WO2009152676A1

WO2009152676A1 - Aaa server, p-gw, pcrf, method and system for obtaining the ue's id

Info

Publication number: WO2009152676A1
Application number: PCT/CN2008/073647
Authority: WO
Inventors: 霍玉臻; 宗在峰; 刘俊羿
Original assignee: 中兴通讯股份有限公司
Priority date: 2008-06-17
Filing date: 2008-12-22
Publication date: 2009-12-23
Also published as: CN101459904A; CN101459904B

Abstract

A method for obtaining the UE's ID is disclosed, which includes an AAA server processes authentication and authorization with an UE, and the AAA server sends an accessing accept message, which contains an UE's real ID, to a FA of a non-3GPP access network; during the authentication process between the AAA server and the P-GW, if the AAA server makes sure that the UE's ID is a pseudo ID, the AAA server sends the UE's real ID to the P-GW. This invention also provides an AAA server, a P-GW, a PCRF, a system for obtaining the UE's ID. Advantage of this invention: to ensure the non-3GPP UE directly access the EPC network.

Description

AAA JI server, P-GW, PCRF, user equipment identification

Method and system

TECHNICAL FIELD The present invention relates to the field of communications, and in particular, to an authentication and authorization charging server, a packet data network gateway, a policy and charging control function entity, and a method and system for acquiring a user equipment identifier. BACKGROUND OF THE INVENTION In order to maintain the competitiveness of the third generation mobile communication system in the field of mobile communication, improve its network performance, and reduce network construction and operation costs, the 3rd Generation Partnership Project (3GPP) standard 4 The working group is currently working on the Evolved Packet Core (EPC), which is an evolution of the core network system. The EPC system supports access to non-3GPP radio access networks and can be used for user equipment (User Equipment, referred to as UE) provides higher transmission rates and shorter transmission delays. Network interworking between non-3GPP access systems (for example, Worldwide Interoperability for Microwave Access (WiMAX)) and 3GPP systems helps complement the advantages of the two networks and expand network coverage. The scope enables the mobile UE to obtain consistent service access by using different characteristics of the two networks in different wireless access network environments. 1 is a structural diagram of a non-3GPP radio access network accessing a Home Public Land Mobile Network (Home PLMN, referred to as HPLMN) by visiting a Public Land Mobile Network (VPLMN) according to the related art. The network architecture includes a 歹'J network element: a Packet Data Network Gateway (P-GW), located in the 3GPP network, and is used for the UE to access the packet data network (Packet Data Network, referred to as PDN). The Home Subscriber Server (HSS) is located in the 3GPP network and is used to permanently store the subscription data and security data of the UE. The Evolved Packet Data Gateway (ePDG) is used. Located in the 3GPP network, is used to be responsible for untrusted non-3GPP access network access 3GPP; Policy and Charging Rules Function (PCRF), located in the 3GPP network, used for policy control of UE services and The charging function is divided into a home policy control and accounting function (hPCRF) and a visited policy control and charging function (vPCRF) in the roaming scenario; a mobile access gateway (Mobile Access Gateway, abbreviated as MAG) and an external 4弋Foreign Agent (FA), located in a non-3GPP access system, is used to implement proxy mobile IPv6 protocol and mobile IPv4 protocol with P-GW; and, in order to support access of non-3GPP access systems, EPC The system also includes an authentication 4 3GPP Authentication, Authorization and Accounting Server (3GPP AAA Server for short) and an authentication 4 AAA Proxy. For a trusted non-3GPP access network, there is a trust relationship between the 3GPP network and the non-3GPP access network, and the non-3GPP access network can directly access the P-GW through the S2a or S2c interface. When the UE does not support the mobile IP protocol or the mobile IPv4 protocol, the UE first accesses the non-3GPP access system, and then accesses the P-GW through the S2a interface. When the UE supports the dual-stack mobile IP protocol, the UE directly accesses the P through the S2c interface. -GW. Currently, for a UE that accesses the EPC system by a non-3GPP access network, the access authentication authentication protocol uses an Extensible Authentication Protocol (EAP). From the perspective of security, the EAP protocol The UE is required to use the real network access identifier (NAI) of the UE in the access authentication process, and is installed and encrypted in the EAP text, so that only the AAA server and the UE know that the UE is authentic. NAI, for other network elements, the true NAI of the UE is invisible, and the pseudo-random NAI is used in the message packet. In the interworking system shown in Figure 1, both the P-GW and the PCRF need to know the UE. The unique identifier (such as the International Mobile Subscriber Identity (IMSI) or the real identity of the UE based on the IMSI-based NAI) identifies the UE to complete the subsequent service. Currently, the P-GW and the PCRF can pass The following three methods (methods 1 to 3) acquire the identifier of the UE. In a first method, FIG. 2 shows a method for acquiring a UE identifier in a mobile IPv4 mode according to the related art, where the S2a interface branch Mobile IPv4 protocol, as shown in step 201 in FIG. 2: right of access authentication and Mann 4, Step 202: Mobile IP Agent Advertisements, Step 203: the mobile IP registration request, Step 204: Gateway session establishment process, Step 205: Mobile IP registration request, Step 206: Mobile IP authentication and rights, Step 207: P-GW address update, Step 208: P-GW session establishment process, Step 209: Move IP registration response, step 210: Gateway session policy providing process, step 211: Mobile IP registration response. In