WO2012171430A1

WO2012171430A1 - Method for obtaining tunnel information, a security gateway(segw) and an evolved home base station/ a home base station

Info

Publication number: WO2012171430A1
Application number: PCT/CN2012/076020
Authority: WO
Inventors: 毕以峰; 刘国燕; 宗在峰; 周晓云
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-06-14
Filing date: 2012-05-24
Publication date: 2012-12-20
Also published as: CN102833359A

Abstract

A method for obtaining tunnel information, a security gateway(SeGW) and an evolved home base station/ a home base station is provided in the invention. The method comprises: a tunnel is established between the SeGW and the evolved home base station/ home base station(H(e)NB), the SeGW sends the tunnel information to the H(e)NB, and wherein the tunnel information comprises a local IP address of the H(e)NB. In the invention, by the SeGW sending the tunnel information which comprises the local IP address of the H(e)NB to the H(e)NB, the problem how the H(e)NB obtains the effective local IP address of itself in the circumstance of the network address transition(NAT) is solved, which enables a fixed network side locates the fixed link in which the H(e)NB locates according to the tunnel information, so that the service quality is ensured in the fixed network link.

Description

The present invention relates to the field of communications, and in particular to a tunnel information acquisition method, a security gateway, and an evolved home base station/home base station. BACKGROUND OF THE INVENTION The Evolved Packet System (EPS) of the 3rd Generation Partnership Project (3GPP) is evolved by the Evolved Universal Terrestrial Radio Access Network (E- UTRAN), Mobility Management Entity (MME), Serving Gateway (S-GW), Packet Data Network Gateway (P-GW), Home Subscriber Server , referred to as HSS), 3GPP's Authentication Authorization and Accounting (AAA) server, Policy and Charging Rules Function (PCRF) and other supporting nodes. FIG. 1 is a structural diagram of a HeNB accessing EPS convergence according to the related art. As shown in the EPS frame in FIG. 1, the MME is responsible for control planes such as mobility management, processing of non-access stratum signaling, and management of user mobility management context; S-GW is connected to E-UTRAN. Access gateway device, forwarding data between E-UTRAN and P-GW, and responsible for buffering paging waiting data; P-GW is a border gateway of EPS and Packet Data Network (PDN), It is responsible for the access of the PDN and the forwarding of data between the EPS and the PDN. The S-GW and the P-GW can be set up or set up in the network deployment. The Evolved Packet Core can be called the Evolved Packet Core. , referred to as EPC) Gateway or Integrated Services Gateway. The PCRF is a policy and charging rule function entity. It is connected to the carrier network protocol service network through the receiving interface Rx to obtain service information. In addition, it is connected to the gateway device in the network through the Gx/Gxc interface, and is responsible for initiating the IP bearer. Establish, ensure the quality of service (Quality of Service, QoS for short), and perform charging control. The EPS system supports Home evolved NodeB (HeNB) access, as shown in Figure 1. The HeNB is a small, low-power base station deployed in indoor locations such as homes, offices, and corporate buildings. The HeNB usually accesses the core network of the EPS through a leased fixed line. To ensure the security of the access, the security gateway (SeGW) is shielded in the core network. The data between the HeNB and the SeGW is encapsulated by Internet Protocol Security (IP Security). HeNB can pass After being connected to the IPSec tunnel established by the SeGW, the MME and the S-GW that are directly connected to the core network may also be connected to the MME and the P S-GW through the HeNB GW, that is, the HeNB GW is an optional network element. At the same time, in order to implement management of the HeNB, a Home eNodeB Management System (HeMS) is introduced. In addition, the GPRS (General Packet Radio Service) system belonging to the third generation mobile communication supports access of a Home NodeB (HNB). The related art is similar to HeNB. The QoS of the fixed line that is accessed by H(e)B (that is, the collective name of HeNB and HNB) is usually restricted by the contract of the owner of H(e) B and the fixed network operator. Therefore, when the 3GPP UE passes the H (e) When B accesses the 3GPP core network access service, the required QoS cannot exceed the QoS of the fixed line subscription that the fixed network operator can provide. Otherwise, the QoS of the UE access service will not be guaranteed, especially the service of Guaranteed Bitrates (GBR). Therefore, for 3GPP networks and fixed networks, a unified control mechanism is needed to implement user/connection/service admission control, as shown in Figure 1 (HeNB case). The Policy Control and Charging (PCC) network element PCRF of the 3GPP system is connected to the fixed-band policy control function (BPCF) of the fixed network through the S9* interface to implement policy interworking and resources. Management, so that the reasonable control and management of fixed network resources