[go: up one dir, main page]

WO2012119450A1 - Serveur de mappage dans un réseau à séparation d'identifiant d'abonné et d'adresse url, et procédé pour la mise en œuvre de ce serveur - Google Patents

Serveur de mappage dans un réseau à séparation d'identifiant d'abonné et d'adresse url, et procédé pour la mise en œuvre de ce serveur Download PDF

Info

Publication number
WO2012119450A1
WO2012119450A1 PCT/CN2011/080645 CN2011080645W WO2012119450A1 WO 2012119450 A1 WO2012119450 A1 WO 2012119450A1 CN 2011080645 W CN2011080645 W CN 2011080645W WO 2012119450 A1 WO2012119450 A1 WO 2012119450A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
rid
aid
access
mapping
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2011/080645
Other languages
English (en)
Chinese (zh)
Inventor
沈炯
王晓明
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Publication of WO2012119450A1 publication Critical patent/WO2012119450A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Definitions

  • the present invention relates to the field of mobile communication technologies, and in particular, to a mapping server in an identity location separation network and an implementation method thereof. Background technique
  • AAA servers Authentication, Authorization, Accounting, Authentication, Authorization, and Accounting
  • the main purpose of the AAA server is to manage which users can access the network server, which services are available to users with access rights, and how to account for users who are using network resources. Its specific functions mainly include:
  • RADIUS Remote Authentication Dial In User Service
  • UDP User Datagram Protocol
  • RFC Request For Comments, Request for Comments
  • SILSN Identity and Identifier & Locator Separation Network
  • HIP Home IP
  • LIP Location Identity Separation Protocol
  • each implementation has a variety of related technologies to support, in which the identity of the end user (indicated as AID in the text) does not change during the move, and the location identifier is additionally assigned according to the location of the terminal (represented as RID in the text) ) to achieve routing and forwarding of data packets.
  • Figure 1 shows a network architecture for identity and location separation (SILSN), the SILSN architecture
  • the network topology is divided into an access network and a backbone network that do not overlap in the topology relationship.
  • the access network is located at the edge of the backbone network and is responsible for accessing all terminals, and the backbone network is responsible for routing data packets between terminals accessed by the backbone network. Forward.
  • the user ID of the AID as the terminal remains unchanged during the terminal movement; the RID is the location identifier assigned by the network to the terminal and is used in the backbone network.
  • the identity and location identifiers may have different names in different SILSN architectures, but the essence is the same.
  • the terminal may be one or more of a mobile terminal, a fixed terminal, and a nomadic terminal, such as a mobile phone, a landline telephone, a computer, a server, and the like.
  • the access network is used to provide a Layer 2 (physical layer and link layer) access device for the terminal, and maintains a physical access link between the terminal and the ASR.
  • Layer 2 physical layer and link layer
  • the main network elements of the backbone network include:
  • An Access Service Router is an edge router of the backbone network. It is used to assign RIDs to terminals, maintain AID-RID mapping information of terminals, and register AID-RID bindings to ILRs. , and implement routing and forwarding of data packets.
  • the terminal must access the backbone network through the ASR.
  • the RID assigned by the ASR to the terminal contains the address information of the ASR, or the ASR, and the RID is used as the destination address of the data packet, and the data packet is routed to the ASR.
  • a common router (referred to as CR), a core router of the backbone network, is configured to perform routing according to the RID in the data packet, and forward the data packet with the RID as the destination address.
  • the Identity Location Register which can be called a mapping server, etc., can be called a mapping plane when the identity location register is deployed in a distributed manner.
  • the ILR is used to store and maintain the mapping information of the identity identifier AID and the location identifier RID of the home user terminal, and is also written as AID-RID mapping information to process registration, deregistration and query of the terminal location.
  • the backbone network may further include:
  • An Internet Service Router has interfaces with traditional IP networks, ASRs, and ILRs to implement interworking between identity and location separation networks and traditional IP networks.
  • the ASR needs to be the terminal when the terminal accesses.
  • the RID is assigned, and the ILR is required to register the binding of the user's AID with the RID to update the bound RID of the terminal in the ILR.
  • the ASR maintains the peer information of the terminal for each terminal (also referred to as connection information between the terminal and the communication peer, or communication relationship information between the terminal and the communication peer), where the terminal includes the terminal AID and its communication pair.
  • the correspondence information of the terminal AID may further include AID-RID mapping information of the terminal.
  • the existing Wideband Code Division Multiple Access (WCDMA) system is an important system and method for implementing service access based on wireless WCDMA technology.
  • the core network architecture of WCDMA is shown in Figure 2. It includes the Serving GPRS Support Node (SGSN) and the Gateway GPRS Support Node (GGSN). Network element such as home subscriber registration register, in this paper, 2G (second generation mobile communication technology) home location register (HLR) and home subscriber server in 3G (Home Subscriber Server, HSS for short) ) collectively referred to as the home subscriber subscription register, denoted by HLR/HSS. Since the existing TD-SCDMA (Time Division-Synchronous Code Division Multiple Access) core network uses the same architecture as WCDMA, the following WCDMA refers to WCDMA and TD-SCDMA.
  • the SGSN is a basic component network element of the GPRS network. It is a new network element device introduced in the Globle System for Mobile Communication (GSM) network to provide GPRS services. It mainly performs the functions of routing and forwarding, mobility management, session management, logical link management, authentication and encryption of packet data packets.
  • GSM Globle System for Mobile Communication
  • the GGSN provides routing and encapsulation of data packets between the WCDMA network and the external data network. It acts as a gateway and can be called an access gateway. It includes routing information of the PS attached user. The routing information is used to tunnel data packets.
  • the current attachment point of the MS ie, the SGSN.
  • the WCDMA network can use the AAA server to complete the authentication, authorization, and accounting for the GPRS Internet users.
  • the Gi interface between the GGSN and the AAA server uses the RADIUS protocol.
  • the interface messages include:
