WO2024259645A1 - 一种用于空地网络架构的管道安全性提升方法与装置 - Google Patents

一种用于空地网络架构的管道安全性提升方法与装置 Download PDF

Info

Publication number
WO2024259645A1
WO2024259645A1 PCT/CN2023/101762 CN2023101762W WO2024259645A1 WO 2024259645 A1 WO2024259645 A1 WO 2024259645A1 CN 2023101762 W CN2023101762 W CN 2023101762W WO 2024259645 A1 WO2024259645 A1 WO 2024259645A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
base station
function
network element
request
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
PCT/CN2023/101762
Other languages
English (en)
French (fr)
Inventor
郝楠
张兴明
朱向明
张富军
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Zhejiang Lab
Original Assignee
Zhejiang Lab
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zhejiang Lab filed Critical Zhejiang Lab
Priority to PCT/CN2023/101762 priority Critical patent/WO2024259645A1/zh
Publication of WO2024259645A1 publication Critical patent/WO2024259645A1/zh
Priority to US19/002,805 priority patent/US12470285B2/en
Anticipated expiration legal-status Critical
Pending legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B7/00—Radio transmission systems, i.e. using radiation field
    • H04B7/14—Relay systems
    • H04B7/15—Active relay systems
    • H04B7/185—Space-based or airborne stations; Stations for satellite systems
    • H04B7/1851—Systems using a satellite or space-based relay
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/108—Source integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/06—Airborne or Satellite Networks