can be realized, and the higher priority resources accessed through H(e) B are preferentially guaranteed. As described above, if the fixed network is required to provide QoS guarantee for the accessed H(e)B line, the fixed network needs to locate the fixed line where the current H(e) B is located (the technical specification is called backhaul, that is, the fixed network backhaul network). ). In the prior art, the fixed network line is located through the tunnel information of H(e)B. The information is sent by the terminal from the H(e)B attaching process or the PDN connection establishing process to the PCRF. Based on the information, the PCRF finds the BPCF of the fixed network line that manages the H(e)B and establishes an S9* session with the resource. The home base station HeNB (HNB-like) establishes an IPsec tunnel between the HeNB and the SeGW when accessing the EPC, as shown in Figure 1, where the HeNB and the SeGW are the two endpoints of the IPsec tunnel, respectively. If there is no Network Address Translation (NAT) in the fixed network/wireless LAN, as shown in Figure 2, that is, there is no residential gateway RG (Residential Gateway) or the home gateway RG acts as the bridge mode. The outer IP address of the HeNB, or local address, is allocated by the fixed network/wireless LAN access network, specifically by the broadband access service gateway/broadband remote access server (Broadband Network Gateway/ The Broadband Remote Access Server (BNG/BRAS for short) is assigned to it. This address is a valid local/outer IP address and is part of constructing tunnel information. If there is network address translation in the WLAN network, as shown in FIG. 3, the NAT converter allocates a private network IP address to the HeNB, and the address is invalid as the local/outer IP address of the terminal to locate the fixed network link. Address, but BNG/BRAS assigns a public network IP address to the RG, and there is a one-to-one correspondence between the private local/outer IP address of He B and the public IP address of the RG plus the port number on the RG. The data packet is transmitted between the HeNB and the RG. The outer layer encapsulates the private address of the HeNB. When the data packet traverses the NAT, the outer layer encapsulates the public IP address of the RG plus the corresponding port number. For the fixed-line link, the private local/outer IP address of the HeNB is invalid, and the public IP address of the RG (or the external port number) is the effective information for locating the fixed line, so it is called RG here. The public IP address is also the effective outer/local IP address/port number of the HeNB, or simply the outer/local IP address/port number of the HeNB. This information is also part of the tunnel information. In addition to the fixed network information such as the effective local/outer IP address (and port number) of the HeNB, the tunnel information may include the following information: Fully Qualified Domain Name (FQDN) of the BPCF; Endpoint of the IPsec tunnel The address and/or the port number of the SeGW; the identity of the HeNB, such as the International Mobile Station Identity (IMSI); the Virtual Local Area Network Identity (VLAN ID) where the HeNB is located. . The current question is how H(e) B can obtain information such as its own valid outer or local IP address and port number, ie part of the tunnel information. When H(e) B establishes an IPSec tunnel with SeGW, if there is no device responsible for address translation between H(e)B and SeGW, such as RG, then H(e)B itself can know its own effective outer layer. Or information such as the local IP address and port number; but if there is a device responsible for address translation between H(e) B and SeGW, H(e) B knows its own outer or local IP address and port number, etc. The address and port number information is private and invalid (invalid for locating the fixed network link) and cannot be used to locate the fixed network link where H(e)B is located. Therefore, in the scenario where NAT exists, how H(e) B can obtain its own valid outer or local IP address and port number is a problem to be solved. SUMMARY OF THE INVENTION The present invention provides a tunnel information acquisition method, a security gateway, and an evolved home base station/home base station, to at least solve the problem of how the H(e)NB can obtain its own effective local IP address in the scenario where there is a NAT. . According to an aspect of the present invention, a tunnel information acquisition method is provided, including: establishing an IPSec tunnel between a security gateway SeGW and an evolved home base station/home base station H(e)B; and sending, by the SeGW, tunnel information to H(e)B The tunnel information includes a valid local IP address of H(e)B. Preferably, before the SeGW sends the tunnel information to the H(e)NB, the method further includes: the SeGW receiving the first message from the H(e)NB for requesting the tunnel information. Preferably, the first message carries the initial address of H(e) B detected by H(e)B and the initial address of the SeGW detected by H(e)NB. Preferably, the sending, by the SeGW, the tunnel information to the H(e)NB comprises: the SeGW sending a second message to the