  • Access class Access-Request (access request), Access-Accept (access acceptance response), Access-Reject (4 wife into giant color p- direction); Accounting class: Accounting-Request Start, Accounting-Response Start, Accounting-Request Stop, Accounting-Response Stop, Accounting Request Interim-Update, Accounting-Response Interim-Update.
  • mapping server of an identity location separation network in an existing WCDMA or TD-SCDMA network, and implement a corresponding function of the mapping server.
  • the technical problem to be solved by the present invention is to provide a mapping server in an identity location separation network and an implementation method thereof, and use the AAA server to implement the main functions of the mapping server in the identity location separation network.
  • the present invention provides an implementation method of an identity location separation network mapping server, where the method includes:
  • the Authentication, Authorization, and Accounting (AAA) server maintains and maintains the mapping relationship between the user identity, identity identifier (AID), and location identifier (RID) of the terminal;
  • the AAA server After receiving the mapping query request initiated by the access service router or the interconnection service node (ISR) according to the user identifier or the AID of the terminal, the AAA server returns the corresponding RID according to the user identifier or the AID in the mapping query request.
  • ISR interconnection service node
  • the saving and maintaining the mapping relationship by the AAA server includes:
  • the AAA server pre-stores the correspondence between the user identifier of the terminal and the AID; after the access service router accessed by the terminal allocates the RID to the terminal, the RID allocated for the terminal is sent to the AAA server;
  • the AAA server After receiving the RID, the AAA server saves or updates the user identifier of the terminal,
  • the user identity comprises an International Mobile Subscriber Identity (IMSI) or an IMSI and an Access Point Name (APN).
  • IMSI International Mobile Subscriber Identity
  • APN Access Point Name
  • WCDMA Wideband Code Division Multiple Access
  • TD-SCDMA Time Division Synchronous Code Division Multiple Access
  • GGSN access gateway
  • the GGSN After receiving the activation request from the terminal, the GGSN sends the RID that is allocated to the terminal to the AAA server in the access request, and sends the access request to the AAA server;
  • the access request sent by the GGSN to the AAA server further carries the user identifier and the authentication information of the terminal;
  • the AAA server After receiving the access request, the AAA server authenticates the terminal according to the authentication information, and queries the corresponding AID according to the user identifier. If the terminal passes the authentication and queries for a valid AID, And sending, by the access gateway, an access response to the terminal, and carrying the AID as an IP address allocated to the terminal in the access response; and if the terminal fails to pass the verification, The GGSN returns an access reject message.
  • the GGSN returns the AID as an IP address assigned to the terminal to the terminal according to the received AID included in the access response, and locally saves the AID and RID of the terminal locally. Binding relationship.
  • the saving or updating means the AAA server adds the RID to the mapping relationship according to the received RID, or updates the RID in the mapping relationship.
  • the AAA server After receiving the access request, the AAA server sends an access to the terminal through the access gateway if the terminal passes the verification but fails to query the valid AID according to the user identifier.
  • the access response includes a specific AID value
  • the GGSN allocates a dynamic IP address to the terminal according to a specific AID value included in the access response, or rejects a user activation request of the terminal.
  • the updating of the mapping relationship further includes:
  • the access gateway After receiving the deactivation message of the terminal, the access gateway sends a deactivation message to the AAA server, and carries the user identifier of the terminal;
  • the AAA server After receiving the deactivation message, the AAA server deletes according to the user identifier of the terminal. And deleting the RID in the mapping relationship of the terminal, and sending a deactivation response to the access gateway.
  • the access gateway carries the specified RID to be deleted in the deactivation message sent to the AAA server.
  • the updating of the mapping relationship further includes:
  • the access gateway After receiving the context change request or the handover request of the terminal, the access gateway sends the
  • the AAA server sends an access request, where the access request carries the user identifier of the terminal and a new RID allocated to the terminal;
  • the AAA server After receiving the access request, the AAA server updates the RID in the saved mapping relationship of the terminal according to the new RID.
  • the present invention also provides an implementation method of an identity location separation network mapping server, where the method includes:
  • the AAA server saves the first identifier of the terminal, and maintains a mapping relationship between the first identifier and the second identifier of the terminal.
  • the AAA server After receiving the mapping query request initiated by the GGSN or the ISR according to the first identifier of the terminal, the AAA server returns a corresponding second identifier according to the first identifier in the mapping query request.
  • the method is applied to a WCDMA or TD-SCDMA network, and the second identifier includes an RID;
  • the RID allocated to the terminal is sent to the AAA server;
  • the AAA server After receiving the RID, the AAA server saves or updates the first identifier of the terminal and
  • the first identifier includes a user identifier, and/or an AID
  • the user identifier includes an IMSI, or includes an IMSI and an APN.
  • the present invention also provides a mapping server for an identity location separation network, the mapping server comprising:
  • mapping relationship storage module configured to: save and maintain a mapping relationship between a user identifier, an identity (AID), and a location identifier (RID) of the terminal;
  • the query request processing module is configured to: after receiving the mapping query request initiated by the GGSN or the ISR in the identity location separation network according to the user identifier or the AID of the terminal, return the corresponding user identifier or AID according to the mapping query request. RID.
  • mapping relationship storage module is further configured to: save and maintain the mapping relationship as follows:
  • the mapping between the user identifier, the AID, and the RID of the terminal is saved or updated.
  • the mapping server is applied to an AAA server in a WCDMA or TD-SCDMA network,
  • the mapping relationship storage module is configured to: when receiving an access request sent by the GGSN in the WCDMA or TD-SCDMA network, authenticating the terminal according to the user identifier and the authentication information of the terminal included in the access request, At the same time, the corresponding AID is queried according to the user identifier. If the terminal passes the authentication and the valid AID is queried, the GGSN sends an access response to the terminal, and carries the The AID is used as an IP address assigned to the terminal; if the terminal fails the verification, an access reject message is returned to the GGSN.