Definitions

  • the present invention relates to the field of computer networks and communication technologies, and in particular to a pipeline safety improvement method and device for an air-to-ground network architecture.
  • 3GPP 5G technology only proposes the discussion of the wireless side technology of the satellite-ground integrated network (NTN non-terrestrial networks) and has no research content on the core network side.
  • the CCSA TC12 working group "General Technical Requirements for Space-ground Integrated 5G Network (Draft for Review)" Item 11.3
  • Space-ground Integrated 5G Network Security Plan also gives a general description of the space-ground integrated architecture and security requirements: The space-ground integrated 5G network security should be comprehensively considered from the aspects of physical security, data security and network operation security.
  • the content may include but is not limited to terminal connection security, space-based access network connection security, space-based core network connection security, ground-based access network connection security, ground-based core network connection security, network function security, user data security, network physical isolation and logical isolation, network management security, network configuration security, space-ground integrated business security, etc.
  • the technical means that can be used include but are not limited to anti-destruction technology, anti-interference technology, secure access and secure routing technology, secure transmission, secure storage and key management technology and other network security protection technologies to build a space-ground integrated network security architecture and ensure the safe operation of the network system.
  • 5G terminals are connected to 5G ground base stations (gNB) through the air interface side.
  • the backhaul network (including control plane messages and user plane messages) from 5G ground base stations to 5G core network (5GC: 5G Core Network) is relayed by satellites, and 5G terminals are finally connected to the data network server through the 5G data pipeline relayed by satellites.
  • 5G core network and satellite core network There is currently no network function intercommunication and signaling interaction architecture and method between the two network systems.
  • the relay satellite controlled by the satellite core network successfully establishes the relay pipeline between the 5G ground base station and the satellite depends on the pre-configuration file of the 5G ground base station in the satellite core network.
  • This configuration information belongs to the network element node (node) or instance (Instance) information.
  • node node
  • instance Instance
  • the 5G ground base station configuration file can only be manually changed by the satellite core network independent of the 5G system.
  • the search for network functions is done by pre-registering the network function's profile and associated discovery parameters to the network repository function (NRF Network Repository Function).
  • NRF Network Repository Function When a network function needs to be used, the network function is the service provider (service producer) and the network element requesting the service is the service consumer (service consumer).
  • service consumer when the service consumer (NF_B) does not have an available service provider (NF_A)
  • NF_B When NF_B receives the information, it sends a search request to NRF with the discovery parameters of NF_A. NRF returns the content matching the query parameters according to the registration information of NF_A.
  • the service provider NF_A registers the network function configuration file and the associated discovery parameters for configuration file search to the NRF, and the NRF returns success to confirm that NF_A has successfully registered.
  • the NRF itself has the function of preventing the modification of registration information. Once the network element node is successfully registered, the NRF cannot modify the registration information to protect the information security of the network element node.
  • the service consumer NF_B needs to communicate with NF_A for functional interaction.
  • NF_B first sends the discovery parameters associated with NF_A to NRF and requests the configuration file pre-registered by its associated NF_A.
  • the configuration file may contain one or more network element instance information.
  • NRF returns the registration information that matches the query parameters.
  • NF_B After NF_B receives the query result returned by NRF, if there are multiple network function instances of NF_A, it selects and connects to an instance of NF_A according to a certain algorithm (such as round-robin).
  • a certain algorithm such as round-robin
  • the current 5G core network does not support registering 5G base stations as network function elements for search into the 5G core network NRF.
  • the existing 5G core network only supports external application functions (AF Application Function) to provide some terminal (UE User Equipment) user-related business information through the parameter provision (Parameter Provision) service of the network exposure function node (NEF Network Expose Function).
  • external nodes of the 5G core network can only access 5G core network elements through the network exposure function node (NEF Network Expose Function), but the existing 5G core network does not support external network elements to search/query internal network elements registered in NRF through NEF, and there is no interface and signaling process for querying public information of internal network elements.
  • NEF Network Expose Function
  • NRF provides a connection token (Access Token) service for network element instances.
  • connection token Access Token
  • NF_B the service consumer
  • NF_A the service provider
  • NF_B After NF_B obtains the service provider (NF_A) instance corresponding to the request parameters from NRF, it selects a NF_A instance and requests a connection token authorized by the instance for the selected NF_A instance through the connection token service.
  • NF_A service provider
  • NF_B After NF_B obtains the connection token corresponding to the NF_A instance ID (ID Identity) from NRF, the service request message sent to NF_A must carry the connection token. If the connection token function is enabled and NF_B does not obtain the connection token of the NF_A instance from the connection token service of NRF, NF_A rejects the service request and the connection is illegal.
  • ID Identity NF_A instance ID
  • the satellite uses a pre-configuration method to identify 5G ground base station relay pipeline requests. Any changes in 5G ground base station information require independent changes to the satellite configuration file through an independent satellite system. The operation is cumbersome and cannot be integrated into the network element management system based on the 5G service-based architecture eSBA. In the scenario of large-scale deployment of 5G base stations or small stations (including 5G base stations and 5G satellite gateways, or 5G system equipment with access point functions), the complexity of heterogeneous system maintenance is further increased.
  • 5G ground base station information needs to be open to the satellite core network that is independent of the 5G system, and the configuration files need to be updated through third-party channels, further increasing the possibility of 5G system information leakage and thus causing 5G system security risks.
  • the satellite In the satellite-ground (heterogeneous) integrated network architecture, since the ground station needs to establish a relay pipeline with the satellite and the core network, the satellite, as a heterogeneous system network element, only has a base station configuration table, and cannot use the 5G system to search for publicly available information of the 5G internal network element nodes. The satellite cannot use the existing 5G security system to identify the legitimacy of the base station relay request connection outside the ground base station configuration table. At the same time, since the satellite system does not have the legitimacy information of the base station outside the configuration table (the cause may be improper or delayed configuration update operation), the satellite cannot establish a relay pipeline connection between the 5G ground station and the 5G core network. User services cannot be guaranteed.
  • the purpose of the present invention is to address the problems of data pipeline connection security, maintenance complexity and user service experience continuity between heterogeneous systems caused by the inability to share publicly available data and network functions between 5G and heterogeneous network systems networked with the 5G system on the existing 3GPP air-ground integrated architecture (NTN).
  • NTN air-ground integrated architecture
  • An information sharing architecture and method based on 5G function sharing is provided to improve the connection security between network elements/network equipment of the space-ground integrated heterogeneous system, the ease of system maintenance and the method for improving user service experience.
  • a pipeline safety improvement method for air-ground network architecture comprising the following steps:
  • the relay satellite After receiving the relay pipe connection establishment request initiated by the base station, the relay satellite initiates a network element verification request carrying the configuration information of the base station to the network exposure function network element based on the base station configuration information in the connection establishment request, and sends a network function search request to the network warehouse function network element through the network exposure function network element;
  • the network warehouse function network element After receiving the search request, the network warehouse function network element returns the base station query result to the network exposure function network element according to the registration information; if there is configuration information registered with the corresponding base station, the network exposure function network element sets the verification result in the verification result information element to "registered", otherwise it is set to "non-existent", and responds to the network element verification request of the relay satellite;
  • S4 The relay satellite responds to the received verification request and checks the verification result cell carried.
  • the base station relay pipe connection establishment request is accepted
  • the base station relay pipe connection establishment request is rejected.
  • connection between the legal base station in S1 and the 5G core network is:
  • the base station and the core network are connected by using themselves as network function nodes and passing through the 5G core network warehouse function network element
  • the registration service registers the base station configuration information to the network warehouse function network element of the 5G core network; in this registration process, the base station configuration information is carried by a newly added cell structure;
  • the base station configuration information includes mandatory parameters and optional parameters, the mandatory parameters are the global base station node identity; the optional parameters are: the base station node name, the supported tracking area list and the supported tracking area items in the list and the tracking area code under the tracking area item.
  • the network warehouse functional network element that pre-registers the base station configuration information to the 5G core network in S1 is specifically:
  • the base station configuration information is added to the network function configuration file carried in the network warehouse function network element registration request, and registered with the network warehouse function network element. If the registration is successful, a registration success status code and the corresponding network function configuration file are returned, otherwise a registration failure status code or a relocation status code is returned; in the failure state, the base station needs to reselect an instance of the network warehouse function network element and execute the base station registration process for the selected network warehouse function network element instance again.
  • the network function search request sent by the network exposure function network element carries a base station configuration information query parameter.
  • the network warehouse function network element uses the existing network function discovery service to search for the configuration information pre-registered for the base station.
  • the base station configuration information query parameters are mandatory parameters and optional parameters that are consistent with the base station configuration information, the mandatory parameters are used to determine the verification result; and the optional parameters are used to provide base station auxiliary information.
  • the network warehouse functional network element After receiving the search request, the network warehouse functional network element returns the base station query result to the network exposure functional network element according to the registration information, specifically:
  • the network warehouse function network element checks whether the registration information matches the base station configuration information carried in the query request, returns the matching information and sets the request response status code to query success;
  • the request response status code is set to query invalid, and the network function search request needs to be resent, or the request response status code is set to redirect and a resource redirection header is carried in the response, indicating that the search request needs to be resent and sent to the location specified by the resource redirection header.
  • the network exposure function network element returns a network function search request response to the corresponding query relay satellite; if the network function search request response returned by the network warehouse function network element cannot be processed, the status code is set to request invalid; or the status code is set to relocation and a resource relocation header is carried in the response to be sent to the relay satellite.
  • the relay satellite after the relay satellite receives the response to the network function search request, if the response status code is a successful query, the satellite will admit or reject the initiating base station of the relay pipe connection establishment request based on the carried verification result; if the response status code is an invalid query, the relay satellite needs to resend the network element verification request; if the response status code is a relocation status code and a resource relocation header is carried in the response, it means that the relay satellite needs to resend the network element verification request and send it to the location specified by the resource relocation header; if the satellite cannot obtain a valid verification result after attempting the network element verification service for a preset number of times, the satellite rejects the relay pipe establishment request of the base station.
  • the present invention provides a pipeline safety improvement device for an air-ground network architecture, comprising a memory and one or more processors, wherein the memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the steps of a pipeline safety improvement method for an air-ground network architecture.
  • the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps of a pipeline safety improvement method for an air-to-ground network architecture.
  • a method is proposed for sharing data between heterogeneous systems under a 5G air-ground integrated architecture and reusing existing 5G network functions, thereby reducing the complexity of system maintenance under a heterogeneous networking architecture, ensuring the security of network relay pipelines within heterogeneous systems, and improving user service experience.
  • the satellite system in the 5G heterogeneous network only needs to open the NEF interface based on the 5G functional process and the 5G core network network function registration information interface from NEF to NRF to determine the legitimacy of the ground base station initiated by the relay request. Since there is no need to open the 5G base station information to network elements outside the 5G system, the security of the 5G base station and the air-ground integrated relay pipeline constructed by the 5G base station and the satellite system outside the 5G system can be guaranteed.