H(e)NB, where the second message carries the valid local IP address of the H(e)B. Preferably, the second message further carries an initial address of the SeGW detected by the SeGW. Preferably, the second message also carries a valid local port number of H(e)B. Preferably, the first message is one of the following: IKE_SA_INIT request/response (Internet Key Exchange-Security Association initial request/response, Internet Key Exchange Security Alliance initial request/response), IKE AUTH request/response (Internet Key Exchange Authentication) Request/Response), CREATE CHILD SA request/response (Create a child SA request/response). Preferably, the second message is one of the following: IKE_SA_INIT request/response IKE AUTH request/response, CRE ATE CHILD SA request/response. Preferably, the second message carries NAT-OAi=NATPub and NAT-OAr=Raddr, wherein NAT-OAi is the initial address of the initiator H(e)NB detected by the responding party SeGW, and the NAT-OAr is the responding party. The initial address of the responding party SeGW detected by the SeGW. Preferably, the second message carries the TSi and the TSr, where the TSi carries the initial address of the initiator HCe)NB detected by the responder SeGW, and the TSr carries the initial address of the responder SeGW detected by the responder SeGW. Preferably, H(e) B reports the tunnel information to the fixed network side to which it is connected via the EPC network; the fixed network side locates the fixed network link of H(e) B according to the tunnel information. According to another aspect of the present invention, a security gateway is provided, including: a first tunnel module, configured to establish an IPSec tunnel between the SeGW and the evolved home base station/home base station H(e)B; and a tunnel information sending module, configured to The tunnel information is sent to H(e) B, where the tunnel information includes a valid local IP address of H(e)B. Preferably, the SeGW further comprises: a receiving module, configured to receive the first message from H(e) B to request tunnel information. Preferably, the tunnel information sending module comprises: a sending submodule, configured to send a second message to H(e)B, where the second message carries a valid local IP address of H(e)B. Preferably, the second message also carries a valid local port number of H(e)B. According to still another aspect of the present invention, an evolved home base station/home base station is provided, including: a second tunnel module, configured to establish an IPSec tunnel between the security gateway SeGW and H(e)B; and a tunnel information receiving module, configured to Receiving tunnel information from the SeGW, where the tunnel information includes a valid local IP address of H(e)B. In the present invention, the tunnel information including the valid local IP address of the H(e)NB is sent to the H(e) B through the SeGW, thereby solving how the H(e) B obtains its effective locality in the NAT scenario. The problem of the IP address enables the fixed network side to locate the fixed network link where the H(e)NB is located according to the tunnel information, and guarantee the quality of service on the fixed network link. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a schematic diagram of an HeNB accessing an EPS convergence according to the related art; FIG. 2 is a schematic diagram of an address allocation in a NAT-free scenario according to the related art; FIG. 3 is a NAT scenario according to the related art. FIG. 4 is a flowchart of a method for acquiring tunnel information according to an embodiment of the present invention; FIG. 5 is a flowchart of a method for acquiring tunnel information according to Embodiment 1 of the present invention; FIG. 6 is a tunnel information according to Embodiment 2 of the present invention; FIG. 7 is a schematic structural diagram of a SeGW according to an embodiment of the present invention; and FIG. 8 is a schematic structural diagram of an evolved home base station/home base station according to an embodiment of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. FIG. 4 is a flowchart of a method for acquiring tunnel information according to an embodiment of the present invention. As shown in FIG. 4, the method includes the following steps: Step S402: An IPSec tunnel is established between a security gateway SeGW and an evolved home base station/home base station H(e)B. Step S404, the SeGW sends the tunnel information to H(e)B, where the tunnel information includes a valid local IP address of H(e)B. In this embodiment, the tunnel information including the valid local IP address of the H(e)NB is sent to the H(e) B through the SeGW, thereby solving the problem that how the H(e) B obtains itself in the NAT scenario. The problem of the local IP address enables the fixed network side to locate the fixed network link of H(e) B according to the tunnel information to ensure the quality of service on the fixed network link. Embodiment 1 In this embodiment, when an IPsec tunnel is established between H(e)B and SeGW in the Quick Mode of IKEvl (The Internet Key Exchange Protocol version 1), the two parties negotiate each other. The process of the address. In this embodiment, the data security between H(e)B and SeGW is the