CN106454814A - GTP tunnel communication system and method - Google Patents

Abstract

The invention provides a system and method for GTP tunnel communication. The system includes: a protocol pool unit set at the sending end of the GTP tunnel, a ubiquitous bearer selection device, and a de-protocol masquerading unit set at the receiving end of the GTP tunnel; wherein the protocol pool is used to store various transport layer protocols The ubiquitous bearer selection device is used to select at least one transport layer protocol from the various transport layer protocols to camouflage the data that needs to be transmitted through the GTP tunnel; the de-protocol camouflage unit is used to analyze The data content transmitted through the GTP tunnel. The present invention adds a protocol pool with various protocol types between the transport layer and the GTP tunnel, so that the GTP tunnel can support multiple transport protocols; moreover, the present invention can also use the ubiquitous bearer selection device for the data to be sent through the GTP tunnel Protocol camouflage is performed on data to ensure that it is difficult for attackers to accurately obtain important information of data packets.

Description

A system and method for GTP tunnel communication

technical field

The present invention relates to wireless communication, in particular to wireless communication based on GTP tunnel.

Background technique

With the intelligentization of mobile terminals and the enablement of 4G, packet data is important user data, and its security is widely concerned by users. However, in the current mobile communication network, user group data leakage is serious, and more and more users report that their personal information is stolen by a third party when ordering or experiencing certain business applications. For example, the user data of T-Mobile was stolen, tens of millions of credit cards in the United States were leaked, and domestic celebrity phones were published on the Internet. According to CNCERT data, the number of malicious codes on my country's mobile Internet reached 1.7 billion in 2014, an increase of 2.5 times compared to last year. Among the malicious behaviors caused by malicious codes, the proportion of stealing user privacy information is as high as 39.8%. In addition, there are viruses and Trojans flooding in the communication core network, which seriously threatens the user's data security.

Among existing communication methods, the most commonly used communication protocol is GPRS Tunneling Protocol (GPRS Tunneling Protocol, GTP). The GTP protocol is a tunnel transmission protocol based on UDP and TCP data transmission protocols. It serves as the transmission interface between the access network and the core network, so that GTP tunnels can be used on the signaling transmission plane or data transmission plane. transfer data. However, the traditional GTP tunneling protocol is not safe in the current environment where network attacks are rampant. This is because in current 2G, 3G, and 4G communications, GTP tunnels use TCP and UDP transmission protocols to transmit data, and its data transmission structure and data packet structure are relatively fixed, making it easy for attackers to use packet capture. Intercept key information such as user identity and location. It can be seen that the current communication architecture of the GTP tunnel brings huge security risks to the transmission of communication data.

Contents of the invention

Therefore, the object of the present invention is to overcome above-mentioned defective of prior art, provide a kind of system for GTP tunnel communication, comprise: the agreement pool unit that is arranged on the sending end of GTP tunnel and ubiquitous bearer selection device, and be arranged on GTP tunnel The de-protocol masquerading unit at the receiving end; where,

The protocol pool is used to store various transport layer protocols;

The ubiquitous bearer selection device is used to select at least one transport layer protocol from the various transport layer protocols to camouflage the data that needs to be transmitted through the GTP tunnel;

The protocol de-masquerading unit is configured to analyze the data content transmitted through the GTP tunnel.

Preferably, according to the system, wherein the ubiquitous bearer selection device is further configured to select at least one transport layer protocol data packet header and corresponding identification field from the various transport layer protocols to disguise the need to pass the Describes the data transmitted by the GTP tunnel.

Preferably, according to the system, wherein the sending end and the receiving end of the GTP tunnel share the corresponding relationship between the transport layer protocol and the identification.

Preferably, according to the system, the de-protocol masquerading unit is further configured to determine the data packet according to the corresponding relationship between the transport layer protocol and the identification and the identification field in the data packet from the sending end of the GTP tunnel The transport layer protocol used for masquerading.

Preferably, according to the system, wherein the protocol pool is further used for storing the data packet header of the data packet when the format of the protocol adopted by the data packet to be transmitted through the GTP tunnel is not stored.