  • the present invention effectively reduces the complexity of configuration file operations in the 5G space-ground integrated system, significantly improves the two-way security of base stations and satellite relay pipelines, and enhances the stability and reliability of the overall heterogeneous business system.
  • the satellite system can verify the legitimacy information of base stations outside the 5G system base station configuration table (the cause may be improper or delayed configuration update operation) through the 5G core network and establish a relay pipeline to connect to the 5G core network, user services are guaranteed.
  • FIG1 is a diagram showing the architecture of a 5G ground-to-sky integrated network system in the prior art
  • FIG2 is a flowchart of 5G core network element discovery in the prior art
  • FIG3 is a diagram showing the current status of NRF and NEF network functions of the 5G core network in the prior art
  • FIG4 is a flow chart of token communication between network elements of a 5G core network in the prior art
  • FIG5 is a schematic diagram of the connection of relay pipes of different systems in the air-ground integrated architecture in the prior art
  • FIG6 is a flow chart of a pipeline safety improvement method for an air-to-ground network architecture provided by an embodiment of the present invention.
  • FIG7 is a diagram showing the architecture of a relay pipeline security enhancement system provided by an embodiment of the present invention.
  • FIG8 is a signaling flow of a method for improving relay pipeline security under a satellite-ground integrated architecture provided by an embodiment of the present invention.
  • FIG. 9 is a flow chart of a 5G base station registering base station configuration information and associated discovery parameters to an NRF message according to an embodiment of the present invention.
  • FIG10 is a flow chart of a method for verifying the legitimacy of a base station by a satellite for initiating a request for establishing a relay pipe according to an embodiment of the present invention
  • FIG. 11 is a schematic diagram of a pipeline safety improvement method and device structure for an air-to-ground network architecture provided in an embodiment of the present invention.
  • first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.
  • the word "if” as used herein may be interpreted as "at the time of” or "when” or "in response to determining”.
  • Embodiment 1 The present invention is based on the data sharing architecture between heterogeneous systems in 5G networking and reuse of existing network element functions in 5G architecture
  • the method as shown in FIG6 , comprises the following steps:
  • the base station registers the discoverable feature information in the base station configuration information into the 5G core network NRF through the network element registration service (NFRegister) in the 5G core network NRF network element management service (NFManagement Service).
  • NFRegister network element registration service
  • NFManagement Service 5G core network NRF network element management service
  • the connection between a legal base station and the 5G core network is as follows: the base station uses itself as a network function node in the satellite-ground integrated architecture, and registers the base station (gNB) configuration information to the network warehouse function network element of the 5G core network through the network element registration service (NFRegister) in the 5G core network NRF network element management service (NFManagement Service); the registration process is based on the existing network element registration process in TS 29.510, and carries the base station feature information through the newly added cell structure (RanInfo).
  • the feature information includes geographic location, base station identity (RAN ID, RAN Name), base station tracking area identification (TAI: Tracking Area Indication) and base station service time, including mandatory parameters and optional parameters, and the mandatory parameters are: global base station node identity.
  • the optional parameters are: base station node name, supported tracking area list and supported tracking area items in the list and tracking area code under the tracking area item.
  • the network warehouse functional network element that pre-registers the base station configuration information to the 5G core network in S1 is specifically:
  • the base station configuration information is added to the network function configuration file carried in the network warehouse function registration request, and registered with the network warehouse function network element. If the registration is successful, a status code meaning successful registration and the corresponding network function configuration file are returned, otherwise a status code meaning failure or a relocation status code is returned; in the failure state, the base station needs to reselect an instance of the network warehouse function network element and execute the base station registration process again for the selected network warehouse function network element instance.
  • the satellite performs a legitimacy query on the base station:
  • the base station pre-configuration table may not be updated in time.
  • the satellite After receiving a relay pipe connection establishment request initiated by a base station, the satellite sends a network function (base station) search request to the network warehouse function network element through the network exposure function network element of the 5G core network based on the base station configuration information in the connection establishment request; specifically, the 3GPP fifth-generation communication system (5GS) network element verification request is sent to the network element exposure function network element through the 5G system network element verification service, and then the network function search request is sent to the network warehouse function network element through the network exposure function network element.
  • This new service is optionally included in the network element management service (NFManagement Service) in TS29.510.
  • NFManagement Service network element management service
  • the optional parameters are: base station node name, supported tracking area list and supported tracking area items in the list and tracking area code under the tracking area item, which are used to provide base station ancillary information. Failure to query the optional parameters does not affect the verification result.
  • NRF's network element discovery service does not support base station discovery.
  • NEF also does not support receiving external network element information of the 5G core network to assist in searching and verifying information within the 5G core network.
  • the network warehouse function network element After receiving the network function search request, the network warehouse function network element returns the base station query result to the network exposure function network element according to the registration information; if there is configuration information registered with the corresponding base station, the network exposure function network element sets the verification result in the verification result (VerificationResult) information element to "registered (REGISTERED)", otherwise it is set to "content does not exist (NOT EXIST)", and responds to the base station verification request of the relay satellite network element;
  • the specific results of the base station query returned to the network exposure function network element based on the registration information are as follows: the network warehouse function network element checks whether the registration information matches the base station configuration information carried in the query request, returns the matching information and sets the request response status code to query success; if the network function discovery request cannot be processed, the request response status code is set to query invalid, and the network function discovery request needs to be resent; or the request response status code is set to relocation and a resource relocation header is carried in the response, indicating that the query request needs to be resent and sent to the location specified by the resource relocation header.
  • the network exposure function returns the network element verification response to the corresponding query relay satellite; if the network function discovery request response returned by the network warehouse request cannot be processed, the status code is set to invalid network element verification request; or the status code is set to relocation and the resource relocation header is carried in the response to the relay satellite.
  • the relay satellite responds to the received verification request and checks the carried verification result (VerificationResult) information element. If the information element carries "registered”, the base station relay pipe establishment request is accepted and the corresponding relay pipe is established; if the information element carries "does not exist", the base station relay pipe establishment request is rejected.
  • VerificationResult carried verification result
  • the relay satellite when the relay satellite receives the response to the network element verification request, if the response status code is a successful query, the satellite will admit or reject the base station requesting the relay pipeline establishment according to the carried "verification result"; if the received response status code is set to query invalid, the relay satellite needs to resend the network element verification request according to a certain algorithm; if the received response status code is a relocation status code and carries a relocation header in the response, it means that the relay satellite needs to resend the verification request and send it to the location specified by the resource relocation header. If the satellite fails to obtain a valid verification result after trying the network element verification service for a preset number of times, the satellite directly rejects the base station's request to establish a relay pipeline.
  • FIG8 shows the signaling process of the method for improving the security of relay pipelines under the satellite-ground integrated architecture proposed by the present invention.
  • the 5G ground base station when the 5G ground base station is connected to the 5G core network, it registers the base station configuration information into the 5G core network NRF as a network function node.
  • the connection can be a direct connection relayed by a default pre-configured satellite, or it can be pre-configured in the NRF by the operator through the network management system (e.g., BOSS, Business and operation supporting system).
  • the network management system e.g., BOSS, Business and operation supporting system.
  • the base station needs to reselect the NRF instance and execute the base station registration process again on the selected NRF instance.
  • the newly added base station configuration information element in Table 1 includes the mandatory (M) and optional information (O) in Table 2;
  • the fake base station has stolen the satellite pre-configuration information of the legitimate base station through certain means, the fake base station cannot connect itself to the 5G core network via satellite relay and register in the NRF of the 5G core network.
  • the relay satellite After receiving the satellite relay connection establishment request of a new base station (legal or illegal) outside the configuration table of the legitimate base station (the cause may be improper configuration update operation or lag), the relay satellite only needs to match the successfully registered and legitimate 5G base station content in the NRF through the network exposure function network element NEF of the 5G core network, as shown in Figure 10.
  • the specific steps are as follows:
  • the relay satellite sends a 5GS network element verification request to the NEF through the 5G system network element information verification service newly proposed by the present invention.
  • the verification request includes the configuration query parameters of the base station initiating the received relay request, and the parameters include the necessary and optional parameters in Table 2 (in Table 2, "M” represents a required option and "O” represents an optional option).
  • NEF uses the existing TS 29.510 NRF network function discovery service (Nnrf_NFDiscovery in Figure 10) to search for the pre-registered configuration information of the base station. NEF sends a network service discovery request carrying the necessary and optional parameters in Table 2 to NRF, as shown in 2 in Figure 10.
  • NEF uses the existing TS 29.510 NRF network function discovery service (Nnrf_NFDiscovery in Figure 10) to search for the pre-registered configuration information of the base station.
  • NEF sends a network service discovery request carrying the necessary and optional parameters in Table 2 to NRF, as shown in 2 in Figure 10.
  • NEF returns the network element verification request response to the corresponding query relay satellite. If the network function discovery request response returned by the NRF cannot be processed, the status code is set to "4xx"/"5xx” to indicate that the network element verification request is invalid; or the status code is set to "3xx” and carries the "relocation" header in the response and sent to the relay satellite, such as "307" and "308".
  • the relay satellite When the relay satellite receives the response to the network element verification request, if the response status code is "200" or "201", the satellite will admit or reject the base station requesting the relay pipeline establishment according to the carried "verification result". If the received response status code is set to "4xx"/"5xx", it means that the query is invalid. The relay satellite needs to reselect an available NEF instance and resend the network element verification request when the status code is "400" and "504"; as shown in 4b of Figure 10, if the received response status code is "3xx” and carries a "relocation" header in the response, it means that the relay satellite needs to resend the verification request and send it to the location specified by the resource relocation header, such as "307" and "308".
  • An embodiment of a device for improving pipeline safety in an air-to-ground network architecture of the present invention can be applied to any device with data processing capabilities, and the any device with data processing capabilities can be a device or apparatus such as a computer.
  • the device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them.
  • FIG11 it is a hardware structure diagram of any device with data processing capabilities in which a device for improving pipeline safety in an air-to-ground network architecture under the air-to-ground network architecture of the present invention is located.
  • any device with data processing capabilities in which the device in the embodiment is located is usually based on the data processing instructions of the device.
  • the actual functions of the device with processing capabilities may also include other hardware, which will not be described in detail.
  • the relevant parts can refer to the partial description of the method embodiment.
  • the device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.
  • An embodiment of the present invention further provides a computer-readable storage medium having a program stored thereon.
  • the program is executed by a processor, a pipeline safety improvement method for an air-to-ground network architecture in the above embodiment is implemented.
  • the computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory.
  • the computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device.
  • the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability.
  • the computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Physics & Mathematics (AREA)
  • Astronomy & Astrophysics (AREA)
  • General Physics & Mathematics (AREA)
  • Aviation & Aerospace Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种用于空地网络架构的管道安全性提升方法与装置。该方法将基站配置信息预先注册到5G核心网的网络仓库功能网元中；卫星在收到基站发起的中继管道连接建立请求后，通过网络暴露功能网元对网络仓库功能网元发送网络功能查找请求，在网络暴露功能网元收到该基站的网络功能发现请求响应后，根据是否存在基站注册信息设置该基站对应校验结果并响应网元校验请求，最后卫星检查收到的响应带的校验结果信元来判定当前接入基站的合法性。本方法提出的异构系统间网络功能共享可公开信息的数据管道架构及交互方法，降低部署成本并保证效率及普适性，有效补充了5G天地一体化架构下中继卫星对伪基站安全性甄别所需信令交互方法及信元设计。

