of other types of static storage devices, RAM, etc.
  • the communication unit 1303 includes a sending unit and a receiving unit: the receiving unit is used to receive an identity list of abnormal terminals from the security detection network element, and the identity list is used to indicate one or more abnormal terminals; the processing unit, It is used to determine the abnormal category information according to the local policy and the correspondence between the identity list and the category information of the terminal and the terminal's identification; the sending unit is used to send the abnormal category information.
  • the processing unit is specifically used for:
  • the category information of the terminal and the terminal identification determine the candidate abnormal category information corresponding to the identity list, wherein the terminals in the identity list with the same category information correspond to the same candidate anomaly Category information
  • the abnormal category information is abnormal category information
  • the candidate abnormal category information For each candidate abnormal category information, if the number of terminals attributed to the candidate abnormal category information in the identity list is greater than a preset number threshold, it is determined that the candidate abnormal category information is abnormal category information.
  • the sending unit is specifically used to send the abnormal category information to the access network device.
  • the sending unit is specifically used to send the abnormal category information to the user plane network element; the sending unit is also used to send the flow matching information and the flow processing method to the user plane network element, and the flow matching information is used to Matching user plane flow, the flow processing method is used to control the user plane flow of matching flow matching information sent by a terminal matching abnormal category information.
  • the device 1300 may be the security detection network element in any of the foregoing embodiments, or may be a chip in the security detection network element.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, a transceiver
  • the transceiver includes a radio frequency circuit
  • the storage unit may be, for example, a memory.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, an input / output interface, a pin, or a circuit.
  • the storage unit is a storage unit within the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit within the security detection network element located outside the chip, such as a ROM or static information and Instruction of other types of static storage devices, RAM, etc.
  • the processing unit is used to determine that there is abnormal category information based on the traffic data of the terminal; the sending unit is used to send the abnormal category information.
  • the sending unit is further configured to send a data collection service request message to the network device before the processing unit determines the category information of the terminal that has abnormal behavior according to the terminal's traffic data.
  • the data collection service request message includes The data collection unit and the data collection range, the data collection unit is used to indicate the format of the reported data, and the data collection range is used to indicate the collection according to the category information of the terminal.
  • the receiving unit is configured to receive a data collection service response message sent by a network device.
  • the data collection service response message includes category information and traffic data corresponding to the category information, and the traffic data of the terminal indicated by the category information meets the reporting conditions.
  • the data collection service request message further includes a reporting condition, and the reporting condition is used to indicate a condition that triggers reporting of traffic data.
  • the network device includes some or all of the following devices: a mobility management network element, a session management network element, a policy control network element, and a user plane network element.
  • the processing unit is configured to determine the abnormal category information based on the traffic data of the terminal, specifically including: detecting the traffic data corresponding to the category information according to the security detection algorithm to determine the abnormal category information.
  • the device 1300 may be a user plane network element in any of the foregoing embodiments, or may be a chip in the user plane network element.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, a transceiver, which includes a radio frequency circuit
  • the storage unit may be, for example, a memory.
  • the processing unit 1302 may be, for example, a processor
  • the communication unit may be, for example, an input / output interface, a pin, or a circuit.
  • the storage unit is a storage unit within the chip, such as a register, a cache, etc.
  • the storage unit may also be a storage unit located outside the chip within the user plane network element, such as a ROM or static information and Instruction of other types of static storage devices, RAM, etc.
  • the communication unit 1303 includes a sending unit and a receiving unit: the receiving unit is used to receive abnormal category information, flow matching information and flow processing method; the processing unit is used to send if the user plane traffic matches the flow matching information and send If the terminal of the user plane traffic matches the abnormal category information, the user plane traffic is controlled according to the flow processing method.
  • the processing unit is specifically configured to discard the user plane traffic if the stream processing method includes a discard operation; or, modify the service quality of the user plane traffic if the stream processing method includes a service quality modification operation.
  • the type shown in FIG. 13 is a terminal, or an access network device, or a core network element, or a policy control network element, or a security detection network element, or a user plane network element.
  • the apparatus may be the foregoing terminal, access network equipment, mobility management network element, policy control network element, user plane network element, or security detection network element.
  • the device 1400 includes: a processor 1402, a communication interface 1403, and a memory 1401.
  • the device 1400 may further include a bus 1404.
  • the communication interface 1403, the processor 1402, and the memory 1401 may be connected to each other through a communication line 1404;
  • the communication line 1404 may be a peripheral component interconnection standard (PCI) bus or an extended industry standard architecture (extended industry standard architecture) , Referred to as EISA) bus.
  • PCI peripheral component interconnection standard
  • EISA extended industry standard architecture
  • the communication line 1404 can be divided into an address bus, a data bus, and a control bus. For ease of representation, only a thick line is used in FIG. 14, but it does not mean that there is only one bus or one type of bus.
  • the processor 1402 may be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for controlling the execution of the program of the solution of the present application.
  • Communication interface 1403 using any device such as a transceiver, to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), Wired access network, etc.
  • RAN radio access network
  • WLAN wireless local area network
  • Wired access network etc.
  • the memory 1401 may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM), or other types of information and instructions that can be stored
  • the dynamic storage device can also be an electrically erasable programmable read-only memory (electrically programmable server read-only memory (EEPROM), compact disc-read memory (CD-ROM) or other optical disk storage, Disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can Any other media accessed by the computer, but not limited to this.
  • the memory may exist independently, and is connected to the processor through the communication line 1404. The memory can also be integrated with the processor.
  • the memory 1401 is used to store computer execution instructions for executing the solution of the present application, and the processor 1402 controls execution.
  • the processor 1402 is used to execute computer execution instructions stored in the memory 1401, so as to implement the method for determining category information and the method for controlling terminal access provided by the above-described embodiments of the present application.
  • the computer execution instructions in the embodiments of the present application may also be called application program codes, which are not specifically limited in the embodiments of the present application.
  • At least one (a, b) of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be a single or can be Multiple.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a dedicated computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be from a website site, computer, server or data center Transmit to another website, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device including one or more available media integrated servers, data centers, and the like.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), or the like.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a DVD
  • a semiconductor medium for example, a solid state disk (SSD)
  • the various illustrative logic units and circuits described in the embodiments of the present application may be implemented by a general-purpose processor, a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices. Discrete gate or transistor logic, discrete hardware components, or any combination of the above are designed to implement or operate the described functions.
  • the general-purpose processor may be a microprocessor, and optionally, the general-purpose processor may also be any conventional processor, controller, microcontroller, or state machine.
  • the processor may also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration achieve.
  • the steps of the method or algorithm described in the embodiments of the present application may be directly embedded in hardware, a software unit executed by a processor, or a combination of both.
  • the software unit may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium in the art.
  • the storage medium may be connected to the processor, so that the processor can read information from the storage medium and can write information to the storage medium.
  • the storage medium may also be integrated into the processor.
  • the processor and the storage medium may be provided in the ASIC, and the ASIC may be provided in the terminal.
  • the processor and the storage medium may also be provided in different components in the terminal.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operating steps are performed on the computer or other programmable device to produce computer-implemented processing, which is executed on the computer or other programmable device
  • the instructions provide steps for implementing the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供类别信息的确定方法及装置。该方法包括：核心网网元获取终端的信息；核心网网元根据终端的信息，确定终端的类别信息。基于该方案，由核心网网元为终端分配类别，并且是基于终端的信息为终端分配类别，因而分类方式较为灵活。相较于背景技术中的按照业务紧急度进行分类且分类结果预先写入SIM卡的分类方式，本申请的分类方法更为灵活。