And, the present invention also provides a kind of method for GTP tunnel communication, comprising:

1) Select one of the preset transport layer protocols, and use the selected transport layer protocol to disguise the data that needs to be transmitted through the GTP tunnel;

2) Transmit the masqueraded data through the GTP tunnel;

3) Receive the data from the sender of the GTP tunnel and restore the data content.

Preferably, according to the method, wherein,

The step 1) includes: using the selected transport layer protocol and the corresponding identification to disguise the data that needs to be transmitted through the GTP tunnel;

The step 3) includes: analyzing the data content in the data from the sending end of the GTP tunnel according to the preset corresponding relationship between the transport layer protocol and the identifier.

Preferably, according to the method, wherein step 1) comprises:

1-1) Select one of the preset transport layer protocols;

1-2) According to the preset correspondence between the transport layer protocol and the identification, add the data packet header of the selected transport layer protocol and the corresponding identification field at the front end of the data to be transmitted through the GTP tunnel.

Preferably, according to the method, the data to be transmitted through the GTP tunnel is a transport layer data packet.

Preferably, according to the method, the data that needs to be transmitted through the GTP tunnel is the core data content in the transport layer data packet.

Preferably, according to the method, it also includes:

4) Updating the correspondence between the transport layer protocol and the identifier as required.

Compared with the prior art, the present invention has the advantages of:

1. A protocol pool with various protocol types is added between the transport layer and the GTP tunnel, so that the GTP tunnel can support a variety of transport protocols, and the protocol pool can also be used for the data sent to the GTP tunnel. When set in the protocol pool, the protocol used to add the data. In this way, the scalability and universality of the GTP data transport layer protocol can be improved, the security of data and the complexity of information can be enhanced, and the reliability of information security can be enhanced, making it difficult for attackers to accurately capture the type of transmitted information. , thereby improving the security of data transmission.

2. Set the ubiquitous bearer selection device to camouflage the data to be sent through the GTP tunnel, so that the transmission protocol adopted by the GTP tunnel is no longer limited to the TCP and UDP protocols, and the protocol originally adopted by the data can be changed, so that the data in the GTP tunnel The way data is carried is no longer static, making it difficult for attackers to accurately obtain important information about data packets.

Description of drawings

Embodiments of the present invention will be further described below with reference to the accompanying drawings, wherein:

Fig. 1 is a scene diagram of GTP tunnel transmitting data in the protocol stack in the prior art;

FIG. 2 is a schematic diagram of a network structure of a GTP tunnel in the prior art;

Fig. 3 is the schematic diagram that the GTP tunnel sender disguises the original transport layer protocol TCP as SCTP according to an embodiment of the present invention;

Fig. 4 is a flowchart of a method for GTP tunnel communication according to an embodiment of the present invention.

detailed description

The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments.

As mentioned above, there are increasingly higher requirements for the confidentiality of user data in the current communication field, and the GTP tunnel transmission protocol, as a transmission node between the access network and the core network, needs to improve the security of the protocol. The scheme of using the GPRS tunneling protocol for communication in the prior art will be introduced below through FIG. 1 and FIG. 2 .

FIG. 1 shows a scene diagram of a GTP tunnel transmitting data in a protocol stack in the prior art. In the scenario shown in Figure 1, the user sends data to the base station (eNode B), and the base station sends the data to the communication core network including the radio network controller (RNC), and sends the data to the GTP tunnel through the RNC. The GTP Tunnel identifies the endpoints of the tunnel to transfer data between the Serving GPRS Support Node (SGSN) and the Gateway GPRS Support Node (GGSN). In the scenario shown in Figure 1, the data passing through the GGSN node is sent to the intranet or the Internet through the firewall.