  • the mapping relationship storage module is further configured to: after receiving the access request, if the terminal passes the verification, but fails to query the valid AID according to the user identifier, the access gateway is used to The terminal sends an access response, where the access response includes a specific AID value, and the GGSN is notified to allocate a dynamic IP address to the terminal, or reject the user activation request of the terminal.
  • the mapping relationship storage module is further configured to: after receiving the deactivation message sent by the GGSN, delete the saved mapping relationship of the terminal according to the user identifier of the terminal carried in the deactivation message The RID in the middle, and sends a deactivation response to the GGSN.
  • the mapping relationship storage module is further configured to: delete the specified to be deleted in the saved mapping relationship of the terminal according to the specified RID to be deleted that is carried in the deactivation message sent by the GGSN RID; and / or
  • the user identifier of the terminal and the new RID allocated to the terminal are updated, and the RID in the mapping relationship of the saved terminal is updated.
  • the embodiment of the invention utilizes the AAA server to implement the main functions of the mapping server in the WCDMA-based identity location separation network, and can fully utilize the existing AAA server and the message and process between the GGSN and the AAA server, thereby having better economy and feasibility.
  • 1 is an architectural diagram of a packet domain of an existing WCDMA system
  • FIG. 2 is a schematic diagram of a SILSN network architecture according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of another SILSN network architecture according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a process for a GGSN to obtain a user AID and a registered RID from an AAA server according to an embodiment of the present invention
  • FIG. 5 is a schematic flowchart of deleting an RID of a user by an AAA server when a user is deactivated according to an embodiment of the present invention
  • FIG. 6 is a schematic flowchart of a GGSN or an ISR initiating a mapping query to an AAA server according to an embodiment of the present invention
  • FIG. 7 is a schematic flowchart of an AAA server updating a terminal mapping relationship in a terminal handover process according to an embodiment of the present invention. Preferred embodiment of the invention
  • FIG. 2 and FIG. 3 show an architecture of a WCDMA core network having a SILSN architecture, and the above SILSN architecture is applied to a WCDMA system.
  • the SILSN architecture is used only to specifically describe an embodiment of the present invention, and the flow of the present invention is also Can be widely applied to other identity location separation architecture.
  • the GGSN is used as the function of the ASR, and is responsible for forwarding the message.
  • the interface S1 is used to query the ILR for the RID of the communication peer, and register, update, and register the AID of the terminal. RID mapping relationship, etc.
  • the ISR in Figure 3 is a new network element introduced in the WCDMA core network for interworking between the identity and location separation network and the traditional IP network.
  • the interface S1 is used to query the RID of the communication peer.
  • the signaling interface S2 is used to notify the ISR of the AID-RID binding change when the GGSN is switched, and can also be used for the GGSN to notify the ISR to register and delete the AID-RID binding. set.
  • the data interface D2 between the GGSN and the ISR is used by the GGSN to forward the data sent by the MS to the external network and the ISR forwards the data addressed to the MS to the GGSN.
  • the data interface D3 between the ISR and the external network is outside the scope of this patent.
  • the main object of the present invention is to provide an implementation method of an ILR based on an AAA server as an identity and location separation network. It should be noted that, since the TD-SCDMA core network architecture is consistent with the WCDMA core network architecture, the inventive scheme is equally applicable in the TD-SCDMA core network.
  • the following WCDMA refers to WCDMA and TD-SCDMA.
  • the present invention is not limited to the above architecture. Since the radio access network may employ other structures, in other architectures the target RNC may be other radio side network elements.
  • the present invention provides a method for using AAA as an identity location separation network ILR, namely: using an AAA server as an ILR in a WCDMA network, implementing ILR functions, mainly responsible for maintaining the binding between the user ID and the AID-RID mapping relationship, providing the interface S1, for querying the AID-RID binding, and registering, updating, and deregistering the AID-RID mapping relationship of the terminal.
  • the user identifier may include an IMSI (International Mobile Subscriber Identification Number), and may also include an IMSI and an APN (Access Point Name).
  • the AAA server when used in the WCDMA network, one user is uniquely identified by using IMSI and APN. Unless otherwise specified, the following user identifier refers to IMSI plus APN.
  • the method for implementing the identity location separation network mapping server mainly includes: the AAA server saves the first identifier of the terminal, and maintains the first identifier and the second identifier of the terminal. Mapping relations;
  • the AAA server After receiving the mapping query request initiated by the GGSN or the ISR according to the first identifier of the terminal, the AAA server returns a corresponding second identifier according to the first identifier in the mapping query request.
  • the method is applied to a WCDMA or TD-SCDMA network, and the second identifier includes an RID;
  • the RID allocated to the terminal is sent to the AAA server;
  • the AAA server After receiving the RID, the AAA server saves or updates the mapping relationship between the first identifier of the terminal and the RID.
  • the first identifier includes a user identifier, and/or an AID
  • the user identifier includes an IMSI, or includes an IMSI and an APN.
  • an identity location separation network mapping server which mainly includes:
  • the AAA server saves and maintains the user ID, identity (AID) and location identifier of the terminal.
  • the corresponding RID is returned according to the user identifier or AID of the terminal in the mapping query request.
  • the user identifier includes an IMSI and an APN.
  • the correspondence between the terminal user identifier and the AID is saved on the AAA server.
  • the AAA server may only store the corresponding relationship of the local terminal, and may also store the correspondence between all the terminals); after the access service router that the terminal accesses allocates the RID to the terminal, initiates registration with the AAA server, and carries the user identifier of the terminal and The RID;
  • the AAA server searches for the corresponding relationship according to the user identifier of the terminal, and saves the mapping relationship between the user identifier, the AID, and the RID of the terminal (for example, adding RID information to the corresponding relationship).