Description

类别信息的确定方法及装置
相关申请的交叉引用
本申请要求在2018年11月02日提交中国专利局、申请号为201811302764.0、申请名称为“类别信息的确定方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及移动通信技术领域，尤其涉及类别信息的确定方法及装置。
背景技术
在一些业务场景中，有些终端通常实现简单，安全防护差，容易被攻击者攻击，成为攻击者控制的设备。一种攻击的示例是，攻击者可以利用病毒软件快速控制大量的终端，形成自己控制的僵尸网络。当规模达到一定数值，攻击者可以控制这些终端对某个服务器同时发起大量连接，使服务器不堪重负而宕机，造成分布式拒绝服务(Distributed Denial of Service,DDoS)攻击。
目前，一种控制终端的攻击的方法是，基站按照终端的业务紧急度的粒度进行终端的接入控制，即终端的用户识别模块(Subscriber Identity Module，SIM)卡内预先写入接入类别(access class，AC)，不同的AC所表示的业务紧急度不同。基站因遭受攻击而发生过载时，发送广播数据包，用于限制终端的接入。终端在接收到广播数据包后，根据SIM卡中的AC，判断是否需要限制自身接入到基站，从而实现控制终端的接入。
上述方法存在的缺陷是：1)终端的AC是预先写入SIM卡中，因而灵活度不够；2)该AC仅能反映终端的业务紧急度，因而对终端的分类方法不够灵活。
发明内容
本申请提供类别信息的确定方法、控制终端接入的方法及装置，用以实现灵活地对终端进行分类，以及基于该分类实现对终端的控制接入。
第一方面，本申请提供一种类别信息的确定方法，该方法包括：针对接入网络的N个终端，核心网网元获取所述N个终端的信息；针对所述N个终端中的每个终端，核心网网元根据终端的信息，确定终端的类别信息。其中，终端的信息包括下列信息中的部分或全部信息：
终端的功能信息，功能信息用于指示终端的能力信息；
终端的用户信息，用户信息用于指示终端的拥有者信息；
终端的设备信息，设备信息用于指示终端的制造信息；
终端的位置信息，位置信息用于指示终端所在的位置。
基于该方案，由核心网网元为终端分配类别，并且是基于终端的信息为终端分配类别，因而分类方式较为灵活。相较于背景技术中的按照业务紧急度进行分类且分类结果预先写 入SIM卡的分类方式，本申请的分类方法更为灵活。
在一种可能的实现方式中，所述终端的功能信息包括网络能力、移动站网络能力、移动站类别掩码2、移动站类别掩码3、支持的编码、增加的更新类别、语音域偏好、终端的使用设置、终端的设备性能、移动台支持网络特征中的部分或全部参数，所述终端的用户信息包括组标识、管理员标识、公司标识中的部分或全部参数，所述终端的设备信息包括终端的设备标识码的类别分配号、软件版本号中的部分或全部参数。
在一种可能的实现方式中，核心网网元根据终端的信息，确定终端的类别信息，包括：核心网网元根据终端的位置信息，确定终端的类别信息中的第一类别；核心网网元根据终端的功能信息、用户信息或设备信息中的部分或全部信息，确定终端的类别信息中的第二类别。
在一种可能的实现方式中，若终端的位置信息发生更新，则核心网网元根据更新后的位置信息，更新终端的类别信息中的第一类别。
在一种可能的实现方式中，核心网网元向通信设备发送终端的类别信息，通信设备包括以下设备中的部分或全部设备：终端、接入网设备、移动性管理网元、会话管理网元、策略控制网元、用户面网元。
在一种可能的实现方式中，核心网网元接收指示信息，指示信息用于指示确定终端的类别信息。
在一种可能的实现方式中，核心网网元为移动性管理网元或策略控制网元。
在一种可能的实现方式中，所述核心网网元为策略控制网元；
针对所述N个终端中的每个终端，所述策略控制网元存储所述终端的类别信息与所述终端的标识之间的对应关系。
第二方面，本申请提供一种控制终端接入的方法，该方法包括：策略控制网元接收来自安全检测网元的异常终端的身份列表，所述身份列表用于指示一个或多个异常终端；策略控制网元根据本地策略、所述身份列表以及终端的类别信息与终端的标识之间的对应关系，确定异常类别信息；策略控制网元发送所述异常类别信息。基于该方案，可以基于异常类别信息，实施对终端的控制，因而实现了按类别信息粒度控制终端的接入，可实现一次控制多个终端接入的功能，减少了控制信令。
在一种可能的实现方式中，所述策略控制网元根据本地策略、所述身份列表，以及终端的类别信息与终端的标识之间的对应关系，确定异常类别信息，包括：
所述控制策略网元根据所述身份列表，终端的类别信息与终端的标识之间的对应关系，确定所述身份列表对应的候选异常类别信息，其中，所述身份列表中具有相同类别信息的终端对应同一个候选异常类别信息；
针对每个候选异常类别信息，如果所述身份列表中归属于所述候选异常类别信息的终端数量与所述候选异常类别信息对应的所有终端的数量的比值大于预设的比例阈值，则确定所述候选异常类别信息为异常类别信息；或者，
针对每个候选异常类别信息，如果所述身份列表中归属于所述候选异常类别信息的终端数量大于预设的数量阈值，则确定所述候选异常类别信息为异常类别信息。
在一种可能的实现方式中，策略控制网元发送类别信息，包括：策略控制网元向接入网设备发送异常类别信息。
在又一种可能的实现方式中，策略控制网元发送异常类别信息，包括：策略控制网元 向用户面网元发送异常类别信息；策略控制网元还向用户面网元发送流匹配信息和流处理方法，流匹配信息用于匹配用户面流量，流处理方法用于控制匹配异常类别信息的终端发送的匹配流匹配信息的用户面流量。
第三方面，本申请提供一种控制终端接入的方法，该方法包括：安全检测网元根据终端的流量数据，确定异常类别信息；安全检测网元发送异常类别信息。基于该方案，可以基于异常类别信息，实施对终端的控制，因而实现了按类别信息粒度控制终端的接入，可实现一次控制多个终端接入的功能，减少了控制信令。
在一种可能的实现方式中，安全检测网元根据终端的流量数据，确定异常类别信息之前，还包括：安全检测网元向网络设备发送数据收集服务请求消息，数据收集服务请求消息包括数据收集单元和数据收集范围，数据收集单元用于指示上报的数据的格式，数据收集范围用于指示按终端的类别信息进行收集；安全检测网元接收网络设备发送的数据收集服务响应消息，数据收集服务响应消息包括类别信息和类别信息对应的流量数据，类别信息指示的终端的流量数据满足上报条件。
在一种可能的实现方式中，数据收集服务请求消息还包括上报条件，上报条件用于指示触发上报流量数据的条件。
在一种可能的实现方式中，网络设备包括下列设备中的部分或全部设备：移动性管理网元、会话管理网元、策略控制网元、用户面网元。
在一种可能的实现方式中，安全检测网元根据终端的流量数据，确定异常类别信息，包括：安全检测网元根据安全检测算法对类别信息对应的流量数据进行检测，确定异常类别信息。
第四方面，本申请提供一种控制终端接入的方法，该方法包括：用户面网元接收异常类别信息、流匹配信息和流处理方法；若用户面流量与流匹配信息匹配、且发送用户面流量的终端匹配异常类别信息，则用户面网元根据流处理方法执行对用户面流量的控制。基于该方案，可以基于异常类别信息，实施对终端的控制，因而实现了按类别信息粒度控制终端的接入，可实现一次控制多个终端接入的功能，减少了控制信令。
在一种可能的实现方式中，用户面网元根据流处理方法执行对用户面流量的控制，包括：若流处理方法包括丢弃操作，则用户面网元丢弃用户面流量；或者，若流处理方法包括服务质量修改操作，用户面网元修改用户面流量的服务质量。
第五方面，本申请提供一种控制终端接入的方法，该方法包括：接入网设备从核心网网元接收异常类别信息；接入网设备发送广播数据包，广播数据包包括异常类别信息，所述广播数据包用于限制与异常类别信息匹配的终端的接入。基于该方案，可以基于异常类别信息，实施对终端的控制，因而实现了按类别信息粒度控制终端的接入，可实现一次控制多个终端接入的功能，减少了控制信令。
在一种可能的实现方式中，接入网设备发送广播数据包之前，还包括：接入网设备接收限制指示，限制指示用于指示根据所述限制指示限制于所述异常类别信息匹配的终端的接入。
在一种可能的实现方式中，接入网设备接收异常类别信息之后，还包括：接入网设备启动计时器。接入网设备发送广播数据包，包括：若计时器未超时，则接入网设备发送广播数据包。
第六方面，本申请提供一种控制终端接入的方法，该方法包括：终端从接入网设备接 收广播数据包，所述广播数据包包括异常类别信息；若终端的类别信息与接收到的异常类别信息匹配，则终端限制终端的接入，其中，所述终端的类别信息是所述终端从核心网网元接收到的。基于该方案，可以基于异常类别信息，实施对终端的控制，因而实现了按类别信息粒度控制终端的接入，可实现一次控制多个终端接入的功能，减少了控制信令。
在一种可能的实现方式中，所述终端还从核心网网元接收所述终端的类别信息，所述终端的类别信息是根据所述终端的信息生成的，所述终端的信息包括下列信息中的部分或全部信息：
所述终端的功能信息，所述功能信息用于指示所述终端的能力信息；
所述终端的用户信息，所述用户信息用于指示所述终端的拥有者信息；
所述终端的设备信息，所述设备信息用于指示所述终端的制造信息；
所述终端的位置信息，所述位置信息用于指示所述终端所在的位置。
在一种可能的实现方式中，终端还可以释放与接入网设备的连接。
第七方面，本申请提供一种装置，该装置可以是接入网设备、终端设备、安全功能网元，也可以是芯片。该装置具有实现上述第一方面、或者第二方面、或者第三方面、或者第四方面中任意一个方面的各实施例的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第八方面，提供了一种装置，包括：处理器和存储器；该存储器用于存储计算机执行指令，当该装置运行时，该处理器执行该存储器存储的该计算机执行指令，以使该装置执行如上述第一方面或第一方面中任一所述的类别信息的确定方法、或者以使该装置执行如上述第二方面或第二方面中任一所述的控制终端接入的方法、或者以使该装置执行如上述第三方面或第三方面中任一所述的控制终端接入的方法、或者以使该装置执行如上述第四方面或第四方面中任一所述的控制终端接入的方法、或者以使该装置执行如上述第五方面或第五方面中任一所述的控制终端接入的方法、或者以使该装置执行如上述第六方面或第六方面中任一所述的控制终端接入的方法。
第九方面，本申请还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第十方面，本申请还提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第十一方面，本申请还提供一种系统，该系统包括上述第二方面或第二方面的任一实施例中的策略控制网元、上述第三方面或第三方面的任一实施例中的安全检测网元、上述第四方面或第四方面的任一实施例中的用户面网元。进一步的，该系统还可以包括上述第六方面或第六方面的任一实施例中的终端。
第十二方面，本申请还提供一种系统，该系统包括上述第三方面或第三方面的任一实施例中的安全检测网元和上述第五方面或第五方面的任一实施例中的接入网设备。进一步的，该系统还可以包括上述第六方面或第六方面的任一实施例中的终端。
本申请的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
图1为本申请提供的一种可能的网络架构示意图；
图2为现有技术的一种控制UE接入的方法流程图；
图3为现有技术的又一种控制UE接入的方法流程图；
图4为本申请提供的一种UE的类别信息的确定方法流程图；
图5为本申请提供的又一种UE的类别信息的确定方法流程图；
图6为本申请提供的又一种UE的类别信息的确定方法流程图；
图7为本申请提供的又一种UE的类别信息的确定方法流程图；
图8为本申请提供的一种发送UE的类别信息的方法流程图；
图9为本申请提供的一种更新UE的类别信息的方法流程图；
图10为本申请提供的一种收集网络设备的流量的方法流程图；
图11为本申请提供的一种控制UE接入的方法流程图；
图12为本申请提供的又一种控制UE接入的方法流程图；
图13为本申请提供的一种装置示意图；
图14为本申请提供的又一种装置示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
如图1所示，为本申请适用的一种可能的网络架构示意图。该网络架构包括接入网设备和核心网网元。可选的，该网络架构还包括安全功能网元。其中，接入网设备可以通过有线或无线的方式与终端通信。终端可以通过非接入层(non access stratum，NAS)消息与核心网网元通信，例如通过N1接口。
其中，核心网网元包括可以包括移动性管理网元、会话管理网元、策略控制网元、用户面网元、数据管理网元中的部分或全部网元。
本申请中，核心网网元可以根据终端的信息对终端进行分类。例如可以是移动性管理网元对终端进行分类，或者可以是策略控制网元对终端进行分类，或者可以是移动性管理网元和策略控制网元对终端进行分类等。
本申请中，终端是一种具有无线收发功能的设备，终端可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端可以是手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端，以及还可以包括用户设备(user equipment，UE)等。终端还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具 有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来第五代(the 5th generation，5G)网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等。终端有时也可以称为终端设备、用户设备(user equipment，UE)、接入终端设备、车载终端、工业控制终端、UE单元、UE站、移动站、移动台、远方站、远程终端设备、移动设备、UE终端设备、终端设备、无线通信设备、UE代理或UE装置等。终端也可以是固定的或者移动的。本申请实施例对此并不限定。
接入网设备，也可以称为无线接入网(radio access network，RAN)设备，是一种为终端提供无线通信功能的设备。接入网设备例如包括但不限于：5G中的下一代基站(g nodeB，gNB)、演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心等。接入网设备还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器、集中单元(centralized unit，CU)，和/或分布单元(distributed unit,DU)，或者该网络设备可以为中继站、接入点、车载设备、可穿戴设备以及未来5G网络中的网络设备或者未来演进的PLMN网络中的网络设备等。终端可以与不同技术的多个接入网设备进行通信，例如，终端可以与支持长期演进(long term evolution，LTE)网络的接入网设备通信，也可以与支持5G网络的接入网设备通信，还可以支持与LTE网络的接入网设备以及5G网络的接入网设备的双连接。本申请实施例并不限定。
用户面网元，主要负责对用户报文进行处理，如转发、计费、合法监听等。在5G网络中，用户面网元可以是用户面功能(user plane function，UPF)网元，在未来通信如第6代(6th generation，6G)网络中，用户面网元仍可以是UPF网元，或有其它的名称，本申请不做限定。
会话管理网元，主要用于移动网络中的会话管理，如会话创建、修改、释放。具体功能比如包括为用户分配互联网协议(internet protocol，IP)地址、选择提供报文转发功能的用户面网元。在5G网络中，会话管理网元可以是会话管理功能(session management function，SMF)网元，在未来通信如6G网络中，会话管理网元仍可以是SMF网元，或有其它的名称，本申请不做限定。
移动性管理网元，主要用于移动网络中的终端的注册、移动性管理、跟踪区更新流程。移动性管理网元终结了NAS消息、完成注册管理、连接管理以及可达性管理、分配跟踪区域列表(track area list，TA list)以及移动性管理等，并且透明路由会话管理(session management，SM)消息到会话管理网元。在5G网络中，移动性管理网元可以是接入与移动性管理功能(access and mobility management function，AMF)网元，在未来通信如6G网络中，移动性管理网元仍可以是AMF网元，或者有其它名称，本申请对此不作限定。
数据管理网元，主要用于负责管理签约数据，当签约数据修改的时候，负责通知相应的网元。在5G中，数据管理网元可以是统一数据管理(unified data management，UDM)网元，在未来通信如6G中，数据管理网元仍可以是UDM网元，或有其它的名称，本申请不做限定。
策略控制网元，其包含用户签约信息管理功能，策略控制功能，计费策略控制功能，服务质量(quality of service，QoS)控制等。在5G网络中，策略控制网元可以是策略控制功能(policy control function，PCF)网元，在未来通信如6G网络中，策略控制网元仍可以是PCF网元，或有其它的名称，本申请不做限定。
本申请中的安全检测网元，具备安全功能，可以对终端的流量数据进行分析，发现其中的恶意流量，即发现其中存在异常行为的终端。在具体实现中，在5G中，安全检测网元可以称为安全检测功能(Security Detection Function，SEDF)网元，或者有其他名称。在具体实现中，安全检测网元可以是单独的网元，或集成于网络数据分析功能(NetWork Data Analysis Function，NWDAF)实体中、或集成于操作、管理和维护(Operation,Administration and Maintenance，OAM)实体中、或集成于应用功能(Application Function，AF)实体中。其中，OAM实体也可以称为网络管理系统，用于提供一组网络管理功能，包括故障监测，故障申告，故障定位，以及故障修复等。NWDAF实体，用于提供大数据分析服务，该实体可以从第三代合作伙伴计划(3rd generation partnership project，3GPP)网络收集数据，并进行大数据分析，从而提供更佳的策略。AF实体，用于提供应用服务，这种应用服务可以是第三方提供的，也可以是运营商提供的。
可以理解的是,上述功能既可以是硬件设备中的网络元件,也可以是在专用硬件上运行软件功能，或者是平台(例如,云平台)上实例化的虚拟化功能。
为方便说明，本申请后续，以终端为UE，接入网设备为基站，用户面网元为UPF网元，会话管理网元称为SMF网元，移动性管理网元为AMF网元，策略控制网元为PCF网元，数据管理网元为UDM网元，安全检测网元为SEDF网元为例进行说明。进一步地，将UPF网元简称为UPF，会话管理网元简称为SMF，AMF网元简称为AMF，PCF网元简称为PCF，UDM网元简称为UDM，SEDF网元简称为SEDF。即本申请后续所描述的UPF均可替换为用户面网元，SMF均可替换为会话管理网元，AMF均可替换为移动性管理网元，UDM均可替换为数据管理网元，SEDF均可替换为安全检测网元，UE均可替换为终端，基站均可替换为接入网设备。这里做统一说明，后续不再赘述。
5G主要面向三大业务场景，增强移动宽带(Enhanced Mobile Broadband,eMBB)，增强型机器类通信(Enhanced Machine Type Communication,eMTC)和极高可靠极低时延通信(Ultra-Reliable and Low-Latency Communication,URLLC)。其中，eMTC主要面向物联网(Internet of Things,IoT)设备，这类设备通常实现简单，安全防护差，容易被攻击者攻击，成为攻击者控制的设备。
一种攻击的示例是，攻击者可以利用病毒软件快速控制大量的IoT设备，形成自己控制的僵尸网络。当规模达到一定数值，攻击者可以控制这些设备对某个服务器同时发起大量连接，使服务器不堪重负而宕机，造成DDoS攻击。
因此，当服务器遭受DDoS攻击时，需要对发起攻击的终端进行控制，以限制该终端的接入。
如图2所示，为现有技术中的一种控制UE接入的方法。该方法包括以下步骤：