tunnel mode adopted. Therefore, H(e)B and SeGW must mutually negotiate the address information of the other party. As shown in FIG. 5, the following steps are included: Step S502: H(e)B sends a first message to the SeGW. The first message may carry NAT-OAi=Iaddr and NAT-OAr=Raddr. Where NAT-OAi refers to the initial address (OA, original address) of the initiator (i, initiator) H(e) B observed by the initiator H(e) B, and the actual value of the address is laddr (Initiator address, ie RG is the private IP address assigned to the terminal); where NAT-OAr refers to the initial address (original address, OA for short) of the responding party (r, responder), and the actual value of the address is Raddr (Responder address), which is the actual address of the SeGW; wherein the first message may be an IKE_SA_INIT request/response or an IKE AUTH request/response, CREATE CHILD SA request/response message. The first message may carry an indication, where the indication is used to indicate that the local/outer IP address of the H(e)B request is valid to the SeGW. The SeGW may not change the first message, and the SeGW defaults. After receiving the first message, it sends its valid local/outer IP address to H(e)B. Step S504, the SeGW sends a second message to Η θ;> Β. The second message carries both NAT-OAi=NATPub and NAT-OAr=Raddr. NAT-OAi refers to the initial address (0A, original address) of the initiator (i, initiator) H(e) B observed by the responding party SeGW after NAT traversal. The actual value of the address is NATPub (NAT public Address, ie RG's public IP address); where NAT-OAr refers to the respondent (r, responder) SeGW's initial address (Original Address, OA for short) after NAT traversal, the actual value of the address is Raddr (Responder address), which is the actual address of SeGW. The second message may be an IKE SA INIT request/response or an IKE AUTH request/response , CREATE CHILD SA request/response message. Among them, the second message only carries NAT-OAi=NATPub to Η( ;) Β. After the above interaction, H(e)B obtains the valid local/outer IP address after NAT conversion, that is, NATPub in the above process. In addition, the port number can also be carried to H(e)B by extending the cell NAT-OAi, or by adding a similar cell to enable H(e)B to obtain its valid local/outer port number. . The initial address of the initiator H(e) B that can be observed by the foregoing SeGW means that the SeGW obtains the source address of the first message as the observed initiator H after receiving the first message of step 502. ) The initial address of B. Step S506, H(e) B acquires the valid local/outer address of the H(e)NB observed by the SeGW (ie, the IP address of the RG) by step S504, and H(e)B constructs the local as a component. Tunnel information. Step S508, when the terminal initiates an attach, a PDN connection establishment, a handover, a TAU (Tracking Area Update), a RAU (Routing Area Update), and the like from H(e)B, H(e) B. The tunnel message between the H(e)NB and the 3GPP core network element (the MME for the HeNB and the SGSN for the HNB) (the SI interface message for the HeNB and the Iu interface message for the HNB), the "tunnel information" Send to the 3GPP core network element (MME/SGSN). After receiving the tunnel information, the GPP core network transmits the tunnel information through the path of the MME S-GW (P-GW^) PCRF fixed network (BPCF) or through the SGSN GGSN PCRF fixed network (BPCF). After the tunnel information arrives at the PCRF, the PCRF uses the tunnel information to locate the fixed network BPCF, and the fixed network related network element (BPCF or other proxy network element) receives the tunnel information and locates the fixed network line where the H(e) B is located. Resources on fixed line lines (such as QoS guarantees, etc.). The second embodiment describes the processing flow in which the two parties negotiate each other's addresses when the IPsec tunnel is established between the H(e)B and the SeGW in the scenario of the IKEv2 (The Internet Key Exchange Protocol version 2), where The address is passed through the Traffic Selector (TS). In this embodiment, the data security between H(e)B and SeGW is the tunnel mode adopted. Therefore, H(e)B and SeGW must mutually negotiate the address information of each other, as shown in FIG. 6, including the following steps. Step S602: H(e) B sends a first message to the SeGW. The first message carries the TSi and the TSr. The TSi specifies the source address of the service data sent by the initiator of the security association, or the destination address of the service data sent to the initiator of the security association. The TSr specifies the source address of the service data sent by the responder of the security association, or the destination address of the service data sent to the responder of the security association. The TSi carries the initial address of the initiator (i, initiator) H (^), and the actual value of the address is the private IP address assigned by the RG to the terminal; where the TSr carries the initiator H ( e) The observed respondent (r, responder) The initial address of the SeGW, the actual value of the address is the actual address of the SeGW; wherein the first message may be IKE_SA_INIT