Description

一种用于空地网络架构的管道安全性提升方法与装置 技术领域
本发明涉及计算机网络和通信技术领域，尤其涉及一种用于空地网络架构的管道安全性提升方法与装置。
背景技术
目前3GPP 5G技术仅提出星地一体组网无线侧技术讨论(NTN non-terrestrial networks)尚无核心网侧研究内容，同时CCSA TC12工作组“天地一体5G网络总体技术要求(送审稿)”第11.3项“天地一体5G网络安全方案”也对天地一体化架构和安全需求进行了概括性描述：天地一体5G网络安全应从物理安全、数据安全和网络运行安全几个方面全面进行考虑，内容可以包括但不限于终端连接安全、天基接入网连接安全、天基核心网连接安全、地基接入网连接安全、地基核心网连接安全、网络功能安全、用户数据安全、网络物理隔离和逻辑隔离、网络管理安全、网络配置安全、天地一体业务安全等。可采用的技术手段包括但不限于抗毁技术、抗干扰技术、安全接入和安全路由技术、安全传输、安全存储及密钥管理技术等网络安全防护技术来构建天地一体网络安全架构，保障网络体系安全运行。
如图1所示，现有星地一体化组网架构下5G终端通过空口侧连接到5G地面基站(gNB)，5G地面基站到5G核心网(5GC：5G Core Network)的回传网络(包括控制面消息和用户面消息)由卫星进行中继，5G终端最终通过由卫星中继的5G数据管道连接到数据网络服务器。需要注意的是，5G系统和作为5G回传网络中继节点的卫星系统是完全独立的，由各自的核心网(5G核心网及卫星核心网)进行控制，两套网络系统间目前没有网络功能互通及信令交互架构和方法。卫星核心网控制的中继卫星对5G地面基站与卫星间的中继管道建立成功与否取决于卫星核心网中5G地面基站的预配置文件，该配置信息属于网元(network element)节点(node)或实例(Instance)信息，目前只能由独立于5G系统的卫星核心网对5G地面基站配置文件进行手动更改。
5G核心网中基于服务的架构(eSBA,enhanced service based Architecture)下，网络功能(NF Network Function)的查找采用预先将网络功能的配置信息(Profile)及关联的发现参数注册到网络仓库功能(NRF Network Repository Function)上的形式。当某个网络功能需要被使用时，该网络功能此时为业务提供者(service producer)，请求该服务的网元为业务消费者(service consumer)。如图2所示，当业务消费者(NF_B)没有可用业务提供者(NF_A)信 息时，NF_B携带NF_A的发现参数将查找请求发送到NRF，NRF根据NF_A的注册信息并返回匹配该查询参数的内容。具体步骤如下：
图2中的①所示，业务提供者NF_A把网络功能配置文件及用于配置文件搜索的关联发现(discovery)参数注册到NRF，NRF返回成功以确认NF_A成功注册。NRF本身具备注册信息防止修改功能，网元节点一旦成功注册后，NRF无法对该注册信息进行修改，保护网元节点信息安全。
图2中的②所示，业务消费者NF_B需要和NF_A通信进行功能交互，NF_B首先把NF_A关联的发现参数发送到NRF并请求其关联的NF_A预先注册的配置文件,该配置文件可包含一个或多个网元实例信息，NRF返回查询参数匹配的注册信息。
图2中的③所示，NF_B在接收到NRF返回的查询结果后，如果存在多个NF_A的网络功能实例，则根据一定算法(例如round-robin)选择并连接NF_A的一个实例。
如图3中的a)所示，目前5G核心网不支持将5G基站作为进行查找的网络功能网元形式注册到5G核心网NRF中，如图3中的b)所示，现有5G核心网仅支持外部应用功能(AF Application Function)通过网络暴露功能节点(NEF Network Expose Function)的参数提供(Parameter Provision)服务提供部分终端(UE User Equipment)用户的关联业务信息。同时如图3中的c)所示，5G核心网外部节点对5G核心网网元访问仅能通过网络暴露功能节点(NEF Network Expose Function)，但现有5G核心网并不支持外部网元通过NEF查找/询问注册到NRF中的内部网元，无用于内部网元可公开信息查询的接口和信令流程。
此外NRF提供网元实例的连接令牌(Access Token)服务。如图4，通过令牌服务，服务消费方(NF_B)仅可在NRF提供授权令牌情况下和服务提供方(NF_A)进行连接，具体步骤如下：
NF_B从NRF拿到对应请求参数的服务提供方(NF_A)实例后，选择一个NF_A实例并通过连接令牌服务为对应选定的NF_A实例请求该实例授权的连接令牌。
NF_B从NRF获得对应NF_A实例标识(ID Identity)的连接令牌后，发送给NF_A的业务请求消息必须携带该连接令牌。如果连接令牌功能开启NF_B并未从NRF的连接令牌服务中拿到NF_A实例的连接令牌,NF_A拒绝此业务请求，此时连接非法。
如图5所示，现有与5G组网构成空地一体化的卫星系统存在以下几点问题：
卫星对5G地面基站中继管道请求甄别采用预配置方式，任意5G地面基站信息变动都需要通过独立卫星系统对该卫星配置文件进行独立更改，操作繁琐且无法融入基于5G基于服务架构eSBA的网元管理体系，在5G基站或小型站(包括5G基站及5G卫星网关，或具有接入点功能的5G系统设备)大量部署场景下，进一步增加了异构系统维护复杂性。
5G地面基站信息需要对独立于5G系统的卫星核心网开放，并通过三方管道进行配置文件更新，进一步增加了5G系统信息泄露从而引发5G系统安全性风险。
星地(异构)一体化网络架构中，由于地面站需要和卫星建立和核心网的中继管道，卫星作为异构系统网元仅有基站配置表，无法通过5G系统对5G内部网元节点可公开信息进行查找，卫星对地面基站配置表外基站中继请求连接合法性甄别无法采用5G已有安全体系.同时由于卫星系统没有该部分配置表外(造成原因可能为配置更新操作不当或者滞后)基站合法性信息，这造成卫星无法建立5G地面站与5G核心网的中继管道连接。用户业务无法保障。
如上所述，为降低系统维护复杂度、提升异构系统数据管道安全性以及提高用户业务体验，现有空地一体架构下5G和与5G组网的异构系统间亟需一种新的数据共享架构及网络功能重用的方法。
发明内容
本发明的目的在于针对现有3GPP空地一体架构(NTN)上5G和与5G系统组网的异构网络系统间无法进行可公开数据及网络功能共享造成的异构系统间数据管道连接安全性、维护复杂性及用户业务体验连续性的问题，提供一种基于5G功能共享的信息共享架构和方法来提升天地一体化异构系统网元/网络设备间连接安全性、系统维护易操作性及提升用户业务体验的方法。
本发明的目的是通过以下技术方案来实现的：一种用于空地网络架构的管道安全性提升方法，该方法包括如下步骤：
S1：在合法基站与5G核心网有连接或网络仓库功能网元对网络功能网元配置信息基于手动配置更新时，将基站配置信息预先注册到5G核心网的网络仓库功能网元中；
S2：中继卫星在收到基站发起的中继管道连接建立请求后，基于连接建立请求中的基站配置信息，中继卫星发起携带该基站的配置信息的网元校验请求至网络暴露功能网元，通过网络暴露功能网元对网络仓库功能网元发送网络功能查找请求；
S3：网络仓库功能网元收到查找请求后，根据注册信息对网络暴露功能网元返回基站查询结果；若存在对应基站注册的配置信息，则网络暴露功能网元设置校验结果信元中的校验结果为“已注册”，否则设置为“不存在”，并响应中继卫星的网元校验请求；
S4：中继卫星根据收到的校验请求响应并检查携带的校验结果信元，
若信元中携带“已注册”校验结果，则接受该基站中继管道连接建立请求；
若信元中携带“不存在”校验结果，则拒绝该基站中继管道连接建立请求。
进一步地，S1中合法基站与5G核心网的连接为：
基站和核心网连接方式是将自身作为网络功能节点，通过5G核心网网络仓库功能网元 的注册服务，将基站配置信息注册到5G核心网的网络仓库功能网元中；该注册流程中基站配置信息通过新增信元结构携带；
所述基站配置信息包含包括必选项参数和可选项参数，所述必选项参数为全球基站节点身份标识；所述可选项参数为：基站节点名字、支持的追踪区列表和该列表中支持的追踪区项以及该追踪区项下的追踪区域码。
进一步地，S1中将基站配置信息预先注册到5G核心网的网络仓库功能网元具体为：
将基站配置信息加入到网络仓库功能网元注册请求中携带的网络功能配置文件，并注册到网络仓库功能网元，注册成功则返回注册成功状态码及对应的网络功能配置文件，否则返回注册失败状态码或者重定位状态码；失败状态下需要基站重新选择网络仓库功能网元的实例，并对选定网络仓库功能网元实例再次执行基站注册流程。
