WO2015100874A1

WO2015100874A1 - Home gateway access management method and system

Info

Publication number: WO2015100874A1
Application number: PCT/CN2014/075012
Authority: WO
Inventors: 王飞
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-12-31
Filing date: 2014-04-09
Publication date: 2015-07-09
Also published as: CN104754689B; CN104754689A

Abstract

The present invention relates to a home gateway access management method and system. The method comprises: a home gateway (HGW) sending to a wireless access gateway (WAG) a query message of an international mobile subscriber identity (IMSI) of a mobile phone carrying a newly established wireless fidelity (WiFi) link, and querying an authentication result of the mobile phone to the WAG; and the HGW receiving a response message carrying the authentication result of the mobile phone and returned by the WAG, and controlling WiFi link data transmission of the mobile phone according to the authentication result.

Description

Home gateway access management method and system

Technical field

The present invention relates to the field of wireless communications, and in particular, to a home gateway access management method and system. Background technique

The home gateway allows the mobile phone to access and conduct data services through WiFi (Wireless Fidelity), but in actual operation, it may be necessary to filter users who use WiFi (for example, the A operator's home gateway wants to only allow users of the A carrier). Accessing the A operator's Wifi network through the home gateway).

The related home gateway access terminal management mode cannot filter the terminal and cannot meet the application requirements. Summary of the invention

The embodiment of the invention provides a home gateway access management method and system, which solves the problem that the related home gateway access terminal management mode cannot filter the terminal and cannot meet the application requirements.

A home gateway access management method includes:

The home gateway (HGW) sends an inquiry message of an International Mobile Subscriber Identity (IMSI) carrying a mobile phone with a newly established wireless fidelity (WiFi) link to the wireless access gateway (WAG), and queries the WAG for the mobile phone The result of the authentication;

Receiving, by the HGW, the WAG returns a response message carrying an authentication result of the mobile phone, and controlling, according to the authentication result, the WiFi link data transmission of the mobile phone.

Optionally, the method further includes:

The HGW receives a DHCP Request Option 60 message sent by the mobile phone carrying the mobile phone IMSI.

Optionally, the HGW receives the response message that the WAG carries the authentication result of the mobile phone, and controls the WiFi link data transmission of the mobile phone according to the authentication result, include:

When the response message received by the HGW indicates that the mobile phone authentication is passed, the HWG releases the data stream to the WiFi link, and allows the mobile phone on the WiFi link to pass through the WiFi link and the network side. Data service; and

When the response message received by the HGW indicates that the mobile phone authentication fails, the HGW prohibits the mobile phone on the WiFi link from performing data service with the network side through the WiFi link.

Optionally, the method further includes:

The HGW sets a wait timeout timer for the query message while sending the query message to the WAG.

Optionally, the HGW receives the response message that the WAG carries the authentication result of the mobile phone, and controls the WiFi link data transmission of the mobile phone according to the authentication result, and further includes:

After receiving the response message indicating that the mobile phone authentication passes or fails, the HGW cancels the waiting timeout timer.

When the response message received by the HGW indicates that the mobile phone is still in the authentication, the HGW continues to wait for the waiting timeout timer to expire;

After the waiting timeout timer expires, the HGW sends a query message carrying the IMSI of the mobile phone to the WAG, and records the number of times the query message is sent.

Optionally, the method further includes:

The HGW acquires an Internet Protocol (IP) of the WAG at startup, and establishes a route to the WAG.

The embodiment of the invention further provides a home gateway access management method, including:

The wireless access gateway (WAG) receives the home gateway (HGW) and sends the newly established Querying an International Mobile Subscriber Identity (IMSI) query message of a mobile phone of a line-fidelity (WiFi) link, and querying the WAG for an authentication result of the mobile phone;

The WAG parses the IMSI of the mobile phone from the query message, and queries an authentication result of the mobile phone according to the IMSI;

The WAG sends a response message to the HGW, where the response message carries the authentication result of the mobile phone.