步骤201，SEDF确定存在异常行为的UE。
这里存在异常行为的UE可以是一个或多个UE。
步骤202，SEDF向基站发送UE的第二标识，第二标识用于指示存在异常行为的UE。
步骤203，可选地，基站根据第二标识释放与UE之间的连接。
步骤204，第一UE发起连接，并携带第一标识，第一标识用于指示该UE。
步骤205，基站将第一标识和第二标识进行匹配。
若第一标识和第二标识匹配，则继续执行以下步骤206-步骤207。
步骤206，基站限制第一UE的接入。
由于第一UE是存在异常行为的UE，因此基站限制该第一UE的接入。
可选的，该步骤206中，基站还向第一UE发送拒绝原因，比如拒绝原因为安全原因。
步骤207，第一UE等待设定时长后，再次尝试接入。
该实施例，是以UE粒度对出现异常行为的UE进行接入控制，当DDoS攻击发生时，出现异常行为的UE数量是很多的，例如数万级别，以UE粒度UE的接入，则需要数万条信令，造成信令开销很大。
如图3所示，为现有技术提供的又一种控制UE接入的方法。该实施例适用于基站的过载控制，当基站上发生过载时，基站可能会触发这一流程。该方法包括以下步骤：
步骤301，基站发生过载。
基站发生过载的原因，可能是当前接入的UE过多、或者是UE发送的消息过多、或者基站的CPU过载等。
步骤302，基站发送广播数据包，广播数据包中包含三个参数：ac-BarringFactor,ac-BarringTime,ac-BarringForSpecialAC。
其中，ac-BarringFactor是一个0到1之间的值，UE在每次尝试接入前，会先生成一个0到1之间的随机数，若生成的随机数小于ac-BarringFactor，则可以直接接入，否则不接入，并等待一段时间再次尝试。
ac-BarringTime用于指示阻止接入的时间，当UE决定不接入时，等待ac-BarringTime的时间。
ac-BarringForSpecialAC用于指示一个或多个接入类别(access class，AC)。Access Class指示了UE的接入类别，且配置在UE的SIM卡上。AC共有15种，其中，0-9是正常UE随机分配，11为公共陆地移动网络(public land mobile network，PLMN)使用，12为安全服务，13为公共设备，14为紧急服务，15为PLMN员工。可见，11-15的AC优先级较高。正常情况下，在AC Barring Check发生时，0-9的UE都需要启动AC Barring Check，11-15的UE可以正常连接。但是，ac-BarringForSpecialAC可以指示11-15的AC，当参数ac-BarringForSpecialAC存在时，被指示的AC的UE也需要启动AC Barring Check。
步骤303，UE收到广播数据包后，根据SIM卡中的AC确定相应的接入方式。
当SIM卡中的AC属于0-9时，UE直接根据ac-BarringFactor和ac-BarringTime执行AC Barring Check。当SIM卡中的AC属于11-15时，根据ac-BarringForSpecialAC决定是否执行AC Barring Check。
图3所示的实施例的过载机制是按照UE的业务紧急度的粒度(以AC指示业务紧急度)进行UE的接入控制，该方法存在的缺陷是：1)UE的AC是预先写入SIM卡中，因而灵活度不够；2)该过载机制仅作用于尝试进行连接的UE，无法控制已经连接到基站的UE；3)该过载机制由基站自发实施，但检测机制简单，无法控制一些高级的攻击。
为解决图2和图3的实施例在控制UE接入时存在的问题，本申请提供一种UE的类别信息的确定方法和控制UE接入的方法。下面分别说明。
如图4所示，为本申请提供的一种UE的类别信息的确定方法，该方法可用于为UE 分类。该方法包括以下步骤：
步骤401，针对接入网络的N个UE，核心网网元获取该N个UE的信息，N为正整数。
这里的核心网网元例如可以是AMF、或者是PCF、或者是AMF和PCF。
这里的UE的信息，包括下列信息中的部分或全部信息：
(1)UE的功能信息，功能信息用于指示UE的能力信息，可以指示UE支持的功能。例如，UE的功能信息可以包含UE的网络能力(UE Network Capability)、移动站网络能力(MS Network Capability)、移动站类别掩码2(Mobile Station Classmask2)、移动站类别掩码3(Mobile Station Classmask3)、支持的编码(Supported Codecs)、增加的更新类别(Additional Update Type)、语音域偏好以及UE的使用设置(Voice domain Preference and UE’s usage setting)、设备性能(Device Properities)、移动台支持网络特征(MS Network Feature Support)等参数中的部分或全部参数。
(2)UE的用户信息，用户信息用于指示UE的拥有者信息，例如，UE的用户信息可以包含组标识(group ID)，管理员ID，公司ID等参数中的部分或全部参数。
(3)UE的设备信息，设备信息用于指示UE的制造信息，例如，UE的设备信息可以是UE的设备标识码的类别分配号(Type Allocation Code,TAC)，软件版本号(SV)等。
(4)UE的位置信息，位置信息用于指示UE所在的位置，例如，UE的位置信息可以是UE当前所在的小区标识，位置区等。
步骤402，针对N个UE的任一UE，核心网网元根据UE的信息，确定该UE的类别信息。
需要说明书的是，核心网网元根据UE的哪些信息，以及如何确定UE所属的类别信息，可以根据预先设置的策略来确定。该预先设置的策略也可以由操作人员根据需要进行调整。例如，在预防潜在攻击的场景下，在使用上述UE的信息对UE进行分类时，可以根据攻击方式的不同，而选择相应的UE的信息对UE进行分类。通常攻击者攻击UE的方式包含：
攻击方式一、利用应用软件/通信协议/操作系统/固件漏洞进行攻击。
根据漏洞所处的不同位置可以将漏洞类型划分为应用软件、通信协议以及操作系统漏洞，例如，由于应用软件设计缺陷导致的漏洞叫做应用软件漏洞，如微信出现的缓冲区溢出漏洞；由于通信协议设计缺陷导致的漏洞叫做通信协议漏洞，如传输层安全(Transport Layer Security,TLS)协议的心脏出血漏洞；由于操作系统设计缺陷导致的漏洞叫做操作系统漏洞，如安卓的缓冲区溢出漏洞；由于驱动程序设计缺陷导致的漏洞叫做固件漏洞。针对这类漏洞，攻击者通常可以精心构造攻击数据包，并将之发送到具有该类漏洞的UE中，由于漏洞缺陷，攻击者可以通过该漏洞获得UE的控制权。
应用软件漏洞攻击通常与UE的用户信息相关。例如，IoT设备的功能单一，通常需要预装专一的应用软件，这种应用软件可以由UE的用户信息反映，比如A公司所属的共享单车需要预装A公司开发的APP，而B公司所属的共享单车需要预装B公司开发的APP，那么一旦A公司的APP出现漏洞，A公司所属的共享单车都可能存在安全风险。UE的group ID或者company ID可以区分不同的公司。这种情况下，可以根据UE的用户信息确定UE的分类信息。
通信协议漏洞攻击通常与UE的功能信息和/或设备信息相关。例如，IoT设备出厂时 即确定了通信芯片，那么通信协议可以由UE的功能信息和设备信息共同反映，比如由A公司生产的电表其芯片实现通信协议A，而由B公司生产的电表其芯片未实现通信协议A，若通信协议A存在漏洞，则实现通信协议A的A公司生产的电表可能存在安全风险。UE的国际移动设备标识(International Mobile Equipment Identity,IMEI)/永久设备标识(permanent equipment identifier,PEI)的类型分配码(Type Allocation Code,TAC)可以反映UE的生产厂商以及设备型号，而UE的能力信息可以反映UE是否实现存在漏洞的通信协议。这种情况下，可以根据UE的功能信息和/或设备信息确定UE的分类信息。
操作系统漏洞攻击通常与UE的设备信息相关。例如，IoT设备出厂时即预装了操作系统，那么操作系统可以由UE的设备信息反映，比如由A公司生产的医疗设备预装了版本A的安卓系统，由B公司生产的预装了版本B的苹果系统，若版本A的安卓系统存在漏洞，则A公司生产的预装版本A的安卓系统的医疗设备可能存在安全风险。UE的国际移动设备标识(International Mobile Equipment Identity,IMEI)/永久设备标识(permanent equipment identifier,PEI)的类型分配码(Type Allocation Code,TAC)可以反映UE的生产厂商以及设备型号，软件版本号(Software Version,SV)可以反映UE的操作系统版本号。这种情况下，可以根据UE的设备信息确定UE的分类信息。
固件漏洞攻击通常与UE的设备信息相关。例如，IoT设备出厂时即预装了驱动程序，那么驱动程序可以由UE的设备信息反映，比如由A公司生产的医疗设备预装了驱动A，由B公司生产的医疗设备预装了驱动B，若驱动A的存在漏洞，则A公司生产的预装驱动A的医疗设备可能存在安全风险。UE的国际移动设备标识(International Mobile Equipment Identity,IMEI)/永久设备标识(permanent equipment identifier,PEI)的类型分配码(Type Allocation Code,TAC)可以反映UE的生产厂商以及设备型号。这种情况下，可以根据UE的设备信息确定UE的分类信息。
攻击方式二、利用管理漏洞：出厂设备通常会存在默认用户名以及密码，例如，用户名admin，密码admin，管理员有时会忘记修改这些默认的用户名和密码，这点容易被攻击者利用，存在管理风险。管理漏洞攻击通常与UE的设备信息相关，可以通过UE的国际移动设备标识(International Mobile Equipment Identity,IMEI)/永久设备标识(permanent equipment identifier,PEI)的类型分配码(Type Allocation Code,TAC)来反映UE的生产厂商以及设备型号。这种情况下，可以根据UE的设备信息确定UE的分类信息。
攻击方式三、利用物理方式攻击：这类攻击要求攻击者在接近终端的位置进行攻击，例如，侧信道攻击，硬件攻击等。例如，攻击者可以移动到一个区域内，对该区域的所有数据采集器进行攻击，达到篡改采集数据的目的。物理攻击方式通常与UE的位置信息相关，可以通过UE的位置标识来反映UE的位置，例如CGI，TAI等。这种情况下，可以根据UE的位置信息确定UE的分类信息。
因此，本申请实施例选取上述UE的信息确定UE的类别信息，可以与攻击者的攻击手段相关联，从而反映出存在相同潜在攻击的一类终端，从而可以实施按类别的方式控制终端的有益效果。
在一种实现方式中，核心网网元根据一个UE的信息，直接确定该UE的类别信息。例如，根据UE的功能信息、用户信息、设备信息和位置信息中的部分或全部信息确定UE的类别信息。
下面举例说明。以根据UE的用户信息和UE的设备信息确定UE的类别信息为例， 具体的，以UE的用户信息包括组标识(group ID)，UE的设备信息包括TAC和SV为例。比如，当UE的用户信息指示为group ID 1，设备信息指示为TAC1、SV1，则为该UE分配类别1，记为C1。当UE的用户信息指示为group ID 2，设备信息指示为TAC1、SV2，则为该UE分配类别2，记为C2。当UE的用户信息指示为group ID1，设备信息指示为TAC3、SV3，则为该UE分配类别3，记为C3。以此类推。
比如，基于上述分类方式，则对UE进行分类，最终得到的分类信息例如可以是：
UE1：C1(即UE1属于类别1)；
UE2：C2(即UE2属于类别2)；
UE3：C2(即UE3属于类别2)；
UE4：C3(即UE4属于类别3)；
……
上述分类方式中，UE的类别信息是根据UE的所有信息确定的，若两个UE的所有UE的信息属于同一类别，则核心网网元为两个UE确定的类别信息相同。但是，若两个UE的任一UE的信息不属于同一类别，则核心网网元为两个UE确定的类别信息不同。
在另一种实现方式中，核心网网元根据UE的动态信息确定UE的类别信息中的第一类别，以及，根据UE的静态信息确定UE的类别信息中的第二类别。其中，UE的动态信息代表第一预设时间内(一般为较短时间)会可能发生改变的UE的信息，例如可以是UE的位置信息。UE的静态信息代表第二预设时间内(一般为较长时间)不改变的UE的信息，例如可以是UE的功能信息、用户信息或设备信息中的部分或全部信息。第一类别也可以称为动态类别信息，第二类别也可以称为静态类别信息。其中，第一预设时间的时长小于等于第二预设时间的时长。
下面举例说明。
针对核心网网元根据UE的位置信息确定UE的类别信息中的第一类别，由于跟踪区标识(Tracking Area Identity，TAI)和全球小区识别码(Cell Global Identification，CGI)均可以指示UE的当前位置，因此可以根据TAI或CGI为对UE进行第一类别的分类。比如，以TAI为例，当UE处于TAI1时，则为该UE分配第一类别1，记为C11。当UE处于TAI2时，则为该UE分配第一类别2，记为C12。当UE处于TAI3和TAI4时，则为该UE分配第一类别3，记为C13。以此类推。需要说明的是，当UE移动至新的TAI，比如UE从TAI1移动至TAI2，则该UE的第一类别需要从C11更新为C12。当然，当UE移动至新的TAI时，也可能不需要更新第一类别，比如UE从TAI3移动至TAI4，则该UE的第一类别仍然保持为C13。再比如，以CGI为例，当UE处于CGI1和CGI4时，则为该UE分配第一类别1，记为C11。当UE处于CGI2时，则为该UE分配第一类别2，记为C12。当UE处于CGI3时，则为该UE分配第一类别3，记为C13。以此类推。需要说明的是，当UE移动至新的CGI，比如UE从CGI1移动至CGI2，则该UE的第一类别需要从C11更新为C12。当然，当UE移动至新的CGI时，也可能不需要更新第一类别，比如UE从CGI1移动至CGI4，则该UE的第一类别仍然保持为C11。在实际应用中，选择TAI或CGI中的一种对UE进行第二类别的分配。当然，也可以将TAI和CGI进行结合，对UE进行第二类别的分配。
针对核心网网元根据UE的功能信息、用户信息或设备信息中的部分或全部信息确定UE的类别信息中的第二类别，下面以根据UE的功能信息、用户信息和设备信息确定UE 的类别信息中的第二类别为例。比如，当UE的用户信息指示所属公司是ofo公司，设备信息指示制造厂商是GIANT，功能信息指示设备支持NB-IOT CP协议时，则为该UE1分配第二类别1，记为C21。当UE的用户信息指示所属公司是摩拜单车公司，设备信息指示制造厂商是PHOENIX，功能信息指示设备功能支持NB-IOT CP协议时，则为该UE2分配第二类别2，记为C22。以此类推。
比如，基于上述分类方式，则对UE进行分类，最终得到的分类信息例如可以是：
UE1：C11、C22，(即UE1属于第一类别1和第二类别2)；
UE2：C11、C21，(即UE2属于第一类别1和第二类别1)；
UE3：C12、C23，(即UE3属于第一类别2和第二类别3)；
UE4：C12、C24，(即UE4属于第一类别2和第二类别4)；
UE5：C13、C21，(即UE5属于第一类别3和第二类别1)；
……
上述分类方式中，一般地，UE所属的第一类别是可以变化的，即若UE的位置信息发生更新，则核心网网元根据更新后的位置信息更新UE的类别信息中的第一类别。当然，在实际应用中，UE所属的第一类别和第二类别是否可以发生变化，视实际需要而定，本申请不做限定。
在又一种实现方式中，核心网网元根据不同UE的信息确定不同的类别，例如，核心网网元根据UE的位置信息确定UE的类别信息中的第一类别，根据UE的功能信息确定UE的类别信息中的第二类别，根据UE的用户信息确定UE的类别信息中的第三类别，根据UE的设备信息确定UE的类别信息中的第四类别。当然，核心网网元也可以仅确定上述四个类别中的部分类别。
下面举例说明。
针对核心网网元根据UE的位置信息确定UE的类别信息中的第一类别，由于跟踪区标识(Tracking Area Identity，TAI)和全球小区识别码(Cell Global Identification，CGI)均可以指示UE的当前位置，因此可以根据TAI或CGI为对UE进行第一类别的分类。比如，以TAI为例，当UE处于TAI1时，则为该UE分配第一类别1，记为C11。当UE处于TAI2时，则为该UE分配第一类别2，记为C12。当UE处于TAI3和TAI4时，则为该UE分配第一类别3，记为C13。以此类推。需要说明的是，当UE移动至新的TAI，比如UE从TAI1移动至TAI2，则该UE的第一类别需要从C11更新为C12。当然，当UE移动至新的TAI时，也可能不需要更新第一类别，比如UE从TAI3移动至TAI4，则该UE的第一类别仍然保持为C13。再比如，以CGI为例，当UE处于CGI1和CGI4时，则为该UE分配第一类别1，记为C11。当UE处于CGI2时，则为该UE分配第一类别2，记为C12。当UE处于CGI3时，则为该UE分配第一类别3，记为C13。以此类推。需要说明的是，当UE移动至新的CGI，比如UE从CGI1移动至CGI2，则该UE的第一类别需要从C11更新为C12。当然，当UE移动至新的CGI时，也可能不需要更新第一类别，比如UE从CGI1移动至CGI4，则该UE的第一类别仍然保持为C11。在实际应用中，选择TAI或CGI中的一种对UE进行第二类别的分配。当然，也可以将TAI和CGI进行结合，对UE进行第二类别的分配。
针对核心网网元根据UE的功能信息确定UE的类别信息中的第二类别。比如，当UE的功能信息指示设备功能支持NB-IOT CP协议时，则为该UE分配第二类别1，记为C21。 再比如，当UE的功能信息指示设备功能支持NB-IOT UP协议时，则为该UE分配第二类别2，记为C22，以此类推。
针对核心网网元根据UE的用户信息确定UE的类别信息中的第三类别。比如，当UE的用户信息指示所属公司是ofo公司时，则为该UE分配第三类别1，记为C31。再比如，当UE的用户信息所属公司是摩拜公司时，则为该UE分配第三类别2，记为C32。以此类推。
针对核心网网元根据UE的设备信息确定UE的类别信息中的第四类别。比如，当UE的设备信息指示制造厂商是GIANT所生产的A型号设备时，则为该UE分配第四类别1，记为C41。再比如，当UE的设备信息指示制造厂商是PHOENIX所生产的B型号设备时，则为该UE分配第四类别2，记为C42。以此类推。
比如，基于上述分类方式，则对UE进行分类，最终得到的分类信息例如可以是：
UE1：C11、C22、C31、C42，(即UE1属于第一类别1、第二类别2、第三类别1、第四类别2)；
UE2：C11、C21、C32、C42，(即UE2属于第一类别1、第二类别1、第三类别2、第四类别2)；
UE3：C12、C23、C31、C42，(即UE3属于第一类别2、第二类别3、第三类别1、第四类别2)；
UE4：C12、C22、C32、C41，(即UE4属于第一类别2、第二类别2、第三类别2、第四类别1)；
UE5：C13、C21、C31、C41，(即UE5属于第一类别3、第二类别1、第三类别1、第四类别1)；
……
上述分类方式中，一般地，UE所属的第一类别是可以变化的，即若UE的位置信息发生更新，则核心网网元根据更新后的位置信息更新UE的类别信息中的第一类别。UE所属的第二类别、第三类别、第四类别是不发生变化的。当然，在实际应用中，UE所属的第一类别、第二类别、第三类别、第四类别是否可以发生变化，视实际需要而定，本申请不做限定。通过图4所示的实施例，可以由核心网网元为UE分配类别，并且是基于UE的UE的功能信息、用户信息、设备信息和位置信息中的部分或全部信息为终端分配类别，因而分类方式较为灵活。本申请实施例选取上述UE的信息确定UE的类别信息，可以与攻击者的攻击手段相关联，从而反映出存在相同潜在攻击的一类终端，从而可以实施按类别的方式控制终端的有益效果。相较于图3所示的现有技术中的按照业务紧急度进行分类且分类结果预先写入SIM卡的分类方式，本申请的分类方法更为灵活。
