CN114205814B - Data transmission method, device and system, electronic equipment and storage medium - Google Patents

Abstract

The application discloses a data transmission method, a device, a system, an electronic device and a storage medium, which relate to the field of communication and are used for solving the problem of lower message data security when a wireless terminal transmits messages with a core network in the prior art, and comprise the following steps: the user terminal sends a data message to the user plane function network element through the base station; the user plane function network element determines the encryption mode and the destination IP address of the data message; the user plane function network element sends the data message to the destination IP address. The application is used for the encrypted message transmission between the wireless terminal and the core network.

Description

A data transmission method, device, system, electronic equipment and storage medium

Technical field

The present application relates to the field of communications, and in particular, to a data transmission method, device, system, electronic equipment and storage medium.

Background technique

Currently, after a wireless terminal establishes a bearer with the core network through a base station, when the wireless terminal transmits data packets on the bearer, all data packets sent and received are transmitted in plain text. Message data is transmitted in clear text on wireless channels and bearer networks, which can lead to message data leakage, data tampering, traffic hijacking, phishing attacks and other security issues. As long as the network sniffing equipment and some technical means are used, the message can be restored. The content of this article is very unsafe.

The solution in the existing technology is that the wireless terminal establishes a bearer with the core network through the base station, and transmits data messages on the bearer. Some applications with security requirements will encrypt the payload part of data packets, such as hypertext transfer protocol over securesocket layer (HTTPS) packets. However, the header part including the destination IP address and source IP address is still transmitted in clear text, and the security issue has not been resolved.

Contents of the invention

This application provides a data transmission method, device, system, electronic equipment and storage medium to solve the problem in the prior art that the security of message data is low when a wireless terminal transmits messages between the core network and the wireless terminal.

In order to achieve the above purpose, this application adopts the following technical solutions:

In a first aspect, this application provides a data transmission method, including: a user plane functional network element receiving a data message from a user terminal UE. The user plane functional network element determines the encryption method of the data packet according to the packet encryption mode flag bit. The user plane functional network element determines the destination IP address of the data message based on the encryption method of the data message. The user plane functional network element sends the data packet to the destination IP address.

In a possible implementation manner, the encryption method of the above-mentioned data message includes: a plain text transmission method, a fully encrypted transmission method, and a message header obfuscated encryption transmission method.

In a possible implementation, the user plane functional network element determines the destination IP address of the data packet according to the encryption method of the data packet, which specifically includes: if the encryption method of the data packet is plaintext transmission, obtain the data packet header of the data packet, and determine the destination IP address of the data packet based on the header of the data packet. If the encryption method of the data packet is the fully encrypted transmission method or the header obfuscation encryption transmission method, the user plane functional network element decrypts the header of the data packet and determines the data based on the header of the decrypted data packet. The destination IP address of the message.

Based on the above technical solution, this application can bring the following beneficial effects: This application adds a message encryption mode flag bit in the data message sent by the UE, so that after receiving the data message, the user plane functional network element can Text encryption mode flag bit to determine the encryption mode of the data message. When the encryption mode is plain text transmission mode, the header of the message data is directly obtained to determine the destination IP address; and when the encryption mode is fully encrypted transmission mode or the message header is obfuscated In the encrypted transmission mode, the header of the data message is decrypted to obtain the destination IP address of the data message. Finally, the user plane functional network element sends the data packet to the destination IP address. Therefore, this application can simultaneously support the UE to send data messages in the conventional method and the encrypted method, and can effectively improve the data security and flexibility during transmission in the wireless channel and bearer network.

In the second aspect, this application provides a data transmission method, which includes: the user terminal UE determines the message encryption mode flag according to the unified data management UDM subscription data. The UE sends a data packet to the user plane functional network element.

In a possible implementation, the above method also includes: the UE sends a data message to the user plane functional network element through the base station; the data message includes a message encryption mode flag bit, and the message encryption mode flag bit is used to indicate the data The encryption method of the message.

In addition, the technical effects of the data transmission method of the second aspect can be referred to the technical effects of the data transmission method of the first aspect, and will not be described again here.

In a third aspect, the present application provides a data transmission device, which includes: a receiving unit, a processing unit and a sending unit. The receiving unit is configured to receive a data message from the user terminal UE; wherein the data message includes a message encryption mode flag. The processing unit is used to determine the encryption method of the data message according to the message encryption mode flag bit. The processing unit is also used to determine the destination IP address of the data message based on the encryption method of the data message. The sending unit is used to send data packets to the destination IP address.

In a possible implementation method, the encryption method of the data message includes: a plain text transmission method, a fully encrypted transmission method, and a message header obfuscated encryption transmission method.

In a possible implementation, the processing unit is also used to obtain the header of the data message when the encryption method of the data message is plaintext transmission, and determine the purpose of the data message based on the header of the data message. IP address. The processing unit is also used to decrypt the header of the data message when the encryption method of the data message is the fully encrypted transmission method or the message header obfuscation encryption transmission method, and determine the header based on the decrypted data message. The destination IP address of the data packet.