Optionally, after the step of parsing the IMSI of the mobile phone from the query message, the method for querying the authentication result of the mobile phone according to the IMSI, the method further includes:

While the mobile phone is still in the authentication process, the WAG replies to the HGW with a response message indicating that the mobile phone is authenticating.

Optionally, the method further includes:

The WAG receives a registration request of the mobile phone, and performs authentication authentication on the mobile phone; and the WAG saves the authentication result of the mobile phone and the IMSI of the mobile phone. Optionally, the WAG receives the registration request of the mobile phone, and performs authentication authentication on the mobile phone, including:

The WAG parses the authentication random number and the authentication data from the registration request of the mobile phone, and sends the authentication random number, the authentication data, and the authentication algorithm to the network security system server of the access network (AN - AAA ) ;

The AN-AAA calculates the authentication data locally according to the authentication algorithm using the authentication random number;

When the calculation result of the AN-AAA is consistent with the authentication data sent by the WAG, determining that the authentication succeeds, and determining that the authentication fails when the AN-AAA calculation result is inconsistent with the authentication data sent by the WAG; as well as

The AN-AAA returns an authentication result to the WAG.

The embodiment of the invention further provides a home gateway access management system, including: a home gateway (HGW) and a wireless access gateway (WAG); The HGW is configured to send, to the WAG, an inquiry message of an International Mobile Subscriber Identity (IMSSI) carrying a mobile phone with a newly established Wireless Fidelity (WiFi) link, and query the WAG for an authentication result of the mobile phone. Receiving, by the WAG, a response message carrying the authentication result of the mobile phone, and controlling, according to the authentication result, the WiFi link data transmission of the mobile phone; and the WAG, configured to receive the HGW to send The query message of the IMSI carrying the mobile phone with the newly established WiFi link sends a response message to the HGW, where the response message carries the authentication result of the mobile phone.

Optionally, the HGW is further configured to acquire an Internet Protocol (IP) address of the WAG at startup, and establish a route to the WAG.

Optionally, the WAG is further configured to receive a registration request of the mobile phone, perform authentication authentication on the mobile phone, and save the authentication result of the mobile phone and the IMSI of the mobile phone.

The embodiment of the invention implements the restriction on the use of the home gateway by the different network mobile phone, and solves the problem that the related home gateway access terminal management mode cannot filter the terminal and cannot meet the application requirement. BRIEF abstract

1 is a schematic structural diagram of a home gateway access management system according to Embodiment 1 of the present invention;

2 is a flow chart of a mobile phone side of a home gateway access management method according to Embodiment 2 of the present invention;

3 is a flow chart of an HGW side of a home gateway access management method according to Embodiment 2 of the present invention;

4 is a flow chart of a WAG side of a home gateway access management method according to Embodiment 2 of the present invention;

FIG. 5 is a flowchart of a home gateway access management method according to Embodiment 3 of the present invention; FIG. 6 is a flowchart of a home gateway access management method according to Embodiment 4 of the present invention; HGW internal processing logic diagram restricted by other network users;

FIG. 8 is a logic diagram of internal processing of the HGW for restricting access to other network users. Preferred embodiment of the invention

The related home gateway access terminal management mode cannot filter the terminal and cannot meet the application requirements.

Embodiments of the present invention provide a home gateway access management method and system. Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

First, the first embodiment of the present invention will be described with reference to the accompanying drawings.

The embodiment of the invention provides a home gateway access management system. The system structure is as shown in FIG. 1 and includes:

HGW 101 and WAG 102;

The HGW 101 is configured to send an inquiry message of the IMSI of the mobile phone carrying the newly established WiFi link to the WAG 102, query the WAG for the authentication result of the mobile phone, and receive the WAG 102 to return the carried message. a response message of the authentication result of the mobile phone, and controlling, according to the authentication result, the WiFi link data transmission of the mobile phone;

The WAG 102 is configured to receive an inquiry message of the IMSI of the mobile phone carrying the newly established WiFi link sent by the HGW 101, and send a response message to the HGW 101, where the response message carries the information of the mobile phone. The result of the right. Optionally, the HGW 101 is further configured to acquire an IP address of the WAG 102 at startup, and establish a route to the WAG 102.