request/response (Internet Key Exchange-Security Association initial request/ Response, Internet Key Exchange Security Association Initial Request/Response) or IKE_AUTH request/response, CREATE CHILD SA request/response message. The message carries an indication, where the indication is used to indicate that the local/outer IP address of the H(e)B request is valid to the SeGW; wherein the first message is not changed, and the SeGW receives the first message by default. Sending its valid local/outer IP address to H(e) B. Step S604, the SeGW sends a second message to Η(^ Β. wherein the second message carries TSi and TSr The TSI carries the initial address of the initiator (i, initiator) H(e) B observed by the responding party SeGW after the NAT traversal, and the actual value of the address is the public IP address of the RG; wherein the TSr carries the NAT traversal After the respondent SeGW observes the respondent (r, responder) the initial address of the SeGW, the actual value of the address is the actual address of the SeGW. The second message may be IKE SA INIT request/response or IKE AUTH request/ Response, CREATE CHILD SA request/response message, wherein the second message can only carry TSi to H(e) B. After the above operation, H(e) B obtains the valid local/outer IP address after NAT conversion. In addition, in this embodiment, the port number can also be carried to H(e) B by extending the cell TSi, or H(e) B can be obtained by adding a similar cell. Its valid local/outer port number. The initial address of the initiator H(e) B that can be observed by the foregoing SeGW is that the SeGW obtains the source address of the first message as the observed initiator H after receiving the first message of step 602. ) The initial address of B. Step S606, H(e) B acquires the valid local/outer address of the H(e)NB observed by the SeGW (ie, the IP address of the RG) by step S604, and H(e)B constructs the local as a component. Tunnel information. Step S608, when the terminal initiates an operation such as attach, PDN connection establishment, handover, TAU (Tracking Area Update), RAlKRouting Area Update, and routing area update from H(e)B, Η0)ΝΒ passes H ( e) an interface message between the NB and the 3GPP core network element (the HeNB is the MME and the HNB is the SGSN) (the SI interface is the SI interface message and the HNB is the Iu interface message), and the "tunnel information" is sent to the 3GPP core. Network element (MME/SGSN). After receiving the tunnel information, the GPP core network transmits the tunnel information through the path of the MME S-GW (P-GW^) PCRF fixed network (BPCF) or through the SGSN GGSN PCRF fixed network (BPCF). After the tunnel information arrives at the PCRF, the PCRF uses the tunnel information to locate the fixed network BPCF, and the fixed network related network element (BPCF or other proxy network element) receives the tunnel information and locates the fixed network line where the H(e) B is located. Resources on fixed line lines (such as QoS guarantees, etc.). FIG. 7 is a schematic structural diagram of a SeGW according to an embodiment of the present invention. As shown in FIG. 7, the SeGW 100 includes: a first tunnel module 102 and a tunnel information sending module 104. The first tunnel module 102 is configured to establish an IPSec tunnel between the SeGW and the evolved home base station/home base station H(e)B. The tunnel information sending module 104 is configured to send tunnel information to H(e) B, where the tunnel information includes a valid local IP address of H(e)B. In this embodiment, the tunnel information including the valid local IP address of the H(e)NB is sent to the H(e) B through the SeGW, thereby solving the problem that how the H(e) B obtains itself in the NAT scenario. The problem of the local IP address enables the fixed network side to locate the fixed network link of H(e) B according to the tunnel information, and guarantees the service quality of H(e) B in the fixed network. The SeGW further includes a receiving module 106 (not shown), and the receiving module 106 is configured to receive the first message from H(e) B to request tunnel information. FIG. 8 is a schematic structural diagram of an evolved home base station/home base station according to an embodiment of the present invention. As shown in FIG. 8, the H(e)B 200 includes: a second tunnel module 202 and a tunnel information receiving module 204. The second tunnel module 202 is configured to establish an IPSec tunnel between the security gateway SeGW and the H(e)NB. The tunnel information receiving module 204 is configured to receive tunnel information from the SeGW, wherein the tunnel information includes a valid local IP address of H(e)B. In the foregoing embodiments of the present invention, the tunnel information including the valid local IP address of the H(e) B is sent to the H(e) B through the SeGW, thereby solving the H(e) B in the NAT scenario. The problem of obtaining a valid local IP address is such that the fixed network side can locate the fixed network link of H(e) B according to the tunnel information, thereby ensuring the quality of service on the fixed network link. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A method for acquiring tunnel information, including:

Establishing an Internet Protocol Security IPSec tunnel between the security gateway SeGW and the evolved home base station/home base station H(e)B;

The SeGW sends the tunnel information to the H(e)B, where the tunnel information includes a local IP address of the H(e)B.

2. The method according to claim 1, wherein before the SeGW sends the tunnel information to the H(e)B, the method further includes:

The SeGW receives a first message from the H(e) B set to request the tunnel information.

The method according to claim 2, wherein the first message carries an initial address of the HCe) B detected by the H(e)B and the detected by the HCe) B The initial address of SeGW.

The method according to claim 1 or 2, wherein the sending, by the SeGW, the tunnel information to the H(e) B includes:

The SeGW sends a second message to the H(e)NB, where the second message carries the local IP address of the H(e)B.

The method according to claim 4, wherein the second message further carries an initial address of the SeGW detected by the SeGW.

The method according to claim 4, wherein the second message further carries a local port number of the H(e)B.

7. The method according to claim 2, wherein the first message is one of the following:

Internet Key Exchange Security Association Initial Request/Response IKE_SA_INIT request/response, Internet Key Exchange Authentication Request/Response IKE_AUTH request/response Create a child security association request/response CREATE_CHILD_SA request/response.

8. The method according to claim 4, wherein the second message is one of the following: Internet Key Exchange Security Association Initial Request/Response IKE_SA_INIT request/response, Internet Key Exchange Authentication Request/Response IKE_AUTH request/response Create a child security association request/response CREATE_CHILD_SA request/response.

The method according to claim 8, wherein the second message carries a NAT-OAi=NATPub and a NAT-OAr=Raddr, wherein the NAT-OAi is an initiator detected by the responding party SeGW ( » 初始 Initial address, NAT-OAr is the initial address of the responding party SeGW detected by the responding party SeGW.

10. The method according to claim 8, wherein the second message carries a TSi and a TSr, where the TSi carries an initial address of the initiator H(e)NB detected by the responding party SeGW, and the TSr carries the responder The initial address of the responding party SeGW detected by the SeGW.

11. The method according to claim 1, wherein

The H(e) B reports the tunnel information to the fixed network side to which the enhanced packet core EPC network is connected; the fixed network side locates the fixed network link of the H(e) B according to the tunnel information. .

12. A security gateway SeGW, including:

a first tunnel module, configured to establish an Internet Protocol security IPSec tunnel between the SeGW and the evolved home base station/home base station H(e)B;

The tunnel information sending module is configured to send the tunnel information to the H(e) B, where the tunnel information includes a local IP address of the H(e) B.

The SeGW according to claim 12, wherein the SeGW further includes:

And a receiving module, configured to receive a first message from the H(e) B to request the tunnel information.

The SeGW according to claim 12, wherein the tunnel information sending module comprises:

The sending submodule is configured to send a second message to the H(e) B, where the second message carries a local IP address of the H(e)NB.

The SeGW according to claim 14, wherein the second message further carries a local port number of the H(e)B. Evolved Home Base Station/Home Base Station H(e) B, including: a second tunnel module, configured to establish an Internet Protocol security IPSec tunnel between the security gateway SeGW and the H(e)B;

The tunnel information receiving module is configured to receive tunnel information from the SeGW, where the tunnel information includes a local IP address of the H(e)B.