step 203, the UE initiates a mobile IP registration request to the non-3GPP access network, and the non-3GPP access network forwards the mobile IP registration request to the FA/P-GW, and the FA/P-GW may request the mobile IP registration. The identifier used to identify the UE is obtained. Mode 2, FIG. 3 shows a flow of a method for acquiring a UE identity in a mobile IPv6 mode according to the related art, where the S2a interface supports a mobile IPv4 protocol, as shown in FIG. 3, step 301: access authentication and authorization, step 301a: Access acceptance information, step 302: Layer 3 access trigger, Step 303: Gateway session establishment procedure, Step 304: Mobile IP binding update request, Step 305: Mobile IP authentication and 4 吏, Step 306: P-GW address Update, step 307: P-GW session establishment process, step 308: Mobile IP binding update response, step 309: gateway session policy providing process, step 310: Layer 3 access ends. The AAA server sends the unique identifier of the UE (such as the IMSI) to the MAG, and the MAG sends the identifier of the UE to the P-GW through the proxy strap update message in the AAA server. The identifier of the UE is sent to the PCRF in the gateway session establishment notification message. Mode 3, FIG. 4 shows a flow of a method for acquiring a UE identifier in a dual-stack mobile IPv6 mode according to the related art, where the S2c interface supports a dual-stack mobile IP protocol, as shown in FIG. 4, step 401: access authentication And 4 MANN, step 402: Layer 3 access, and obtain the local IP address, Step 403: Gateway session establishment process, Step 404: Establish security association, Step 405: Authentication and authentication, Step 406: Mobile IP binding The update request, step 407: Internet Protocol-Connected Access Network (IP-CAN) session establishment process, step 408: Mobile IP update binding response. The eNB sends a unique identifier to the P-GW to identify the UE. At present, due to the new requirement for the UE, the UE is required to transmit its own real identity to the network through the air interface. For example, for the S2a interface supporting the mobile IPv4 protocol, the NAI of the mobile IP registration request message initiated by the UE must be based on the IMSI. NAI. However, the traditional non-3GPP UE (such as the WiMAX UE) sends the mobile IP registration request, and the UE identifier carried in the mobile IP registration request is a pseudo identifier instead of the real identifier, that is, the mobile IP registration request in step 203. The UE carries the pseudo-identity of the UE. For the S2c interface that supports the dual-stack mobile IP protocol, the UE is required to send the UE identifier to the P-GW during the establishment of the security association with the P-GW. However, there is a certain risk, for example, Will be attacked by a middleman, and Moreover, even if it can be transmitted securely, the traditional non-3GPP still does not want to directly send the real identity. Therefore, the traditional non-3GPP UE must meet the requirement before accessing the EPC, otherwise it cannot be used normally, thus limiting the non-3GPP and EPC systems. The scope of application of interoperability technology. Moreover, since the non-3GPP network and the P-GW cannot distinguish whether the UE identifier sent by the UE is the real identifier of the UE, if the identifier sent by the UE is simply the real UE identifier, the UE may be misidentified and cause the service. The failure of the non-3GPP MAG does not require the use of the real UE identity in the original system to identify the UE, so the UE's real identity may not be sent to the P-GW according to the local policy. On the other hand, in the 3GPP network, the real identity of the UE is used by the network element (for example, P-GW, PCRF) in the 3GPP to identify the UE. In the related art, the real identity of the UE is obtained. The network element that is sent to the network side and requests the network element (such as P-GW, PCRF) that cannot identify the real identity of the UE to receive the real identity of the UE by default, which not only restricts the non-3GPP UE from directly accessing the EPC network. It also laid a hidden danger for the network element to correctly identify the UE. SUMMARY OF THE INVENTION The present invention has been made in view of the problem that the non-3GPP network existing in the related art cannot distinguish whether the UE identity transmitted by the UE is the real identity of the UE. To this end, the main object of the present invention is to provide an improved user equipment identity. Obtain a solution to solve at least one of the above problems in the related art. In order to achieve the above object, according to an aspect of the present invention, a method for acquiring a user equipment identifier is provided, and the method is based on a mobile IPv4 protocol. The method for obtaining the user equipment identifier according to the present invention includes: the authentication authorization charging server and the user equipment perform access authentication and 4 MANN, and the authentication 4 MANN charging server sends an access accept message to the external proxy of the non-3GPP access network. And carrying the real identity of the user equipment in the access accepting message; in the authentication process of the authentication and authorization charging server and the packet data network gateway, when the authentication and authorization charging server verifies that the user equipment identifier is a pseudo user equipment identifier, The real identity of the user equipment is sent to the packet data network gateway. According to another aspect of the present invention, there is also provided a method for obtaining a user equipment identity, the method being based on a Mobile IPv4 protocol. The method for obtaining the user equipment identifier according to the present invention includes: authenticating an authorized charging server and using The user equipment performs access authentication and 4 MANN, and the authentication 