Optionally, the WAG 102 is further configured to receive a registration request of the mobile phone, perform authentication authentication on the mobile phone, and save the authentication result of the mobile phone and the IMSI of the mobile phone.

HGW 101 mainly provides Wi-Fi wireless links to mobile phones, ensuring that mobile phones can access data services through the WiFi to the network side.

The WAG 102 is mainly used to process the authentication signaling from the mobile phone and manage the authentication session, and supports the HGW to query the mobile phone authentication result. Optionally, the system further includes a network security system (AN-AAA: Access Network AAA, AAA: Authentication, Authorization, Accounting) server 103, which provides authentication data, authentication data, and access to the WAG. The user performs billing.

Optionally, the system further includes a Home Location Register (HLR), which is mainly responsible for allocating and transmitting user authentication data, and adding a network element to the fixed network.

Optionally, the system further includes a Broadband Remote Access Server (BRAS), which is a new access gateway for broadband network applications. It is located at the edge layer of the backbone network and is responsible for broadband data connection of the home gateway. In.

Embodiment 2 of the present invention will be described below with reference to the accompanying drawings.

In conjunction with the home gateway access management system shown in FIG. 1 , an embodiment of the present invention provides a home gateway access management method, and the process for the mobile phone side to manage the terminal accessing the home gateway using the method is as shown in FIG. 2 . , including:

Step 201: The mobile phone carries the IMSI information of the user to the HGW in the DHCP Request Option 60 message.

In this step, after the mobile phone turns on the WiFi switch, the scanned hotspot automatically initiates a connection. When the IP address is automatically obtained from the HWG through the DHCP process, the user's IMSI information is carried in the DHCP Request option 60 message to the HGW.

Step 202: After the connection is successful, the mobile phone automatically initiates UW authentication to the WAG server; if the authentication is successful, the WiFi connection is maintained; if the authentication fails, the WiFi connection is disconnected.

The process on the HGW side is shown in Figure 3, including:

Step 301: The HGW establishes a route to the WAG server.

In this step, HGW-Start, immediately use chinanetcw.chinatelecom.cn to do the domain name system (DNS) operation to obtain the address IP address of the WAG server; After obtaining the IP address of the WAG server, the HWG establishes a local to the WAG server. Route, the route can be used to enable the HGW to send a request message to the WAG to query whether the mobile phone passes the authentication. Step 302: After receiving the DHCP Request Option 60 message, the HGW extracts the IMSI information of the user from the message, and associates with the WiFi link currently allocated to the user, that is, the IMSI is used as a field of the WiFi link management control block. Save it up.

Step 303: When the HGW detects that a certain WiFi link is connected, the IMSI carrying the mobile phone periodically initiates a message for querying the mobile phone authentication result to the WAG gateway, and sets a waiting timeout timer for the query message. Waiting for the WAG to respond to the message within the timeout allowed by the wait timeout timer.

According to the received WAG response message, the content is handled as follows:

1. If the received WAG response message indicates that the authentication of the mobile phone is still in progress, the HGW continues to wait for the timer to expire. After the waiting timer expires, the query message is re-initiated and the number of queries is counted.

2. If the WAG query response message indicates that the mobile phone authentication is passed, the HWG releases the data stream to the WiFi link, allowing the WiFi link to acquire data on the network side; and cancels the query message waiting timer.

3. If the query response message of the WAG is received, indicating that the authentication fails, it is prohibited to acquire data from the network side for the WiFi link. Cancel the wait timer for the query message.