进一步地，在上述步骤402之后，核心网网元还可以向通信设备发送UE的类别信息。比如，当是由AMF确定UE的类别信息时，则AMF可以向以下通信设备发送UE的类别信息：UE、基站、SMF、PCF或UPF。再比如，当是由PCF确定UE的类别信息时，则PCF可以向以下通信设备发送UE的类别信息：UE、基站、AMF、SMF或UPF。再比如，当是由AMF和PCF共同确定UE的类别信息时，比如AMF确定UE的第一类别，PCF确定UE的第二类别；或者AMF确定UE的第一类别，PCF确定UE的第二类别、第三类别和第四类别，则基于该实现方式，AMF在确定出UE的第一类别后，将UE的第一类别发送至PCF，然后PCF可以向以下通信设备发送UE的类别信息：UE、基站、AMF、SMF 或UPF。
进一步地，在上述步骤401之前，还可以包括以下步骤：核心网网元接收指示信息，该指示信息用于指示确定UE的类别信息。即核心网网元是在接收到指示信息后，才确定UE的类别信息的。该指示信息例如可以是网管系统发送的，或者还可以是UE发送的，本申请不做限定。
作为示例，下面结合附图，给出几种确定UE的类别信息的具体实现方法。
如图5所示，为本申请提供的一种UE的类别信息的确定方法。该方法是由AMF确定UE的类别信息。该方法包括以下步骤：
步骤501，UE向基站发送注册请求(registration request)消息。
可选的，该消息中包括UE的能力信息(UE Capability),UE Capability可以包含UE的网络能力(UE Network Capability)、移动站网络能力(MS Network Capability)、移动站类别掩码2(Mobile Station Classmask2)、移动站类别掩码3(Mobile Station Classmask3)、支持的编码(Supported Codecs)、增加的更新类别(Additional Update Type)、语音域偏好以及UE的使用设置(Voice domain Preference and UE’s usage setting)、设备性能(Device Properities)、移动台支持网络特征(MS Network Feature Support)等参数中的部分或全部参数。
其中，UE的能力信息也可以称为UE的功能信息。
步骤502，基站向AMF发送初始化UE消息(Initial UE message)，该Initial UE message包含UE的位置信息和注册请求消息等。
上述Initial UE message是一个N2消息。AMF可以从N2消息中获得UE的位置信息，如CGI，TAI等，其中CGI反映了UE所处的小区位置，TAI反映了UE所处的跟踪区位置。AMF还可以从注册请求消息获得UE的能力信息。
步骤503，AMF通过NAS安全模式完成(security mode completed，SMP)消息过程，从UE获得UE的设备信息，例如可以是IMEI/PEI中的TAC、SV等。
比如，AMF可以通过NAS SMP过程，从UE获得永久设备标识(Permanent Equipment Identifier，PEI)，PEI可以反映设备的制造厂商等设备相关信息。
步骤504，AMF通过Nudm_SDM_Get过程，从UDM获得UE的用户信息。
其中，UE的用户信息具体可以是SIM卡相关信息，例如，通过Nudm_SDM_Get过程从UDM获得的SIM卡相关信息包括组标识(group ID)，管理员ID，公司ID等信息，其中group ID可以反映UE的组类别，管理员ID可以反映UE的用户信息，公司ID可以反映UE所属公司的信息。
步骤505，AMF根据UE的信息确定UE的类别信息。
AMF确定UE的类别信息的具体实现方法可参考前述图4所示的实施例中的相关描述，这里不再赘述。
可选地，AMF将UE的类别信息存储到UE的上下文中。
步骤506，AMF向UDM、PCF、UE、基站中的部分或全部通信设备发送UE的类别信息。
可选的，AMF可以通过调用PCF开放的服务接口，向PCF发送UE的类别信息。PCF提供的服务可以包含Npcf_AMPolicyControl。
可选的，AMF可以通过调用UDM开放的服务接口，向UDM发送UE的类别信息。 UDM提供的服务可以包含Subscriber Data Management,UE Context Management服务等。
可选地，AMF可以通过NAS消息向UE发送UE的类别信息，例如NAS消息为注册接受消息(Registration Accept)。
可选地，AMF可以通过N2消息向基站发送UE的类别信息，例如N2消息为建立初始上下文消息。
步骤507，获得UE的类别信息的通信设备存储UE的类别信息。
比如，PCF将获得的UE的类别信息存储于该UE的上下文信息中。
比如，UDM将获得的UE的类别信息存储于该UE的上下文信息中。
比如，基站将获得的UE的类别信息存储于该UE的上下文信息中。
比如，UE将获得的UE的类别信息存储于本地。
作为一种实现方式，在上述步骤501、步骤502中还可以携带指示信息，该指示信息用于指示确定UE的类别信息，从而AMF在接收到指示信息时，可以根据指示信息执行上述步骤505。
作为又一种实现方式，AMF还可以从其他网元，如AF网元接收到上述指示信息，从而AMF在接收到指示信息时，根据指示信息执行上述步骤505。
基于图5所示的实施例，AMF在确定UE的类别信息之后，可以向PCF、UDM、基站、UE中的部分或全部设备发送UE的类别信息：
情形一，AMF向PCF和UDM发送UE的类别信息，且AMF存储该UE的类别信息，从而AMF可以在该UE的上下文中存储该UE的类别信息，PCF可以在该UE的上下文中存储该UE的类别信息，UDM可以在该UE的上下文中存储该UE的类别信息。
情形二，AMF只向UDM或PCF发送UE的类别信息，UDM或PCF可以在该UE的上下文中存储该UE的类别信息，且AMF不存储该UE的类别信息。
情形三，AMF向UDM和PCF发送UE的类别信息，且AMF不存储该UE的类别信息，则UDM可以在该UE的上下文中存储该UE的类别信息，PCF可以在该UE的上下文中存储该UE的类别信息。
情形四，AMF向基站、UE和PCF发送UE的类别信息，且AMF也存储该UE的类别信息，从而AMF可以在该UE的上下文中存储该UE的类别信息，PCF可以在该UE的上下文中存储该UE的类别信息，基站可以在该UE的上下文中存储该UE的类别信息，UE可以存储该UE的类别信息。
当然，还包括其它各种情形，这里不再一一例举。即通过图5所示的实施例，在AMF确定了UE的类别信息之后，可以使得核心网网元、UE、基站中的部分或全部设备获取到该UE的类别信息。对于已经获取到该UE的类别信息的设备，可以将该UE的类别信息存储在本地，后续需要使用时可以从本地获取，对于其他没有获取到该UE的类别信息的设备，后续需要使用时可以从存储有该类别信息的设备中获取。
需要说明的是，通信设备在存储UE的类别信息时，可以是存储UE的标识与UE的类别信息之间的对应关系或映射关系。
如图6所示，为本申请提供的又一种UE的类别信息的确定方法。该方法是由PCF确定UE的类别信息。该方法包括以下步骤：
步骤601-步骤604，同图5所示的步骤501-步骤504，可参考前述描述，这里不再赘 述。
步骤605，AMF向PCF发送UE的信息。
比如，AMF通过调用PCF的服务化接口，向UE发送上述UE的信息，这里UE的信息可以包含UE的功能信息、UE的位置信息、UE的用户信息、UE的设备信息等。其中，PCF提供的服务可以为Npcf_AMPolicyControl。
步骤606，PCF根据UE的信息确定UE的类别信息。
可选的，PCF还将UE的类别信息存储到UE的上下文中。
PCF确定UE的类别信息的具体实现方式，与图5所示的实施例的步骤505中确定UE的类别信息的方法相同，可参考前述描述。
步骤607，PCF向AMF发送UE的类别信息。
步骤608，AMF向UDM、UE、基站中的部分或全部通信设备发送UE的类别信息。
可选的，AMF可以通过调用UDM开放的服务接口，向UDM发送UE的类别信息。UDM提供的服务可以包含Subscriber Data Management,UE Context Management服务等。
可选地，AMF可以通过NAS消息向UE发送UE的类别信息，例如NAS消息为注册接受消息。
可选地，AMF可以通过N2消息向基站发送UE的类别信息，例如N2消息为建立初始上下文消息。
步骤609，获得UE的类别信息的通信设备存储UE的类别信息。
比如，UDM将获得的UE的类别信息存储于该UE的上下文信息中。
比如，基站将获得的UE的类别信息存储于该UE的上下文信息中。
比如，UE将获得的UE的类别信息存储于本地。
作为一种实现方式，在上述步骤601、步骤602、步骤605还可以携带指示信息，该指示信息用于指示确定UE的类别信息，从而PCF在接收到指示信息时，根据指示信息执行上述步骤606。
作为又一种实现方式，PCF还可以从其他网元，如AF网元接收到上述指示信息，从而PCF在接收到指示信息时，根据指示信息执行上述步骤606。
基于图6所示的实施例，PCF在确定UE的类别信息之后，可以向AMF、UDM、基站、UE中的部分或全部设备发送UE的类别信息：
情形一，PCF向AMF和UDM均发送UE的类别信息，且PCF也存储该UE的类别信息，从而PCF可以在该UE的上下文中存储该UE的类别信息，UDM可以在该UE的上下文中存储该UE的类别信息，AMF可以在该UE的上下文中存储该UE的类别信息。
情形二，PCF只向UDM发送UE的类别信息，且PCF不存储该UE的类别信息，则UDM可以在该UE的上下文中存储该UE的类别信息。
情形三，PCF向UDM发送UE的类别信息，且PCF存储该UE的类别信息，则UDM可以在该UE的上下文中存储该UE的类别信息，PCF可以在该UE的上下文中存储该UE的类别信息。
情形四，PCF向基站、UE和AMF发送UE的类别信息，则基站可以在该UE的上下文中存储该UE的类别信息，UE可以存储该UE的类别信息，AMF可以在该UE的上下文中存储该UE的类别信息，PCF在该UE的上下文中存储该UE的类别信息。
当然，还包括其它各种情形，这里不再一一例举。即通过图6所示的实施例，在PCF 确定了UE的类别信息之后，可以使得核心网网元、UE、基站中的部分或全部设备获取到该UE的类别信息。对于已经获取到该UE的类别信息的设备，可以将该UE的类别信息存储在本地，后续需要使用时可以从本地获取，对于其他没有获取到该UE的类别信息的设备，后续需要使用时可以从存储有该类别信息的设备中获取。
需要说明的是，通信设备在存储UE的类别信息时，可以是存储UE的标识与UE的类别信息之间的对应关系或映射关系。
如图7所示，为本申请提供的又一种UE的类别信息的确定方法。该方法是由AMF和PCF共同确定UE的类别信息。该方法包括以下步骤：
步骤701-步骤704，同图5所示的步骤501-步骤504，可参考前述描述，这里不再赘述。
步骤705，AMF根据UE的动态信息确定UE的动态类别信息。
这里，UE的动态信息例如可以是UE的位置信息，动态类别信息指的是UE的第一类别，即AMF根据UE的位置信息确定UE的第一类别。
步骤706，AMF向PCF发送UE的静态信息和动态类别信息。
这里的静态信息指的是UE的用户信息、UE的功能信息、UE的设备信息中的部分或全部信息。
比如，AMF通过调用PCF的服务化接口，向UE发送UE的静态信息和动态类别信息。其中，PCF提供的服务可以为Npcf_AMPolicyControl。
步骤707，PCF根据UE的静态信息确定UE的静态类别信息。
这里的静态类别信息，在不同的分类方式中，含义不同。比如，若是根据UE的用户信息、UE的功能信息、UE的设备信息中的部分或全部信息确定第二类别，则这里的静态类别信息指的是UE的第二类别。再比如，若是根据UE的功能信息确定UE的类别信息中的第二类别，根据UE的用户信息确定UE的类别信息中的第三类别，根据UE的设备信息确定UE的类别信息中的第四类别，则这里的静态类别信息指的是UE的第二类别、第三类别和第四类别。
PCF一方面可以确定UE的静态类别信息，另一方面可以从AMF获取到UE的动态类别信息，从而PCF可以获取到UE的类别信息(包括UE的静态类别信息和UE的动态类别信息)。可选的，PCF还将UE的类别信息存储到UE的上下文中。
步骤708，PCF向AMF发送UE的类别信息。
步骤709，AMF向UDM、UE、基站中的部分或全部通信设备发送UE的类别信息。
可选的，AMF可以通过调用UDM开放的服务接口，向UDM发送UE的类别信息。UDM提供的服务可以包含Subscriber Data Management,UE Context Management服务等。
可选地，AMF可以通过NAS消息向UE发送UE的类别信息，例如NAS消息为注册接受消息。
可选地，AMF可以通过N2消息向基站发送UE的类别信息，例如N2消息为建立初始上下文消息。
步骤710，获得UE的类别信息的通信设备存储UE的类别信息。
比如，UDM将获得的UE的类别信息存储于该UE的上下文信息中。
比如，基站将获得的UE的类别信息存储于该UE的上下文信息中。
比如，UE将获得的UE的类别信息存储于本地。
作为一种可替代的实现方式，上述步骤706-步骤710还可以替换为：由AMF确定UE的动态类别信息后向其他通信设备发送UE的动态类别信息，由PCF确定UE的静态类别信息后向其他通信设备发送UE的静态类别信息。
作为一种可替代的实现方式，上述步骤706-步骤710还可以替换为：由AMF确定UE的动态类别信息后向PCF发送UE的动态类别信息，由PCF确定UE的静态类别信息后，根据静态类别信息和动态类别信息确定UE的类别信息，然后由PCF向其他通信设备发送UE的类别信息。
作为一种实现方式，在上述步骤701、步骤702、步骤706还可以携带指示信息，该指示信息用于指示确定UE的类别信息，从而AMF在接收到指示信息时，根据指示信息执行上述步骤705，PCF在接收到指示信息时，根据指示信息执行上述步骤707。
作为又一种实现方式，AMF和PCF还可以从其他网元，如AF网元接收到上述指示信息，从而AMF和PCF在接收到指示信息时，根据指示信息执行上述步骤705和步骤707。基于图7所示的实施例，由AMF确定UE的类别信息中的动态类别信息，由PCF确定UE的类别信息中的静态类别信息之后，可以向其他设备发送UE的类别信息。比如，基于图7所示的实施例的实现方式，PCF向AMF发送了UE的类别信息之后，AMF可以向UE、基站、UDM中的部分或全部通信设备发送UE的类别信息，并且，PCF可以存储或不存储UE的类别信息，下面分别说明：
情形一，AMF向UDM发送UE的类别信息，且AMF存储该UE的类别信息，从而AMF可以在该UE的上下文中存储该UE的类别信息，UDM可以在该UE的上下文中存储该UE的类别信息。并且，PCF在该UE的上下文中也存储该UE的类别信息。
情形二，AMF只向UDM发送UE的类别信息，UDM可以在该UE的上下文中存储该UE的类别信息，且AMF不存储该UE的类别信息。并且，PCF不存储该UE的类别信息。
情形三，AMF向UDM发送UE的类别信息，且AMF不存储该UE的类别信息，则UDM可以在该UE的上下文中存储该UE的类别信息。并且，PCF在该UE的上下文中也存储该UE的类别信息。
情形四，AMF向基站和UE发送UE的类别信息，且AMF也存储该UE的类别信息，从而AMF可以在该UE的上下文中存储该UE的类别信息，基站可以在该UE的上下文中存储该UE的类别信息，UE可以存储该UE的类别信息。并且，PCF也存储该UE的类别信息。
当然，还包括其它各种情形，这里不再一一例举。即通过图7所示的实施例，在AMF和PCF共同确定了UE的类别信息之后，可以使得核心网网元、UE、基站中的部分或全部设备获取到该UE的类别信息。对于已经获取到该UE的类别信息的设备，可以将该UE的类别信息存储在本地，后续需要使用时可以从本地获取，对于其他没有获取到该UE的类别信息的设备，后续需要使用时可以从存储有该类别信息的设备中获取。
需要说明的是，通信设备在存储UE的类别信息时，可以是存储UE的标识与UE的类别信息之间的对应关系或映射关系。
下面介绍SMF和UPF获取到UE的类别信息的具体实现方式。如图8所示，为本申 请提供的一种发送UE的类别信息的方法。该方法包括以下步骤：
步骤801，UE发起协议数据单元(protocol data unit，PDU)会话建立流程，UE向AMF发送PDU会话建立请求。
UE在发起通信时，需要先发起图5-7中的注册流程，建立NAS通信，后续需要发起图8所示的PDU会话建立流程，以请求网络侧为其建立通信资源。因此，该流程发生在图5-7流程之后，核心网网元(如图5中AMF，图6中PCF或者图7中的AMF&PCF)已经确定好UE的类别信息。
步骤802，SMF获得UE的类别信息。
SMF可以通过以下任一方式获取到UE的类别信息。
方法一，SMF从AMF获得UE的类别信息。
AMF可以通过调用SMF开放的服务接口，向SMF发送UE的类别信息。其中，SMF向AMF提供的服务可以包含Create SM Context服务，SMContextStatusNotify服务等。
其中，AMF可以通过图5-图7中任一实施例的方法获得UE的类别信息。例如，在图5-7任一实施例描述的情形一中，AMF可以获得UE的类别信息。
方法二，SMF从UDM获得UE的类别信息。
SMF可以通过调用UDM开放的服务接口，向UDM查询获得UE的类别信息。其中，UDM向SMF提供的服务可以包含Subscriber Data Management服务,UE Context Management服务等。
其中，UDM可以通过图5-图7中任一实施例的方法获得UE的类别信息。例如，在图5-7任一实施例描述的情形一或情形二或情形三中，UDM可以获得UE的类别信息。
方法三，SMF从PCF获得UE的类别信息。
SMF可以通过调用PCF开放的服务接口，向PCF查询获得UE的类别信息。其中，PCF向SMF提供的服务可以包含Npcf_SMPolicyControl服务。
其中，PCF可以通过图5-图7中任一实施例的方法获得UE的类别信息。例如，PCF可以通过图5实施例的情形一或情形二或情形三或情形四获得UE的类别信息。或者，PCF可以通过图6实施例的情形一或情形三或情形四获得UE的类别信息。或者，PCF可以通过图7实施例的情形一或情形三或情形四获得UE的类别信息。
步骤803，SMF将该UE的类别信息存储到对应的UE上下文中。
该步骤为可选步骤。
步骤804，SMF向UPF发送UE的类别信息。
在PDU会话建立过程中，SMF可以根据现有技术为UE请求建立的PDU会话分配UPF，并向分配的UPF发送UE的类别信息。比如，SMF可以通过N4会话建立(N4Session Establishment)消息、或者N4会话修改请求(N4Session Modification Request)消息向UPF发送UE的类别信息。
可选的，SMF还可以向UPF发送UE的标识，标识可以是UE的源IP。
步骤805，UPF将该UE的类别信息存储到对应的UE上下文中。
可选的，UPF还可以将该UE的该类别信息与UE的标识进行绑定。
例如，UPF可以将UE的标识与UE的类别信息进行映射，形成映射表或对应关系，例如group1：IP1，IP2，group2：IP3，group3：IP4，IP5的形式。
基于图8所示的实施例，在UE的PDU会话建立过程中，SMF获取UE的类别信息， 并将UE的类别信息发送给服务于该UE的PDU会话的UPF。
通过上述图5-图7所示的实施例中的任一实施例，以及通过上述图8所示的实施例，网络中的各个网元，如UE、基站、AMF、SMF、PCF、UPF、UDM中的部分或全部网元可以获取到UE的类别信息并存储，以便于后续可以使用该UE的类别信息，如根据UE的类别信息对UE进行接入控制，后续会具体介绍。
进一步地，由于UE的位置是可以移动的，在一种实现方式中，核心网网元可以根据UE更新后的位置信息，重新确定UE的类别信息中的第一类别，或者称为，根据UE更新后的动态信息，重新确定UE的类别信息中的动态类别信息。
具体的，基于图5-图7中的任一实施例的确定UE的类别信息的方法，若UE的位置信息发生变化，均需要重新确定UE的类别信息中的第一类别。下面以基于图5所示的确定UE的类别信息的方法为例，当UE的位置更新时，则可以根据以下方法重新确定UE的类别信息中的第一类别。
需要说明的是，基于图6或图7所示的确定UE的类别信息的方法，当UE的位置更新时，重新确定UE的类别信息中的第一类别的方法，与该图9所示的方法类似，可参考实施，不再赘述。