  • the access gateway may also not carry the access request sent to the AAA server.
  • the access gateway may also not carry the access request sent to the AAA server.
  • the RID information assigned to the user but after receiving the access response of the AAA server, and the user authentication is successful, a new message is used to send the RID information allocated for the terminal to the AAA server.
  • the saving or updating means adding the RID information to the mapping relationship according to the received RID information, or updating the RID information in the mapping relationship.
  • the access gateway may include multiple RIDs in the RID information of the terminal sent to the AAA server.
  • the access request and response use the existing Access-Request, Access-Accept/Access-Reject message.
  • mapping relationship further includes:
  • the access gateway After receiving the deactivation message of the terminal, the access gateway sends a deactivation message to the AAA server, and carries the user identifier of the terminal;
  • the AAA server After receiving the deactivation message, the AAA server deletes the RID information in the mapping relationship of the terminal according to the user identifier of the terminal, and sends a deactivation message response to the access gateway.
  • the deactivation message sent by the access gateway to the AAA server also carries the specified RID, which is used to delete the specified RID.
  • the activation message and the response use the Accounting-Request Stop, Accounting-Response Sto message of the existing AAA server.
  • the access gateway sends an activation message to the AAA server, and receives an activation message response, the access gateway goes to the AAA month.
  • the server sends an Accounting-Request Start, and the AAA server returns an Accounting- Response Start.
  • the new access gateway sends an access request to the AAA server after receiving the PDP context change request or the handover request, where the access request carries the user identifier of the user, and a new RID assigned to the user;
  • the AAA server replaces the RID bound to the user identifier of the user with a new RID, and sends an access request response to the new access gateway, carrying the identity identifier AID of the user.
  • the access request sent by the new access gateway to the AAA server further carries the original RID, and after receiving the access request, the AAA server will The original RID bound to the user identifier is replaced with a new RID.
  • the access gateway when forwarding the data packet of the user, if the ISR does not have the binding relationship between the identity identifier AID of the communication peer and the location identifier RID, the ISR queries the AAA server, and sends a RID query request to the AAA server to carry the user identity. Identifies the AID.
  • the AAA server After receiving the RID query request of the access gateway, the AAA server queries the RID bound to the identity identifier, returns the RID query response of the access gateway, and carries the RID.
  • the AAA server returns multiple RIDs.
  • This embodiment is based on the core network architecture of the identity location separation described in FIG. 3, and describes a process in which the GGSN obtains the user identity identifier AID and the registered user location identifier RID from the AAA server when the user terminal sends a PDP context activation request.
  • the process of user registration in this embodiment mainly includes the following steps:
  • Step 401 The terminal sends a PDP context activation request to the SGSN, which is consistent with the existing WCDMA process.
  • Step 402 The SGSN sends a Create PDP Context Request message to the GGSN associated with the terminal, which is consistent with the existing WCDMA process.
  • Step 403 The GGSN sends an access request to the AAA server, and uses an existing Access-Request message between the GGSN and the AAA server, and the existing WCDMA process.
  • the Called-Station-Id field is filled in with the APN value
  • the 3GPP-IMSI field of the 3GPP Vendor-Specific field is filled in the IMSI value of the user terminal
  • the NAS-IP-Address field is filled in the address of the GGSN for forwarding the datagram to the user terminal (location) Identifies RID).
  • Step 404 The AAA server queries the corresponding Framed-IP-Address (AID) according to the IMSI and the APN. If there is a valid mapped AID, the AAA server records the IMSI, the APN, and the Framed-IP-Address ( The mapping relationship between the AID) and the RID carried in the NAS-IP-Address field in step 403. The AAA server sends an existing Access-Accept message to the GGSN, which is consistent with the existing WCDMA process, in which the Framed-IP-Address field is filled with the AID value.
  • AID Framed-IP-Address
  • the AAA server If the AAA server does not find a valid mapped AID according to the IMSI and the APN (ie, no user identity is bound to the AID), the AAA server sends an existing Access-Accept message to the GGSN, which is consistent with the existing WCDMA process, where The Framed-IP-Address (AID) field is filled with a specific agreed AID value, such as "0x00000000".
  • the AAA server If the AAA server is responsible for authenticating the user and the authentication fails, the AAA server sends an existing Access-Reject message to the GGSN, which is consistent with the existing WCDMA process.
  • Step 405 If the GGSN receives the Access-Accept message, and the Framed-IP-Address (AID) field is a valid value, the GGSN caches the mapping between the user AID and the RID, and sends the existing Accounting-Request Start to the AAA server. The fee starts to request) the message, consistent with the existing WCDMA process.
  • AID Framed-IP-Address
  • Step 406 The AAA server sends an existing Accounting-Response Start to the GGSN.
  • the (Billing Request Response) response message is consistent with the existing WCDMA process.
  • Step 407 The GGSN sends a Create PDP Context Request Reply to the SGSN, and sends the valid AID of the user obtained in Step 404 as the IP address assigned to the terminal to the SGSN, which is consistent with the existing WCDMA process.
  • the GGSN may use the existing dynamic IP address allocation process to allocate a dynamic IP address and send a PDP context request response to the SGSN, which is consistent with the existing WCDMA process.
  • the PDP context request may also be sent to the SGSN. Failure response, rejecting the terminal to activate the PDP context.
  • the GGSN rejects the terminal to activate the PDP context, consistent with the existing WCDMA procedure.
  • Step 408 The SGSN sends a PDP context activation response to the terminal, which is consistent with the existing WCDMA process.
  • the p GGSN does not send the Accounting-Request Start to the AAA server, but only the Accounting-Request Stop.
  • the AID-RID mapping is deleted, and steps 405 and 406 can be omitted.
  • This embodiment is based on the core network architecture of the identity location separation described in FIG. 3, and describes the process of deleting the user AID and RID mapping when the user terminal sends a PDP context deactivation request.
  • the process mainly includes the following steps:
  • Step 501 The terminal sends a PDP context deactivation request to the SGSN, which is consistent with the existing WCDMA process.
  • Step 502 The SGSN sends a delete PDP context request to the GGSN, which is consistent with the existing WCDMA process.