4. The maximum number of times that the HGW initiates periodic challenge authentication results to the WAG is preferably no more than five times, and each time the result is no more than three seconds. The HGW has received the authentication result of the changed user back from the WAG, and immediately stops sending the inquiry message to the WAG and cancels the waiting timer.

The process on the WAG side is shown in Figure 4, including:

Step 401: After receiving the registration request from the mobile phone, the WAG performs authentication and authentication according to the normal UW authentication (this process can be referred to the “111-2012 China Telecom Mobile Terminal Demand Specification-CDMA+WiFi Volume (V201 2-9.pdf). "6.1.2 Registration Success Process").

Step 402: After receiving the inquiry request from the HGW, the WAG parses the user's IMSI from the request message, and uses the IMSI to query the current user's authentication result.

According to the different authentication results of the query, the processing method is as follows:

1. If the user is still in the process of authentication, the response message is sent to the HGW. In response to the message, the authentication is in progress.

2. If the user is successfully authenticated, the HGW responds with a response message indicating whether the authentication succeeds or fails.

3. If the authentication of the mobile phone fails, the HGW responds with a response message indicating that the authentication fails.

Embodiment 3 of the present invention will be described below with reference to the accompanying drawings.

In conjunction with the home gateway access management system shown in FIG. 1 , an embodiment of the present invention provides a home gateway access management method, and the process for the mobile phone side to manage the terminal accessing the home gateway using the method is as shown in FIG. 5 . , including:

Step 501: The mobile phone selects a hotspot and initiates a connection;

In this step, when the WiFi switch is turned on on the mobile phone, one of the searched one or more hotspots is selected to initiate an automatic connection, and the IMSI information of the mobile phone is carried in the option 60 field of the connected DHCP Request message. The mobile phone automatically initiates a registration request for a Session Initiation Protocol (SIP) signaling to the WAG gateway over the WiFi link after the automatic connection. The request has a type of authentication algorithm supported by the card (CAVE algorithm or MD5 algorithm).

Step 502: After detecting the connection with the WiFi of the mobile phone, the HGW sends a message to the WAG to query the authentication result of the mobile phone, and sets a timer to perform a protection query response.

Step 503: After receiving the Register request, the WAG gateway selects an algorithm (the preferred algorithm is MD5), and returns a 401 message to the mobile phone. The 401 (Unauthorized, Unauthorized) message carries the corresponding authentication algorithm according to the selected algorithm. Authentication random number;

Step 504: After receiving the 401 message, the mobile phone parses out the number of authentication random numbers from the SIP message and calculates by the card according to the agreed CAVE or MD5 algorithm. After the result is obtained, a Register Request message is sent to the WAG, and the message carries the authentication random number and the authentication data calculated by the card.

Step 505: After receiving the Register Request message re-initiated by the mobile phone, the WAG parses the authentication random number and the authentication data, and sends the authentication algorithm to the AN-AAA for authentication.

Step 506: After receiving the authentication data sent by the WAG, the AN-AAA calculates the authentication data according to the authentication algorithm locally by using the authentication random number. If AN-AAA calculates the authentication data and mobile phone meter locally If the calculated authentication data is consistent, then the WAG will respond to the message indicating that the authentication is successful. Step 507: After receiving the message that the AN-AAA indicates that the authentication succeeds, the WAG sends a message 200 (for registration, for Register) to the mobile phone.

Step 508: After receiving the 200 response message of the register, the mobile phone prompts the user to verify that the UW authentication is successful. Otherwise, the user is prompted to fail authentication;

Step 509: If the HGW queries that the mobile phone is successfully authenticated, the data link is released to the WiFi link established with the mobile phone; otherwise, the data flow is not released to the WiFi link.

Embodiment 4 of the present invention will be described below with reference to the accompanying drawings.

An embodiment of the present invention provides a home gateway access management method, and the process of managing the mobile phone accessed by the home gateway using the method is as shown in FIG. 6, and includes:

Step 601: The HGW acquires an IP address of the WAG at startup, and establishes a route to the WAG.