In addition, the technical effects of the data transmission device of the third aspect can be referred to the technical effects of the data transmission method of the first aspect, and will not be described again here.

In a fourth aspect, the present application provides a data transmission device, which includes: a processing unit and a sending unit. The processing unit is used to manage UDM contract data based on unified data and determine the message encryption mode flag. The sending unit is used to send data packets to the user plane functional network element.

In a possible implementation, the sending unit is also used to send a data message to the user plane functional network element through the base station; the data message includes a message encryption mode flag bit, and the message encryption mode flag bit is used to indicate the data The encryption method of the message.

In addition, the technical effects of the data transmission device of the fourth aspect can be referred to the technical effects of the data transmission method of the first aspect, and will not be described again here.

In the fifth aspect, this application provides a data transmission system, including: a user plane functional network element and a user terminal UE. The user plane functional network element is used to receive data packets from the UE, determine the encryption method of the data packet and the destination IP address of the data packet, and send the data packet to the destination IP address. The UE is used to manage UDM subscription data based on unified data, determine the message encryption mode flag bit, and send a data message to the user plane functional network element; wherein the data message includes the message encryption mode flag bit.

In addition, the technical effects of the data transmission system described in the fifth aspect can be referred to the technical effects of the data transmission method described in the first aspect, and will not be described again here.

In a sixth aspect, the present application provides a computer-readable storage medium storing one or more programs. The one or more programs include instructions. When executed by the electronic device of the present application, the above instructions cause the electronic device to execute the first aspect. , any possible implementation manner of the first aspect, the second aspect, and the data transmission method described in any possible implementation manner of the second aspect.

In a seventh aspect, the present application provides an electronic device, including: a processor and a memory; wherein the memory is used to store one or more programs, and the one or more programs include computer execution instructions. When the electronic device is running, the processor executes The computer executes instructions stored in the memory to cause the electronic device to perform data transmission as described in the first aspect, any possible implementation of the first aspect, the second aspect, and any possible implementation of the second aspect. method.

In an eighth aspect, the present application provides a computer program product containing instructions. When the instructions are run on a computer, the electronic device of the present application executes the first aspect, any possible implementation manner of the first aspect, and the third aspect. The data transmission method described in the second aspect and any possible implementation manner of the second aspect.

In a ninth aspect, the present application provides a chip system, which is applied to a data transmission device; the chip system includes one or more interface circuits and one or more processors. The interface circuit and the processor are interconnected through lines; the interface circuit is used to receive signals from the memory of the data transmission device and send the signals to the processor, where the signals include information stored in the memory. computer instructions. When the processor executes the computer instructions, the data transmission device executes the first aspect, any possible implementation of the first aspect, the second aspect, and any possible implementation of the second aspect. The data transfer method described in .

Description of the drawings

Figure 1 is a schematic diagram of a data message format provided by an embodiment of the present application;

Figure 2 is a schematic diagram of another data message format provided by an embodiment of the present application;

Figure 3 is a schematic diagram of the network architecture of a data transmission method provided by an embodiment of the present application;

Figure 4 is a schematic architectural diagram of a data transmission system provided by an embodiment of the present application;

Figure 5 is a schematic flow chart of a data transmission method provided by an embodiment of the present application;

Figure 6 is a schematic flow chart of another data transmission method provided by an embodiment of the present application;

Figure 7 is a schematic structural diagram of a data transmission device provided by an embodiment of the present application;

Figure 8 is a schematic structural diagram of a data transmission device provided by an embodiment of the present application;

Figure 9 is a schematic structural diagram of another data transmission device provided by an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of this application.

The character "/" in this article generally indicates that the related objects are an "or" relationship. For example, A/B can be understood as A or B.

The terms "first" and "second" in the description and claims of this application are used to distinguish different objects, rather than to describe a specific order of objects. For example, the first edge service node and the second edge service node are used to distinguish different edge service nodes, rather than to describe the characteristic sequence of the edge service nodes.

Furthermore, references to the terms "including" and "having" and any variations thereof in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes other unlisted steps or units, or optionally also Includes other steps or units that are inherent to such processes, methods, products, or devices.

In addition, in the embodiments of this application, words such as "exemplary" or "for example" are used to represent examples, illustrations or explanations. Any embodiment or design described herein as "exemplary" or "such as" is not intended to be construed as preferred or advantageous over other embodiments or designs. Rather, use of the words "exemplary," or "such as" is intended to present a concept in a concrete manner.

In order to facilitate understanding of the technical solutions of this application, some technical terms are introduced below.