  • Step 503 The GGSN sends a stop charging request to the AAA server, and uses an existing Accounting-Request Stop message, where the Called-Station-Id field is filled with the APN value, and the 3GPP-IMSI field of the 3GPP Vendor-Specific Fill in the IMSI value and fill in the RID in the NAS-IP-Address field.
  • the process is consistent with existing WCDMA processes.
  • Step 504 After receiving the stop charging request, the AAA server clears the RID corresponding to the IMSI and the APN.
  • Step 505 The AAA server sends a stop charging response to the GGSN, using the existing one.
  • Step 506 The GGSN sends a delete PDP context response to the SGSN, and the process is consistent with the existing WCDMA process.
  • Step 507 The SGSN sends a PDP context deactivation response to the terminal, and the process is consistent with the existing WCDMA process.
  • step 503 of this embodiment the GGSN is also carried in the Accounting-Request Sto message.
  • the Framed-IP-Address field is filled in with the AID value; in step 504, the AAA server clears the RID of the AID value map.
  • the GGSN may not carry the NAS-IP-Address (RID) field in the Accounting-Request Sto message; in step 504, the AAA server clears all RIDs mapped by the IMSI and the APN.
  • RID NAS-IP-Address
  • This embodiment describes the process in which the GGSN or ISR sends an AID-RID mapping query and the AAA server returns the AID-RID mapping.
  • the process mainly includes the following steps:
  • Step 601 The GGSN or the ISR sends an AID-RID mapping query request to the AAA server, and carries the Framed-IP-Address field, where the value is the AID value to be queried.
  • Step 602 The AAA server queries the mapped RID according to the AID in step 601.
  • Step 603 The AAA server sends an AID-RID mapping query response to the GGSN, and carries a NAS-IP-Address field, and the value is the RID obtained by querying in step 602.
  • step 602 if the AAA server finds that an AID corresponds to multiple RIDs, then in step 603, the extended field is used to return multiple RIDs, or the multiple AID-RID mapping query responses are returned.
  • This embodiment describes a process in which a terminal switches a GGSN, a new GGSN after handover, or an original GGSN before handover to update an AID-RID mapping to an AAA server.
  • the process mainly includes Next steps:
  • Step 701 The new GGSN that the terminal switches to sends an Access-Request message to the AAA server, which is consistent with the existing Access-Request message between the GGSN and the AAA server.
  • the Called-Station-Id field is filled in the APN value
  • the 3GPP-IMSI field of the 3GPP Vendor-Specific is filled in the IMSI value of the user terminal
  • the NAS-IP-Address field is filled in the address of the GGSN for forwarding the datagram to the user terminal (location) Identifies RID).
  • Step 702 Step 404 is the same as Embodiment 1.
  • Step 703 Step 405 is the same as Embodiment 1.
  • Step 704 The same as step 406 of the first embodiment.
  • the Access-Request message carries the Framed-IP-Address field, fills in the AID value of the terminal, and the AAA server updates the RID according to the AID instead of passing through the IMSI and the APN.
  • the Access-Request message carries the Framed-IP-Address field, and the original RID value of the terminal is filled in.
  • the AAA server replaces the original RID value in the mapping corresponding to the IMSI and the APN as the new RID value.
  • the p GGSN does not send the Accounting-Request Start to the AAA server, but only the Accounting-Request Stop.
  • the AID-RID mapping is deleted, and steps 703 and 704 can be omitted.
  • Updating the AID-RID mapping relationship can also be done by the original GGSN before the terminal switches.
  • the embodiment of the present invention further provides a mapping server in an identity location separation network, where the mapping server mainly includes:
  • mapping relationship storage module configured to save and maintain a mapping relationship between a user identifier, an identity (AID), and a location identifier (RID) of the terminal;
  • a query request processing module configured to receive a mapping query request initiated by the GGSN or the ISR in the identity location separation network according to the user identifier or the AID of the terminal, according to the mapping query request
  • the user ID or AID returns the corresponding RID.
  • mapping relationship storage module is configured to save and maintain the mapping relationship in the following manner:
  • the mapping between the user identifier, the AID, and the RID of the terminal is saved or updated.
  • mapping server is applied to an AAA server in a WCDMA or TD-SCDMA network
  • the mapping relationship storage module is configured to: when receiving an access request sent by the GGSN in the WCDMA or the TD-SCDMA network, perform authentication on the terminal according to the user identifier and the authentication information of the terminal included in the access request, At the same time, the corresponding AID is queried according to the user identifier. If the terminal passes the authentication and the valid AID is queried, the GGSN sends an access response to the terminal, and carries the The AID is used as an IP address assigned to the terminal; if the terminal fails the verification, an access reject message is returned to the GGSN.
  • mapping relationship storage module is further configured to: after receiving the access request, if the terminal passes the verification, but fails to query the valid AID according to the user identifier, the access gateway is used to The terminal sends an access response, where the access response includes a specific AID value, and the GGSN is notified to allocate a dynamic IP address to the terminal, or reject the user activation request of the terminal.
  • mapping relationship storage module is further configured to: after receiving the deactivation message sent by the GGSN, delete the saved mapping relationship of the terminal according to the user identifier of the terminal carried in the deactivation message The RID in the middle, and sends a deactivation response to the GGSN.
  • mapping relationship storage module is further configured to: delete the specified to be deleted in the saved mapping relationship of the terminal according to the specified RID to be deleted that is carried in the deactivation message sent by the GGSN RID; and / or
  • the saved terminal After receiving the access request sent by the new access gateway to which the terminal is handed over, according to the user identifier of the terminal included in the access request and the new RID allocated to the terminal, the saved terminal is The RID in the mapping relationship is updated. It should be noted that, since the TD-SCDMA core network and the WCDMA core network use the same architecture, the technical solution of the present invention can also be applied to the TD-SCDMA and similar architecture core networks.
  • modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module.
  • the invention is not limited to any particular combination of hardware and software.
  • the embodiment of the present invention utilizes an AAA server to implement the main functions of a mapping server in a WCDMA-based identity location separation network, and can fully utilize existing AAA servers and messages and processes between the GGSN and the AAA server, thereby having a better economy. Sex and feasibility.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