进一步地，所述网络暴露功能网元发送的网络功能查找请求带有基站配置信息查询参数，网络仓库功能网元收到查找请求后，沿用现有的网络功能发现服务对该基站预先注册的配置信息进行查找。
进一步地，所述基站配置信息查询参数为与基站配置信息一致的必选项参数和可选项参数，所述必选项参数用于决定校验结果；所述可选项参数用于提供基站附属信息。
进一步地，所述网络仓库功能网元收到查找请求后，根据注册信息对网络暴露功能网元返回基站查询结果具体为：
网络仓库功能网元检查注册信息是否匹配该查询请求中携带的基站配置信息，返回匹配信息并将请求响应状态码置为查询成功；
如果无法处理该网络功能查找请求，则将请求响应状态码置为查询无效，需要重发该网络功能查找请求，或者将请求响应状态码置为重定位并在响应中携带资源重定位头，代表需要重新发送查找请求且发送到该资源重定位头指定的位置。
进一步地，所述网络暴露功能网元将网络功能查找请求响应返回给对应查询中继卫星；如果无法处理该网络仓库功能网元返回的网络功能查找请求响应，则将状态码置为请求无效；或者将状态码置为重定位并在响应中携带资源重定位头发送给该中继卫星。
进一步地，S4中，中继卫星在收到网络功能查找请求响应后，如果响应状态码为查询成功，则卫星根据携带的校验结果对该中继管道连接建立请求的发起基站进行准入或拒绝；如果响应状态码为查询无效，中继卫星需要重发该网元校验请求；如果响应状态码为重定位状态码并在响应中携带资源重定位头，代表中继卫星需要重新发送网元校验请求且发送到该资源重定位头指定的位置；如果卫星按预设次数尝试网元校验服务后无法获得有效校验结果，则卫星拒绝该基站的中继管道建立请求。
第二方面，本发明提供了一种用于空地网络架构的管道安全性提升装置，包括存储器和一个或多个处理器，所述存储器中存储有可执行代码，所述一个或多个处理器执行所述可执行代码时，用于实现所述的一种用于空地网络架构的管道安全性提升方法的步骤。
第三方面，本发明提供了一种计算机可读存储介质，其上存储有程序，该程序被处理器执行时，实现所述的一种用于空地网络架构的管道安全性提升方法的步骤。
本发明的有益效果：提出了5G空地一体架构下通过异构系统间可公开数据共享及重用5G已有网络功能，从而实现降低异构组网架构下系统维护复杂性，保障异构系统内网络中继管道安全性以及提高用户业务体验的方法。通过5G地面基站注册到5G核心网NRF的形式，与5G异构组网的卫星系统仅需通过开放基于5G功能流程的NEF接口及NEF到NRF的5G核心网网络功能注册信息接口，从而确定该中继请求发起地面基站合法性。由于无需将5G基站信息开放给5G系统外部网元，5G基站安全及5G基站与5G系统外的卫星系统构建的空地一体中继管道的安全性得以保障。
此外对比目前卫星与5G组网传统方案，本发明有效减少5G天地一体化系统中配置文件操作复杂度，显著提高基站和卫星中继管道双向安全性，提升整体异构业务系统的稳定性和可靠性。
最后由于卫星系统可对5G系统基站配置表外(造成原因可能为配置更新操作不当或者滞后)基站合法性信息通过5G核心网进行校验并建立中继管道连接5G核心网，用户业务得到保障。
附图说明
图1为现有技术中5G天地一体化网络系统架构图；
图2为现有技术中5G核心网网元发现流程图；
图3为现有技术中5G核心网NRF及NEF网络功能现况概况图；
图4为现有技术中5G核心网网元间令牌通信流程图；
图5为现有技术中空地一体架构中异系统中继管道连接示意图；
图6为本发明实施例提供的一种用于空地网络架构的管道安全性提升方法流程图；
图7为本发明实施例提供的中继管道安全性提升系统架构图；
图8为本发明实施例提供的星地一体架构下中继管道安全性提升方法信令流程；
图9为本发明实施例提供的5G基站将基站配置信息及关联的发现参数注册到NRF消息流程图；
图10为本发明实施例提供的卫星对中继管道建立请求发起基站进行合法性校验方法流程图；
图11为本发明实施例提供的一种用于空地网络架构的管道安全性提升方法与装置结构示意图。
具体实施方式
为使本发明的上述目的、特征和优点能够更加明显易懂，下面结合附图对本发明的具体实施方式做详细的说明。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
上述对本说明书特定实施例进行了描述。其它实施例在所附权利要求书的范围内。在一些情况下，在权利要求书中记载的动作或步骤可以按照不同于实施例中的顺序来执行并且仍然可以实现期望的结果。另外，在附图中描绘的过程不一定要求示出的特定顺序或者连续顺序才能实现期望的结果。在某些实施方式中，多任务处理和并行处理也是可以的或者可能是有利的。
在本说明书一个或多个实施例使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本说明书一个或多个实施例。在本说明书一个或多个实施例和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本说明书一个或多个实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本说明书一个或多个实施例范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是本发明还可以采用其他不同于在此描述的其它方式来实施，本领域技术人员可以在不违背本发明内涵的情况下做类似推广，因此本发明不受下面公开的具体实施例的限制。
为了便于对本发明实施例的理解，以下结合附图对本发明具体实施方式作进一步详细说明。
实施例1：本发明基于与5G组网异构系统间数据共享架构及重用5G架构已有网元功能 的方法，如图6所示，包括以下步骤：
S1：如图7中的①所示，在合法基站与5G核心网有连接或网络仓库功能网元基于手动配置升级时，将基站配置信息预先注册到5G核心网的网络仓库功能网元中；
基站通过5G核心网NRF网元管理业务(NFManagement Service)中的网元注册服务(NFRegister)将基站配置信息中可被发现特征信息注册到5G核心网NRF中。
合法基站与5G核心网的连接为：基站在星地一体架构中将自身作为网络功能节点，通过5G核心网NRF网元管理业务(NFManagement Service)中的网元注册服务(NFRegister)把基站(gNB)配置信息注册到5G核心网的网络仓库功能网元中；该注册流程基于TS 29.510已有网元注册流程，通过新增信元结构(RanInfo)携带基站特征信息。特征信息包含地理位置，基站身份(RAN ID、RAN Name)，基站追踪区标识(TAI：Tracking Area Indication)和基站服务时间，具体包括必选项参数和可选项参数，所述必选项参数为：全球基站节点身份标识。
所述可选项参数为：基站节点名字、支持的追踪区列表和该列表中支持的追踪区项以及该追踪区项下的追踪区域码。
所述S1中将基站配置信息预先注册到5G核心网的网络仓库功能网元具体为：
将基站配置信息加入到网络仓库功能注册请求中携带的网络功能配置文件，并注册到网络仓库功能网元，注册成功则返回含义为注册成功的状态码及对应的网络功能配置文件，否则返回含义失败的状态码或者重定位状态码；失败状态下需要基站重新选择网络仓库功能网元的实例，并对该选定网络仓库功能网元实例再次执行基站注册流程。
图7中的②所示，卫星对基站进行合法性查询：
S2：卫星由于5G系统更新间隔或预配置文件错误，基站预配置表不一定及时更新。如卫星在收到某基站发起的中继管道连接建立请求后，基于连接建立请求中的基站配置信息，通过5G核心网的网络暴露功能网元对网络仓库功能网元发送网络功能(基站)查找请求；具体为通过5G系统网元校验服务发送3GPP第五代通信系统(5GS)网元校验请求至网元暴露功能网元，再通过网络暴露功能网元发送网络功能查找请求至网络仓库功能网元，该新增服务可选的包含在TS29.510中网元管理业务(NFManagement Service)中。
通过已有TS 29.510 NRF网络功能发现服务对NRF发送网络功能查找请求，该请求中携带从卫星收到的网元校验请求中的基站配置信息查询参数。所述基站配置信息查询参数包括必选项参数和可选项参数，所述必选项参数为：全球基站节点身份标识，用于决定校验结果。
所述可选项参数为：基站节点名字、支持的追踪区列表和该列表中支持的追踪区项以及该追踪区项下的追踪区域码，用于提供基站附属信息，未查询到可选项参数不影响校验结果。
该部分内容为新增内容，目前NRF的网元发现业务并不支持对基站进行发现。NEF也不支持接收5G核心网外部网元信息协助对5G核心网内信息进行查找与校验。
S3：网络仓库功能网元收到网络功能查找请求后，根据注册信息对网络暴露功能网元返回基站查询结果；若存在对应基站注册的配置信息，则网络暴露功能网元设置校验结果(VerificationResult)信元中的校验结果为“已注册(REGISTERED)”，否则设置为“内容不存在(NOT EXIST)”，并响应中继卫星网元的基站校验请求；