4 MANN charging server sends an access accept message to the external proxy of the non-3GPP access network, where the access accept message carries the real identifier of the user equipment. According to another aspect of the present invention, there is also provided a method for obtaining a user equipment identity, the method being based on a Mobile IPv6 protocol. The method for obtaining the user equipment identifier according to the present invention includes: in the authentication process of the authentication and authorization charging server and the packet data network gateway, when the authentication and authorization accounting server verifies that the user equipment identifier is a pseudo user equipment identifier, the user equipment is The real identity is sent to the packet data network gateway. According to another aspect of the present invention, there is also provided a method for obtaining a user equipment identity, the method being based on a dual stack mobile IP protocol. The method for obtaining the user equipment identifier according to the present invention includes: the authentication and authorization charging server and the user equipment perform access authentication and 4 MANN, and the authentication 4 MANN charging server sends an access accept message to the non-3GPP access network, and The access accept message carries the real identity of the user equipment; in the authentication process of the authentication 4 MANN charging server and the packet data network gateway, when the authentication and authorization charging server verifies that the user equipment identifier is a pseudo user equipment identifier, the user is The real identity of the device is sent to the packet data network gateway. According to another aspect of the present invention, an authentication 4 MANN charging server is provided. The authentication 4 MANN charging server according to the present invention includes: the authentication 4 MANN charging server is configured to perform access authentication and 4 MANN with the user equipment, obtain the real identity of the user equipment, and send to the non-3GPP access network. The access accept message is sent, and the real identity of the user equipment is carried in the access accept message. According to another aspect of the present invention, a packet data network gateway is provided. The packet data network gateway according to the present invention includes: a packet data network gateway, configured to send a request message to the authentication and authorization charging server during the authentication process with the authentication and authorization accounting server, and receive the packet data network gateway in the request message. The user equipment identifier sent by the user equipment, so that the authentication and authorization charging server verifies whether the user equipment identifier is the real identifier of the user equipment; and is used to receive the authentication authorization charging in case the authentication and authorization accounting server fails to verify. The real identity of the user device sent by the server. According to another aspect of the present invention, a policy and charging control function entity is provided. The policy and charging control function entity according to the present invention includes: the policy and charging control function entity is configured to receive a session establishment message sent by the non-3GPP access network, where the session establishment message carries the real identity of the user equipment, where the user equipment The real identity is obtained by the non-3GPP access network from the authentication 4 Manpower Accounting Server; and the real identity of the user equipment is obtained according to the received session establishment message. According to another aspect of the present invention, an acquisition system for user equipment identification is provided. The acquiring system of the user equipment identifier according to the present invention includes: an authentication and authorization charging server, a non-3GPP access network, a packet data network gateway, and a policy and charging control function entity, wherein the authentication and authorization charging server is used for the user equipment Performing access authentication and authorization, obtaining the real identity of the user equipment, sending an access accept message to the non-3GPP access network, and carrying the real identity of the user equipment in the access accept message; the non-3GPP access network is configured to receive the authentication and authorization The access accept message sent by the billing server, and obtains the real identifier of the user equipment; the packet data network gateway is configured to send a request message to the authentication and authorization billing server during the authentication process with the authentication and authorization billing server, and in the request message And carrying the user equipment identifier sent by the user equipment received by the packet data network gateway, so that the authentication and authorization accounting server verifies whether the user equipment identifier is a real identifier of the user equipment; and is used in the case that the authentication and authorization accounting server fails to verify. , receiving the user sent from the authentication and authorization accounting server The real identity of the device; the policy and charging control function entity is configured to receive a session establishment message sent by the non-3GPP access network, where the session establishment message carries the real identity of the user equipment, where the real identity of the user equipment is a non-3GPP access network. Obtained from the authentication and authorization accounting server; and obtains the real identifier of the user equipment according to the received session establishment message. Through the above at least one technical solution of the present invention, at different stages of the terminal access network process,