La présente invention se rapporte à un serveur de mappage dans le réseau à séparation d'identifiant d'abonné et d'adresse URL. L'invention se rapporte d'autre part à un procédé pour la mise en œuvre de ce serveur. Le procédé selon l'invention comprend les étapes suivantes : un serveur d'authentification, d'autorisation et de traçabilité (AAA, Authentication, Authorization and Accounting) enregistre et maintient une relation de mappage entre des ID d'utilisateurs, des ID d'authentification (AID, Authentication ID) et des ID d'adresses URL (RID) ; après réception de la requête d'interrogation de la relation de mappage, qui est initiée par le routeur de service d'accès ou le nœud de services Internet sur la base de l'ID d'utilisateur ou de l'AID de l'abonné, le serveur AAA retourne le RID correspondant à l'ID d'utilisateur ou à l'AID en fonction de l'ID d'utilisateur ou de l'AID contenu dans la requête d'interrogation de la relation de mappage. La présente invention utilise le serveur AAA pour réaliser la fonction principale du serveur de mappage dans le réseau à séparation d'identifiant d'abonné et d'adresse URL basé WCDMA. L'invention est ainsi apte à utiliser au maximum le serveur AAA existant ainsi que les messages et les flux entre le nœud de support GPRS de transit (GGSN, Gateway GPRS Support Node) et le serveur AAA. L'invention présente donc des avantages significatifs en termes d'économie et de faisabilité.
PCT/CN2011/080645 2011-03-09 2011-10-11 Serveur de mappage dans un réseau à séparation d'identifiant d'abonné et d'adresse url, et procédé pour la mise en œuvre de ce serveur Ceased WO2012119450A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201110056241.4 2011-03-09
CN201110056241.4A CN102685712B (zh) 2011-03-09 2011-03-09 一种身份位置分离网络中的映射服务器及其实现方法