Step 602: The HGW receives a DHCP Request option 60 message sent by the mobile phone and carrying the mobile phone IMSI.

Step 603: The HGW sends an IMSI query message carrying the mobile phone with the newly established WiFi link to the WAG, and queries the WAG for the authentication result of the mobile phone.

In this step, optionally, the HGW sends a wait timeout timer to the query message while sending the query message to the WAG.

Step 604: The WAG receives an inquiry message of the IMSI of the mobile phone that carries the newly established WiFi link sent by the HGW.

First, the process of authenticating the mobile phone by WAG is described as follows:

1. The WAG receives the registration request of the mobile phone, and performs authentication and authentication on the mobile phone;

2. The WAG parses the authentication random number and the authentication data from the registration request of the mobile phone, and sends the authentication random number, the authentication data, and the authentication algorithm to the network security system server of the access network ( AN - AAA ) ;

3. The AN-AAA uses the authentication random number to locally calculate the authentication according to the authentication algorithm. Right data

4. When the calculation result of the AN-AAA is consistent with the authentication data sent by the WAG, determining that the authentication is successful, and determining the authentication when the result of the AN-AAA calculation is inconsistent with the authentication data sent by the WAG Failure

5. The AN-AAA returns an authentication result to the WAG.

After the authentication of the mobile phone is completed, the WAG saves the authentication result of the mobile phone and the IMSI of the mobile phone.

Step 605: The WAG parses an IMSI of the mobile phone from the query message, and queries an authentication result of the mobile phone according to the IMSI.

Step 606: The WAG sends a response message to the HGW, where the response message carries an authentication result of the mobile phone.

Optionally, when the mobile phone is still in the authentication process, the WAG returns a response message indicating that the mobile phone is authenticating to the HGW.

Step 607: The HGW receives the response message that the WAG carries the authentication result of the mobile phone, and controls the WiFi link data transmission of the mobile phone according to the authentication result.

Optionally, the HGW cancels the waiting timeout timer after receiving a response message indicating that the mobile phone authentication passes or fails.

The HGW internal processing logic diagram that is not restricted to other network users is shown in Figure 7. After using the home gateway access management method provided by the embodiment of the present invention, the internal processing logic for restricting access to other network users is as shown in FIG. 8. It can be seen that the technical solution provided by the embodiment of the present invention can manage the home gateway access user, and effectively restrict the access of the other network user.

An embodiment of the present invention provides a home gateway access management method and system. The HGW sends an IMSI query message carrying a mobile phone with a newly established WiFi link to the WAG, and queries the WAG for the authentication result of the mobile phone. The HGW receives the response message of the WAG carrying the authentication result of the mobile phone, and controls the WiFi link data transmission of the mobile phone according to the authentication result, thereby realizing the restriction of the different network mobile phone to the family. The use of the gateway solves the problem that the related home gateway access terminal management mode cannot filter the terminal and cannot meet the application requirements. can By restricting the use of home gateways by different mobile phones, it can effectively protect the operator's network investment and reduce the data server load of the network.

It will be understood by those skilled in the art that all or part of the steps of the above embodiments may be implemented using a computer program flow, which may be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Optionally, all or part of the steps of the foregoing embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any particular combination of hardware and software.

The various devices/function modules/functional units in the above embodiments may be implemented using a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

Each device/function module/functional unit in the above embodiments can be stored in a computer readable storage medium when implemented in the form of a software function module and sold or used as a standalone product. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

It is to be understood by those skilled in the art that variations or substitutions are within the scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Industrial Applicability The embodiments of the present invention implement the limitation of the use of the home gateway by the different network mobile phone, and solve the problem that the related home gateway access terminal management mode cannot filter the terminal and cannot meet the application requirements.