The related network elements of the 3GPP access network and the 3GPP system are mutually authenticated with the authentication and authorization accounting server, and the real identification of the UE is obtained from the authentication and authorization accounting server, and the non-3GPP network existing in the related technology cannot be distinguished from the UE transmitted by the terminal. The problem of whether the identity is a true identity of the UE can ensure that the non-3GPP terminal directly accesses the EPC network. Other features and advantages of the invention will be set forth in the description which follows, and The objectives and other advantages of the invention will be realized and attained by the <RTI BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings are included to provide a further understanding of the invention The embodiments of the invention are used to explain the invention, and are not intended to limit the invention. In the drawings: FIG. 1 is a network architecture diagram of a non-3GPP access network and a 3GPP EPC network according to the related art; FIG. 2 is a flowchart of a method for acquiring a user equipment identifier in a mobile IPv4 mode according to the related art; FIG. 4 is a flowchart of a method for acquiring user equipment identifiers in a dual-stack mobile IPv6 mode according to the related art; FIG. 5 is a flowchart of a method for acquiring user equipment identifiers according to the related art; FIG. 6 is a flowchart of a detailed process of acquiring a user equipment identifier according to Embodiment 1 of the method of the present invention; FIG. 7 is a user equipment identifier according to Embodiment 3 of the method according to the present invention; FIG. 8 is a flowchart of a method for acquiring user equipment identifier according to Embodiment 4 of the method of the present invention; FIG. 9 is a detailed processing method for acquiring user equipment identifier according to Embodiment 4 of the method of the present invention; FIG. 10 is a structural block diagram of an acquisition system for user equipment identification according to an embodiment of the system of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention provides an improved acquisition scheme of user equipment identity, in view of the fact that the non-3GPP network existing in the related art cannot distinguish whether the UE identity sent by the UE is the real identity of the UE. In the embodiment of the present invention, the relevant network elements of the non-3GPP access network and the 3GPP system are mutually authenticated with the authentication and authorization accounting server, and the UE can be obtained from the authentication and authorization accounting server. Real identity. The embodiments of the present invention are described in detail below with reference to the accompanying drawings, which are intended to illustrate and illustrate the invention. The features of the embodiments of the present invention and the embodiments may be combined with each other if they do not conflict. It should be noted that the steps shown in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer executable instructions, and, although the logical order is shown in the flowchart, in some cases, The steps shown or described may be performed in an order different than that herein. Method Embodiment 1 According to an embodiment of the present invention, a method for acquiring a user equipment identifier is provided, and the method is based on mobile IPv4. FIG. 5 is a flowchart of a method for acquiring a user equipment identifier according to an embodiment of the present invention. As shown in FIG. 5, a method for acquiring a UE identifier according to an embodiment of the present invention includes the following steps (step S502 to step S504): Step S502, The AAA server performs access authentication and 4 MANN rights with the UE, and the AAA server sends an access accept message to the external proxy of the non-3GPP access network, and carries the real target of the UE in the access accept message; Receiving the access accept message, obtaining the real identity of the UE, sending the session establishment information to the PCRF, and carrying the real identity of the UE in the session establishment information; the PCRF receiving the session establishment information, and acquiring the real identity of the UE; Step S504, In the authentication process of the AAA server and the P-GW, when the AAA server verifies that the UE identifier is a pseudo UE identifier, the AAA server sends the real identifier of the UE to the P-GW; after that, the P-GW sends a session establishment request to the PCRF, and is in the session. The request establishes the real identity of the UE. The PCRF receives the session establishment request, and sends the policy information of the UE to the P-GW according to the real identity of the UE. The authentication process of the AAA server and the P-GW includes: The AAA server receives the access request from the P-GW, where the access request carries the UE identifier sent by the UE received by the P-GW. According to the technical solution provided by the embodiment of the present invention, the relevant network elements of the non-3GPP access network and the 3GPP system are mutually authenticated with the AAA server, and the real identifier of the UE is obtained from the AAA server. It can ensure that non-3GPP UEs directly access the EPC network. FIG. ⁶ is a detailed processing flowchart of a method for acquiring a UE identifier based on a mobile IPv4 mode according to an embodiment of the method of the present invention. As shown in FIG. 6, the method includes the following steps (step S601 to step S611): Step S601, The non-3GPP UE initializes the access network, performs UE access authentication and 4 MANN-, step S601a, after the access authentication and the 4 MANN flow are completed, the AAA server sends AAA to the non-3GPP access network authenticator. The protocol message access accept message (that is, the access accept message described above), the message carries the real identity of the user equipment, and the FA is located in the authenticator when performing access authentication and authorization, so the FA Obtaining the real identity of the UE at the same time; Step S602, the FA located in the non-3GPP access network sends a mobile IP proxy advertisement to the UE; Step S603, after receiving the proxy advertisement, the UE sends a mobile IP registration request to the non-3GPP access network (ie, The access request mentioned in the above;), wherein the mobile IP registration request carries a UE identifier, and the UE identifier may be a pseudo UE identifier, or may be a real identifier of the UE. For example, a traditional non-3GPP UE may Using the pseudo UE identifier; Step S604, the non-3GPP access network and the PCRF interact to complete the gateway session establishment process, in the process, the non-3GPP access network sends the real UE identifier obtained in step S601a to the PCRF to identify the UE; S605, the FA that is located in the non-3GPP network forwards the UE-initiated mobile IP registration request to the P-GW, and forwards the UE identifier from the UE to the P-GW. Step S606: After receiving the mobile IP registration request, the P-GW receives the mobile IP registration request, AAA server interaction, mobile IP authentication and 4 MANN rights, since the P-GW cannot identify whether the UE identity from the UE is the real identity of the UE, in the mobile IP authentication and 4 MANN rights process, the P-GW to the AAA month The server sends a request message, where the request message carries the user equipment identifier from the UE. Step S606a, the AAA server receives the request message, obtains the UE identifier from the UE, and determines whether the UE identifier is the real identifier of the UE. That is, the AAA server determines whether the UE identity acquired by the P-GW is the real identity of the UE; Step S606b, if the UE identity acquired by the P-GW is a pseudo UE