Base stations are mainly used to implement resource scheduling, wireless resource management, wireless access control and other functions of terminal equipment. Base stations can include various forms of base stations, such as macro base stations, micro base stations (also called small stations), relay stations, access points, etc. Specifically, it can be: an access point (AP) in a Wireless Local Area Network (WLAN), a Global System for Mobile Communications (GSM) or a Code Division Multiple Access (Code Division). The base station (Base Transceiver Station, BTS) in Multiple Access (CDMA), or the base station (NodeB, NB) in Wideband Code Division Multiple Access (WCDMA), or the evolved type in LTE Base station (Evolved Node B, eNB or eNodeB), or relay station or access point, or vehicle-mounted equipment, wearable devices, and the next generation Node B (The NextGeneration Node B, gNB) in the future 5G network or future evolved public land mobile Base stations in the Public Land Mobile Network (PLMN) network, etc.

The above has introduced some technical terms in this application.

In the existing technology, after a wireless terminal establishes a bearer with the core network through a base station, when the wireless terminal transmits data packets on the bearer, all data packets sent and received are transmitted in plain text. Message data is transmitted in clear text on wireless channels and bearer networks, which can lead to message data leakage, data tampering, traffic hijacking, phishing attacks and other security issues. As long as the network sniffing equipment and some technical means are used, the message can be restored. The content of this article is very unsafe.

The current solution is for the wireless terminal to establish a bearer with the core network through the base station and transmit data messages on the bearer. Some applications with security requirements will encrypt the payload part of data packets, such as HTTPS packets. However, the header part including the destination IP address and source IP address is still transmitted in clear text, and the security issue has not been resolved.

For example, the prior art discloses a solution 1. Machine A transmits data to machine B. The steps for processing uplink data messages are:

1. The wireless terminal transmits all unencrypted data messages to the base station through the wireless link.

2. The base station encapsulates the data packet with GTP-U protocol through the N3 interface and forwards the data to the user plane function (user port function, UPF) network element.

3. UPF decapsulates the GTP-U message and decodes the header field of the data to obtain the source IP address and destination IP address of the data. UPF performs QoS, conventional accounting, and PFCP node management of data packets, and reports the information generated by data packets to the session management function (SMF) network element of the 5GC core network through the N4 interface.

4. UPF forwards the data packet to the external network through the N6 interface according to the destination IP address of the data packet.

Among them, as shown in Figure 1, the data message is expressed in the form of a data link layer MAC frame, and the solid line frame part is plain text data.

However, in solution 1, the message data is transmitted in plain text on the wireless channel and the bearer network, and no data encryption is provided in any way. This will lead to security issues such as packet data leakage, data tampering, traffic hijacking, and phishing attacks. The content of the packet can be restored through network sniffing equipment and some technical means, which is very unsafe.

For another example, the prior art also discloses a scheme 2. The processing steps of the uplink data message from machine A to machine B are roughly the same as scheme 1. The difference is that the data payload of the message sent by machine A has been encrypted. Among them, as shown in Figure 2, the data message is expressed in the form of a data link layer MAC frame, the solid line box part is plain text data, and the dotted line box part is encrypted data.

However, in Solution 2, only the payload part of the message data is encrypted in the wireless channel and bearer network, which ensures that user data is encrypted during transmission and prevents the server from being impersonated by phishing websites. However, header fields such as IP addresses are still transmitted in clear text, which may lead to security risks such as IP address modification and IP address theft.

Figure 3 shows a schematic diagram of the network architecture of the data transmission method provided by this application. The network architecture includes: user equipment, new air interface, user plane function, data network, authentication service function, access and mobility management function, session management function, Network elements such as network storage functions, unified data management, policy control functions, application functions, and network opening functions.

Among them, user equipment (UE) is a terminal equipment used by users when performing mobile communications.

New radio (NR) is used to complete the forwarding of control signals and user data between the terminal and the core network.

The user plane function (UPF) is a network element that processes user data plane data. It is used for packet routing and forwarding, quality of service (QoS) processing, and packet filter control protocol (PFCP) nodes. Management etc.

A data network (DN) is a network used to transmit data.

Authentication server function (AUSF) is used for terminal authentication and protection, protection control information list, etc.

The access and mobility management function (authentication management function, AMF) is responsible for terminal access permissions and handovers.

The session management function (service management function, SMF) is used to ensure service continuity and provide users with an uninterrupted service experience, including changes in IP addresses and anchor points. SMF is also responsible for session management, such as interacting with the separated data plane, creating, updating, and deleting protocol data unit (PDU) sessions, and selecting and controlling user plane functions.

The network repository function (NRF) is used for network function registration, management, status detection, and automatic management of all network functions.

Unified data management (UDM) is used to store contract information and supports the storage and processing of authentication certificates.

The policy control function (PCF) is used to provide policy information for the control plane function, store and provide user policy-related subscription information.

Application function (AF) is used to interact with the core network and provide services.

The network exposure function (NEF) is responsible for opening network data to the outside world.