Usually, the GTP tunnel is mainly responsible for carrying data in the network application layer, and completes the load transmission of service data between SGSN and GGSN nodes by encapsulating and decapsulating data packets. Referring to the schematic diagram of the network level of the GTP tunnel in the prior art shown in Figure 2, wherein L1 to GTP are respectively in the physical layer, data link layer, network layer, transport layer, and session layer in the network, and the GTP tunnel is in the session layer , which are established between GSN nodes through Gn or Gp interfaces. As shown in Figure 2, in the transport layer, the existing GTP tunnel bearer method uses UDP and TCP as the bearer protocol of the transport layer. Basic user data can be stolen by disguising GTP packets.

The inventor found through research that in the above-mentioned existing communication systems such as 2G, 3G, LTE, etc., the transmission of the GTP tunnel transmission protocol on the user plane is carried by the UDP/IP protocol, while on the control plane it is carried by TCP/IP. Bearer, which makes the transmission methods for different planes relatively fixed, so it is vulnerable to attacks. On the other hand, for other environments where the transport bearer is not UDP or TCP, the GTP tunneling protocol cannot be used.

For this reason, the present invention proposes a system for GTP tunnel communication. Fig. 3 shows the sending end of the GTP tunnel communication system according to an embodiment of the present invention.

As shown in FIG. 3 , the sending end of the GTP tunnel communication system includes: a protocol pool unit and a ubiquitous bearer selection device. Referring to Fig. 3, at the sending end of the system, the protocol pool stores a variety of different transport layer protocols; when the transport layer protocol adopted by the data that needs to be transmitted through the GTP tunnel has not been stored by the protocol pool, it can be stored by the protocol pool The transport layer protocol of the data; the ubiquitous bearer selection device selects one from various protocols stored in the protocol pool, such as selecting the SCTP protocol shown in Figure 3 to disguise the core data in the original TCP packet as SCTP data packets to be transmitted through the established GTP tunnel.

In the system of the present invention, the protocol pool is used to store the data formats of various transport layer protocols, such as the header formats of various protocols; When the transport layer protocol of the data packet has not been stored, the data packet header of the transport layer protocol is stored. It should be understood that the protocol pool according to the present invention may be a storage unit with only a storage function for storing various transport layer protocols; it may also be implemented as a device with both a storage unit and an analysis function.

By using the protocol pool to store various transport layer protocols, the GTP tunnel can support other transport protocols except TCP and UDP. Some commonly used transmission protocols can be preset in the protocol pool initially, such as UDP, SCTP, SPX, TCP, ICMP, DCCP, etc.; after receiving the data packet that will be used for GTP tunnel transmission, analyze the data packet, If the protocol adopted by the received data packet does not exist in the current protocol pool, add the data packet header of the data packet to the protocol pool; The header of the data packet is compared with the headers of various protocol types existing in the protocol pool. If no matching result is found, the header of the data packet is added to the protocol pool, and the data content of the packet is retained. Partially left for the processing of the subsequent steps; and, the analysis of the data packet can be further carried out to determine the core data of the data packet (for example, the data content part involved in the data packet), and store the core data in the protocol pool or In the storage unit, the ubiquitous bearer selection device can be used to encapsulate the core data with a different or the same protocol as the original protocol.

By using the protocol pool, the protocol types supported by GTP data transmission can be increased, so that the transmitted data types are no longer single (that is, no longer limited to the transmission of TCP and UDP data packets), thus increasing the difficulty of network attacks.

According to the ubiquitous bearer selection device in the system of the present invention, it is used to select at least one protocol from various transport layer protocols supported by the protocol pool to disguise the data to be transmitted, so as to increase the efficiency of GTP tunnel data transmission safety. When masquerading a data packet, the data packet header of the masquerading protocol can be added before the data content, and a field for identifying the original transmission protocol and/or masquerading protocol is set in the data packet header of the masquerading protocol, so as to be parsed at the receiving end transmitted data.

The following uses a specific example to introduce the process of using the ubiquitous bearer selection device to disguise a TCP data packet as an SCTP data packet.