identity, after the mobile IP authentication and the 4 MAN rights process are completed, the AAA server To P-GW Sending an AAA protocol message access accept message, where the message carries the real identity of the UE; if the UE identity acquired by the P-GW is the UE The AAA server may send the real identity of the UE to the P-GW, or may not send the real target of the UE to the P-GW. Step S607: The P-GW interacts with the AAA server to perform P-GW. Update of the address; Step S608, the P-GW uses the real UE identifier obtained in the step S606b to interact with the PCRF, completes the IP-CAN (IP connection access network) session establishment process, and acquires the policy of the UE; Step S609, the P-GW sends The mobile IP registration response message is sent to the FA to complete the mobile IP registration process. Step S610, the non-3GPP access network and the PCRF interact to complete the gateway session policy providing process. Step S611, the FA forwards the mobile IP registration response message to the UE, and completes the mobile IP registration. . According to the above implementation steps, both the FA and the P-GW can identify the UE by obtaining the correct identity of the correct UE from the AAA server by authenticating with the AAA server, and ensuring that the non-3GPP UE can directly access the EPC. The internet. Method Embodiment 2 According to an embodiment of the present invention, a method for acquiring a user equipment identifier is provided, and the method is based on a mobile IPv4 protocol. The method for obtaining the UE identifier according to the embodiment of the present invention includes: the AAA server and the UE perform access authentication and 4 MANN, and the AAA server sends an access accept message to the external proxy of the non-3GPP access network, where the access The acceptance message carries the real identity of the UE. For the external proxy, it receives the access accept message, obtains the real identity of the UE, sends session establishment information to the PCRF, and carries the real identity of the UE in the session establishment information; the PCRF receives the session establishment information, and obtains the reality of the UE. Logo. Then, the AAA server and the P-GW perform authentication, and in the case that the AAA server 3 identifies the UE identity as a pseudo UE identity, the real identity of the UE is sent to the P-GW. Then, the P-GW sends a session establishment request to the PCRF, and carries the real identity of the UE in the session establishment request. The PCRF receives the session establishment request, and sends the policy information of the UE to the P-GW according to the real identity of the UE. The AAA server and the P-GW authentication process specifically include: the AAA server receives an access request from the P-GW, where the access request carries the UE sent by the P-GW. UE identification. According to the technical solution provided by the embodiment of the present invention, the relevant network elements of the non-3GPP access network and the 3GPP system are mutually authenticated with the AAA server, and the real identifier of the UE is obtained from the AAA server. It can ensure that non-3GPP UEs directly access the EPC network. Method Embodiment 3 According to an embodiment of the present invention, a method for acquiring a user equipment identifier is provided. The method is based on a mobile IPv6 protocol, and includes the following steps: in the authentication process of the AAA server and the P-GW, the AAA calendar The server 3 sends the real identity of the UE to the P-GW in the case that the UE identity is a pseudo UE identity. Then, the P-GW sends a session establishment request to the PCRF, and carries the real identity of the UE in the session establishment request. The PCRF receives the session establishment request, and sends the policy information of the UE to the P-GW according to the real identity of the UE. FIG. 7 is a detailed processing flowchart of the method for obtaining an identifier based on the mobile IPv6 mode according to the third embodiment of the method of the present invention. As shown in FIG. 7, the method includes the following steps (step S701 to step S710): Step S701, The non-3GPP UE initializes the access network, performs the access authentication of the UE and the 4 MANN rights; Step S701a, after the access authentication and the 4 MANN flow are completed, the AAA server sends the AAA protocol message to the MAG of the non-3GPP access network. The incoming message (ie, the access accept message described above) carries the real identity of the UE in the message; in step S702, the UE initiates a layer 3 access triggering process, and the UE that does not support the mobile IP can pass the dynamic host. The Dynamic Host Configuration Protocol (DHCP) process is configured to trigger the access of the layer 3; Step S703, the non-3GPP access network and the PCRF interact to complete the gateway session establishment process, in the process, the non-3GPP access network Sending the real UE identifier obtained in step S701a to the PCRF to identify the UE; Step S704, the MAG located in the non-3GPP network sends a proxy binding update request to the P-GW, according to the local policy, the MAG is The proxy binding update request may not carry the real UE label of the UE. Step S705: After receiving the mobile IP registration request, the P-GW interacts with the AAA server to perform mobile IP authentication and 4 Manchester rights. Since the P-GW cannot identify whether the UE identity from the UE is the real identity of the UE, In the process of the mobile IP authentication and the 4 MANN, the P-GW sends a request message to the AAA server, where the request message carries the UE identifier from the UE. In step S705a, the AAA server receives the request message and obtains the The UE identifier of the UE, that is, whether the UE identifier acquired by the P-GW is the real identifier of the UE; Step S705b, if the UE identifier acquired by the P-GW is a pseudo UE identifier, after the mobile IP authentication and the 4 MAN rights process are completed, the AAA server Sending an AAA protocol message access accept message to the P-GW, where the message carries the real identity of the UE; if the UE identity acquired by the P-GW is the real identity of the UE, then the AAA server can forward to the P- The GW sends the real identity of the UE, and may not send the real identity of the UE to the P-GW. In step S706, the P-GW exchanges with the AAA server to update the P-GW address. Step S707: The P-GW uses the step S705b to obtain the P-GW address. Real UE identity and PCRF Mutual, complete the IP-CAN session establishment process, acquire the UE's policy; Step S708, the P-GW sends a proxy binding update response message to the MAG to complete the proxy mobile IP registration procedure; Step S709, the non-3GPP access network and the PCRF interact with each other. The gateway session policy providing process is performed; Step S710, interacting with the non-3GPP access network to complete layer 3 access. According to the above implementation steps, the non-3GPP UE accesses the EPC network through the non-3GPP access network through the S2a interface, the protocol on the S2a interface is the proxy mobile IP6, and the P-GW and the AAA server are used to authenticate the 4 MANN flow, so that no MAG is obtained from the MAG. The P-GW that obtains the real identity of the UE obtains the real identity of the UE, and is used to identify the UE. Method Embodiment 4 provides a method for obtaining a user equipment identifier according to an embodiment of the present invention, which is based on a dual-stack mobile IP protocol, and FIG. 8 is a flowchart of a method for acquiring a user equipment identifier according to Embodiment 4 of the method of the present invention. As shown in FIG. 8, the method includes the following steps (step S802 to step S804): Step S802, the AAA server performs access authentication and 4 MANN rights, and the AAA server sends an access accept message