In this network architecture, the N1 interface is the reference point between the terminal and AMF; the N2 interface is the reference point between NR and AMF, used for sending non-access layer messages, etc.; the N3 interface is the reference point between NR and UPF , uses the GTP-U protocol to transmit user plane data, etc.; the N4 interface is the reference point between SMF and UPF, and uses the PFCP control plane protocol stack to encapsulate signaling, transmit data cache indication information, etc.; the N6 interface is the reference point between UPF and DN Reference point, used to transmit user plane data, etc.

In the data transmission method provided by this application, the execution subject can be an electronic device (such as a computer terminal, a server), a processor in the electronic device, or a control module for data transmission in the electronic device. It can also be a client in an electronic device for data transmission.

FIG. 4 is a schematic architectural diagram of a data transmission system 400 provided by an embodiment of the present application. As shown in Figure 4, the data transmission system 400 includes: a user terminal 401 and a user plane functional network element 402. Among them, the user plane functional network element 402 receives the data packet from the user terminal 401, determines the encryption method and destination IP address of the data packet, and sends the data packet to the destination IP address. The specific implementation of this solution will be described in detail in subsequent method embodiments, and will not be described again here.

Optionally, assuming that the data transmission system shown in Figure 4 is applied to the network architecture shown in Figure 3, the network element or entity corresponding to the above user plane functional network element 402 can be in the network architecture shown in Figure 3 UPF network element.

In order to solve the problem in the prior art that the security of message data is low when wireless terminals transmit messages with the core network, this application provides a data transmission method. As shown in Figure 5, taking the network element or entity corresponding to the user plane function network element 402 as a UPF network element as an example, the technical solution of the embodiment of the present application is explained. The data transmission method provided by this application includes the following steps:

S501. The UE sends a data message to the base station. Correspondingly, the base station receives the data message.

Among them, the message encryption mode flag is determined based on the UE's UDM subscription data. The message encryption mode flag is used to indicate the encryption mode of the data message. It can be understood that the UE sends a data message to the base station through a wireless link.

Optional encryption methods for data messages include plain text transmission, fully encrypted transmission, and header obfuscation encrypted transmission.

S502. The base station performs protocol encapsulation on the data message.

Optionally, the base station performs protocol encapsulation of the data packet through the N3 interface. For example, the protocol used by the base station to encapsulate the data packet is the GTP-U protocol. The specific process of protocol encapsulation of data packets according to the GTP-U protocol is an existing technology, and will not be described in detail here in this application.

S503. The base station sends the encapsulated data message to the UPF. Correspondingly, UPF receives the encapsulated data message.

S504, UPF determines the encryption method of the data message.

Optionally, after receiving the data message from the base station, the UPF determines the packet detection rules (PDR) corresponding to the data message according to the packet detection priority.

For example, if the packet detection priority presets the packet encryption mode flag as the first priority, then the UPF is the first to obtain the packet encryption mode flag. After that, UPF determines the PDR corresponding to the data message based on the identified message encryption mode flag. After that, UPF determines the encryption method of the data message based on the PDR corresponding to the data message.

S505. UPF determines the source IP address and destination IP address corresponding to the data message.

Optionally, UPF decrypts the header of the data message. It can be understood that if the transmission mode indicated by the message encryption mode flag bit at this time is plaintext transmission, there is no need to decrypt the header of the data message. UPF can directly obtain the source IP address and destination IP address corresponding to the data message based on the header of the data message.

For example, when the encryption method of the data packet is plaintext transmission, UPF obtains the header of the data packet and determines the destination IP address of the data packet based on the header of the data packet.

For example, when the encryption method of the data packet is the fully encrypted transmission method or the header obfuscation encryption transmission method, UPF decrypts the header of the data packet and uses the header of the decrypted data packet to Determine the destination IP address of the data packet.

S506, PDF sends a data packet to the destination IP address.

It should be noted that after PDF determines the encryption method of the data message and decodes the header of the data message, it forwards the data message in the same manner as in the prior art. This application will no longer describe it here. Repeat.

Based on the above technical solution, this application adds a message encryption mode flag bit in the data message sent by the UE, so that the user plane functional network element can determine the data message according to the message encryption mode flag bit after receiving the data message. The encryption method of the message. When the encryption method is plain text transmission, the header of the message data is directly obtained to determine the destination IP address; and when the encryption method is fully encrypted transmission or message header obfuscated encryption transmission, the data message is Decrypt the header to obtain the destination IP address of the data packet. Finally, the user plane functional network element sends the data packet to the destination IP address. Therefore, this application can simultaneously support the UE to send data messages in the conventional method and the encrypted method, and can effectively improve the data security and flexibility during transmission in the wireless channel and bearer network.

Combined with Figure 5, as shown in Figure 6, the data transmission method provided by this application also includes the process of UE initiating PDU session creation before S501. The specific steps are as follows:

S601. The UE requests PDU session establishment.