Publications (1)

Publication Number Publication Date
WO2012119450A1 true WO2012119450A1 (fr) 2012-09-13

Family

ID=46797456

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/080645 Ceased WO2012119450A1 (fr) 2011-03-09 2011-10-11 Serveur de mappage dans un réseau à séparation d'identifiant d'abonné et d'adresse url, et procédé pour la mise en œuvre de ce serveur

Country Status (2)

Country Link
CN (1) CN102685712B (fr)
WO (1) WO2012119450A1 (fr)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103781047A (zh) * 2012-10-23 2014-05-07 中兴通讯股份有限公司 漫游时数据路由方法、互通服务路由器和接入服务路由器
US8910300B2 (en) 2010-12-30 2014-12-09 Fon Wireless Limited Secure tunneling platform system and method
US9088955B2 (en) 2006-04-12 2015-07-21 Fon Wireless Limited System and method for linking existing Wi-Fi access points into a single unified network
US9826102B2 (en) 2006-04-12 2017-11-21 Fon Wireless Limited Linking existing Wi-Fi access points into unified network for VoIP
US12501267B2 (en) 2022-07-08 2025-12-16 T-Mobile Usa, Inc. Secure messaging framework for preventing SIM swap fraud

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103905386B (zh) * 2012-12-26 2017-10-24 中国电信股份有限公司 Sip终端非注册接入的方法、边缘设备及网络
CN104468850A (zh) * 2013-09-12 2015-03-25 中兴通讯股份有限公司 标识信息处理方法及装置
CN106126174B (zh) 2016-06-16 2019-02-22 Oppo广东移动通信有限公司 一种场景音效的控制方法、及电子设备
WO2018207006A1 (fr) * 2017-05-12 2018-11-15 Telefonaktiebolaget Lm Ericsson (Publ) Rupture de protocole de réseau de localisation d'identifiant local (ilnp)
CN110445873B (zh) * 2019-08-14 2022-08-23 睿云联(厦门)网络通讯技术有限公司 一种云平台服务接入方法及重定向服务器
CN111817854B (zh) * 2020-06-04 2022-03-18 中国电子科技集团公司第三十研究所 一种基于无中心标识映射同步管理的安全认证方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101483675A (zh) * 2008-01-11 2009-07-15 华为技术有限公司 一种网络设备查找方法和网络设备
CN101656765A (zh) * 2009-09-14 2010-02-24 中兴通讯股份有限公司 身份位置分离网络的名址映射系统及数据传输方法
CN101656656A (zh) * 2008-08-22 2010-02-24 中国移动通信集团公司 基于异构化移动通信网络的报文发送、接收方法及装置
CN101667916A (zh) * 2009-09-28 2010-03-10 北京交通大学 一种基于分离映射网络使用数字证书验证用户身份的方法
CN101730101A (zh) * 2009-04-15 2010-06-09 中兴通讯股份有限公司 身份标识与位置分离的实现方法、系统及装置
CN101945034A (zh) * 2009-07-08 2011-01-12 中兴通讯股份有限公司 一种身份标识与位置分离协议数据转发系统及方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101483675A (zh) * 2008-01-11 2009-07-15 华为技术有限公司 一种网络设备查找方法和网络设备
CN101656656A (zh) * 2008-08-22 2010-02-24 中国移动通信集团公司 基于异构化移动通信网络的报文发送、接收方法及装置
CN101730101A (zh) * 2009-04-15 2010-06-09 中兴通讯股份有限公司 身份标识与位置分离的实现方法、系统及装置
CN101945034A (zh) * 2009-07-08 2011-01-12 中兴通讯股份有限公司 一种身份标识与位置分离协议数据转发系统及方法
CN101656765A (zh) * 2009-09-14 2010-02-24 中兴通讯股份有限公司 身份位置分离网络的名址映射系统及数据传输方法
CN101667916A (zh) * 2009-09-28 2010-03-10 北京交通大学 一种基于分离映射网络使用数字证书验证用户身份的方法