to the non-3GPP access network, and carries the real identity of the UE in the access accept message. Further, the non-3GPP access network receives the access accept message, obtains the real identity of the UE, sends the session establishment information to the PCRF, and carries the real identity of the UE in the session establishment information; the PCRF receives the session establishment information, and acquires the UE's Real identity. Step S804: In the process of authenticating the AAA server and the P-GW, if the AAA server verifies that the UE identifier is a pseudo UE identifier, the AAA server sends the real identifier of the UE to the P-GW. The AAA server and the P-GW authentication process specifically include: The AAA server receives the establishment of the security association request from the P-GW, where the establishment of the security association request carries the UE identity sent by the UE received by the P-GW. Further, the method further includes: the P-GW sends a session establishment request to the PCRF, and carries the real identity of the UE in the session establishment request; the PCRF receives the session establishment request, and sends the policy information of the UE to the UE according to the real identity of the UE. P-GW. According to the technical solution provided by the embodiment of the present invention, the relevant network elements of the non-3GPP access network and the 3GPP system are mutually authenticated with the AAA server, and the real identifier of the UE is obtained from the AAA server. It ensures that non-3GPP UEs can directly access the EPC network. FIG. 9 is a detailed processing flowchart of a method for acquiring a user equipment identifier in a dual-stack mobile IP mode according to an embodiment of the method of the present invention. As shown in FIG. 9, the method includes the following steps (step S901 to step S908): Step S901 The non-3GPP UE initializes the access network, performs UE access authentication and 4 MANN rights; Step S901a, after the access authentication and the 4 MANN flow are completed, the AAA server sends AAA protocol message access to the non-3GPP access network. Accepting the message (ie, the access accept message described above), in the message carrying the real identity of the UE; Step S902, the UE initiates the layer 3 access procedure in the non-3GPP access network and obtains the local IP address; S903, the non-3GPP access network and the PCRF interact to complete the gateway session establishment process, where In the process, the non-3GPP access network sends the real UE identifier obtained in step S901a to the PCRF to identify the UE. In step S904, the UE establishes a security association with the P-GW. In the security association establishment process, the UE sends the P-GW to the P-GW. And sending a security association request, where the security association request carries a user equipment identifier, where the UE identifier may be a pseudo UE identifier, or may be a real identifier of the UE, for example, the traditional UE sends a pseudo UE identifier; Step S905, in the security alliance During the establishment process, the P-GW interacts with the AAA server to perform authentication and 4 MANN rights. Since the P-GW cannot identify whether the UE identity from the UE is the real identity of the UE, in the mobile IP authentication and the 4 MANN rights process, The P-GW sends a request message to the AAA server, where the request message carries the UE identifier from the UE. Step S905a, the AAA server receives the request message, and obtains the UE identifier from the UE, that is, the P-GW acquires. Whether the UE identity is the real identity of the UE; Step S905b, if the UE identity acquired by the P-GW is a pseudo UE identity, after the mobile IP authentication and the 4 MAN rights process are completed, the AAA server sends an AAA protocol message to the P-GW. Accepting the message, where the message carries the real identity of the UE; if the UE identity acquired by the P-GW is the real identity of the UE, the AAA server may send the real identity of the UE to the P-GW according to the policy, or may not The P-GW sends the real identity of the UE. In step S906, the UE initiates a mobile IP binding process, and sends a mobile IP binding update request to the P-GW. Step S907: The P-GW uses the real identity of the UE and the PCRF obtained in step 705b. The IP-CAN session establishment process is completed, and the UE's policy is obtained. Step S908: The P-GW sends a mobile IP binding update response message to the UE to complete the mobile IP binding process. According to the above implementation steps, the non-3GPP UE accesses the EPC network through the S3c interface through the non-3GPP access network, and the ten-node on the S2c interface is dual-stack mobile IPv6, and the non-3GPP access network and the P-GW can pass the AAA. The server authenticates the 4 MANN flow, and obtains the correct real UE identifier from the AAA server to identify the UE. Device embodiment 1 According to an embodiment of the present invention, an authentication and authorization charging server (AAA server) is further provided, where the AAA server is configured to perform access authentication and 4 MANN rights with the UE, obtain the real identity of the UE, and send the message to the non-3GPP access network. Accessing the acceptance message, and carrying the real identity of the UE in the access accept message, and the AAA server is further configured to verify the UE identity sent by the P-GW, and in the case that the UE identity is not the real identity of the UE, The real identity of the UE is sent to the P-GW. Device Embodiment 2 According to an embodiment of the present invention, a packet data network gateway (P-GW) is further provided, where the P-GW is configured to send a request message to an AAA server during the authentication process with the AAA server, and request The message carries the UE identifier sent by the UE received by the P-GW, used by the AAA server to verify whether the UE identifier is the real identifier of the UE, and used to receive the UE sent by the AAA server if the AAA server fails to be verified. Real identity. The third embodiment of the present invention provides a policy and charging control function entity (PCRF) for receiving a session establishment message sent by a non-3GPP access network, where the session setup message carries the UE. The real identity of the UE is obtained by the non-3GPP access network from the AAA server; and the real identity of the UE is obtained according to the received session establishment message. System Embodiment According to an embodiment of the present invention, an acquisition system for user equipment identification is provided. FIG. 10 is a structural block diagram of an apparatus for acquiring a user equipment identifier according to an embodiment of the present invention. As shown in FIG. 10, the system includes an authentication and authorization charging server (AAA server) 10, a non-3GPP access network 20, and a packet data network gateway. (P-GW) 30 and Policy and Charging Control Function Entity (PCRF) 40. At least one of the AAA server 10, the P-GW 30, and the PCRF 40 used in the embodiment of the system can be implemented by using the corresponding device provided in the above device embodiment. The above various components are specifically described below. The AAA server 10 is configured to perform access authentication and 4 MANN rights with the UE, obtain the real identity of the UE, send an access accept message to the non-3GPP access network 20, and carry the real identity of the UE in the access accept message; The AAA server 10 is further configured to verify the UE identity sent by the P-GW 30, and send the real identity of the UE to the P-GW 30 if the 3 identity UE identity is not the real identity of the UE; The non-3GPP access network 20 is connected to the AAA server 10 and the PCRF 40 for receiving the access accept message sent by the AAA server 10 and acquiring the real identity of the UE.