S602. AMF selects SMF according to the request.

S603. AMF requests to create a PDU session SM context service. In order to establish the connection between AMF and SMF regarding this UE Session; transmit the subscription data UDM selected by this SMF and trigger the entire 5GC session establishment process.

Among them, a new message encryption mode flag flag-1 is added to UDM, which is used to identify the first priority of packet detection. For example, the value of the message encryption mode flag flag-1 includes three parameters. The content of the parameters and the encryption methods they represent are: 0-regular transmission mode (that is, plaintext transmission mode), 1-full encryption. Transmission method, 2-message header obfuscation and encryption transmission method.

S604. SMF obtains contract data from UDM or updates contract data.

S605. SMF returns a create PDU session SM context service response.

S606, SMF selects the appropriate PCF.

S607. SMF and PCF establish a session policy.

S608. The SMF selects the UPF serving the UE and allocates an IP address to the UE session.

S609. The SMF sends an N4 session establishment request to the UPF, providing packet detection rules (PDR), forwarding behavior rules (FAR), etc. to be installed on the UPF of the PDU session.

Among them, a new ciphertext transmission flag flag-2 is added to the PDR rule, which is determined by flag-1, the identifier of different message encryption methods in UDM. Corresponding to the value of the packet encryption mode flag flag-1 in S603, when the flag-2 parameter is 0, it means that UPF will use the conventional transmission method; when the flag-2 parameter is 1, the packets of the PDU session will be hit. Processed as ciphertext; when the flag-2 parameter is 2, processed as ciphertext of obfuscated message headers. For ciphertext, decrypt it first and then match the tuple matching rules in the PDR rule.

S610. UPF returns an N4 session establishment response to SMF, carrying PDU session context information, such as QoS flow list, etc.

S611. SMF sends N1/N2 message transmission request to AMF.

S612. The AMF sends an N2 interface PDU session request to the base station.

S613. The base station sends a radio resource establishment request to the UE, and establishes an appropriate radio bearer for the UE according to the PDU session information provided by the AMF.

S614. The base station returns the N2 interface PDU session reception information to the AMF, which carries the N3 interface resources allocated by the base station, and the uplink data link is established.

S615. AMF sends an updated SM session context request to SMF.

S616. SMF sends N4 session update to UPF. Downlink established.

S617. The SMF returns an update SM session context request response to the AMF. This completes the entire 5GS session establishment process.

S618. The AMF returns the session establishment request response PDU session establishment accept to the UE, and the response carries the MSG-1 content.

S619. The UE processes the PDU session establishment accept message and parses and updates the content in MSG-1 to LIST-1 and LIST-2 in the encryption and decryption module of the UE, where LIST-2-node-action in LIST-2 -src-ip is initially 0.

The above describes the process of UE initiating PDU session creation in the data transmission method provided by this application.

The following describes the implementation method of the encryption method of the data message in the embodiment of the present application.

(1) If the parameter of the message encryption mode flag bit is 1, it means that the encryption mode of the data message at this time is the fully encrypted transmission mode. The specific implementation method is: after upf receives the data message, after teid hits pdr, according to The parameter of flag-2 (the parameter of flag-2 is 1 at this time) determines that the data message is a fully encrypted message, then it is transferred to the decryption module for decryption processing, and then the normal plaintext forwarding process is performed; upf processes the downlink data At that time, the PDR corresponding to the UE is hit according to the destination IP address, and based on the identification bit in the PDR, it is judged whether encryption is required. If encryption is required, it is transferred to the encryption and decryption module for encryption processing and then sent to the corresponding UE through N3 and the base station. By default, all uplink and downlink messages are encrypted and decrypted in the UE.

(2) If the parameter of the message encryption mode flag is 2, it means that the encryption mode of the data message at this time is the message header obfuscation encryption transmission mode. The specific implementation method is:

According to the method of payload encryption and message header (IP header) obfuscation, the message header obfuscation encrypted transmission is realized, and some messages can be obfuscated according to business needs. The payload encryption part is the same as the existing technology, and will not be described in detail here in this application. The implementation steps of the message header obfuscation mechanism are as follows:

S1. The UE registers with the network to establish a PDU session. When assigning an IP address through the PDU session, a real IP address and a set of special IP addresses will be allocated, such as 10.x.x.1/8 or IP address list LIST-1.

An obfuscation processing module is added to the protocol stack of S2 and UE. The obfuscation module maintains an N-tuple rule table LIST-2. This rule table is issued through 5GC configuration. The rules of the rule table are N-tuple LIST-2-node-rule. The action contains the source IP obfuscation address (LIST-2-node-action-src-ip), the destination address obfuscation key LIST-2-node-action-dst-ip-key, and the obfuscation/encryption type LIST- of the payload part. 2-node-action-payload-type, key LIST-2-node-action-payload-key.