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9088955B2 (en) 2006-04-12 2015-07-21 Fon Wireless Limited System and method for linking existing Wi-Fi access points into a single unified network
US9125170B2 (en) 2006-04-12 2015-09-01 Fon Wireless Limited Linking existing Wi-Fi access points into unified network
US9826102B2 (en) 2006-04-12 2017-11-21 Fon Wireless Limited Linking existing Wi-Fi access points into unified network for VoIP
US10291787B2 (en) 2006-04-12 2019-05-14 Fon Wireless Limited Unified network of Wi-Fi access points
US10728396B2 (en) 2006-04-12 2020-07-28 Fon Wireless Limited Unified network of Wi-Fi access points
US8910300B2 (en) 2010-12-30 2014-12-09 Fon Wireless Limited Secure tunneling platform system and method
US9015855B2 (en) 2010-12-30 2015-04-21 Fon Wireless Limited Secure tunneling platform system and method
CN103781047A (zh) * 2012-10-23 2014-05-07 中兴通讯股份有限公司 漫游时数据路由方法、互通服务路由器和接入服务路由器
US12501267B2 (en) 2022-07-08 2025-12-16 T-Mobile Usa, Inc. Secure messaging framework for preventing SIM swap fraud

Also Published As

Publication number Publication date
CN102685712B (zh) 2016-08-03
CN102685712A (zh) 2012-09-19

Similar Documents

Publication Publication Date Title
CN102685712B (zh) 一种身份位置分离网络中的映射服务器及其实现方法
US10462699B2 (en) System and method for internet protocol version-based multiple access point name support in a network environment
CN114846764B (zh) 为与服务应用的加密通信更新通信网络中锚密钥的方法、设备和系统
CN114946153B (zh) 与服务应用进行加密通信的通信网络中的应用密钥生成与管理的方法、设备及系统
US8625617B2 (en) Method, apparatus, and system for updating packet data network gateway information
US20080294891A1 (en) Method for Authenticating a Mobile Node in a Communication Network
JP2009510858A (ja) 拡張システム・アーキテクチャにおけるポリシ制御
US20150296445A1 (en) Method, device and system for managing packet data network type
WO2008022597A1 (fr) Procédé et dispositif pour transfert intercellulaire de terminal procédé et dispositif permettant d'obtenir l'adresse d'une entité d'accès d'origine
CN101971596B (zh) 在无线网络中的安全关联的动态管理的方法和装置
WO2009046666A1 (fr) Procédé d'adressage d'entité à fonction de décision de politique, élément de réseau et système de réseau
WO2011085618A1 (fr) Procédé de commutation de terminal et réseau de communication correspondant
US8893231B2 (en) Multi-access authentication in communication system
WO2011011945A1 (fr) Procédé d'envoi de message et nœud de support gprs de desserte
WO2014101755A1 (fr) Procédé et système de dérivation de données de service
WO2011057556A1 (fr) Procédé et système de réseau mobile pour réduire la demande d'adresse à protocole internet
US20120207060A1 (en) Method and System for Implementing ID/Locator Mapping
WO2011120365A1 (fr) Procédé et système d'établissement de connexion entre terminaux multiconnectés
CN102369695A (zh) 关联会话的方法、装置及系统
WO2011011940A1 (fr) Procédé et système pour établir une connexion de réseau mobile
US8045569B1 (en) Mechanism to verify packet data network support for internet protocol mobility
WO2011120276A1 (fr) Procédé et système permettant d'établir une connexion entre des terminaux
WO2009155863A1 (fr) Procédé et système destinés à prendre en charge une sécurité de mobilité dans un réseau de prochaine génération
WO2010091589A1 (fr) Procédé d'authentification de sécurité
CN103634776B (zh) 一种获取终端的接入标识的方法及身份信息服务器

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11860208

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 11860208

Country of ref document: EP

Kind code of ref document: A1