根据注册信息对网络暴露功能网元返回基站查询结果具体为：网络仓库功能网元检查注册信息是否匹配该查询请求中携带的基站配置信息，返回匹配信息并将请求响应状态码置为查询成功；如果无法处理该网络功能发现请求，则将请求响应状态码置为查询无效，需要重发该网络功能发现请求；或者将请求响应状态码置为重定位并在响应中携带资源重定位头，代表需要重新发送查询请求且发送到该资源重定位头指定的位置。
网络暴露功能将网元校验响应返回给对应查询中继卫星；如果无法处理该网络仓库请求返回的网络功能发现请求响应，则将状态码置为网元校验请求无效；或者将状态码置为重定位并在响应中携带资源重定位头发送给该中继卫星。
S4：如图7中的③所示，中继卫星根据收到的校验请求响应并检查携带的校验结果(VerificationResult)信元，若信元中携带“已注册”，则接受该基站中继管道建立请求并建立对应中继管道；若信元中携带“不存在”，则拒绝该基站中继管道建立请求。
该步骤中，中继卫星在收到网元校验请求响应，如果响应的状态码为查询成功，则卫星根据携带的“校验结果”对该中继管道建立请求基站进行准入或拒绝；如果收到响应状态码置为查询无效，中继卫星需要按照一定算法重发该网元校验请求；如果收到响应状态码为重定位状态码并携带重定位头在响应中，代表中继卫星需要重新发送校验请求且发送到该资源重定位头指定的位置。如果卫星按预设次数尝试网元校验服务后无法获得有效校验结果，则直接卫星拒绝该基站的中继管道建立请求。
实施例2：图8给出了本发明提出星地一体架构下中继管道安全性提升方法的信令流程。首先，5G地面基站在与5G核心网有连接时将自身作为网络功能节点把基站配置信息注册到5G核心网NRF中，该连接可为通过默认预配置的卫星进行中继的直接连接，也可经由运营商通过网管系统(例如BOSS,Business and operation supporting system)预配置在NRF中。
如图9所示，首先，5G合法基站作为服务消费者将携带基站配置信息的注册请求通过默认预配置卫星建立的中继连接，发送到5G核心网NRF进行注册。该注册流程基于TS 29.510 NRF网络功能注册流程，通过将本发明新提出的基站配置信息(表1和表2给出了本发明新增的基站配置信息注册到NRF所需信元设计，该结构兼容现有TS29.510标准)加入到NRF网络 功能管理服务(NFManagement)的注册请求(NFRegister Request)携带的网络功能配置文件(NFProfile)中并注册到NRF，注册成功则返回状态码“200”或“201”并根据状态码可选携带成功注册的网络功能配置文件，如图9中的2a所示；否则返回状态码“4xx”/“5xx”失败或者“3xx”重定位，如图9中的2b所示。失败状态下需要基站重新选择NRF的实例并对该选定NRF实例再次执行基站注册流程。
表1网元配置(NFProfile)中新增信元结构
表2新增的基站配置信息(RanInfo)信元结构
表1当中新增的基站配置信息信元包含表2中的必选(M)及可选信息(O)；
所述必选信息包含全球基站节点身份标识(Global RAN Node ID)，可选信息包括基站节点名字(RAN Node Name)、支持的追踪区列表(Supported TA List)和该列表中支持的追踪区项(Supported TA Item)以及该追踪区项下的追踪区域码(TAC)。
此时需要注意的是，尽管伪基站通过一定手段窃取到合法基站的卫星预配置信息，该伪基站无法将自身连接到经由卫星中继的5G核心网并注册到5G核心网的NRF中。中继卫星在接收到合法基站配置表外(造成原因可能为配置更新操作不当或者滞后)新基站(合法或非法)的卫星中继连接建立请求后，仅需通过5G核心网的网络暴露功能网元NEF对NRF中已经成功注册和合法5G基站内容进行匹配查询，如图10所示，具体步骤如下：
中继卫星通过本发明新提出的5G系统网元信息校验服务发送5GS网元校验请求到NEF，该校验请求中包含接收到的中继请求发起基站的配置查询参数，参数包含表2中必要及可选参数(表2中“M”代表必选项，“O”代表可选项)。
NEF在收到该校验请求后，沿用现有TS 29.510 NRF网络功能发现服务(图10中Nnrf_NFDiscovery)对该基站预先注册的配置信息进行查找。NEF向NRF发送携带有表2中必要及可选参数的网络服务发现请求，如图10中的2所示。
如图10中的3a所示，NRF收到来自NEF的网络功能发现请求，NRF检查注册信息是否包 含该基站配置信息，返回匹配信息并将请求响应状态码置为“200”或“201”并返回匹配结果；如果无法处理该网络功能发现请求，则将状态码置为“4xx”/“5xx”代表查询无效，在状态码为“400”和“504”情况下需重新选定可用NRF实例并重发该网络功能发现请求；或者“3xx”并携带“重定位”头在响应中，代表需要重新发送查询请求且发送到该资源重定位头指定的位置，(如图10中的3b所示)例如“307”和“308”。
NEF收到来自NRF的基站网络功能发现请求响应，如果正常处理该响应，则将校验请求响应状态码置为“200”或“201”，如图10中的4a所示，并根据NRF返回的网络功能发现请求响应中携带的网络功能查询结果设置并返回该基站对应的校验结果；
如表3所示，存在匹配基站信息，则设置为“注册过(Registered)”，不存在匹配基站信息，则设置为“不存在(Not Exist)”。
表3：校验结果(VerificationResult)
NEF返回网元校验请求响应给对应查询中继卫星。如果无法处理该NRF返回的网络功能发现请求响应，则将状态码置为“4xx”/“5xx”代表网元校验请求无效；或者将状态码置为“3xx”并携带“重定位”头在响应并发送给该中继卫星，例如“307”和“308”。
中继卫星在收到网元校验请求响应，如果响应的状态码为“200”或“201”，则卫星根据携带的“校验结果”对该中继管道建立请求基站进行准入或拒绝。如果收到响应状态码置为“4xx”/“5xx”则代表查询无效，中继卫星需要在状态码为“400”和“504”情况下需重新选定可用NEF实例并重发该网元校验请求；如图10中的4b所示，如果收到响应状态码为“3xx”并携带“重定位”头在响应中，代表中继卫星需要重新发送校验请求且发送到该资源重定位头指定的位置，例如“307”和“308”。
本发明一种用于空地网络架构的管道安全性提升的装置实施例可以应用在任意具备数据处理能力的设备上，该任意具备数据处理能力的设备可以为诸如计算机等设备或装置。装置实施例可以通过软件实现，也可以通过硬件或者软硬件结合的方式实现。以软件实现为例，作为一个逻辑意义上的装置，是通过其所在任意具备数据处理能力的设备的处理器将非易失性存储器中对应的计算机程序指令读取到内存中运行形成的。从硬件层面而言，如图11所示，为本发明空地网络架构下一种用于空地网络架构的管道安全性提升装置所在任意具备数据处理能力的设备的一种硬件结构图，除了图11所示的处理器、内存、网络接口、以及非易失性存储器之外，实施例中装置所在的任意具备数据处理能力的设备通常根据该任意具备数据处 理能力的设备的实际功能，还可以包括其他硬件，对此不再赘述。
上述装置中各个单元的功能和作用的实现过程具体详见上述方法中对应步骤的实现过程，在此不再赘述。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本发明方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
本发明实施例还提供一种计算机可读存储介质，其上存储有程序，该程序被处理器执行时，实现上述实施例中的一种用于空地网络架构的管道安全性提升方法。
所述计算机可读存储介质可以是前述任一实施例所述的任意具备数据处理能力的设备的内部存储单元，例如硬盘或内存。所述计算机可读存储介质也可以是任意具备数据处理能力的设备的外部存储设备，例如所述设备上配备的插接式硬盘、智能存储卡(Smart Media Card，SMC)、SD卡、闪存卡(Flash Card)等。进一步的，所述计算机可读存储介质还可以既包括任意具备数据处理能力的设备的内部存储单元也包括外部存储设备。所述计算机可读存储介质用于存储所述计算机程序以及所述任意具备数据处理能力的设备所需的其他程序和数据，还可以用于暂时地存储已经输出或者将要输出的数据。
以上所述仅为本说明书一个或多个实施例的较佳实施例而已，并不用以限制本说明书一个或多个实施例，凡在本说明书一个或多个实施例的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本说明书一个或多个实施例保护的范围之内。