The P-GW 30 is connected to the AAA server 10 and the PCRF 40, and is configured to send a request message to the AAA server 10 during the authentication process with the AAA server 10, and carry the UE received by the P-GW 30 in the request message. The UE identifier is used by the AAA server to verify whether the UE identity is the real identity of the UE; and for receiving the real identity of the UE sent by the AAA server 10 in case the AAA server 10 fails to verify; In addition, the P-GW 30 is further configured to send a session establishment request to the PCRF 40, and carry the true identity of the UE in the session establishment request.

The PCRF 40 is connected to the non-3GPP access network 20 and the P-GW 30, and is configured to receive a session setup message sent by the non-3GPP access network 20. The session setup message carries the real identity of the UE, where the real identity of the UE is non- The 3GPP access network obtains the real identity of the UE according to the received session establishment message; in addition, the PCRF 40 is further configured to receive the session establishment request sent by the P-GW 30, and according to The real identity of the UE carried in the session establishment request is sent to the P-GW 30. According to the UE identity acquisition system provided by the embodiment of the present invention, the relevant network elements of the non-3GPP access network and the 3GPP system are mutually authenticated with the authentication and authorization accounting server at different stages of the UE network access process, and the authentication and authorization accounting server is authenticated. Obtaining the real identity of the UE ensures that the non-3GPP UE can directly access the EPC network. As described above, the acquisition method and/or system of the user equipment identifier provided by the present invention, the FA located in the non-3GPP access network and the P-GW located in the 3GPP network, are performed by the AAA server at different stages of the network access process. The interaction between the authentication and the authorization process is performed by the AAA server to deliver the real identity of the UE to the relevant network element, which not only ensures that the network element on the network side can accurately obtain the real UE identifier, but also can no longer restrict the UE from transmitting the real UE identifier. Traditional non-3GPP UEs can directly access the 3GPP EPC network. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. For those skilled in the art, the present invention can be variously modified and modified. Any modifications, equivalent substitutions, improvements, etc. made therein are intended to be included within the scope of the present invention.

Claims

Claim

A method for obtaining a user equipment identifier, which is based on the mobile IPv4 protocol, and includes: the authentication and authorization charging server and the user equipment perform access authentication and authorization, and the authentication and authorization charging server is to the non-3GPP access network. The external proxy sends an access accept message, and carries the real identifier of the user equipment in the access accept message;

In the authentication process of the authentication and authorization accounting server and the packet data network gateway, if the authentication and authorization accounting server verifies that the user equipment identifier is a pseudo user equipment identifier, the real identifier of the user equipment is sent to The packet data network gateway.

2. The method according to claim 1, wherein the method further comprises:

The external proxy receives the access accept message, obtains the real identity of the user equipment, sends session establishment information to the policy and charging control function entity, and carries the reality of the user equipment in the session establishment information. Identification

The policy and charging control function entity receives the session establishment information and obtains the real identity of the user equipment.

The method according to claim 1 or 2, wherein the authentication process of the authentication and authorization charging server and the packet data network gateway specifically includes:

The authentication and authorization charging server receives an access request from the packet data network gateway, where the access request carries the user equipment identifier sent by the user equipment received by the packet data network gateway.

The method according to claim 1 or 2, wherein the method further comprises:

Transmitting, by the packet data network gateway, a session establishment request to the policy and charging control function entity, and carrying the real identity of the user equipment in the session establishment request;

The policy and charging control function entity receives the session establishment request, and sends policy information of the user equipment to the packet data network gateway according to the real identifier of the user equipment.

A method for obtaining a user equipment identifier, which is based on a mobile IPv4 protocol, and includes: The authentication and authorization accounting server performs access authentication and authorization with the user equipment, and the authentication and authorization charging server sends an access accept message to the external proxy of the non-3GPP access network, where the access accept message carries the The true identity of the user device.

The method according to claim 5, wherein the method further comprises:

A method for obtaining a user equipment identifier, which is based on the mobile IPv6 protocol, and includes: in the authentication process of the authentication and authorization charging server and the packet data network gateway, the authentication and authorization charging server verifies the If the user equipment identifier is a pseudo user equipment identifier, the real identifier of the user equipment is sent to the packet data network gateway.

The method according to claim 7, wherein the method further comprises:

A method for obtaining a user equipment identifier, based on a dual stack mobile IP protocol, characterized in that:

The authentication and authorization accounting server performs access authentication and authorization with the user equipment, and the authentication and authorization charging server sends an access acceptance message to the non-3GPP access network, and carries the reality of the user equipment in the access acceptance message. Identification

10. The method according to claim 9, wherein the method further comprises:

The non-3GPP access network receives the access accept message, obtains the real identity of the user equipment, sends session establishment information to the policy and charging control function entity, and carries the user in the session establishment information. The true identity of the device; The policy and charging control function entity receives the session establishment information and obtains a real identifier of the user equipment.

The method according to claim 9 or 10, wherein the authentication process of the authentication and authorization charging server and the packet data network gateway specifically includes:

The authentication and authorization accounting server receives the establishment of a security association request from the packet data network gateway, where the establishment of the security association request carries the user equipment identifier sent by the user equipment received by the packet data network gateway .

The method according to claim 9 or 10, wherein the method further comprises: the packet data network gateway sending a session establishment request to the policy and charging control function entity, and establishing the session in the session Requesting to carry the real identity of the user equipment;

An authentication and authorization accounting server, wherein the authentication and authorization accounting server is configured to perform access authentication and authorization with a user equipment, obtain a real identifier of the user equipment, and send the connection to a non-3GPP access network. And accepting the message, and carrying the real identity of the user equipment in the access accept message.

The authentication and authorization charging server according to claim 13, wherein the authentication and authorization charging server is further configured to verify the user equipment identifier sent by the packet data network gateway, and verify the user equipment identifier. In the case of not being the real identity of the user equipment, the real identity of the user equipment is sent to the packet data network gateway.

A packet data network gateway, wherein the packet data network gateway is configured to send a request message to the authentication and authorization charging server during an authentication process with an authentication and authorization accounting server, and in the request The message carries the user equipment identifier sent by the user equipment received by the packet data network gateway, so that the authentication and authorization charging server verifies whether the user equipment identifier is a real identifier of the user equipment, and is used for the authentication. If the authentication and accounting server fails to be authenticated, the real identifier of the user equipment sent by the authentication and authorization accounting server is received.

A policy and charging control function entity, wherein the policy and charging control function entity is configured to receive a session establishment message sent by a non-3GPP access network, where the session establishment message is And carrying the real identity of the user equipment, where the real identity of the user equipment is obtained by the non-3GPP access network from the authentication and authorization accounting server; and acquiring the message according to the received session establishment message. The true identity of the user device.

An acquisition system for a user equipment identifier, comprising: an authentication and authorization charging server, a non-3GPP access network, a packet data network gateway, and a policy and charging control function entity, wherein the authentication and authorization charging server And performing the access authentication and authorization with the user equipment, obtaining the real identity of the user equipment, sending an access accept message to the non-3GPP access network, and carrying the real identifier of the user equipment in the access accept message ;

The non-3GPP access network is configured to receive an access accept message sent by the authentication and authorization charging server, and obtain a real identifier of the user equipment;

The packet data network gateway is configured to send a request message to the authentication and authorization charging server during the authentication process with the authentication and authorization accounting server, and carry the user received by the packet data network gateway in the request message. The user equipment identifier sent by the device, so that the authentication and authorization accounting server verifies whether the user equipment identifier is a real identifier of the user equipment, and is used to receive the source information if the authentication and authorization accounting server fails to verify The authentic identification of the user equipment sent by the authentication 4 Manchester right billing server;

The policy and charging control function entity is configured to receive a session establishment message sent by a non-3GPP access network, where the session establishment message carries a real identifier of the user equipment, where the real identifier of the user equipment is the The non-3GPP access network obtains the real identity of the user equipment according to the received session establishment message.