Assuming that several protocol formats such as UDP, SCTP, SPX, TCP, ICMP, and DCCP have been stored in the protocol pool, the ubiquitous bearer selection device can firstly randomly number and identify these protocols. The corresponding relationship should be known by the protocol de-masquerading unit at the receiving end of the GTP tunnel. The method for making the de-protocol masquerading unit share the corresponding relationship with the ubiquitous bearer selection device may adopt any known prior art. In order to further increase security, the corresponding relationship between the identifier and the protocol may also be updated at intervals.

The following table is an example of the corresponding relationship between the identifier and the protocol. For example, if the serial number of TCP is set to 2, then the serial number "2" is expressed as the identifier "0010" in 4-bit binary.

UDP 1 0001 TCP 2 0010 SPX 3 0011 SCTP4 0100 ICMP5 0101 DCCP 6 0110

Here, a random number generator may be set, and a packet header of a protocol corresponding to the random number is selected from the current protocol pool according to the generated random number to encapsulate the received original data packet. Assuming that the generated random number is 4, it means that the original transport layer protocol TCP needs to be disguised as SCTP. In order to carry out the camouflage, it is necessary to add an SCTP data header before the original TCP data packet or before the data content of the original TCP data packet, and add a 32-bit identification field 0000 0000 0000 0000 0000 before the SCTP data header 0000 0100 0010 . The identification field here is preferably 32 bits or a multiple of 32. This is due to the fact that the data packet header used in the current international protocol format is 32 bits or a multiple of 32 bits. For the convenience of processing, the identification used for camouflage can be added before the data. The number of bits is set to 32. In the 32-bit identification field shown above, the last 4 digits "0010" are used to identify the original transmission protocol before masquerading as TCP, and the last 5-8 digits "0100" are used to identify the SCTP protocol used for masquerading. The rest of the digits can be all set to 0 or use random numbers. In this example, the length of the identifier is 4. In actual use, the length of the identifier can also be appropriately set according to the number of protocol types stored in the protocol pool, such as 8, 16, and so on. Moreover, the present invention does not limit the position of the identification in all the identification fields. For example, the identification field can also be set to 1111 0100 0010 0001 0000 1011 1110 0010, so that the "0010" in the 9th-12th bits is used to identify the The original transmission protocol is TCP, the 5th to 8th digits "0100" are used to identify the masquerading protocol as SCTP, and the remaining digits can be random numbers or used to identify other information that needs to be identified.

After adding the 32-bit identification field, add an IP header containing source address and destination address to it, then the field content of the obtained IP packet is:

IP header 32-bit identification field SCTP header Original TCP packet/data content

In actual operation, if there is data content behind the SCTP header, then in the 32-bit identification field, only the masquerading protocol adopted can be identified as SCTP, so that the receiving end de-masquerades the masquerading SCTP packet to determine the data content; If there is an original TCP packet behind the SCTP header, then it is also necessary to identify the original protocol as TCP in the 32-bit identification field, so that the receiving end parses the content (i.e. the original TCP packet) after de-masquerading to determine the data content.

By adding an identification field during protocol masquerading, the receiving end can know which masquerading protocol is used by the sending end, so that the sending end and the receiving end can adopt a more flexible way to masquerade the data to be transmitted. In the case of not using the identification field, other ways can also be used to enable the receiving end to de-masquerade, for example, sharing the masquerading protocol list between the sending end and the receiving end, and performing masquerading in sequence according to the order of the transport layer protocols on the list.

The above examples illustrate that the ubiquitous bearer selection device according to the present invention works in cooperation with the protocol pool to disguise the original transport layer protocol, so that the data structure of GTP is not limited to TCP and UDP, and it can be used at the sending end and receiving end of data The data structure is dynamically changed between the ends (SGSN and GGSN nodes), so as to provide guarantee for the security of data transmission.

3 above introduces the protocol pool and ubiquitous bearer selection device at the sending end of the GTP tunnel according to the system of the present invention. Correspondingly, the receiving end of the GTP tunnel includes a de-masquerading unit for de-masking the transport layer protocol.

Corresponding to FIG. 3 , at the receiving end (not shown) of the system, the protocol de-masquerading unit restores the data packet whose transport layer protocol is masqueraded as SCTP to the original TCP data packet.