Claims (10)

  1. 一种用于空地网络架构的管道安全性提升方法，其特征在于，该方法包括如下步骤：
    S1：在合法基站与5G核心网有连接或网络仓库功能网元对网络功能网元配置信息基于手动配置更新时，将基站配置信息预先注册到5G核心网的网络仓库功能网元中；
    S2：中继卫星在收到基站发起的中继管道连接建立请求后，基于连接建立请求中的基站配置信息，中继卫星发起携带该基站的配置信息的网元校验请求至网络暴露功能网元，通过网络暴露功能网元对网络仓库功能网元发送网络功能查找请求；
    S3：网络仓库功能网元收到查找请求后，根据注册信息对网络暴露功能网元返回基站查询结果；若存在对应基站注册的配置信息，则网络暴露功能网元设置校验结果信元中的校验结果为“已注册”，否则设置为“不存在”，并响应中继卫星的网元校验请求；
    S4：中继卫星根据收到的校验请求响应并检查携带的校验结果信元，
    若信元中携带“已注册”校验结果，则接受该基站中继管道连接建立请求；
    若信元中携带“不存在”校验结果，则拒绝该基站中继管道连接建立请求。
  2. 根据权利要求1所述的一种用于空地网络架构的管道安全性提升方法，其特征在于，S1中合法基站与5G核心网的连接为：
    基站和核心网连接方式是将自身作为网络功能节点，通过5G核心网网络仓库功能网元的注册服务，将基站配置信息注册到5G核心网的网络仓库功能网元中；该注册流程中基站配置信息通过新增信元结构携带；
    所述基站配置信息包含包括必选项参数和可选项参数，所述必选项参数为全球基站节点身份标识；所述可选项参数为：基站节点名字、支持的追踪区列表和该列表中支持的追踪区项以及该追踪区项下的追踪区域码。
  3. 根据权利要求2所述的一种用于空地网络架构的管道安全性提升方法，其特征在于，S1中将基站配置信息预先注册到5G核心网的网络仓库功能网元具体为：
    将基站配置信息加入到网络仓库功能网元注册请求中携带的网络功能配置文件，并注册到网络仓库功能网元，注册成功则返回注册成功状态码及对应的网络功能配置文件，否则返回注册失败状态码或者重定位状态码；失败状态下需要基站重新选择网络仓库功能网元的实例，并对选定网络仓库功能网元实例再次执行基站注册流程。
  4. 根据权利要求2所述的一种用于空地网络架构的管道安全性提升方法，其特征在于，所述网络暴露功能网元发送的网络功能查找请求带有基站配置信息查询参数，网络仓库功能网元收到查找请求后，沿用现有的网络功能发现服务对该基站预先注册的配置信息进行查找。
  5. 根据权利要求4所述的一种用于空地网络架构的管道安全性提升方法，其特征在于，所述基站配置信息查询参数为与基站配置信息一致的必选项参数和可选项参数，所述必选项参数用于决定校验结果；所述可选项参数用于提供基站附属信息。
  6. 根据权利要求1所述的一种用于空地网络架构的管道安全性提升方法，其特征在于，所述网络仓库功能网元收到查找请求后，根据注册信息对网络暴露功能网元返回基站查询结果具体为：
    网络仓库功能网元检查注册信息是否匹配该查询请求中携带的基站配置信息，返回匹配信息并将请求响应状态码置为查询成功；
    如果无法处理该网络功能查找请求，则将请求响应状态码置为查询无效，需要重发该网络功能查找请求，或者将请求响应状态码置为重定位并在响应中携带资源重定位头，代表需要重新发送查找请求且发送到该资源重定位头指定的位置。
  7. 根据权利要求1所述的一种用于空地网络架构的管道安全性提升方法，其特征在于，所述网络暴露功能网元将网络功能查找请求响应返回给对应查询中继卫星；如果无法处理该网络仓库功能网元返回的网络功能查找请求响应，则将状态码置为请求无效；或者将状态码置为重定位并在响应中携带资源重定位头发送给该中继卫星。
  8. 根据权利要求6所述的一种用于空地网络架构的管道安全性提升方法，其特征在于，S4中，中继卫星在收到网络功能查找请求响应后，如果响应状态码为查询成功，则卫星根据携带的校验结果对该中继管道连接建立请求的发起基站进行准入或拒绝；如果响应状态码为查询无效，中继卫星需要重发该网元校验请求；如果响应状态码为重定位状态码并在响应中携带资源重定位头，代表中继卫星需要重新发送网元校验请求且发送到该资源重定位头指定的位置；如果卫星按预设次数尝试网元校验服务后无法获得有效校验结果，则卫星拒绝该基站的中继管道建立请求。
  9. 一种用于空地网络架构的管道安全性提升装置，包括存储器和一个或多个处理器，所述存储器中存储有可执行代码，其特征在于，所述一个或多个处理器执行所述可执行代码时，用于实现权利要求1-8任一项所述的用于空地网络架构的管道安全性提升方法的步骤。
  10. 一种计算机可读存储介质，其上存储有程序，其特征在于，该程序被处理器执行时，实现权利要求1-8任一项所述的一种用于空地网络架构的管道安全性提升方法的步骤。
PCT/CN2023/101762 2023-06-21 2023-06-21 一种用于空地网络架构的管道安全性提升方法与装置 Pending WO2024259645A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2023/101762 WO2024259645A1 (zh) 2023-06-21 2023-06-21 一种用于空地网络架构的管道安全性提升方法与装置
US19/002,805 US12470285B2 (en) 2023-06-21 2024-12-27 Method and device for improving pipeline safety for space-terrestrial network architecture