S3. When the APP in the UE sends a message, it passes through the protocol stack and reaches the obfuscation module before the network message is sent. The obfuscation module will match the message according to the N-tuple rule table. After a hit, it means that the IP message header needs to be modified. Confused.

S4. Obfuscation method---Source IP address: The source IP address is determined based on LIST-2-node-action-src-ip in LIST-2. When LIST-2-node-action-src-ip is 0, in An IP address is randomly selected from LIST-1; when LIST-2-node-action-src-ip is not 0, the source IP address is directly replaced with LIST-2-node-action-src-ip. According to the configuration, you can set the aging time LIST-2-node-action-src-ip-aging. After the timeout, LIST-2-node-action-src-ip is cleared to 0, and the address is re-randomly selected for the next message.

S5. Obfuscation method---Destination IP address: The destination IP performs obfuscation calculation on the real destination IP based on LIST-2-node-action-dst-ip-key. For example: the real destination IP is A.B.C.D, LIST-2-node-action -dst-ip-key is k (the value range of k is 1~254), and the confusion method is {[(A-k)+255]%256}.{[(B+k)+255]%256}, { [(C-k)+255]%256}, {[(D+k)+255]%256}.

S6. Obfuscation method---payload: Use normal encryption or obfuscation algorithm. The type and key are: LIST-2-node-action-payload-type and LIST-2-node-action-payload-key.

S7. Send message information: Send the obfuscated/encrypted message to the base station according to the UE's regular message sending method.

S8. After receiving the information, the base station forwards it to UPF through N3.

S9. After UPF receives the uplink message, it first hits the pdr based on teid and then determines that flag-2 is 2. When the encrypted message is expressed as method 2, it further determines the source IP address. If the source IP address is in LIST-1 , the message is considered to be an obfuscated/encrypted message, and will be transferred to the UPF unit that specializes in encryption and decryption for deobfuscation and decryption processing to obtain the plaintext message; if the source IP address is not in LIST-1, the message will be processed as normal Ordinary message processing.

S10 and UPF perform normal routing and forwarding of plain text messages.

S11. The downlink message is similar to the above uplink process. The difference is that UPF determines whether it needs to be obfuscated and encrypted based on the destination IP and N-tuple of the message. If necessary, it goes to the encryption and decryption module for encryption processing, and then sends it through N3 and the base station. to UE.

S12. After receiving the message, the UE determines whether it needs to be decrypted based on the destination IP address. If so, it will decrypt it and then pass it to the APP through the protocol stack.

It should be noted that the rules in the UE will be delivered in the PDU session establishment accept message. As shown in Table 1 below, the content MSG-1 used to transmit the encryption rules is added to the PDU session establishment accept message:

Table 1 Contents of encryption rules MSG-1

The above has introduced the implementation method of the encryption method of the data message in the data transmission method provided by this application.

Embodiments of the present application can divide the data transmission device into functional modules or functional units according to the above method examples. For example, each functional module or functional unit can be divided corresponding to each function, or two or more functions can be integrated into one in the processing module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules or functional units. Among them, the division of modules or units in the embodiments of the present application is schematic and is only a logical function division. In actual implementation, there may be other division methods.

Illustratively, as shown in FIG. 7 , it is a possible structural schematic diagram of a data transmission device involved in the embodiment of the present application. The data transmission device 700 includes: a receiving unit 701, a processing unit 702, and a sending unit 703.

Among them, the receiving unit 701 is used to receive data messages from the user terminal UE.

The processing unit 702 is used to determine the encryption method of the data message.

The processing unit 702 is also used to determine the destination IP address of the data message according to the encryption method of the data message.

The sending unit 703 is used to send data packets to the destination IP address.

Optionally, the processing unit 702 is also configured to determine the encryption method of the data message according to the message encryption mode flag.

Optionally, the processing unit 702 is also configured to obtain the header of the data message when the encryption mode of the data message is plain text transmission, and determine the destination IP address of the data message based on the header of the data message.

Optionally, the processing unit 702 is also configured to decrypt the header of the data message when the encryption mode of the data message is a fully encrypted transmission mode or a message header obfuscated encrypted transmission mode, and use the decrypted data message to The header of the message determines the destination IP address of the data message.

Optionally, the data transmission device 700 may also include a storage unit (shown as a dotted box in FIG. 7 ), which stores programs or instructions. When the processing unit 702 executes the program or instructions, the data transmission device can execute The data transmission method described in the above method embodiment.

In addition, the technical effects of the data transmission device described in FIG. 7 can be referred to the technical effects of the data transmission method described in the above embodiments, and will not be described again here.

Illustratively, as shown in FIG. 8 , it is a possible structural schematic diagram of another data transmission device involved in the embodiment of the present application. The data transmission device 800 includes: a processing unit 801 and a sending unit 802.

Among them, the processing unit 801 is used to determine the message encryption mode flag according to the unified data management UDM contract data.