如图9所示，为本申请提供的一种更新UE的类别信息的方法。该方法包括以下步骤：
步骤901，UE向基站发送注册请求消息。
可选的，当UE的位置发生更新时，触发UE向AMF发送注册请求消息，该注册请求消息用于更新位置区域，该注册请求消息包括新的TAI。
该注册请求消息可以携带于NAS消息中。
步骤902，基站向AMF发送注册请求消息。
步骤903，AMF更新UE的类别信息中的第一类别。
在具体实现中，AMF首先根据UE的新的位置信息，重新确定UE的类别信息中的第一类别。若重新确定的第一类别与该UE原来的第一类别相同，则不需要执行该步骤903及后续更新UE的第一类别的相关步骤。若重新确定的第一类别与该UE原来的第一类别不同，则需要执行该步骤903及后续更新UE的第一类别的相关步骤。
步骤904，AMF将更新的UE的第一类别发送至各通信设备。
比如，AMF可以通过调用UDM开放的服务接口，如Nudm_SDM_Get服务，向UDM发送更新的UE的第一类别。
比如，AMF可以通过策略关联建立过程(Policy Association Establishment procedure)，向PCF发送更新的UE的第一类别。
比如，AMF可以通过注册接受消息(Registration Accept)消息，向基站和UE发送更新的UE的第一类别。
作为一种可替换方式，该步骤904也可以替换为：AMF将更新的类别信息发送至各通信设备，即需要将更新的第一类别和原来的静态类别信息发送至各通信设备。
步骤905，各网元根据更新的第一类别，更新UE的类别信息中的第一类别。
步骤906，PCF触发更新SMF上的类别信息，SMF触发更新UPF上的类别信息。
PCF可以通过调用SMF开放的服务接口，向SMF发送UE的类别信息。其中，SMF提供的服务可以包含Nsmf_EventExposure服务。从而，SMF可以根据更新的第一类别， 更新UE的类别信息中的第一类别。以及，SMF可以触发更新UPF上的类别信息。
通过图9所示的实施例，当UE的位置信息发生更新时，各个通信设备可以更新UE的类别信息。
通过上述图5-图9所示的实施例，各个通信设备可以获取到UE的类别信息。下面介绍当UE发生攻击时，网络侧基于UE的类别信息进行攻击行为的控制的方法。即网络侧可以按照UE的类别信息，以UE的类别的粒度，实施对UE的接入的控制。
如图10所示，为本申请提供的一种收集网络设备的流量的方法。该方法包括：
步骤1001，SEDF向网络设备发送数据收集服务请求消息。
在具体实现中，SEDF发送的数据收集服务请求消息可以是订阅数据收集事件。
这里的网络设备可以是AMF、SMF、PCF、UPF、AF等。比如，对于AMF、UDM、PCF等与SEDF有服务化接口的网元，SEDF可以通过调用数据收集订阅服务，即SEDF向AMF、UDM、PCF分别发送数据收集服务请求消息，该消息用于请求AMF、UDM、PCF上报相关的数据信息。再比如，对于UPF、AF等与SEDF没有服务化接口的网元，可以通过SMF、NEF等有服务化接口的网元中转与SEDF之间的通信。
数据收集服务请求消息可以包含数据收集单元，收集范围。数据收集单元用于指示上报数据的格式，收集范围用于指示按何种粒度进行数据收集，这里，收集范围为按类别信息进行收集。数据收集服务请求消息还可以包含上报条件(或称为触发条件)，上报条件用于指示触发上报流量数据的条件，比如上报条件可以是一个阈值参数或时间间隔参数，其中，阈值参数用于指示符合上报条件的数据指标，此时，若某些数据指标超过指定阈值，则网络设备将需要上报数据收集单元所指示的数据信息。时间间隔用于指示周期性数据上报的间隔时间，此时，网络设备将会每隔一定的间隔时间上报数据收集单元所指示的数据信息。
步骤1002，网络设备收集流量数据，并向SEDF发送数据收集服务响应消息。
数据收集服务响应消息包括类别信息和类别信息对应的流量数据，类别信息指示的UE的流量数据满足上报条件。
例如，若网络设备为UPF时，数据收集单元指示收集目标IP的用户面流量单位时间的流数量、平均包大小、包大小方差、平均包间隔等信息，收集范围指示按所有类别信息进行收集，上报条件为时间间隔，其值为T。则UPF会对所有类别信息的用户面信息进行周期性统计。比如，若UPF共有100种类别信息(注意，可以是type的形式，也可以是{type1，type2}的形式，还可以是{type1，type2，type3，type 4}的形式)，则UPF对这100种类别信息每隔T时间段进行一次统计，获得100种类别对应的不同目标IP的单位时间的流数量、平均包大小、包大小方差、平均包间隔等信息，并向SEDF发送数据收集服务响应消息，该数据收集服务响应消息包括类别信息和类别信息对应的流量数据。
需要说明的是，上述网络设备可以通过图5-图7所示的任一实施例的方法获取到UE的类别信息，进而可以实现根据类别信息上报流量数据。例如，对于从SEDF接收到数据收集服务请求消息的网络设备，若该网络设备已经获得UE的类别信息，则可以实现直接根据类别信息上报流量数据。当然，对于从SEDF接收到数据收集服务请求消息的网络设备，若该网络设备没有UE的类别信息，则该网络设备可以从其他具有UE的类别信息的网络设备中获取UE的类别信息。
再例如，若网元为AMF时，数据收集单元指示收集控制面流量单位时间的流数量、平均包间隔等信息，收集范围指示按所有类别信息进行收集，上报条件为阈值触发，比如当单位时间的流数量超过阈值A时触发事件。则AMF会对所有类别信息的控制面信息进行周期性统计。比如，若AMF共有100种类别信息，则AMF对这100种类别信息进行实时统计，当某个类别信息在单位时间的流数量超过阈值A时，AMF向SEDF发送数据收集服务响应消息，该数据收集服务响应消息包括类别信息和类别信息对应的流量数据。
网络设备上报类别信息和类别信息对应的流量数据的具体实现方式，例如可以是：对于AMF、UDM等与SEDF有服务化接口的网络设备，可以通过调用数据收集服务的提示功能直接上报类别信息以及对应的流量数据到SEDF。对于UPF、AF等与SEDF没有服务化接口的网元，可以通过SMF、NEF等有服务化接口的网元中转与SEDF之间的通信，即上报类别信息和类别信息对应的流量数据。
需要说明的是，上述网络设备可以通过图5-图7所示的任一实施例的方法获取到UE的类别信息，进而可以实现根据类别信息上报流量数据。例如，对于从SEDF接收到数据收集服务请求消息的网络设备，若该设备已经获得UE的类别信息，例如图5-图7的情形一或情形三，则可以实现直接根据类别信息上报流量数据。当然，对于从SEDF接收到数据收集服务请求消息的网络设备，若该网络设备没有UE的类别信息，例如图5-图7的情形二，则该网络设备可以从其他具有UE的类别信息的网络设备中获取UE的类别信息。
步骤1003.SEDF根据UE的流量数据，确定异常类别信息。
比如，SEDF根据安全检测算法对类别信息对应的流量数据进行检测，确定异常类别信息。
作为一种示例，当针对外部AF的DDoS攻击发生时，大量的流量会同时访问同一个目标地址，这些流量具有相似的特征，并且很有可能属于同一类别，因为攻击者通常会攻陷同一类别的设备。这样会造成目的地址为该目标的单位时间的访问流数量、平均包大小、包大小方差、平均包间隔等数据发生异常，例如，单位时间内访问的流数量相较于正常时间段会激增，这是由于DDoS攻击的特性造成的；单位时间内的平均包大小相较于正常时间段变化值会减少，这是由于大量相同的用户面攻击包造成的；单位时间内的包大小方差会越来越趋近于0，这是由于大量相同的用户面攻击包造成的；单位时间内的平均包间隔相较于正常时间段变化值会减少，这是由于大量高速的用户面攻击包造成的。因此，这些参数可以作为检测DDoS攻击的输入特征，这些参数输入SEDF后，通过安全检测算法(如机器学习算法)可以得出该数据信息的组合是否存在异常，因此，可以得出该数据信息对应的类别信息是否存在异常。即识别出是哪些类别信息指示的终端造成的攻击。
作为另一种示例，当针对内部AMF或UDM的DDoS攻击发生时，大量的流量会同时访问同一个AMF或UDM，由于是信令消息，无需统计包大小、包方差，因为NAS消息长度差不多，故只需统计单位时间的流数量、平均包间隔等信息。例如，单位时间内访问AMF或UDM的流数量相较于正常时间段会激增，这是由于DDoS攻击的特性造成的；单位时间内的平均包间隔相较于正常时间段变化值会减少，这是由于大量高速的控制面攻击包造成的。因此，这些参数可以作为检测DDoS攻击的输入特征，当单位时间内访问AMF或UDM的流数量超过某个阈值后AMF或UDM将上述参数上报至SEDF，这些参数输入SEDF后，通过安全检测算法(如机器学习算法)可以得出该数据信息的组合是否存在异常，因此，可以得出该数据信息对应的类别信息是否存在异常。即识别出是哪些类别信息 指示的终端造成的攻击。
通过图10所示的实施例，SEDF根据类别信息和数据信息实现按类别信息粒度分析安全威胁的过程，分析速度相比于按UE级别分析更快，信令交互更少。
需要说明的是，SEDF在确定异常类别信息后，可以发送异常类别信息，以使接收到异常类别信息的网元可以根据异常类别信息控制UE的接入。下面给出控制UE接入的不同实现方式。
如图11所示，为本申请提供的一种控制UE接入的方法，该方法是通过控制面实施对存在异常行为的UE的控制。该方法包括以下步骤：
步骤1101，SEDF检测出异常UE(即存在异常行为的UE)，输出异常UE的标识。异常UE的标识可以是异常类别信息，也可以是异常UE的身份列表，例如永久签约标识(Subscription Permanent Identifier，SUPI)列表(list)等。SEDF可以通知AMF或者PCF异常UE的标识。
在一种实现方式中，SEDF向AMF发送异常类别信息。比如，SEDF可以通过图10所示的实施例的方式，检测到一个或多个异常类别信息。则在一种实现方式中，SEDF可以将检测到的所有的异常类别信息均发送至AMF，由AMF根据这些异常类别信息实施对与该异常类别信息匹配的终端的接入控制。在又一种实现方式中，SEDF也可以是只将获取到的所有类别信息中的部分异常类别信息发送至AMF，比如获取到100个异常类别信息，则可以按照预设的比例如30％，将该100个异常类别信息中包括的UE最多的前30％的异常类别信息发送至AMF，或者，可以按照预设的固定数量如50，将该100个异常类别信息中包括的UE最多的前50个异常类别信息发送至AMF，由AMF根据这些异常类别信息实施对与该异常类别信息匹配的终端的接入控制。
在又一种实现方式中，SEDF向PCF发送异常UE的身份列表，如SUPI list，PCF根据SUPI list映射出一个或多个异常类别信息，然后PCF向AMF发送异常类别信息。
在又一种实现方式中，SEDF向AMF发送异常UE的身份列表，如SUPI list，AMF根据SUPI list映射出一个或多个异常类别信息。需要说明的是，SEDF可以是根据现有技术的方法，基于UE粒度(per UE)获取到异常UE的身份列表。
步骤1102，AMF或PCF将身份列表映射为类别信息。
该步骤为可选步骤。当上述步骤1101中SEDF向PCF发送UE的身份列表时，则执行该步骤1102。
可选的，AMF或PCF将身份列表映射为类别信息，具体可以是确定身份列表中每一个终端所属的类别信息；根据所述身份列表中每一个终端所属的类别信息，确定异常类别信息。其中，确定异常类型信息可以包括如下实现方式：
在一种实现方式中，当AMF或PCF对SUPI list映射一个或多个类别时，AMF或PCF可以根据本地策略确定异常类别信息，本地策略可以包含绝对策略与相对策略。绝对策略可以根据预设的绝对阈值判断是否输出对应的类别信息作为异常类别信息，例如获取到100个SUPI，其中有60个SUPI属于类别A，有30个SUPI属于类别B，有10个SUPI属于类别C，管理员设置绝对阈值为30，则由于类别A和类别B的SUPI数量都大于或等于30，故最终确定类别A和类别B为异常类别信息，由于类别C小于绝对阈值，故确定不输出类别C为异常类别信息，在该示例中，类别A、类别B、类别C为候选异常类别信息，类别A和类别B为输出的异常类别信息。相对策略可以根据输出信息的相对比例判断 是否输出对应的类别信息作为异常类别信息，例如获取到100个SUPI，其中有60个SUPI属于类别A，有30个SUPI属于类别B，有10个SUPI属于类别C，管理员设置相对比例为30％，则由于类别A和类别B的SUPI数量占整体数量都大于或等于30％，故最终确定类别A和类别B为异常类别信息，由于类别C占整体数量小于30％，故确定不输出类别C为异常类别信息，在该示例中，类别A、类别B、类别C为候选异常类别信息，类别A和类别B为输出的异常类别信息。
在又一种实现方式中，AMF或PCF可以根据所述身份列表，以及终端的类别信息与终端的标识之间的对应关系，确定所述身份列表对应的候选异常类别信息，其中，所述身份列表中具有相同类别信息的终端对应同一个候选异常类别信息；针对每个候选异常类别信息，如果所述身份列表中归属于所述候选异常类别信息的终端数量与所述候选异常类别信息对应的所有终端的数量的比值大于预设的比例阈值，则确定所述候选异常类别信息为异常类别信息。例如身份列表中包括100个SUPI，映射为三个候选异常类别信息，分别为类别A、类别B和类别C，其中类别A对应的异常UE数量为30，类别B对应的异常UE数量为30，类别C对应的异常UE数量为40，预设的比例阈值为40％，并且，AMF或PCF确定归属于类别A的所有UE的数量为100，归属于类别B的所有UE的数量为50，归属于类别C的所有UE的数量为80，则类别A的异常UE比例为30/100＝30％，类别B的异常UE比例为30/50＝60％，类别C的异常UE比例为40/80＝50％，由于60％和50％均大于比例阈值40％，因此可以确定类别B和类别C均为异常类别信息。
步骤1103，AMF向基站发送类别信息，通知基站按类别信息限制终端的接入。
AMF可以根据本地策略决定按类别信息限制终端的接入，AMF也可以根据其他网元(如PCF，SEDF等)的通知，按类别信息限制终端的接入。
该类别信息用于指示存在异常行为的UE。
可选地，AMF还可以向基站发送限制指示，限制指示用于通知基站按类别信息限制终端的接入。
可选地，AMF还向基站发送计时器，该计时器用于指示限制失效时间。
步骤1104，基站根据类别信息构造广播数据包，广播数据包包含以下参数：
a.限制因子。
限制因子也可以称为限制指示，用于限制与类别信息匹配的UE的接入。在具体实现中，该限制因子可以是类似于图3所示的实施例中的ac-BarringFactor。
b.限制时间(可选)。
在具体实现中，该限制时间可以是类似于图3所示的实施例中的ac-BarringTime。
c.类别信息。
类别信息是基站从AMF获得的。其中，类别信息可以包括一个或者多个类别的信息。例如，步骤1102中确定的异常类别信息包括多个，则基站向UE发送的广播数据包可以包括该多个异常类别信息。
步骤1105，基站发送该广播数据包。
可选地，基站上还可以保存一个计时器。该计时器可以是基站自己根据策略生成的，也可以是由SEDF或AMF提供的。
基站接收类别信息之后，启动计时器，若计时器未超时，则基站广播发送广播数据包，直到计时器超时，则基站停止发送广播数据包。
步骤1106，基站下的所有UE接收到广播数据包，若UE的类别信息与广播数据包中的类别信息匹配，则UE限制UE的接入。
比如，若某个UE存储的类别信息是(C11、C22)，基站发送的广播数据包括的类别信息为类别(C11、C22；C12、C21)，由于广播数据包包括的类别信息包括UE存储的类别信息，因此UE的类别信息与广播数据包中的类别信息匹配，则UE限制UE的接入。
再比如，若某个UE存储的类别信息是(C12、C22)，基站发送的广播数据包括的类别信息为类别(C11、C22；C12、C21)，由于广播数据包包括的类别信息不包括UE存储的类别信息，因此UE的类别信息与广播数据包中的类别信息不匹配，则UE不限制UE的接入。
其中，UE限制UE的接入的具体实现方法，可以与图3所示的实施例中UE限制UE的接入的方法相同。即ac-BarringFactor是一个0到1之间的值，UE在每次尝试接入前，会先生成一个0到1之间的随机数，若生成的随机数小于ac-BarringFactor，则可以直接接入，否则不接入，并等待一段时间再次尝试。ac-BarringTime用于指示阻止接入的时间，当UE决定不接入时，等待ac-BarringTime的时间。
步骤1107，释放UE与基站之间的连接。
该步骤为可选步骤。
在一种实现方式中，UE在确定限制UE的接入时，可以主动释放与基站之间的连接。
在又一种实现方式中，还可以是基站根据UE的类别信息，确定该UE为需要限制接入的UE的，则基站释放与相应类别信息的UE的连接。比如，基站可以向相应的UE发送释放消息，释放消息可以包含原因值，原因值可以指示因安全原因释放UE，UE在收到该原因值的释放消息时，可以等待一段时间再尝试发起连接。此时，基站上需要预先在UE的上下文信息中保存UE的类别信息，该类别信息可以是UE在连接基站时携带在无线资源控制(radio resource control，RRC)消息中由基站获得的，也可以是基站与网络侧交互时，由网络侧通过S1连接或N2连接提供给基站的(如上述图5-图7所示的实施例)，还可以是基站间进行X2或者Xn交互时，由其他基站提供的。
需要说明的是，PCF或AMF可以通过图5-图7所示的任一实施例的方法获取到UE的类别信息，从而PCF或AMF可以将接收到的身份列表(即一个或多个UE的标识)映射为UE的类别信息。例如，若PCF或AMF已经获得UE的类别信息，例如图5-图7的情形一或情形三，即PCF或AMF上存储有多个UE的上下文，且一个UE的上下文中存储有该UE的类别信息和该UE的标识，从而PCF或AMF在接收到身份列表后，可以获取身份列表对应的类别信息。当然，若PCF或AMF没有UE的类别信息，例如图5-图7的情形二，则PCF或AMF可以向其他具有UE的类别信息的网络设备发送身份列表，再从其他具有UE的类别信息的网络设备中接收UE的类别信息。
需要说明的是，UE或基站可以通过图5-图7所示的任一实施例的方法获取到UE的类别信息，从而UE或基站可以根据接收到的类别信息限制终端的接入。例如，UE或基站已经可以根据图5-图7的情形四获得UE的类别信息。
通过图11所示的实施例，SEDF通知按照类别信息实现按类别信息粒度控制UE接入的过程，相比于现有的按UE粒度控制的方案，可实现一次控制多个UE接入的功能，减少了控制信令。进一步的，还可以增加计时器，提供了一种误报自恢复的方式，防止UE被长时间阻止入网。同时，基站可以释放与UE的连接，从而达到控制处于连接态的UE 的功能。
如图12所示，为本申请提供的又一种控制UE接入的方法，该方法是通过用户面实施对存在异常行为的UE的控制。该方法包括以下步骤：
步骤1201，SEDF检测出异常UE(即存在异常行为的UE)，输出异常UE的标识。UE的标识可以是异常类别信息，可以是异常UE的身份列表，例如SUPI list等。SEDF可以通知AMF或者PCF异常UE的标识。
在一种实现方式中，SEDF向PCF发送异常类别信息。具体实现方式，可以参考图11所示的实施例中步骤1101的相关描述。
在又一种实现方式中，SEDF向PCF发送异常UE的身份列表，如SUPI list，PCF根据SUPI list映射出一个或多个异常类别信息。需要说明的是，SEDF可以是根据现有技术的方法，基于UE粒度(per UE)获取到异常UE的身份列表。具体实现方式，可以参考图11所示的实施例中步骤1101的相关描述。
可选的，SEDF还向PCF发送受害者ID，用于标识被攻击目标，比如可以是IP地址以及端口号等。
步骤1202，PCF将身份列表映射为类别信息。
该步骤为可选步骤。当上述步骤1201中SEDF向PCF发送UE的身份列表时，则执行该步骤1202。
PCF将身份列表映射为类别信息的具体实现方式，可以参考图11的实施例的步骤1102中的相关描述。
步骤1203，PCF生成流匹配信息和流处理方法，用于控制存在异常行为的UE。
PCF可以根据本地策略决定按类别信息生成流匹配信息和流处理方法，PCF也可以根据其他网元(如SEDF)的通知，生成流匹配信息和流处理方法。流匹配信息用于匹配用户面流量，可以包含流五元组，例如源IP，源端口，目标IP，目标端口，协议类型。流处理方法用于控制匹配类别信息的UE发送的匹配流匹配信息的用户面流量。类别信息是从SEDF获得的，或者是由PCF映射获得的。