The de-protocol masquerading unit is located at the receiving end of the system, and shares the correspondence between the identification and the transport layer protocol as described above with the protocol pool at the sending end and the ubiquitous bearer selection device; it uses According to the corresponding relationship, the content of the data from the sender is analyzed, for example, according to the identifier in the header of the data packet forged, the masquerading protocol and the transport layer protocol used before masquerading are determined.

For example, when the receiving end receives the data packet whose 32-bit identification field is 1111 0100 0010 0001 00001011 1110 0010 in the preceding example, according to the mutual agreement with the sending end, the de-protocol masquerading unit can determine the " 0010 " identification of the 9th to 12th bits The original transport layer protocol is TCP, and the "0100" in the 5th to 8th digits identifies the masquerading protocol as SCTP.

As mentioned above, in the present invention, the sending end and the receiving end of the GTP tunnel need to share the corresponding relationship between the protocol type and the identifier, so as to restore the masqueraded data. Further, the corresponding relationship between the protocol type and the identification can be modified regularly, or the frequency of modifying the corresponding relationship can be determined according to the traffic of the transmitted data, for example, a timer is set in the system, and a traffic monitoring device, when the traffic transmitted by the system exceeds the set When the threshold is set, modify the correspondence between the protocol type and the identifier.

It should be understood that the protocol pool unit and/or the ubiquitous bearer selection device and/or the protocol de-masquerading unit according to the present invention can be implemented by configuring new hardware, or can be implemented on existing equipment in the form of software modules.

According to an embodiment of the present invention, a method for GTP tunnel communication is also proposed. Referring to Figure 4, the method includes:

S1: establish a GTP tunnel connection;

Here, the existing transmission protocol can be used to establish the connection relationship between the sender and the receiver, such as establishing a connection through the "three-way handshake" of TCP;

S2: Determine the core data that needs to be transmitted through the GTP tunnel;

By analyzing the data that needs to be transmitted through the GTP tunnel, the transport layer protocol and core data in the data can be determined, such as the TCP header and core data in the TCP data packet shown in Figure 3;

The purpose of determining the core data is that only the core data can be protocol disguised in subsequent steps, thereby reducing the amount of data to be transmitted; if there is no need to limit the amount of data to be transmitted, this step S2 can also be skipped, and In subsequent steps, directly increase the field for protocol camouflage before the original TCP packet;

It should be understood that any known means can be used to intercept or receive data packets that need to be communicated through the GTP tunnel, and any existing technology can be used to determine the data content in the data packets;

S3: If an unsupported transport layer protocol is found, store the data packet header of the transport layer protocol; for example, use a greedy algorithm to compare the data packet header with the data packet headers of various supported transport layer protocols;

Through this step S3, the transport layer protocol type that can be supported can be increased, and in other embodiments of the present invention, this step S3 can also be directly continued without performing the subsequent steps;

S4: Select one of the supported transport layer protocols to disguise the determined core data as a new data packet;

The selected protocol may be different from the protocol adopted by the received data packet, or no distinction shall be made;

The method for carrying out protocol masquerading can adopt the method of adding a 32-bit identification field before the original transport layer data packet or before the data content as described above, to generate the following IP data packet:

IP header 32-bit identification field SCTP header Original TCP packet/data content

Here, the corresponding relationship between the identifier and the transport layer protocol needs to be shared between the sending end and the receiving end of the GTP tunnel, and the corresponding relationship can be modified as required, such as once every once in a while;

S5: sending a masqueraded data packet from the sending end of the GTP tunnel to the receiving end of the GTP tunnel;

S6: Receive the data packet at the receiving end of the GTP tunnel, and analyze the data content of the masqueraded data packet according to the corresponding relationship between the identifier and the transport layer protocol.

In the above-mentioned embodiment, the protocol masquerading can be performed on each transport layer data packet respectively, and can also be performed on each multiple transport layer data packets; in actual use, it can be performed according to the complexity and the security requirements. choose.