The sending unit 802 is used to send data packets to the user plane functional network element.

Optionally, the sending unit 802 is also used to send the data message to the user plane functional network element through the base station.

Optionally, the data transmission device 800 may also include a storage unit (shown as a dotted box in FIG. 8 ), which stores programs or instructions. When the processing unit 801 executes the program or instructions, the data transmission device can execute The data transmission method described in the above method embodiment.

In addition, the technical effects of the data transmission device described in FIG. 8 can be referred to the technical effects of the data transmission method described in the above embodiments, which will not be described again here.

Exemplarily, FIG. 9 is a schematic structural diagram of another possible structure of the data transmission device involved in the above embodiment. As shown in Figure 9, the data transmission device 900 includes: a processor 902.

Among them, the processor 902 is used to control and manage the actions of the data transmission device, for example, execute the steps performed by the above-mentioned receiving unit 701, processing unit 702, sending unit 703, processing unit 801 and sending unit 802, and/or use Other processes for executing the technical solutions described in this article.

The above-mentioned processor 902 may implement or execute various exemplary logical blocks, modules and circuits described in conjunction with the contents of this application. The processor may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute the various illustrative logical blocks, modules, and circuits described in connection with this disclosure. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

Optionally, the data transmission device 900 may also include a communication interface 903, a memory 901 and a bus 904. Among them, the communication interface 903 is used to support communication between the data transmission device 900 and other network entities. The memory 901 is used to store program codes and data of the data transmission device.

The memory 901 may be a memory in a data transmission device, and the memory may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, flash memory, hard disk, or Solid state drive; the memory may also include a combination of the above types of memory.

The bus 909 may be an Extended Industry Standard Architecture (EISA) bus or the like. The bus 909 can be divided into an address bus, a data bus, a control bus, etc. For ease of presentation, only one thick line is used in Figure 9, but it does not mean that there is only one bus or one type of bus.

Through the above description of the embodiments, those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be allocated as needed. It is completed by different functional modules, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. For the specific working processes of the systems, devices and modules described above, reference can be made to the corresponding processes in the foregoing method embodiments, which will not be described again here.

Embodiments of the present application provide a computer program product containing instructions. When the computer program product is run on the electronic device of the present application, it causes the computer to execute the data transmission method described in the above method embodiment.

Embodiments of the present application also provide a computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the computer executes the instructions, the electronic device of the present application performs data transmission in the method process shown in the above method embodiment. The various steps performed by the device.

The computer-readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard drive. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), register, hard disk, optical fiber, portable and compact Compact Disc Read-Only Memory (CD-ROM), optical storage device, magnetic storage device, or a suitable combination of the above, or any other form of computer-readable storage medium valued in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and storage medium may be located in an Application Specific Integrated Circuit (ASIC). In the embodiments of the present application, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus or device.

The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be covered by the protection scope of the present application. . Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims (7)

1. A data transmission method, applied to a user plane functional network element, the method comprising:

receiving a data message from a user terminal (UE); the data message comprises a message encryption mode flag bit;

determining the encryption mode of the data message according to the message encryption mode flag bit;

determining a destination IP address of the data message according to the encryption mode of the data message;

sending the data message to the destination IP address;

the encryption mode of the data message comprises the following steps: a plaintext transmission mode, a fully encrypted transmission mode and a message header confusion encrypted transmission mode;

the determining the encryption mode of the data message according to the message encryption mode flag bit comprises the following steps:

the packet detection priority presets a message encryption mode flag bit as a first priority, so that the user plane function network element firstly acquires an identification message encryption mode flag bit; determining a packet detection rule PDR corresponding to the data message according to the identified message encryption mode flag bit, and determining the encryption mode of the data message according to the PDR corresponding to the data message;

The determining the destination IP address of the data packet according to the encryption manner of the data packet specifically includes:

if the transmission mode indicated by the encryption mode flag bit of the data message is the plaintext transmission mode, acquiring a header of the data message, and determining a destination IP address of the data message according to the header of the data message;

and if the transmission mode indicated by the encryption mode flag bit of the data message is the full encryption transmission mode or the message header confusion encryption transmission mode, decrypting the header of the data message, and determining the destination IP address of the data message according to the decrypted header of the data message.

2. A data transmission method, applied to a user terminal UE, the method comprising:

according to unified data management UDM subscription data, determining a message encryption mode flag bit;

transmitting a data message to a user plane function network element;

the UE sends the data message to the user plane function network element through a base station; the data message comprises a message encryption mode flag bit; the packet detection priority is preset, and a message encryption mode flag bit is a first priority; the message encryption mode flag bit is used for indicating packet detection rules PDR corresponding to the data message, and the PDR corresponding to the data message is used for indicating the encryption mode of the data message; the encryption mode of the data message comprises the following steps: a plaintext transmission mode, a fully encrypted transmission mode and a message header confusion encrypted transmission mode;

If the transmission mode indicated by the encryption mode flag bit of the data message is the plaintext transmission mode, acquiring a header of the data message, and determining a destination IP address of the data message according to the header of the data message;

and if the transmission mode indicated by the encryption mode flag bit of the data message is the full encryption transmission mode or the message header confusion encryption transmission mode, decrypting the header of the data message, and determining the destination IP address of the data message according to the decrypted header of the data message.