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2023/101762 WO2024259645A1 (zh) 2023-06-21 2023-06-21 一种用于空地网络架构的管道安全性提升方法与装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US19/002,805 Continuation US12470285B2 (en) 2023-06-21 2024-12-27 Method and device for improving pipeline safety for space-terrestrial network architecture

Publications (1)

Publication Number Publication Date
WO2024259645A1 true WO2024259645A1 (zh) 2024-12-26

Family

ID=93934688

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/101762 Pending WO2024259645A1 (zh) 2023-06-21 2023-06-21 一种用于空地网络架构的管道安全性提升方法与装置

Country Status (2)

Country Link
US (1) US12470285B2 (zh)
WO (1) WO2024259645A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112367666A (zh) * 2020-11-05 2021-02-12 广州爱浦路网络技术有限公司 一种5G核心网中pNF通过NRF认证cNF的方法、装置及系统
WO2021224545A1 (en) * 2020-05-05 2021-11-11 Nokia Technologies Oy Enhanced registration in communication networks
CN115413014A (zh) * 2022-08-19 2022-11-29 中国电信股份有限公司 网络资源服务方法、装置、系统、可读介质及电子设备
CN115915138A (zh) * 2022-11-14 2023-04-04 之江实验室 一种共享5g天地一体化网络信令交互架构的方法
CN116018825A (zh) * 2020-08-12 2023-04-25 交互数字专利控股公司 用于发现和选择本地nef的方法和装置
CN116489652A (zh) * 2023-06-21 2023-07-25 之江实验室 一种用于空地网络架构的管道安全性提升方法与装置

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2003032748A (ja) * 2001-07-17 2003-01-31 Ntt Docomo Inc 移動通信網形成装置、移動通信システム、及び移動通信網形成方法
KR100590484B1 (ko) * 2004-10-06 2006-06-19 에스케이 텔레콤주식회사 도로 안내 데이터를 이용한 음성 기반의 부가 정보 서비스제공 방법 및 시스템
US8583629B2 (en) * 2008-06-03 2013-11-12 The Directv Group, Inc. Methods and apparatus to save search data
US9635195B1 (en) * 2008-12-24 2017-04-25 The Directv Group, Inc. Customizable graphical elements for use in association with a user interface
KR101402960B1 (ko) * 2012-01-26 2014-06-03 김한석 스마트폰을 이용한 긴급호출 오남용 방지 시스템 및 그 방법
DE102012208801A1 (de) * 2012-05-25 2013-11-28 Robert Bosch Gmbh Multischalter mit dynamischer Eingangszuordnung
US11102791B2 (en) * 2013-02-17 2021-08-24 Parallel Wireless, Inc. TV whitespace relay for public safety
US10958425B2 (en) * 2018-05-17 2021-03-23 lOT AND M2M TECHNOLOGIES, LLC Hosted dynamic provisioning protocol with servers and a networked responder
WO2020058878A1 (en) * 2018-09-21 2020-03-26 Telefonaktiebolaget Lm Ericsson (Publ) Intelligent grouping of network nodes for remote interference management
CN113766461B (zh) * 2020-06-01 2024-09-06 中国电信股份有限公司 用户面数据处理方法和基站
EP4173246B1 (en) * 2020-06-26 2024-08-21 Telefonaktiebolaget LM ERICSSON (PUBL) Remote subscription profile download
US20240187176A1 (en) * 2021-03-16 2024-06-06 Intel Corporation Sounding reference signal configuration for antenna switching and carrier switching
US12348300B2 (en) * 2021-09-07 2025-07-01 Intelsat US LLC Process and system for migrating satellite networks to 3GPP 5G architecture
US20230163984A1 (en) * 2022-01-13 2023-05-25 Intel Corporation User equipment (ue) route selection policy (usrp) ue in an evolved packet system (eps)

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021224545A1 (en) * 2020-05-05 2021-11-11 Nokia Technologies Oy Enhanced registration in communication networks
CN116018825A (zh) * 2020-08-12 2023-04-25 交互数字专利控股公司 用于发现和选择本地nef的方法和装置
CN112367666A (zh) * 2020-11-05 2021-02-12 广州爱浦路网络技术有限公司 一种5G核心网中pNF通过NRF认证cNF的方法、装置及系统
CN115413014A (zh) * 2022-08-19 2022-11-29 中国电信股份有限公司 网络资源服务方法、装置、系统、可读介质及电子设备
CN115915138A (zh) * 2022-11-14 2023-04-04 之江实验室 一种共享5g天地一体化网络信令交互架构的方法
CN116489652A (zh) * 2023-06-21 2023-07-25 之江实验室 一种用于空地网络架构的管道安全性提升方法与装置

Also Published As

Publication number Publication date
US12470285B2 (en) 2025-11-11
US20250132810A1 (en) 2025-04-24

Similar Documents

Publication Publication Date Title
CN111865598B (zh) 网络功能服务的身份校验方法及相关装置
CN111512330B (zh) 跨网络身份验证方法以及系统
CN115460606B (zh) 一种基于5g核心网控制面安全性增强的方法及装置
US20250031256A1 (en) Method for signaling interaction in 5g space-ground integrated heterogeneous network architecture
CN116193440B (zh) 一种用于5g异构网络业务安全性提升的用户面方法及装置
US12206671B2 (en) Data management for authorizing data consumers in communication network
CN113037761B (zh) 登录请求的验证方法及装置、存储介质、电子设备
EP2304980B1 (en) A method and apparatus for a subscriber database
CN116438824A (zh) 用于无线网络中核心网装置重分配的方法、装置及系统
US8887244B2 (en) Region access platform for providing a positioning result to a positioning client, a mobile positioning method of the region access platform, and a mobile positioning system comprising the region access platform, a mobile positioning center and a Position Determining Entity
CN111132305A (zh) 5g用户终端接入5g网络的方法、用户终端设备及介质
CN116489652B (zh) 一种用于空地网络架构的管道安全性提升方法与装置
WO2024259645A1 (zh) 一种用于空地网络架构的管道安全性提升方法与装置
CN111340481A (zh) 基于多链区块链网络的数据处理方法、装置和设备
CN115361350B (zh) 一种聊天机器人的发现方法、装置及计算机可读存储介质
CN107959584B (zh) 信息配置方法及装置
CN101137222A (zh) 一种接入鉴权处理方法和系统及装置
CN113596890B (zh) 通信方法、系统、装置及存储介质
CN120358632B (zh) 终端通信方法、装置、系统、通信设备和可读存储介质
US12231408B2 (en) Secure data transfer request routing for peer-to-peer services
CN115348224B (zh) 一种聊天机器人的交互方法、装置及计算机可读存储介质
CN115065969B (zh) 专网通信方法及系统
CN115474256B (zh) 接入本地业务网络的方法、装置和系统
WO2025000119A1 (zh) 一种异构网络架构下业务合法性校验的方法和装置
WO2024094105A1 (zh) 消息交互方法、装置、网络功能、相关设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23941942

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE