WO2012089027A1

WO2012089027A1 - Method and device for external network interworking for user terminals with multiple access methods

Info

Publication number: WO2012089027A1
Application number: PCT/CN2011/084026
Authority: WO
Inventors: 张世伟; 符涛; 王晓明
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-12-27
Filing date: 2011-12-15
Publication date: 2012-07-05
Also published as: CN102546555B; CN102546555A

Abstract

Disclosed is an external network interworking method for user terminals having multiple access methods, for use on identifier/locator separation networks. The method comprises: an access node sends to an interworking gateway node a data packet carrying the original user identifier sent by the original user terminal to an external network, the access node adding to the data packet the locator of said access node and the address of the interworking gateway node. Upon reception of the data packet, the interworking gateway node strips away the locator of the access node and the address of the interworking gateway node, and records the mapping relation between the locator of the access node and the identifier corresponding to the user terminal; the interworking gateway node then sends the data packet to the external network. Also disclosed is an interworking gateway device. The present invention enables normal implementation of basic services based on external networks.

Description

Method and device for interworking between a user terminal and an external network in multiple access modes

Technical field

The present invention relates to the field of communications technologies, and relates to a method and device for interworking between a user terminal and an external network in multiple access modes.

Background technique

In the Transmission Control Protocol/Internet Protocol (TCP/IP) widely used in the Internet, the IP address has a dual function, namely: the communication terminal host network interface as the network layer is in the network topology. The location identifier, which is also the identity of the transport layer host network interface. The TCP/IP design did not consider the case of host mobility at the beginning. However, as host mobility becomes more prevalent, the semantic overload defects of IP addresses are becoming increasingly apparent. When the IP address of the host changes, not only the route changes, but also the identity of the communication terminal host changes. As a result, the routing load becomes heavier and the change of the host ID causes the application and connection to be interrupted. The purpose of separating the identity and location identifiers is to solve the problem of semantic overload and severe routing overload of IP addresses in TCP/IP, as well as security, so as to separate the dual functions of IP addresses, to achieve mobility, multiple townships, Support for dynamic redistribution of IP addresses, mitigation of routing load, and mutual visits between different network areas in the next generation of the Internet.

In order to solve the above problems, a network architecture in which multiple identity identifiers and location identifiers are separated has been proposed, including a Host Identity Protocol (HIP) and a Location Identity Separation Protocol (LISP), which are both identity identifiers and location separation networks.

The identity identification and location separation network architecture shown in Figure 1 (Chinese patent application with application number CN200910174826.9, application date is October 17, 2009). For convenience of description, the following is the short name of this user identity and location separation network. SILSN (Subscriber Identifier & Locator Separation Network); SILSN includes an Access Service Node (ASN), a User Equipment (UE), and an Identification and Locater Register (IRR). The ASN is used to access the user equipment, is responsible for accessing the user equipment, and is responsible for charging and switching functions. The ILR assumes the user's location registration and identity recognition functions. Among them, ASN is a logical entity, which can be a general packet radio service (General Packet) Radio Service, GPRS) Serving GPRS Support Node (SGSN), Gateway GPRS Support Node (GGSN), Packet Data Serving Node (PDSN) and Broadband Access Access (Broadband Remote Access) Server, BRAS) and other devices. The above ILR may be a Key Management System (KMS), a Home Location Register (HLR), a Home Subscriber Server (HSS), an Authorization/Authentication/Payment Month in a specific application scenario. Servers (Authorization, Authentication, Accounting, AAA), and other entities that undertake end-to-end key management and negotiation functions.

In the SILSN, the user is identified by an Access Identification (AID) (used to identify the identity of the user), and the ASN is identified by a Route Identification (RID) (used to identify the location of the user), each Both the user and the ASN have their own independent AID or RID. When a user in the SILSN accesses the network through the user terminal (such as UE1), first register its location with the ILR through the ASN (ie, register the ASN under which the UE1 is located), and the ILR saves the identity AID of the user and the accessed ASN. Correspondence between route identifiers and RIDs. After the UE registers with the UE, the correspondence between the AID of the user and the RID of the accessed ASN is established. Then, if UE1 needs to communicate with UE2, UE1 sends a data message, and ASN1 queries the ILR for the location of UE2, that is, which ASN UE2 is located in, and ASN9 in FIG. Then, the ASN1 sends the data packet to the corresponding ASN9, and the ASN9 sends the processed data packet to the UE2.

The foregoing network well implements the separation of the identity identifier and the location identifier of the UE. When the user equipment moves and roams, the identity identifier does not need to be changed, and the continuity of the service in the mobile process is ensured. Route scalability and security have also improved significantly.

In the original SILSN, each user equipment can only access the network in one way. The SILSN is not designed for simultaneous access of multiple access methods. When users access multiple networks, they can only access the network. A different AID is assigned to each access mode of each terminal, which results in a situation in which a user corresponds to multiple identity identifiers, which violates the basic requirements of the uniqueness of the user identity in the SILSN. Summary of the invention

In the prior art, when the user terminal accesses the network by using multiple access methods, the original user ends. The way in which data packets are transmitted between the end and the external network is prone to confusion.

The object of the present invention is to provide a method for interworking between a user terminal and an external network in multiple access modes, which is applied to a network in which identity identification and location identification are separated, so that the identity and location identification are separated into multiple networks. Users entering the network can access other external networks normally.

In order to solve the above technical problem, the present invention provides a method for interworking between a user terminal and an external network in multiple access modes, and is applied to a network in which identity identification and location identification are separated. The method includes:

The access node sends, to the interworking gateway node, a data packet that is sent by the source user terminal to the external network and carries the identity of the source user corresponding to the source user terminal, where the access node adds the information in the data Describe the location identifier of the access node and the address of the interworking gateway node;

The interworking gateway node receives the data packet, strips the location identifier of the access node, and the address of the interworking gateway node, and records the mapping relationship between the location identifier of the access node and the identity identifier of the source user;

The interworking gateway node sends the data packet to the external network. After the step of recording the mapping relationship between the location identifier of the access node and the identity identifier of the source user, the method further includes: the interworking gateway node mapping the port number of the source user terminal to a port number for the external network And recording the port number of the source user terminal and the port number for the external network into the mapping relationship;

The step of the interworking gateway node transmitting the data to the external network includes: the interworking gateway node transmitting the data packet after performing port number mapping. The interworking gateway node mapping the port number of the source user terminal to The steps for the port number of the external network include:

The interworking gateway node checks whether there is a received data packet with the identity of the same source user, the port number of the same source user terminal, and the location identifier of the different access node.

If present, the interworking gateway node looks up the identity and source user that includes the source user Mapping the port number of the terminal, if not found, mapping the port number of the source user terminal of the received data packet to the port number for the external network; if found, the datagram received this time The port number of the source user terminal in the text is mapped to a port number for the external network different from the port number of the external network corresponding to the identity of the source user in the found mapping relationship;

The method further includes: if the interworking gateway node detects that there is no identity identifier of the same source user, a port number of the same source user terminal, and a location identifier of a different access node that is received by the data packet received this time The data packet to be sent does not perform the step of mapping the port number of the source user terminal to the port number for the external network, and directly transmits the data packet received this time to the external network. The step of the interworking gateway node mapping the port number of the source user terminal to the port number for the external network includes:

The interworking gateway node sequentially maps the port numbers of the source user terminals in the data packets of the same source user, the port number of the same source user terminal, and the location identifier of the different source users to different external networks. The port number. The method also includes:

After receiving the data packet, the interworking gateway node checks whether there is a mapping relationship between the identity identifier of the source user, the port number of the source user terminal, and the location identifier of the access node in the data packet received this time. If yes, the port number of the source user terminal of the received data packet is mapped to the port number of the external network according to the detected mapping relationship, and the data packet received this time is directly sent to the external network. . The method also includes:

Receiving, by the interworking gateway node, a data packet sent by an external network;

The interworking gateway node searches for the location identifier of the destination user corresponding to the identity of the destination user of the data message sent by the external network, and sends the data packet sent by the external network to the location identifier of the destination user. Corresponding access node. In the step of the interworking gateway node finding the location identifier of the destination user, The interworking gateway node is configured to search for a location identifier of the destination user from an authentication node that is stored by the destination user and that stores the location identifier of the destination user; or

The interworking gateway node searches for a location identifier of the destination user from the recorded mapping relationship.

Before the step of identifying the corresponding access node, the method further includes:

The interworking gateway node checks whether the mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal of the data packet sent by the external network is saved on the interworking gateway node, if yes, according to the checked The mapping relationship is performed by port number mapping.

When the interworking gateway node checks that the mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal of the data packet sent by the external network is not saved on the interworking gateway node, the destination user is added. a mapping relationship between the identity identifier and the port number of the destination user terminal, and the identity of the destination user, the location identifier of the destination user, the port number of the destination user terminal, and the port number for the external network are saved to The added mapping relationship; wherein the port number of the destination user terminal is the same as the port number for the external network.

The steps of the access node include:

The interworking gateway node adds a destination address to the received data packet, where the destination address is the location identifier of the discovered destination user, and then sends the data packet with the destination address added to the access node corresponding to the destination address. . In the above method, the network in which the identity identifier and the location identifier are separated is a user identity identifier and a location separation network (SILSN); the access node is an access server (ASN), and the authentication node is an identity identifier and a location registration register. (ILR), the identity is an Access Identifier (AID), and the location identifier is a Route Identifier (RID). The present invention also provides an interworking gateway device, which is applied to a network in which identity identification and location identification are separated, and the interworking gateway device includes:

a receiving module, configured to receive, by the source user terminal, a data packet that is sent by the source user terminal to the external network and that carries the identity of the source user corresponding to the source user terminal, where the access node is in the datagram The location identifier of the access node and the address of the interworking gateway device are added;

a message processing module, configured to: after the location identifier of the access node and the address of the interworking gateway device are stripped from the data packet, the location identifier of the access node and the identity identifier of the source user Sending to the storage module, and sending the data packet to the sending module;

a storage module, configured to record a mapping relationship between a location identifier of the access node and an identity identifier of the source user;

And a sending module, configured to send the data message to an external network.

The packet processing module is further configured to: map the port number of the source user terminal to a port number for the external network, and send the port number of the source user terminal and the port number for the external network to the storage module, and set to be Transmitting, by the port number, the data packet to the sending module; the storage module is further configured to record the port number of the source user terminal and the port number for the external network into the mapping relationship;

The sending module is configured to send the data packet after the port number mapping to the external network. The packet processing module is configured to map the port number of the source user terminal to the port number for the external network as follows: After receiving the data packet, check whether there is the same source as the data packet received this time. The received data packet of the user's identity, the port number of the same source user terminal, and the location identifier of the different access node.

If yes, the mapping between the identity of the source user and the port number of the source user terminal is searched in the storage module. If not found, the port number of the source user terminal of the received data packet is mapped to Port number for the external network; if the mapping between the identity of the source user and the port number of the source user terminal is found, the source in the data packet received this time is used. The port number of the user terminal is mapped to a port number for the external network different from the port number of the external network corresponding to the identity of the source user in the found mapping relationship;

The packet processing module is further configured to: if it is found that there is no identity identifier of the same source user, a port number of the same source user terminal, and a location identifier of a different access node that is received by the data packet received this time The data packet to be sent directly sends the data packet without the port number mapping to the sending module. The message processing module is configured to map the port number of the source user terminal to a port number for the external network as follows:

The port numbers of the source user terminals in the data packets of the same source user, the port number of the same source user terminal, and the location identifier of the different source users are sequentially mapped to different port numbers for the external network.

The packet processing module is further configured to: after receiving the data packet, check whether the identity identifier of the source user, the port number of the source user terminal, and the source user terminal in the data packet received by the current storage module are The mapping of the location identifier of the access node, if any, maps the source user port number of the received data packet to the port number for the external network according to the detected mapping relationship.

The receiving module is further configured to receive a data message sent by an external network;

The packet processing module is further configured to: search for a location identifier of the destination user corresponding to the identity identifier of the destination user of the data packet sent by the external network, and send the location identifier of the destination user to the sending module ;

The sending module is further configured to send the data packet sent by the external network to the access node corresponding to the location identifier of the target user.

The packet processing module is further configured to check whether a mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal of the data packet sent by the external network is saved in the storage module, if yes, The port number mapping is performed according to the checked mapping relationship.

The packet processing module is further configured to: when the storage module does not save the mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal in the data packet sent by the external network, Describe the identity of the destination user, and find the location identifier of the destination user The port number of the destination user terminal and the port number for the external network are sent to the storage module; the storage module is further configured to increase the mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal, The identity identifier of the destination user, the location identifier of the destination user, the port number of the destination user terminal, and the port number for the external network are saved in the added mapping relationship; wherein the port number of the destination user terminal is The port number for the external network is the same.

The sending module is configured to send the data packet sent by the external network to the access node corresponding to the location identifier of the destination user as follows:

And adding a destination address to the data packet sent by the external network, where the destination address is the location identifier of the destination user, and then sending the data packet with the destination address added to the access node corresponding to the destination address.

With the technical solution of the present invention, when the user accesses multiple access modes, the same AID can be used to successfully access the external network, so that basic services based on the external network can be implemented normally. Moreover, no matter how many access modes the user accesses, it is still the same IP address identifier in the external network, which is convenient for monitoring and traceability, and improves system security.

BRIEF abstract

Figure 1 is a schematic diagram of the SILSN architecture;

FIG. 2 is a schematic diagram of a method for interworking between a user terminal and an external network when multiple access modes are used;

3 is a schematic diagram of a data packet encapsulation format of an ASN to an ISN according to an embodiment of the present invention; FIG. 4 is a schematic diagram of a data packet port number of different ASNs to ISNs may be repeated;

FIG. 5 is a schematic diagram of port mapping of an ISN in a forward transmission according to an embodiment of the present invention; FIG.

6 is a schematic diagram of port mapping of an ISN in reverse transmission according to the present invention;

FIG. 7 is a schematic diagram of port mapping of all data packets by an ISN in a forward transmission according to another embodiment of the present invention; FIG.

FIG. 8 is a flowchart of processing a data packet sent by an ISN to an ASN according to an application example of the present invention; FIG. 9 is a flowchart of processing a data packet sent by an ISN to an external network according to an application example of the present invention; FIG. 10 is a schematic structural diagram of an interworking gateway device according to an embodiment of the present invention.

Preferred embodiment of the invention

In a network where identity and location are separated, each user has two identifiers, AID and

RID, where AID represents the identity of the user and RID represents the location of the user. When a user accesses the network by using multiple access methods, in order to maintain the uniqueness of the user identity AID, the AID must remain unchanged. A user terminal can implement multiple access modes in a network with separate identity and location identifiers. The technical solutions for accessing the network include: When the user terminal accesses the network by using different access methods, it must register with different access nodes. More precisely, the same user accesses when accessing different access modes. The incoming access nodes must have different RIDs, and the RIDs corresponding to the various access modes must be different. On the basis of the technical solution, it is also proposed that: when the user registers, the access node should simultaneously carry the user's access mode when reporting the location information of the user terminal to the authentication node, such as a wireless local area network (Wireless Local Area Network, WLAN) access or Wide Code Division Multiplexing Access (WCDMA) access, etc., so that when the user accesses the network by using multiple access methods at the same time, the access node reports each access to the authentication node. The location information of the mode will not cover each other, and the basic conditions are created for the user to access the network in multiple ways.

When a user in the SILSN needs to communicate with an external network (referred to as an external network), it needs to communicate with an Interconnect Service Node (ISN) and an external network. Multiple access methods use the same AID because users access the network in multiple ways. Therefore, when sending and receiving data messages, data messages of different access modes are sent with the same AID. These data messages are easily confused in the ASN, and the original method will cause problems.

In the original method, when the user terminal communicates with the external network, if the ASN discovers that the data packet is sent to the external network, the data packet sent by the user terminal is not encapsulated and directly forwarded to the ISN. After receiving the data packet, the ISN sends the data packet directly to the external network. This is a faster and more efficient implementation method in the single access mode. However, in the case of multiple access modes, data packets with the same AID sent by the user terminal are forwarded to the ISN through multiple ASNs, and are sent by the ISN to the external network (hereinafter referred to as forward transmission), and the ASN is sent to the ISN. The forwarded data packet does not carry the RID of the ASN. In the multiple access mode, one AID may correspond to the RID of multiple ASNs. Therefore, when the external network user terminal replies to the local user terminal (hereinafter referred to as reverse transmission), the ISN does not know which ASN should be forwarded after receiving the replied data message, and if it is randomly forwarded, it will result in a datagram. The text is confusing and the business cannot proceed normally. As shown in FIG. 2, the user terminals UE1 and UE2 that use the same user's identity AID1 access the network in three access modes via ASN1, ASN2, and ASN3, and one access mode corresponds to one ASN. When the three access modes communicate with the external network at the same time, the interworking gateway ISN will receive the data packets sent by the same user from ASN1, ASN2 and ASN3 respectively. When the original mode is used to communicate with the external network, the ISN is directly Send data packets to the external network. The data packets forwarded by the three access modes of UE1 and UE2 via ASN1 and ASN3 are sent by the same IP address (IP3) on the external network because the identity of the same user is used. When the external network replies to the AID1 reverse data packet, the ISN does not know which ASN to send.

It can be seen from the above analysis that after the user accesses multiple access methods, the original SILSN is designed to communicate with the external network. In order to solve the problem that the user communicates with the external network when using multiple access modes, the present invention modifies the original mechanism of the SILSN and the external network interworking to meet the SILSN interworking with other networks in multiple access modes. Need to ensure that the external network business can be carried out normally.

The present invention provides a method for interworking between a user terminal and an external network in multiple access modes. The method is applied to a network in which identity identification and location identification are separated. The method includes:

The access node sends, to the interworking gateway node, a data packet of the identity of the active user that is sent by the source user terminal to the external network, where the access node adds the location identifier of the access node and the interworking gateway in the data packet. the address of;

The interworking gateway node receives the data packet, strips the location identifier of the access node added by the access node, and the address of the interworking gateway, and records the mapping between the location identifier of the access node in the data packet and the identity identifier corresponding to the user terminal. Relationship;

The interworking gateway node sends a data packet to the external network.

Preferably, after the step of mapping the location identifier of the access node of the data packet with the identity identifier corresponding to the user terminal, the method further includes:

The interworking gateway node maps the port number of the source user terminal to a port number for the external network, and Recording the port number of the source user terminal and the port number for the external network to the mapping relationship of the identity of the source user corresponding to the source user terminal;

In the step of the interworking gateway node transmitting the data packet to the external network, the data packet is a data packet after port mapping.

The step of the interworking gateway node mapping the port number of the source user terminal to the port number for the external network includes:

If yes, the interworking gateway node determines whether the mapping relationship between the identity identifier of the source user and the port number of the source user terminal exists in the mapping relationship saved by the interworking gateway node. If not, the data packet received this time is received. The port number of the source user terminal is mapped to the port number of the external network; if it exists, the port number of the source user terminal in the data packet is mapped to the identity of the same user as the existing mapping relationship. The port number for the external network that is different for the port number of the external network;

The method further includes: if the interworking gateway node detects that there is no identity identifier of the same source user, a port number of the same source user terminal, and a location identifier of a different access section that is received by the data packet received this time The data packet to be sent does not perform the step of mapping the port number of the source user terminal to the port number for the external network, and directly performs the step of transmitting the data packet to the external network.

Or,

The steps of the interworking gateway node mapping the port number of the source user terminal to the port number for the external network include:

The interworking gateway node maps the port numbers of the source user terminals in the data packets of the same source user, the port number of the same user terminal, and the location identifier of the different source users to different port numbers for the external network.

The method also includes:

The interworking gateway node receives the data packet sent by the external network;

The identity of the destination user of the data message sent by the interworking gateway node to the external network The location identifier of the corresponding destination user sends the data packet sent by the external network to the access node corresponding to the location identifier of the destination user.

And the step of the interworking gateway node searching for the location identifier of the destination user corresponding to the identity of the destination user of the data sent by the external network,

The interworking gateway node is a location identifier of the destination user corresponding to the identity identifier of the destination user that searches for the data packet sent by the external network from the authentication node to which the destination user belongs and stores the location identifier corresponding to the identity identifier of the destination user; or

The interworking gateway node is a location identifier of the destination user corresponding to the identity of the destination user that searches for the data packet sent by the external network from the stored mapping relationship.

The method further includes: before the step of sending the data packet sent by the external network to the access node corresponding to the location identifier of the destination user, the method further includes:

The interworking gateway node checks whether the mapping relationship between the identity identifier of the destination user and the destination port of the data packet sent by the external network is saved on the interworking gateway node. If yes, the interworking network joint point performs port mapping according to the port mapping relationship. Before the steps of the access node, the method further includes:

The interworking gateway node checks whether the mapping between the identity of the destination user and the port number of the destination user terminal is not saved on the interworking gateway node, and the identity of the destination user and the destination user terminal are increased. The mapping of the port number, and the identity of the destination user, the location identifier of the destination user, the port number of the destination user terminal, and the port number for the external network are saved in the added mapping relationship; The port number of the user terminal is the same as the port number for the external network.

The steps to enter the node include:

The interworking gateway node adds a destination address to the data packet, where the destination address is a location identifier of the user that is found, and then sends the data packet with the destination address added to the corresponding access node.

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that In the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other. In addition, in the embodiment of the present invention, the SILSN is taken as an example for description, but the present invention is not limited thereto, and the same can be applied to other networks in which identity and location identification are separated.

In the existing SILSN and the external network interworking method, the data packet sent by the user terminal in the SILSN to the external network is forwarded directly by the ASN to the ISN. When the ASN forwards the data packet to the ISN, the ASN does not perform any encapsulation or In the replacement work, the data packet has only the destination IP address and the source IP address, and does not carry the location information of the ASN. In this way, when the ISN forwards the data packet (ie, the reverse data packet) of the user terminal replied to the SILSN, it cannot know which ASN the data packet is sent from, so the reverse data packet cannot be replied normally.

The present invention modifies the data packet processing mechanism of the ASN to the external network, that is, the ASN sends the data packet sent by the user terminal to the external network to the ISN to enable the ISN to distinguish the data packet from which the outgoing network is sent to the ISN. In this case, the RID of the ASN and the address of the ISN are added before the original IP packet header (including the UE identifier and the external network address) of the data packet. Therefore, in the present invention, the ASN needs to encapsulate the outer data packet with the data packet sent by the UE to the external network, that is, add a new packet header. Specifically, the ASN uses the entire data packet (ie, IP packet) sent by the UE as the payload of a new data packet, that is, the original IP packet payload and the original IP header (the identifier of the UE (the UE). The identifier includes the user's identity AID and the UE's port number) and the external network address), and a new IP is added to the data payload, and the source address of the new IP address is The location identifier of the ASN accessed by the user terminal, that is, the RID, the destination address of the new data is set to the address of the ISN, and the format of the data packet is as shown in FIG.

In this way, when the data packet is sent from the ASN to the ISN, after the ISN strips the new IP packet header, the ISN can distinguish which ASN the data packet is sent from, so that it is possible to send the data packet returned by the external network. Go to the right ASN.

Considering that packets of the same source AID sent by different ASNs may come from different user terminals (that is, different user terminals use the same user's identity to access the network), the port number may also be duplicated. As shown in FIG. 4, both UE1 and UE2 send a data packet with a source AID of AID1 and a source port number of 5000. In this case, although the ISN records the source RID of the two data packets, since the IP address and the port are the same, the ISN sends the data message to the external network after receiving the data message. The destination address (ie AID1) and the destination port will be identical, this The ISN still cannot distribute reverse data packets of the same address and the same port to the correct ASN.

In order to solve the problem of the special case, the present invention further improves the mechanism for processing the data message by the ISN, and performs port conversion on the ISN, including:

For a data message transmitted in the forward direction (that is, a data message transmitted by the user terminal to the external network in the SILSN), when the ISN receives a new data packet from the ASN, it first checks whether another ASN has sent it. The data packet of the same source AID, if any, indicates that the user accesses the network by using multiple access methods. At this time, the ISN will check whether the source port in the new data file is the same as the AID data sent by other ASNs. The source port is the same as that of the port. If the port is duplicated, the port is mapped to a different port. The port mapping relationship is saved. Then, the port-mapped data packet is sent out. As shown in Figure 5, when the ISN receives the data packet sent by RID2 and RID5, it checks that RID1 sends the same source AID1 and the same source port 23 data packet, and maps the duplicate port of RID2 to the source port. 9001, mapping the duplicate port of RID5 to source port 9002, and then sending it out.

When the ISN receives a data packet from the external network, it remaps the port number based on the existing mapping relationship. As shown in Figure 6, when the ISN receives the data packet of the destination AID1, the destination port 9001, and the data packet of the destination AID1 and the destination port 9002, the ISN uses the mapping relationship to the destination port of the data packet. Both the 9001 and the destination port 9002 are modified to the destination port 23, and then the data message is sent out.

Among them, when port mapping, you should avoid the Internet Engineering Task Force (Internet)

Engineering Task Force, IETF) is divided into the name of the port.

In order to simplify the processing, the ISN can also perform port mapping processing in sequence on the source ports in the data packets sent by all the ASNs carrying the AID of the same user. As shown in Figure 7, the ISN performs a uniform port mapping for data packets sent from the same AID. For example, for AID1, the IID will be located in RID1, and the source port is 23, which translates to 4 ports.艮文; The packet with the source port of 23 in RID9 is converted to the packet with port 9001. In this way, even if the data packets of the same source AID and source port sent by different ASNs can be processed correctly by the ISN and the external network server, the data will not be confused. At the same time, since the user still uses his own AID, It does not affect security functions such as traceability and lawful interception. If the ISN does not find a mapping in the local source port mapping table, the port is not directly translated and sent to the corresponding ASN. For the data packet initiated by the external network, but the destination port number carried in the data packet can also find the destination port number of the data packet in the local source port mapping table, indicating that the user uses the destination port number to The external network sends a data packet. At this time, the destination port number in the data packet is directly mapped according to the local source port mapping table, and the data packet is sent. If the RID corresponding to the destination AID of the data packet is not queried, the ILR needs to query the ILR for the RID of the ASN accessed by the user terminal corresponding to the destination AID. At this time, if the AIR is queried to the ILR, the data message is sent to the user terminal corresponding to the destination AID according to the default priority sequence returned by the ILR or randomly selecting an ASN corresponding to the RID.

An application example of port mapping by the ISN is given below with reference to the accompanying drawings. The ISN needs to process data packets in both directions. The first is the data packet sent by the internal network to the external network, which is referred to as forward data packet processing. The second is the data packet sent by the external network to the internal network, which is hereinafter referred to as reverse data packet processing.

Application example 1, forward data packet processing flow

In this application example, the processing flow of the forward data packet sent by the ISN to the ASN is as shown in FIG. 7, and includes:

Step 801: The ISN receives a data packet sent by the ASN in the SILSN to the external network, and the process begins. The data packet sent by the ASN encapsulates a new IP header, and the new IP header includes: The RID of the ASN, that is, the source RID, and the address of the ISN, and the data packet also carries the active AID and the source port number.

Step 802: The ISN decapsulates the data packet, and extracts a source RID, a source AID, and a source port number in the data packet.

Step 803: The ISN searches for the same mapping relationship in the local port mapping table by using the source AID and the source port number carried in the data packet. If the search fails, the process proceeds to step 804. If the search is performed, the step is performed. 805;

Step 804: If the mapping between the source AID and the source port number is not found in the local port mapping table, the source port number is mapped, and the mapping relationship is saved in the local port mapping table. Go to step 806.

Step 805: Map the source port of the data packet according to the port mapping relationship in the local port mapping table.

Step 806: Send the port-mapped data to the external network, and the process ends.

Application example 2, reverse data packet processing flow

When the reverse data packet is processed, the location information of the destination AID in the data packet is not necessarily saved on the ISN due to the data packet sent from the external network. If the ISN does not have location information for the destination AID, a location query operation needs to be initiated to the ILR. In addition, for data packets directly initiated from the external network, no port conversion is performed, or the port numbers before and after conversion are the same. In this application example, the process of processing data packets sent by the ISN to the external network is as shown in FIG. 9, including:

Step 901: The ISN receives the data packet sent by the external network, and the process begins.

Step 902: The ISN checks whether the location information of the AID (that is, the destination IP address in the data packet) exists in the ISN, that is, the mapping relationship between the AID and the RID of the data packet. If yes, go to step 903. If yes, go to step 910.

Step 903: If the location information of the destination AID already exists, further check whether the destination AID and the destination port carried in the data packet are already in the local port mapping table. If not, go to step 904, if yes, Go to step 920.

Step 904: The destination AID and the destination port carried in the data packet are stored in the local mapping table, and the port numbers before and after the conversion are set to be the same.

After performing this step, if the subsequent ISN receives the data packet sent to the destination AID,

The ISN can directly find the RID corresponding to the destination AID from the local mapping table, so that the location information of the destination AID does not need to be queried from the ILR.

Step 905: The ISN adds an outer IP packet header to the data packet according to the prior art. The IP packet header sets the destination address to the ASN address, and then sends the packet to the corresponding ASN, and the process ends.

Step 910: If the mapping between the AID and the RID is not saved in the ISN, the ISN initiates a location query operation to the ILR, and queries the RID corresponding to the AID. After receiving the correspondence between the AID and the RID returned by the ILR, step 904 is performed.

Step 920: After the port mapping is performed according to the local port mapping table, the data packet is about to be translated. The address is replaced with the port detected in the port mapping table, and then the outer IP header encapsulation is added to the data file, and the destination address of the outer IP header encapsulation is set to the RID of the queried ASN, and then sent to the corresponding ASN. The process ends.

The embodiment further provides an interworking gateway device, as described in FIG. 10, which is applied to a network in which an identity identifier and a location identifier are separated, and the interworking gateway device includes:

a receiving module, configured to receive a data packet that is sent by the source user terminal and sent by the source user terminal to the external network, and the access node adds the location of the access node to the data packet. Identify and address the interworking gateway device;

a message processing module, configured to strip the location identifier of the access node added by the access node and the address of the interworking gateway node, and associate the location identifier of the access node of the data packet with the user terminal The identity identifier is sent to the storage module, and the processed data packet is sent to the sending module;

a storage module, configured to record a mapping relationship between a location identifier of the access node of the data packet and an identity identifier corresponding to the user terminal;

Preferably, the message processing module is further configured to map the port number of the source user terminal to a port number for the external network, and send the port number of the source user terminal and the port number for the external network to the storage module, and map the port. The data packet is sent to the sending module;

The storage module is further configured to record the port number of the source user terminal and the port number for the external network to the mapping relationship of the identity of the source user corresponding to the source user terminal;

The sending module sends a data packet after port mapping to the external network.

The message processing module is configured to map the port number of the source user terminal to the port number for the external network as follows:

Check whether there is a received data packet with the identity of the same source user, the port number of the same source user terminal, and the location identifier of the different access node. The module searches the storage module for the mapping relationship between the identity of the source user and the port number of the source user terminal. If not found, the port number of the source user terminal of the received data packet is mapped to the external network. Port number; if found, this data will be The port number of the source user terminal in the packet is mapped to a port number for the external network different from the port number of the source network corresponding to the identity of the source user in the found mapping relationship;

If the packet processing module detects that there is no received data packet with the identity of the same source user, the port number of the same source user terminal, and the location identifier of the different access node, the data packet received by the packet is not present. Then, the data packet that is not port mapped is sent to the sending module.

Or

The port numbers of the source user terminals in the data packets of the same source user, the port number of the same user terminal, and the location identifier of the different source users are sequentially mapped to different port numbers for the external network.

The packet processing module is further configured to: after receiving the data packet, check whether the identity identifier of the source user, the port number of the source user terminal, and the access in the data module that are received in the current storage module are included in the storage module. A mapping relationship between the location identifiers of the nodes, if yes, mapping the source user port number to a corresponding port number for the external network according to the checked mapping relationship.

Preferably, the receiving module is further configured to receive the data message sent by the external network; and the message processing module is further configured to: find the location identifier of the destination user corresponding to the identity of the destination user of the data message sent by the external network, and Sending the location identifier of the destination user to the sending module;

The sending module is further configured to send the data packet sent by the external network to the access node corresponding to the location identifier of the destination user.

The message processing module is further configured to check whether the mapping relationship between the identity identifier of the destination user and the destination port of the data packet sent by the external network is saved in the storage module, and if yes, port mapping is performed according to the mapping relationship.

The message processing module is further configured to: when it is checked that the interworking gateway node does not save the mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal in the data packet sent by the external network, the destination user The identity identifier, the location identifier of the destination user, the port number of the destination user terminal, and the port number for the external network are sent to the storage module; The storage module is further configured to increase a mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal in the data packet sent by the external network, and identify the identity of the destination user, and locate the location identifier of the destination user. The port number of the user terminal and the port number for the external network are saved in the added mapping relationship; wherein the port number of the destination user terminal is the same as the port number for the external network.

The destination address is added to the data, and the destination address is a location identifier of the destination user, and then the data packet with the destination address added is sent to the corresponding access node.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be accomplished by a program instructing the associated hardware, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Industrial applicability

Compared with the prior art, the present invention enables the user to smoothly access the external network by using the same AID when accessing multiple access modes, so that the basic services based on the external network can be implemented normally, and the monitoring and traceability are facilitated. System security.

Claims

Claim

A method for interworking between a user terminal and an external network in a plurality of access modes, wherein the method is applied to a network in which identity identification and location identification are separated, and the method includes:

The interworking gateway node sends the data packet to the external network.

The method of claim 1, after the step of recording the mapping relationship between the location identifier of the access node and the identity identifier of the source user, the method further includes: the interworking gateway node is the source user terminal The port number is mapped to a port number for the external network, and the port number of the source user terminal and the port number for the external network are recorded in the mapping relationship;

The step of the interworking gateway node transmitting the data to the external network includes: the interworking gateway node transmitting the data packet after performing port number mapping.

3. The method according to claim 2, wherein the step of the interworking gateway node mapping the port number of the source user terminal to the port number for the external network comprises:

If yes, the interworking gateway node searches for a mapping relationship between the identity identifier of the source user and the port number of the source user terminal. If not found, the port number of the source user terminal of the received data packet is mapped to Port number of the external network; if found, mapping the port number of the source user terminal in the data packet received this time to the source in the found mapping relationship The port number of the user corresponding to the external network corresponding to the port number of the external network;

The method further includes: if the interworking gateway node detects that there is no identity identifier of the same source user, a port number of the same source user terminal, and a location identifier of a different access node that is different from the data packet received this time. The received data packet does not perform the step of mapping the port number of the source user terminal to the port number of the external network, and directly transmits the data packet received this time to the external network.

4. The method according to claim 2, wherein the step of the interworking gateway node mapping the port number of the source user terminal to the port number for the external network comprises:

The interworking gateway node sequentially maps the port numbers of the source user terminals in the data packets of the same source user, the port number of the same source user terminal, and the location identifier of the different source users to different external networks. The port number.

5. The method of claim 2, further comprising:

After receiving the data packet, the interworking gateway node checks whether there is a mapping relationship between the identity identifier of the source user, the port number of the source user terminal, and the location identifier of the access node in the data packet received this time. If yes, the port number of the source user terminal of the received data packet is mapped to the port number of the external network according to the detected mapping relationship, and the data packet received this time is directly sent to the external network. .

6. The method of claim 1 or 2 or 3, further comprising:

The interworking gateway node searches for the location identifier of the destination user corresponding to the identity of the destination user of the data message sent by the external network, and sends the data packet sent by the external network to the location identifier of the destination user. Corresponding access node.

7. The method according to claim 6, wherein the step of the interworking gateway node finding the location identifier of the destination user,

The interworking gateway node is configured to search for a location identifier of the destination user from an authentication node that is stored by the destination user and that stores the location identifier of the destination user; or The interworking gateway node searches for a location identifier of the destination user from the recorded mapping relationship.

The method of claim 6, before the step of sending the data packet sent by the external network to the access node corresponding to the location identifier of the destination user, the method further includes:

The method of claim 7 or 8, before the step of transmitting the data packet sent by the external network to the access node corresponding to the location identifier of the destination user, the method further includes: the interworking When the gateway node checks that the mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal of the data packet sent by the external network is not saved on the interworking gateway node, the identity identifier of the destination user is increased. The mapping of the port number of the destination user terminal, and the identity of the destination user, the location identifier of the destination user, the port number of the destination user terminal, and the port number for the external network are saved to the added In the mapping relationship, the port number of the destination user terminal is the same as the port number for the external network.

The method of claim 6, wherein the step of transmitting the data message sent by the external network to the access node corresponding to the location identifier of the destination user comprises:

The interworking gateway node adds a destination address to the received data packet, where the destination address is the location identifier of the discovered destination user, and then sends the data packet with the destination address added to the access node corresponding to the destination address. .

The method according to claim 7, wherein the network in which the identity identifier and the location identifier are separated is a user identity identifier and a location separation network (SILSN); the access node is an access server (ASN), The authentication node is an identity and location registration register (ILR), the identity is an access identifier (AID), and the location identifier is a route identifier (RID).

An interworking gateway device, which is characterized in that it is applied to a network in which an identity identifier and a location identifier are separated, and the interworking gateway device includes: a receiving module, configured to receive, by the source user terminal, a data packet that is sent by the source user terminal to the external network and that carries the identity of the source user corresponding to the source user terminal, where the access node is in the datagram The location identifier of the access node and the address of the interworking gateway device are added;

13. The interworking gateway device according to claim 12, wherein

The sending module is configured to send the data packet after the port number mapping to the external network.

The interworking gateway device according to claim 13, wherein the message processing module is configured to map the port number of the source user terminal to a port number for the external network as follows:

After receiving the data packet, check whether there is a received data packet with the identity of the same source user, the port number of the same source user terminal, and the location identifier of the different access node. ,

The packet processing module is further configured to: if it is found that there is no identity identifier of the same source user, a port number of the same source user terminal, and a location identifier of a different access node that is received by the data packet received this time The data packet to be sent directly sends the data packet without the port number mapping to the sending module.

16. The interworking gateway device of claim 13, wherein

17. The interworking gateway device according to claim 12 or 13 or 14, wherein

18. The interworking gateway device of claim 17, wherein

The message processing module is further configured to check whether the destination is saved in the storage module The mapping relationship between the identity of the user and the port number of the destination user terminal of the data packet sent by the external network, if yes, the port number mapping according to the checked mapping relationship.

19. The interworking gateway device according to claim 17 or 18, wherein

The packet processing module is further configured to: when the storage module does not save the mapping relationship between the identity identifier of the destination user and the port number of the destination user terminal in the data packet sent by the external network, Determining the identity of the destination user, the location identifier of the destination user, the port number of the destination user terminal, and the port number for the external network are sent to the storage module; the storage module is further configured to increase the purpose The mapping between the identity of the user and the port number of the destination user terminal, the identity of the destination user, the location identifier of the destination user, the port number of the destination user terminal, and the port number for the external network are saved to the location. In the added mapping relationship, the port number of the destination user terminal is the same as the port number for the external network.

20. The interworking gateway device of claim 17, wherein

The destination address is added to the data sent by the external network, and the destination address is the location identifier of the discovered destination user, and then the data packet with the destination address added is sent to the access node corresponding to the destination address.