可选地，流匹配信息可以根据受害者ID生成，例如当受害者ID是IP地址以及端口号时，生成源IP是通配符，源端口是通配符，目标IP是受害者的IP地址，目标端口是受害者的端口号，协议类型是通配符的流匹配信息。
在一种实现方式中，PCF可以生成控制策略，该控制策略包括上述流匹配信息和流处理方法。该控制策略可以是特殊的策略和计费控制(Policy and Charging Control，PCC)规则(rule)。例如，PCF生成包含较低服务质量(Quality of Service,QoS)以及流匹配模板的PCC rule，用于指示UPF在匹配流匹配模板时，若当前流属于类别信息的UE发送，则实施对应的QoS控制。或者，PCF生成包含门gate以及流匹配模板的PCC rule，用于指示UPF在匹配流匹配模板时，若当前流属于类别信息的UE发送，则丢弃相关流量。其中，流匹配模板可以用于标识访问受害者ID的流量。如此，可以在UPF控制整个类别信息对应的整体流量。可选的，该控制策略还可以包括上述类别信息。
步骤1204，PCF向SMF发送类别信息、流匹配信息和流处理方法。
在一种实现方式中，PCF向SMF发送类别信息和控制策略，该控制策略包括流匹配信息和流处理方法。
在又一种实现方式中，PCF向SMF发送控制策略，该控制策略包括类别信息、流匹配信息和流处理方法。
可选地，PCF还向SMF发送一个计时器。
步骤1205，SMF向UPF发送类别信息、流匹配信息和流处理方法。
在一种实现方式中，SMF向UPF发送类别信息和控制策略，该控制策略包括流匹配信息和流处理方法。
在又一种实现方式中，SMF向UPF发送控制策略，该控制策略包括类别信息、流匹配信息和流处理方法。
可选地，SMF还向UPF发送一个计时器。
步骤1206，UPF根据类别信息、流匹配信息和流处理方法控制用户面流量。
UPF监控用户面流量，当流量匹配流匹配信息且该流量属于类别信息对应的UE时，则UPF根据流处理方法执行控制指令。若流处理方法包括丢弃操作，则UPF丢弃用户面流量。若流处理方法包括服务质量修改操作，UPF修改用户面流量的服务质量。
例如，UPF根据本地存储的映射表，该映射表存储有源IP与类别信息的对应关系，一个源IP用于标识一个UE。当用户面流量的目标IP匹配流匹配信息的目标IP时，UPF查看源IP，UPF根据映射表获得源IP的类别信息，若源IP对应的类别信息与接收的类别信息匹配，则UPF执行对应的流处理方法，例如丢弃该用户面流量。
可选地，UPF上还可以保存一个计时器。该计时器可以是UPF自己根据策略生成的，也可以是由SEDF或PCF提供的。该计时器用于指示执行用户面流量控制的时间。
需要说明的是，PCF可以通过图5-图7所示的任一实施例的方法获取到UE的类别信息，从而PCF可以将接收到的身份列表(即一个或多个UE的标识)映射为UE的类别信息。例如，若PCF已经获得UE的类别信息，例如图5-图7的情形一或情形三，即PCF上存储有多个UE的上下文，且一个UE的上下文中存储有该UE的类别信息和该UE的标识，从而PCF在接收到身份列表后，可以获取身份列表对应的类别信息。当然，若PCF没有UE的类别信息，例如图5-图7的情形二，则PCF可以向其他具有UE的类别信息的网络设备发送身份列表，再从其他具有UE的类别信息的网络设备中接收UE的类别信息。
需要说明的是，SMF或UPF可以通过图8所示的方法获取到UE的类别信息，从而SMF或UPF可以根据接收到的类别信息限制终端的接入。
通过图12所示的实施例，SEDF通知PCF按照类别信息实现按类别信息粒度限制UE接入的过程，相比于现有的按UE粒度控制的方案，可实现一次控制多个UE流量，减少了控制信令，同时也减少了UPF上的策略数量，也可以精确控制异常的类别。进一步的，还可以增加计时器，提供了一种误报自恢复的方式，防止UE被长时间阻止入网。
上述主要从各个网元之间交互的角度对本申请提供的方案进行了介绍。可以理解的是，上述实现各网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本发明能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
在采用集成的单元的情况下，图13示出了本发明实施例中所涉及的装置的可能的示例性框图，该装置1300可以以软件的形式存在，也可以以硬件的形式存在，还可以以软件和硬件的形式存在，本申请实施例不做限定。装置1300可以包括：处理单元1302和通信单元1303。作为一种实现方式，该通信单元1303可以包括接收单元和/或发送单元。处理单元1302用于对装置1300进行控制管理。通信单元1303用于支持装置1300与其他网络实体的通信。装置1300还可以包括存储单元1301，用于存储装置1300的程序代码和数据。
其中，处理单元1302可以是处理器或控制器，例如可以是通用中央处理器(central processing unit，CPU)，通用处理器，数字信号处理(digital signal processing，DSP)，专用集成电路(application specific integrated circuits，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明实施例公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包括一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元1303可以是通信接口、收发器或收发电路等，其中，该通信接口是统称，在具体实现中，该通信接口可以包括多个接口。存储单元1301可以是存储器。
在第一种应用中，该装置1300可以为上述任一实施例中的接入网设备，还可以为接入网设备中的芯片。例如，当装置1300为接入网设备时，该处理单元1302例如可以是处理器，该通信单元例如可以是收发器，该收发器包括射频电路，可选地，该存储单元例如可以是存储器。例如，当装置1300为接入网设备中的芯片时，该处理单元1302例如可以是处理器，该通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元1302可执行存储单元存储的计算机执行指令，可选地，该存储单元为该芯片内的存储单元，如寄存器、缓存等，该存储单元还可以是该接入网设备内的位于该芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。
具体地，当通信单元1303包括发送单元和接收单元时：接收单元，用于从核心网网元接收异常类别信息；发送单元，用于发送广播数据包，广播数据包包括异常类别信息，广播数据包用于限制与异常类别信息匹配的终端的接入。
在一种可能的实现方式中，接收单元，还用于在发送单元发送广播数据包之前，从所述核心网网元接收限制指示，所述限制指示用于指示根据所述限制指示限制于所述异常类别信息匹配的终端的接入。
在一种可能的实现方式中，处理单元，还用于在接收单元接收异常类别信息之后，启动计时器。发送单元，具体用于若计时器未超时，则发送广播数据包。
在第二种应用中，该装置1300可以为上述任一实施例中的终端，还可以为终端中的芯片。例如，装置1300可以为终端时，该处理单元1302例如可以是处理器，该通信单元例如可以是收发器，该收发器包括射频电路，可选地，该存储单元例如可以是存储器。例如，装置1300可以为终端中的芯片时，该处理单元1302例如可以是处理器，该通信单元例如可以是输入/输出接口、管脚或电路等。可选地，该存储单元为该芯片内的存储单元，如寄存器、缓存等，该存储单元还可以是该终端内的位于该芯片外部的存储单元，如ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM等。
具体地，当通信单元1303包括发送单元和接收单元时，接收单元，用于从接入网设备接收广播信息，所述广播信息包括异常类别信息，所述广播数据包用于限制与所述异常类别信息匹配的终端的接入。处理单元，用于若终端的类别信息与接收到的异常类别信息匹配，则限制终端的接入，所述终端的类别信息是所述终端从核心网网元接收到的。
在一种可能的实现方式中，接收单元，还用于从所述核心网网元接收所述终端的类别信息，所述终端的类别信息是根据所述终端的信息生成的，所述终端的信息包括下列信息中的部分或全部信息：
所述终端的功能信息，所述功能信息用于指示所述终端的能力信息；
所述终端的用户信息，所述用户信息用于指示所述终端的拥有者信息；
所述终端的设备信息，所述设备信息用于指示所述终端的制造信息；
所述终端的位置信息，所述位置信息用于指示所述终端所在的位置。
在一种可能的实现方式中，处理单元，还用于释放与接入网设备的连接。
在第三种应用中，该装置1300可以为上述任一实施例中的核心网网元，还可以为核心网网元中的芯片，这里的核心网网元可以是移动性管理网元或策略控制网元。例如，装置1300可以为核心网网元时，该处理单元1302例如可以是处理器，该通信单元例如可以是收发器，该收发器包括射频电路，可选地，该存储单元例如可以是存储器。例如，装置1300可以为核心网网元中的芯片时，该处理单元1302例如可以是处理器，该通信单元例如可以是输入/输出接口、管脚或电路等。可选地，该存储单元为该芯片内的存储单元，如寄存器、缓存等，该存储单元还可以是该核心网网元内的位于该芯片外部的存储单元，如ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM等。
具体地，当通信单元1303包括发送单元和接收单元时：处理单元，用于针对接入网络的N个终端，获取所述N个终端的信息，N为正整数；其中，一个终端的信息包括下列信息中的部分或全部信息：
终端的功能信息，功能信息用于指示终端的能力信息；
终端的用户信息，用户信息用于指示终端的拥有者信息；
终端的设备信息，设备信息用于指示终端的制造信息；
终端的位置信息，位置信息用于指示终端所在的位置。
所述处理单元，还用于针对所述N个终端中的每个终端，根据终端的信息，确定终端的类别信息。
在一种可能的实现方式中，所述终端的功能信息包括网络能力、移动站网络能力、移动站类别掩码2、移动站类别掩码3、支持的编码、增加的更新类别、语音域偏好、终端的使用设置、终端的设备性能、移动台支持网络特征中的部分或全部参数，所述终端的用户信息包括组标识、管理员标识、公司标识中的部分或全部参数，所述终端的设备信息包括终端的设备标识码的类别分配号、软件版本号中的部分或全部参数。
在一种可能的实现方式中，处理单元，用于根据终端的信息，确定终端的类别信息，具体包括：根据终端的位置信息，确定终端的类别信息中的第一类别；根据终端的功能信息、用户信息或设备信息中的部分或全部信息，确定终端的类别信息中的第二类别。
在一种可能的实现方式中，处理单元，还用于若终端的位置信息发生更新，则根据更新后的位置信息，更新终端的类别信息中的第一类别。
在一种可能的实现方式中，发送单元，用于向通信设备发送终端的类别信息，通信设 备包括以下设备中的部分或全部设备：终端、接入网设备、移动性管理网元、会话管理网元、策略控制网元、用户面网元。
在一种可能的实现方式中，接收单元，用于接收指示信息，指示信息用于指示确定终端的类别信息。
在一种可能的实现方式中，所述核心网网元为策略控制网元，所述策略控制网元包括存储单元，所述存储单元，用于针对所述N个终端中的每个终端，存储所述终端的类别信息与所述终端的标识之间的对应关系。
在第四种应用中，该装置1300可以为上述任一实施例中的策略控制网元，还可以为策略控制网元中的芯片。例如，装置1300可以为策略控制网元时，该处理单元1302例如可以是处理器，该通信单元例如可以是收发器，该收发器包括射频电路，可选地，该存储单元例如可以是存储器。例如，装置1300可以为策略控制网元中的芯片时，该处理单元1302例如可以是处理器，该通信单元例如可以是输入/输出接口、管脚或电路等。可选地，该存储单元为该芯片内的存储单元，如寄存器、缓存等，该存储单元还可以是该策略控制网元内的位于该芯片外部的存储单元，如ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM等。
具体地，当通信单元1303包括发送单元和接收单元时：接收单元，用于接收来自安全检测网元的异常终端的身份列表，所述身份列表用于指示一个或多个异常终端；处理单元，用于根据本地策略和所述身份列表以及终端的类别信息与终端的标识之间的对应关系，确定异常类别信息；发送单元，用于发送异常类别信息。
在一种可能的实现方式中，处理单元，具体用于：
根据所述身份列表，终端的类别信息与终端的标识之间的对应关系，确定所述身份列表对应的候选异常类别信息，其中，所述身份列表中具有相同类别信息的终端对应同一个候选异常类别信息；
针对每个候选异常类别信息，如果身份列表中归属于所述候选异常类别信息的终端数量与所述候选异常类别信息对应的所有终端的数量的比值大于预设的比例阈值，则确定所述候选异常类别信息为异常类别信息；或者，
针对每个候选异常类别信息，如果身份列表中归属于所述候选异常类别信息的终端数量大于预设的数量阈值，则确定所述候选异常类别信息为异常类别信息。
在一种可能的实现方式中，发送单元，具体用于向接入网设备发送异常类别信息。
在一种可能的实现方式中，发送单元，具体用于向用户面网元发送异常类别信息；发送单元，还用于向用户面网元发送流匹配信息和流处理方法，流匹配信息用于匹配用户面流量，流处理方法用于控制匹配异常类别信息的终端发送的匹配流匹配信息的用户面流量。
在第五种应用中，该装置1300可以为上述任一实施例中的安全检测网元，还可以为安全检测网元中的芯片。例如，装置1300可以为安全检测网元时，该处理单元1302例如可以是处理器，该通信单元例如可以是收发器，该收发器包括射频电路，可选地，该存储单元例如可以是存储器。例如，装置1300可以为安全检测网元中的芯片时，该处理单元1302例如可以是处理器，该通信单元例如可以是输入/输出接口、管脚或电路等。可选地，该存储单元为该芯片内的存储单元，如寄存器、缓存等，该存储单元还可以是该安全检测网元内的位于该芯片外部的存储单元，如ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM等。
具体地，当通信单元1303包括发送单元和接收单元时：处理单元，用于根据终端的流量数据，确定存在异常类别信息；发送单元，用于发送异常类别信息。
在一种可能的实现方式中，发送单元，还用于在处理单元根据终端的流量数据确定存在异常行为的终端的类别信息之前，向网络设备发送数据收集服务请求消息，数据收集服务请求消息包括数据收集单元和数据收集范围，数据收集单元用于指示上报的数据的格式，数据收集范围用于指示按终端的类别信息进行收集。接收单元，用于接收网络设备发送的数据收集服务响应消息，数据收集服务响应消息包括类别信息和类别信息对应的流量数据，类别信息指示的终端的流量数据满足上报条件。
在一种可能的实现方式中，数据收集服务请求消息还包括上报条件，上报条件用于指示触发上报流量数据的条件。
在一种可能的实现方式中，网络设备包括下列设备中的部分或全部设备：移动性管理网元、会话管理网元、策略控制网元、用户面网元。
在一种可能的实现方式中，处理单元，用于根据终端的流量数据，确定异常类别信息，具体包括：根据安全检测算法对类别信息对应的流量数据进行检测，确定异常类别信息。
在第六种应用中，该装置1300可以为上述任一实施例中的用户面网元，还可以为用户面网元中的芯片。例如，装置1300可以为用户面网元时，该处理单元1302例如可以是处理器，该通信单元例如可以是收发器，该收发器包括射频电路，可选地，该存储单元例如可以是存储器。例如，装置1300可以为用户面网元中的芯片时，该处理单元1302例如可以是处理器，该通信单元例如可以是输入/输出接口、管脚或电路等。可选地，该存储单元为该芯片内的存储单元，如寄存器、缓存等，该存储单元还可以是该用户面网元内的位于该芯片外部的存储单元，如ROM或可存储静态信息和指令的其他类型的静态存储设备，RAM等。
具体地，当通信单元1303包括发送单元和接收单元时：接收单元，用于接收异常类别信息、流匹配信息和流处理方法；处理单元，用于若用户面流量与流匹配信息匹配、且发送用户面流量的终端匹配异常类别信息，则根据流处理方法执行对用户面流量的控制。
在一种可能的实现方式中，处理单元，具体用于若流处理方法包括丢弃操作，则丢弃用户面流量；或者，若流处理方法包括服务质量修改操作，修改用户面流量的服务质量。
图13所示的装置为终端、或为接入网设备、或为核心网网元、或为策略控制网元、或为安全检测网元、或为用户面网元时，所用于执行的类别信息的确定方法、控制终端接入的方法的具体有益效果，可参考前述方法实施例中的相关描述，这里不再赘述。
参阅图14所示，为本申请提供的一种装置示意图，该装置可以是上述终端、接入网设备、移动性管理网元、策略控制网元、用户面网元、或安全检测网元。该装置1400包括：处理器1402、通信接口1403、存储器1401。可选的，装置1400还可以包括总线1404。其中，通信接口1403、处理器1402以及存储器1401可以通过通信线路1404相互连接；通信线路1404可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。所述通信线路1404可以分为地址总线、数据总线、控制总线等。为便于表示，图14中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
处理器1402可以是一个CPU，微处理器，ASIC，或一个或多个用于控制本申请方案 程序执行的集成电路。
通信接口1403，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)，有线接入网等。
存储器1401可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically er服务器able programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路1404与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器1401用于存储执行本申请方案的计算机执行指令，并由处理器1402来控制执行。处理器1402用于执行存储器1401中存储的计算机执行指令，从而实现本申请上述实施例提供的类别信息的确定方法、控制终端接入的方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
本领域普通技术人员可以理解：本申请中涉及的第一、第二等各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围，也表示先后顺序。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。“至少一个”是指一个或者多个。至少两个是指两个或者多个。“至少一个”、“任意一个”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个、种)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(Solid State Disk，SSD))等。
本申请实施例中所描述的各种说明性的逻辑单元和电路可以通过通用处理器，数字信号处理器，专用集成电路(ASIC)，现场可编程门阵列(FPGA)或其它可编程逻辑装置， 离散门或晶体管逻辑，离散硬件部件，或上述任何组合的设计来实现或操作所描述的功能。通用处理器可以为微处理器，可选地，该通用处理器也可以为任何传统的处理器、控制器、微控制器或状态机。处理器也可以通过计算装置的组合来实现，例如数字信号处理器和微处理器，多个微处理器，一个或多个微处理器联合一个数字信号处理器核，或任何其它类似的配置来实现。
本申请实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件单元、或者这两者的结合。软件单元可以存储于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息。可选地，存储媒介还可以集成到处理器中。处理器和存储媒介可以设置于ASIC中，ASIC可以设置于终端中。可选地，处理器和存储媒介也可以设置于终端中的不同的部件中。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (43)

  1. 一种类别信息的确定方法，其特征在于，包括：
    针对接入网络的N个终端，核心网网元获取所述N个终端的信息，N为正整数，其中，一个终端的信息包括下列信息中的部分或全部信息：
    所述终端的功能信息，所述功能信息用于指示所述终端的能力信息；
    所述终端的用户信息，所述用户信息用于指示所述终端的拥有者信息；
    所述终端的设备信息，所述设备信息用于指示所述终端的制造信息；
    所述终端的位置信息，所述位置信息用于指示所述终端所在的位置；
    针对所述N个终端中的每个终端，所述核心网网元根据所述终端的信息，确定所述终端的类别信息。
  2. 如权利要求1所述的方法，其特征在于，所述终端的功能信息包括网络能力、移动站网络能力、移动站类别掩码2、移动站类别掩码3、支持的编码、增加的更新类别、语音域偏好、终端的使用设置、终端的设备性能、移动台支持网络特征中的部分或全部参数，所述终端的用户信息包括组标识、管理员标识、公司标识中的部分或全部参数，所述终端的设备信息包括终端的设备标识码的类别分配号、软件版本号中的部分或全部参数。
  3. 如权利要求1或2所述的方法，其特征在于，所述核心网网元根据所述终端的信息，确定所述终端的类别信息，包括：
    所述核心网网元根据所述终端的位置信息，确定所述终端的类别信息中的第一类别；
    所述核心网网元根据所述终端的功能信息、用户信息或设备信息中的部分或全部信息，确定所述终端的类别信息中的第二类别。
  4. 如权利要求3所述的方法，其特征在于，所述方法还包括：
    若所述终端的位置信息发生更新，则所述核心网网元根据更新后的位置信息，更新所述终端的类别信息中的第一类别。
  5. 如权利要求1至4任一项所述的方法，其特征在于，所述核心网网元为策略控制网元；
    针对所述N个终端中的每个终端，所述策略控制网元存储所述终端的类别信息与所述终端的标识之间的对应关系。
  6. 如权利要求5所述的方法，其特征在于，所述方法还包括：
    所述策略控制网元从安全检测网元接收所述N个终端中的异常终端的身份列表，所述身份列表用于指示一个或多个异常终端；
    所述策略控制网元根据本地策略、所述身份列表，以及终端的类别信息与终端的标识之间的对应关系，确定异常类别信息；
    所述策略控制网元发送所述异常类别信息。
  7. 如权利要求6所述的方法，其特征在于，所述策略控制网元根据本地策略、所述身份列表，以及终端的类别信息与终端的标识之间的对应关系，确定异常类别信息，包括：
    所述控制策略网元根据所述身份列表，以及终端的类别信息与终端的标识之间的对应关系，确定所述身份列表对应的候选异常类别信息，其中，所述身份列表中具有相同类别信息的终端对应同一个候选异常类别信息；
    针对每个候选异常类别信息，如果所述身份列表中归属于所述候选异常类别信息的终 端数量与所述候选异常类别信息对应的所有终端的数量的比值大于预设的比例阈值，则确定所述候选异常类别信息为异常类别信息；或者，
    针对每个候选异常类别信息，如果所述身份列表中归属于所述候选异常类别信息的终端数量大于预设的数量阈值，则确定所述候选异常类别信息为异常类别信息。
  8. 如权利要求6或7所述的方法，其特征在于，所述策略控制网元发送所述异常类别信息，包括：
    所述策略控制网元向用户面网元发送所述异常类别信息；
    所述方法还包括：
    所述策略控制网元向所述用户面网元发送流匹配信息和流处理方法，所述流匹配信息用于匹配用户面流量，所述流处理方法用于控制匹配所述异常类别信息的终端发送的匹配所述流匹配信息的用户面流量。
  9. 一种控制终端接入的方法，其特征在于，包括：
    用户面网元接收异常类别信息、流匹配信息和流处理方法；
    若用户面流量与所述流匹配信息匹配、且发送所述用户面流量的终端匹配所述异常类别信息，则所述用户面网元根据所述流处理方法执行对所述用户面流量的控制。
  10. 如权利要求9所述的方法，其特征在于，所述用户面网元根据所述流处理方法执行对所述用户面流量的控制，包括：
    若所述流处理方法包括丢弃操作，则所述用户面网元丢弃所述用户面流量；或者，
    若所述流处理方法包括服务质量修改操作，所述用户面网元修改所述用户面流量的服务质量。
  11. 一种控制终端接入的方法，其特征在于，包括：
    接入网设备从核心网网元接收异常类别信息；
    所述接入网设备发送广播数据包，所述广播数据包包括所述异常类别信息，所述广播数据包用于限制与所述异常类别信息匹配的终端的接入。
  12. 如权利要求11所述的方法，其特征在于，所述接入网设备发送广播数据包之前，还包括：
    所述接入网设备从所述核心网网元接收限制指示，所述限制指示用于指示根据所述限制指示限制于所述异常类别信息匹配的终端的接入。
  13. 一种控制终端接入的方法，其特征在于，包括：
    终端从核心网网元接收所述终端的类别信息，所述终端的类别信息是根据所述终端的信息生成的，所述终端的信息包括下列信息中的部分或全部信息：
    所述终端的功能信息，所述功能信息用于指示所述终端的能力信息；
    所述终端的用户信息，所述用户信息用于指示所述终端的拥有者信息；
    所述终端的设备信息，所述设备信息用于指示所述终端的制造信息；
    所述终端的位置信息，所述位置信息用于指示所述终端所在的位置；
    所述终端从接入网设备接收广播数据包，所述广播数据包包括异常类别信息，所述广播数据包用于限制与所述异常类别信息匹配的终端的接入；
    若所述异常类别信息与所述终端的类别信息匹配，则所述终端限制所述终端的接入。
  14. 一种通信装置，其特征在于，包括：
    处理单元，用于针对接入网络的N个终端，获取所述N个终端的信息，其中，一个终 端的信息包括下列信息中的部分或全部信息：
    所述终端的功能信息，所述功能信息用于指示所述终端的能力信息；
    所述终端的用户信息，所述用户信息用于指示所述终端的拥有者信息；
    所述终端的设备信息，所述设备信息用于指示所述终端的制造信息；
    所述终端的位置信息，所述位置信息用于指示所述终端所在的位置；
    所述处理单元，还用于针对所述N个终端中的每个终端，根据所述终端的信息，确定所述终端的类别信息。
  15. 如权利要求14所述的装置，其特征在于，所述终端的功能信息包括网络能力、移动站网络能力、移动站类别掩码2、移动站类别掩码3、支持的编码、增加的更新类别、语音域偏好、终端的使用设置、终端的设备性能、移动台支持网络特征中的部分或全部参数，所述终端的用户信息包括组标识、管理员标识、公司标识中的部分或全部参数，所述终端的设备信息包括终端的设备标识码的类别分配号、软件版本号中的部分或全部参数。
  16. 如权利要求14或15所述的装置，其特征在于，所述处理单元，具体用于根据所述终端的位置信息，确定所述终端的类别信息中的第一类别；以及，根据所述终端的功能信息、用户信息或设备信息中的部分或全部信息，确定所述终端的类别信息中的第二类别。
  17. 如权利要求16所述的装置，其特征在于，所述处理单元，还用于若所述终端的位置信息发生更新，则根据更新后的位置信息，更新所述终端的类别信息中的第一类别。
  18. 如权利要求14至17中任一所述的装置，其特征在于，所述装置为策略控制网元；
    所述策略控制网元还包括存储单元，用于针对所述N个终端中的每个终端，存储所述终端的类别信息与所述终端的标识之间的对应关系。
  19. 如权利要求18所述的装置，其特征在于，所述处理单元，还用于从安全检测网元接收所述N个终端中的异常终端的身份列表，所述身份列表用于指示一个或多个异常终端；以及，根据本地策略、所述身份列表，以及终端的类别信息与终端的标识之间的对应关系，确定异常类别信息；
    所述策略控制网元还包括发送单元，用于发送所述异常类别信息。
  20. 如权利要求19所述的装置，其特征在于，所述处理单元，具体用于：
    根据所述身份列表，以及终端的类别信息与终端的标识之间的对应关系，确定所述身份列表对应的候选异常类别信息，其中，所述身份列表中具有相同类别信息的终端对应同一个候选异常类别信息；
    针对每个候选异常类别信息，如果所述身份列表中归属于所述候选异常类别信息的终端数量与所述候选异常类别信息对应的所有终端的数量的比值大于预设的比例阈值，则确定所述候选异常类别信息为异常类别信息；或者，
    针对每个候选异常类别信息，如果所述身份列表中归属于所述候选异常类别信息的终端数量大于预设的数量阈值，则确定所述候选异常类别信息为异常类别信息。
  21. 如权利要求19或20所述的装置，其特征在于，所述发送单元，具体用于向用户面网元发送所述异常类别信息；以及，向所述用户面网元发送流匹配信息和流处理方法，所述流匹配信息用于匹配用户面流量，所述流处理方法用于控制匹配所述异常类别信息的终端发送的匹配所述流匹配信息的用户面流量。
  22. 一种通信装置，其特征在于，包括：
    接收单元，用于接收异常类别信息、流匹配信息和流处理方法；
    处理单元，用于若用户面流量与所述流匹配信息匹配、且发送所述用户面流量的终端匹配所述异常类别信息，则根据所述流处理方法执行对所述用户面流量的控制。
  23. 如权利要求22所述的装置，其特征在于，所述处理单元，具体用于：
    若所述流处理方法包括丢弃操作，则丢弃所述用户面流量；或者，
    若所述流处理方法包括服务质量修改操作，则修改所述用户面流量的服务质量。
  24. 一种装置，其特征在于，包括：
    接收单元，用于从核心网网元接收异常类别信息；
    发送单元，用于发送广播数据包，所述广播数据包包括所述异常类别信息，所述广播数据包用于限制与所述异常类别信息匹配的终端的接入。
  25. 如权利要求24所述的装置，其特征在于，所述接收单元，还用于在所述发送单元发送广播数据包之前，从所述核心网网元接收限制指示，所述限制指示用于指示根据所述限制指示限制于所述异常类别信息匹配的终端的接入。
  26. 一种装置，其特征在于，包括：
    接收单元，用于从所述核心网网元接收所述终端的类别信息，所述终端的类别信息是根据所述终端的信息生成的，所述终端的信息包括下列信息中的部分或全部信息：
    所述终端的功能信息，所述功能信息用于指示所述终端的能力信息；
    所述终端的用户信息，所述用户信息用于指示所述终端的拥有者信息；
    所述终端的设备信息，所述设备信息用于指示所述终端的制造信息；
    所述终端的位置信息，所述位置信息用于指示所述终端所在的位置；
    所述接收单元，还用于从接入网设备接收广播数据包，所述广播数据包包括所述异常类别信息，所述广播数据包用于限制与所述异常类别信息匹配的终端的接入；
    处理单元，用于若所述异常类别信息与所述终端的类别信息匹配，则限制所述终端的接入。
  27. 一种类别信息的确定方法，其特征在于，包括：
    安全检测功能向移动性管理网元发送订阅数据收集事件，所述订阅数据收集事件包括收集范围以及上报条件；其中，所述收集范围用于指示按照终端的类别信息进行数据收集，所述所述上报条件用于指示触发上报流量数据的条件；
    所述安全检测功能网元从所述移动性管理网元接收数据收集服务响应消息，所述数据收集服务响应消息包括第一类别信息和所述第一类别信息对应的流量数据；其中，所述第一类别信息对应的流量数据满足所述上报条件；
    所述安全检测功能网元根据所述流量数据，确定异常类别信息；
    所述安全检测功能网元向策略控制网元发送所述异常类别信息。
  28. 如权利要求27所述的方法，其特征在于，所述异常类别信息用于对与所述异常类别信息匹配的终端进行接入控制。
  29. 如权利要求27或28所述的方法，其特征在于，所述第一类别信息由所述终端的设备信息确定。
  30. 如权利要求29所述的方法，其特征在于，所述终端的设备信息包括所述终端的设备标识码的类别分配号TAC。
  31. 一种控制终端接入的方法，其特征在于，包括：
    策略管理网元接收安全检测功能网元发送的异常类别信息；
    所述策略管理网元生成流匹配信息和流处理方法；其中，所述流匹配信息用于匹配用户面流量，所述流处理方法用于控制匹配所述异常类别信息的终端发送的与所述流匹配信息相匹配的用户面流量；
    所述策略管理网元向会话管理网元发送所述异常类别信息、所述流匹配信息和所述流处理方法。
  32. 如权利要求31所述的方法，其特征在于，所述方法还包括：
    所述策略管理网元接收所述安全检测功能网元发送的受害者ID，所述受害者ID用于标识被攻击目标；
    所述策略管理网元生成流匹配信息，所述方法包括：
    所述策略管理网元根据所述受害者ID生成所述流匹配信息。
  33. 如权利要求31或32所述的方法，其特征在于，所述策略管理网元生成流匹配信息和流处理方法，包括：
    所述策略管理网元生成策略和计费控制规则，所述策略和计费控制规则包括所述流匹配信息和所述流处理方法。
  34. 如权利要求33所述的方法，其特征在于，所述策略和计费控制规则用于指示丢弃匹配所述异常类别信息的终端发送的与所述流匹配信息相匹配的用户面流量。
  35. 一种通信装置，其特征在于，包括，所述通信装置包括存储器以及与所述存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求1-8任一项所述的方法。
  36. 一种通信装置，其特征在于，包括，所述通信装置包括存储器以及与所述存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求9-12任一项所述的方法。
  37. 一种通信装置，其特征在于，包括，所述通信装置包括存储器以及与所述存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求13所述的方法。
  38. 一种通信装置，其特征在于，包括，所述通信装置包括存储器以及与所述存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求27-30任一项所述的方法。
  39. 一种通信装置，其特征在于，包括，所述通信装置包括存储器以及与所述存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求31-34任一项所述的方法。
  40. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1-8、9-12、13、27-30或者31-34任一项所述的方法。
  41. 一种包含指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得计 算机执行如权利要求1-8、9-12、13、27-30或者31-34任一项所述的方法。
  42. 一种计算机芯片，其特征在于，所述芯片与存储器相连，所述芯片用于读取并执行所述存储器中存储的软件程序，执行如权利要求1-8、9-12、13、27-30或者31-34任一项所述的方法。
  43. 一种通信系统，其特征在于，包括如权利要求38所述的装置和如权利要求39所述的装置。
PCT/CN2019/114760 2018-11-02 2019-10-31 类别信息的确定方法及装置 Ceased WO2020088598A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19878522.2A EP3863317B1 (en) 2018-11-02 2019-10-31 Method and device for determining category information
US17/245,570 US12425861B2 (en) 2018-11-02 2021-04-30 Method for determining class information and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811302764.0 2018-11-02
CN201811302764.0A CN111148105B (zh) 2018-11-02 2018-11-02 类别信息的确定方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/245,570 Continuation US12425861B2 (en) 2018-11-02 2021-04-30 Method for determining class information and apparatus

Publications (1)

Publication Number Publication Date
WO2020088598A1 true WO2020088598A1 (zh) 2020-05-07

Family

ID=70464614

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/114760 Ceased WO2020088598A1 (zh) 2018-11-02 2019-10-31 类别信息的确定方法及装置

Country Status (4)

Country Link
US (1) US12425861B2 (zh)
EP (1) EP3863317B1 (zh)
CN (2) CN115426653B (zh)
WO (1) WO2020088598A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114885333A (zh) * 2022-05-30 2022-08-09 绿盟科技集团股份有限公司 一种违规组织识别方法、装置、设备及介质
US20230075085A1 (en) * 2021-09-03 2023-03-09 Verizon Patent And Licensing Inc. End-to-end encryption for multiple recipient devices

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7088414B2 (ja) * 2018-11-08 2022-06-21 日本電気株式会社 統一されたアクセス制御に関連するパラメータを更新する手順
US11522879B2 (en) * 2020-05-20 2022-12-06 At&T Intellectual Property I, L.P. Scrubber for distributed denial of service attacks targetting mobile networks
US12348425B2 (en) * 2020-06-25 2025-07-01 Telefonaktiebolaget Lm Ericsson (Publ) Network blocking of user equipment application
WO2022061675A1 (zh) 2020-09-24 2022-03-31 华为技术有限公司 一种数据分析方法及装置
CN113645640B (zh) * 2021-08-06 2024-09-24 腾讯科技（深圳）有限公司 网络信息开放方法及相关设备
CN113872802B (zh) * 2021-09-17 2024-01-19 支付宝(杭州)信息技术有限公司 检测网元的方法和装置
CN113873455B (zh) * 2021-11-02 2024-08-27 中国电信股份有限公司 流量统计方法及其系统、计算机可读存储介质
CN114158074B (zh) * 2021-11-29 2024-03-29 北京恒安嘉新安全技术有限公司 一种5g网元地址确定方法、装置、电子设备及存储介质
US11936545B1 (en) * 2022-01-11 2024-03-19 Splunk Inc. Systems and methods for detecting beaconing communications in aggregated traffic data
KR20230161816A (ko) * 2022-05-19 2023-11-28 삼성전자주식회사 Ue의 이상 행동을 감지하여 사업자 망에서 처리하는 방법 및 장치
CN117580094A (zh) * 2022-08-08 2024-02-20 腾讯科技（深圳）有限公司 数据包传输方法及相关设备
CN118138535A (zh) * 2022-12-02 2024-06-04 大唐移动通信设备有限公司 信息传输、处理方法及装置
US20250088894A1 (en) * 2023-09-13 2025-03-13 Dell Products, L.P. Dynamic downlink traffic buffering

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101453389A (zh) * 2008-11-19 2009-06-10 中国网络通信集团公司 流量监测方法及系统
CN103297946A (zh) * 2012-02-24 2013-09-11 中兴通讯股份有限公司 一种监控终端行为异常的方法和系统
CN103918222A (zh) * 2011-10-21 2014-07-09 迈克菲公司 用于检测拒绝服务攻击的系统和方法
CN105812200A (zh) * 2014-12-31 2016-07-27 中国移动通信集团公司 异常行为检测方法及装置
WO2018086963A1 (en) * 2016-11-08 2018-05-17 Telefonaktiebolaget Lm Ericsson (Publ) Faulty device load protection
WO2018196603A1 (zh) * 2017-04-28 2018-11-01 夏普株式会社 用户设备、基站和相关方法

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6405318B1 (en) * 1999-03-12 2002-06-11 Psionic Software, Inc. Intrusion detection system
US20090013404A1 (en) * 2007-07-05 2009-01-08 Alcatel Lucent Distributed defence against DDoS attacks
KR101219538B1 (ko) * 2009-07-29 2013-01-08 한국전자통신연구원 비주얼 데이터 분석 기반의 네트워크 공격 탐지 장치 및 그 방법
CN102447546B (zh) * 2010-09-30 2019-05-24 电信科学技术研究院 一种数据的传输方法和设备
KR101574193B1 (ko) * 2010-12-13 2015-12-11 한국전자통신연구원 분산 서비스 거부 공격 탐지 및 방어 장치 및 방법
CN102404741B (zh) * 2011-11-30 2015-05-20 中国联合网络通信集团有限公司 移动终端上网异常检测方法和装置
US9338134B2 (en) * 2013-03-27 2016-05-10 Fortinet, Inc. Firewall policy management
CN103269384A (zh) * 2013-06-14 2013-08-28 福建伊时代信息科技股份有限公司 富客户端异常处理方法、处理装置及处理系统
CN104468253B (zh) * 2013-09-23 2019-07-12 中兴通讯股份有限公司 一种深度包检测控制方法及装置
US9179007B1 (en) * 2013-09-27 2015-11-03 Juniper Networks, Inc. Analytics triggered subscriber policies
RU2661848C1 (ru) * 2014-09-29 2018-07-19 Хуавэй Текнолоджиз Ко., Лтд. Способ для управления оборудованием пользователя, чтобы осуществлять доступ к сети связи высокоскоростного движущегося транспортного средства
CN104270275B (zh) * 2014-10-14 2018-04-10 广东小天才科技有限公司 一种异常原因的辅助分析方法、服务器以及智能设备
US9591008B2 (en) * 2015-03-06 2017-03-07 Imperva, Inc. Data access verification for enterprise resources
CN107211336A (zh) * 2015-03-09 2017-09-26 华为技术有限公司 控制用户设备接入高速移动工具通信网络的方法
CN106161333B (zh) 2015-03-24 2021-01-15 华为技术有限公司 基于sdn的ddos攻击防护方法、装置及系统
US9872199B2 (en) * 2015-09-22 2018-01-16 Qualcomm Incorporated Assigning a variable QCI for a call among a plurality of user devices
US9838278B2 (en) * 2016-02-26 2017-12-05 Guavus, Inc. Self-learning device classifier
EP3282665B1 (en) * 2016-08-10 2021-01-27 Nokia Solutions and Networks Oy Anomaly detection in software defined networking
CN108347746B (zh) * 2017-01-23 2024-05-03 中兴通讯股份有限公司 接入控制方法、接入网网元及用户设备
CN107835113B (zh) * 2017-07-05 2020-09-08 中山大学 一种基于网络映射的社交网络中异常用户检测方法
US10785258B2 (en) * 2017-12-01 2020-09-22 At&T Intellectual Property I, L.P. Counter intelligence bot

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101453389A (zh) * 2008-11-19 2009-06-10 中国网络通信集团公司 流量监测方法及系统
CN103918222A (zh) * 2011-10-21 2014-07-09 迈克菲公司 用于检测拒绝服务攻击的系统和方法
CN103297946A (zh) * 2012-02-24 2013-09-11 中兴通讯股份有限公司 一种监控终端行为异常的方法和系统
CN105812200A (zh) * 2014-12-31 2016-07-27 中国移动通信集团公司 异常行为检测方法及装置
WO2018086963A1 (en) * 2016-11-08 2018-05-17 Telefonaktiebolaget Lm Ericsson (Publ) Faulty device load protection
WO2018196603A1 (zh) * 2017-04-28 2018-11-01 夏普株式会社 用户设备、基站和相关方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3863317A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20230075085A1 (en) * 2021-09-03 2023-03-09 Verizon Patent And Licensing Inc. End-to-end encryption for multiple recipient devices
US11956222B2 (en) * 2021-09-03 2024-04-09 Verizon Patent And Licensing Inc. End-to-end encryption for multiple recipient devices
CN114885333A (zh) * 2022-05-30 2022-08-09 绿盟科技集团股份有限公司 一种违规组织识别方法、装置、设备及介质

Also Published As

Publication number Publication date
CN111148105A (zh) 2020-05-12
CN115426653A (zh) 2022-12-02
US20210250771A1 (en) 2021-08-12
EP3863317B1 (en) 2024-09-25
CN115426653B (zh) 2025-03-25
CN111148105B (zh) 2022-07-29
US12425861B2 (en) 2025-09-23
EP3863317A4 (en) 2022-03-02
EP3863317A1 (en) 2021-08-11

Similar Documents

Publication Publication Date Title
CN111148105B (zh) 类别信息的确定方法及装置
CN112312466B (zh) 一种事件报告的发送方法、装置及系统
US11895533B2 (en) Method for controlling connection between terminal and network, and related apparatus
US20210076192A1 (en) Communications Method and Apparatus
CN113206814B (zh) 一种网络事件处理方法、装置及可读存储介质
US12200810B2 (en) Congestion control method and apparatus
EP3893536B1 (en) Method, device, and system for increasing cross-network access security
WO2019192366A1 (zh) 一种终端ue管控方法及装置
US11689565B2 (en) Device monitoring method and apparatus and deregistration method and apparatus
CN113923682B (zh) 通信方法、装置及系统
WO2020248709A1 (zh) 一种mdbv的确定方法、装置及系统
US20240224098A1 (en) Network verification method and apparatus
CN110602697A (zh) 一种限制终端设备接入的方法及装置
WO2021159415A1 (zh) 通信方法、装置及系统
EP3900268A1 (en) Methods and apparatus for user plane function analytics
CN115665822A (zh) 流量异常处理方法、装置、用户面功能实体及存储介质
WO2023041056A1 (zh) 网络验证的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19878522

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019878522

Country of ref document: EP

Effective date: 20210504