3. A data transmission device, characterized in that the data transmission device comprises: the device comprises a receiving unit, a processing unit and a transmitting unit;

the receiving unit is used for receiving the data message from the user terminal UE; the data message comprises a message encryption mode flag bit;

the processing unit is used for determining the encryption mode of the data message according to the message encryption mode flag bit; the encryption mode of the data message comprises the following steps: a plaintext transmission mode, a fully encrypted transmission mode and a message header confusion encrypted transmission mode;

the processing unit is further configured to preset a packet encryption mode flag bit to be a first priority according to the packet detection priority, so that the receiving unit first obtains an identification packet encryption mode flag bit; determining a packet detection rule PDR corresponding to the data message according to the identified message encryption mode flag bit, and determining the encryption mode of the data message according to the PDR corresponding to the data message;

The processing unit is further used for determining a destination IP address of the data message according to the encryption mode of the data message;

the sending unit is used for sending the data message to the destination IP address;

the processing unit is further configured to obtain a header of the data packet when the transmission mode indicated by the encryption mode flag bit of the data packet is the plaintext transmission mode, and determine a destination IP address of the data packet according to the header of the data packet;

the processing unit is further configured to decrypt the header of the data packet when the transmission mode indicated by the encryption mode flag bit of the data packet is the full encryption transmission mode or the packet header confusion encryption transmission mode, and determine the destination IP address of the data packet according to the decrypted header of the data packet.

4. A data transmission device, characterized in that the data transmission device comprises: a processing unit and a transmitting unit;

the processing unit is used for managing the UDM subscription data according to the unified data and determining a message encryption mode flag bit;

the sending unit is used for sending the data message to the user plane function network element;

The sending unit is further configured to send the data packet to the user plane function network element through a base station; the data message comprises a message encryption mode flag bit; the packet detection priority is preset, and a message encryption mode flag bit is a first priority; the message encryption mode flag bit is used for indicating packet detection rules PDR corresponding to the data message, and the PDR corresponding to the data message is used for indicating the encryption mode of the data message; the encryption mode of the data message comprises the following steps: a plaintext transmission mode, a fully encrypted transmission mode and a message header confusion encrypted transmission mode;

the processing unit is further configured to obtain a header of the data packet when the transmission mode indicated by the encryption mode flag bit of the data packet is the plaintext transmission mode, and determine a destination IP address of the data packet according to the header of the data packet;

the processing unit is further configured to decrypt the header of the data packet when the transmission mode indicated by the encryption mode flag bit of the data packet is the full encryption transmission mode or the packet header confusion encryption transmission mode, and determine the destination IP address of the data packet according to the decrypted header of the data packet.

5. A communication system, characterized in that the communication system comprises a user plane function network element and a user terminal UE;

the user plane function network element is used for receiving the data message from the UE, determining the encryption mode of the data message and the destination IP address of the data message, and sending the data message to the destination IP address; the encryption mode of the data message comprises the following steps: a plaintext transmission mode, a fully encrypted transmission mode and a message header confusion encrypted transmission mode; after receiving a data message from a base station, the user plane function network element presets a message encryption mode flag bit as a first priority according to a packet detection priority, so that the user plane function network element firstly acquires an identification message encryption mode flag bit; determining a packet detection rule PDR corresponding to the data message according to the identified message encryption mode flag bit, and determining the encryption mode of the data message according to the PDR corresponding to the data message;

the UE is used for managing UDM subscription data according to unified data, determining a message encryption mode flag bit and sending the data message to the user plane function network element; wherein, the data message comprises the message encryption mode flag bit;

The user plane function network element is further configured to obtain a header of the data packet when the transmission mode indicated by the encryption mode flag bit of the data packet is the plaintext transmission mode, and determine a destination IP address of the data packet according to the header of the data packet; and when the transmission mode indicated by the encryption mode flag bit of the data message is the full encryption transmission mode or the message header confusion encryption transmission mode, decrypting the header of the data message, and determining the destination IP address of the data message according to the decrypted header of the data message.

6. An electronic device, comprising: a processor and a memory; wherein the memory is configured to store computer-executable instructions that, when the electronic device is operating, cause the electronic device to perform the data transmission method of claim 1 or 2 by the processor executing the computer-executable instructions stored by the memory.

7. A computer readable storage medium comprising instructions which, when executed by an electronic device, cause the electronic device to perform the data transmission method of claim 1 or 2.