It can be seen from the above embodiments that the present invention adds a protocol pool with various protocol types between the transport layer and the GTP tunnel, so that the GTP tunnel can support multiple transport protocols. When the data of various transport layer protocols is sent to the GTP tunnel, the protocol pool can be used to support the receiving and sending of data. Moreover, the protocol pool may also add the protocol adopted by the data sent to the GTP tunnel when the protocol adopted by the data is not set in the protocol pool. In this way, the scalability and universality of the GTP data transport layer protocol can be improved, the security of data and the complexity of information can be enhanced, and the reliability of information security can be enhanced, making it difficult for attackers to accurately capture the type of transmitted information. , thereby improving the security of data transmission.

In addition, the present invention can also perform protocol camouflage on the data to be sent through the GTP tunnel through the ubiquitous bearer selection device, so that the transmission protocol adopted by the GTP tunnel is no longer limited to TCP and UDP protocols. By adding an identifier in the masquerading data packet to mark which protocol is used for masquerading, the receiving end can determine which method should be used to parse the corresponding transport layer data packet header. The protocol camouflage adopted by the present invention can change the protocol originally adopted by the data, so that the carrying mode of the data in the GTP tunnel is no longer invariable, ensuring that it is difficult for an attacker to accurately obtain important information of the data packet.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than limit them. Although the present invention has been described in detail above with reference to the embodiments, those skilled in the art should understand that modifications or equivalent replacements to the technical solutions of the present invention do not depart from the spirit and scope of the technical solutions of the present invention, and all of them should be covered in Within the scope of the claims of the present invention.

Claims (10)

1. A system for GTP tunnel communication, comprising: a protocol pool unit arranged at a GTP tunnel sending end, and a ubiquitous bearer selection device, and a de-protocol masquerading unit arranged at a GTP tunnel receiving end; wherein, The protocol pool is used to store various transport layer protocols; The ubiquitous bearer selection device is used to select at least one transport layer protocol from the various transport layer protocols to camouflage the data that needs to be transmitted through the GTP tunnel; The protocol de-masquerading unit is configured to analyze the data content transmitted through the GTP tunnel. 2. The system according to claim 1, wherein said ubiquitous bearer selection means is also used to select at least one transport layer protocol packet header and corresponding identification field from said various transport layer protocols to camouflage said Data that needs to be transmitted through the GTP tunnel. 3. The system according to claim 2, wherein the sending end and the receiving end of the GTP tunnel share the corresponding relationship between the transport layer protocol and the identifier. 4. The system according to claim 3, wherein the de-protocol masquerading unit is further configured to determine the identity field according to the correspondence between the transport layer protocol and the identity and the data packet from the sending end of the GTP tunnel. The transport layer protocol used for masquerading by the above data packets. 5. The system according to any one of claims 1-4, wherein the protocol pool is also used to store the protocol pool when the format of the protocol adopted by the data packet that needs to be transmitted through the GTP tunnel is not stored. The packet header of the packet. 6. A method for GTP tunnel communication, comprising: 1) Select one of the preset transport layer protocols, and use the selected transport layer protocol to disguise the data that needs to be transmitted through the GTP tunnel; 2) Transmit the masqueraded data through the GTP tunnel; 3) Receive the data from the sender of the GTP tunnel and restore the data content. 7. The method of claim 6, wherein, The step 1) includes: using the selected transport layer protocol and the corresponding identification to disguise the data that needs to be transmitted through the GTP tunnel; The step 3) includes: analyzing the data content in the data from the sending end of the GTP tunnel according to the preset corresponding relationship between the transport layer protocol and the identifier. 8. The method according to claim 7, wherein step 1) comprises: 1-1) Select one of the preset transport layer protocols; 1-2) According to the preset correspondence between the transport layer protocol and the identification, add the data packet header of the selected transport layer protocol and the corresponding identification field at the front end of the data to be transmitted through the GTP tunnel. 9. The method according to claim 8, wherein the data to be transmitted through the GTP tunnel is a transport layer data packet. 10. The method according to claim 8, wherein the data to be transmitted through the GTP tunnel is the core data content in the transport layer data packet.