Claims

claims

1. A home gateway access management method, including:

The home gateway (HGW) sends a query message carrying the International Mobile Subscriber Identity (IMSI) of the mobile phone with the newly established wireless fidelity (WiFi) link to the wireless access gateway (WAG), and queries the WAG for information about the mobile phone. the authentication result; and

The HGW receives the response message returned by the WAG carrying the authentication result for the mobile phone, and controls the WiFi link data transmission of the mobile phone according to the authentication result.

2. The home gateway access management method according to claim 1, further comprising:

The HGW receives the DHCP request option 60 message sent by the mobile phone and carrying the IMSI of the mobile phone.

3. The home gateway access management method according to claim 1, wherein the HGW receives the response message returned by the WAG carrying the authentication result for the mobile phone, and performs the authentication on the mobile phone according to the authentication result. The mobile phone’s WiFi link data transmission is controlled, including:

When the response message received by the HGW indicates that the mobile phone has passed the authentication, the HWG releases the data flow on the WiFi link and allows the mobile phone on the WiFi link to communicate with the network side through the WiFi link. Conduct data services; and

When the response message received by the HGW indicates that the mobile phone authentication fails, the HGW prohibits the mobile phone on the WiFi link from performing data services with the network side through the WiFi link.

4. The home gateway access management method according to claim 3, further comprising:

While sending the query message to the WAG, the HGW sets a waiting timeout timer for the query message.

5. The home gateway access management method according to claim 4, wherein the HGW receives the response message returned by the WAG carrying the authentication result for the mobile phone, and performs the authentication on the mobile phone according to the authentication result. The mobile phone’s WiFi link data transmission is controlled, including:

After receiving a response message indicating that the mobile phone authentication passes or fails, the HGW cancels the waiting timeout timer.

6. The home gateway access management method according to claim 4, wherein the HGW receives the response message returned by the WAG carrying the authentication result for the mobile phone, and performs the authentication on the mobile phone according to the authentication result. The mobile phone’s WiFi link data transmission is controlled, including:

When the response message received by the HGW indicates that the mobile phone is still being authenticated, the HGW continues to wait for the waiting timeout timer to expire; and

After the waiting timeout timer expires, the HGW resends a query message carrying the IMSI of the mobile phone to the WAG, and records the number of times the query message is sent.

7. The home gateway access management method according to claim 1, further comprising:

The HGW obtains the Internet Protocol (IP) address of the WAG when starting and establishes a route to the WAG.

8. A home gateway access management method, including:

The wireless access gateway (WAG) receives a query message sent by the home gateway (HGW) carrying the International Mobile Subscriber Identity (IMSI) of the mobile phone with the newly established wireless fidelity (WiFi) link, and queries the WAG for the The authentication result of the mobile phone;

The WAG parses the IMSI of the mobile phone from the query message, and queries the authentication result of the mobile phone based on the IMSI; and

The WAG sends a response message to the HGW, and the response message carries the authentication result of the mobile phone.

9. The home gateway access management method according to claim 8, wherein the WAG parses the IMSI of the mobile phone from the query message, and after the step of querying the authentication result of the mobile phone according to the IMSI , Also includes:

When the mobile phone is still in the authentication process, the WAG replies to the HGW with a response message indicating that the mobile phone is being authenticated.

10. The home gateway access management method according to claim 8, further comprising:

The WAG receives the registration request of the mobile phone and authenticates the mobile phone; and the WAG stores the authentication result of the mobile phone and the IMSI of the mobile phone in correspondence.

11. The home gateway access management system according to claim 10, wherein the WAG receives the registration request of the mobile phone and authenticates the mobile phone, including:

The WAG parses the authentication random number and authentication data from the registration request of the mobile phone, and sends the authentication random number, authentication data and authentication algorithm to the network security system server (AN- AAA );

The AN-AAA uses the authentication random number to locally calculate authentication data according to the authentication algorithm;

When the AN-AAA calculation result is consistent with the authentication data sent by the WAG, it is determined that the authentication is successful; when the AN-AAA calculation result is inconsistent with the authentication data sent by the WAG, it is determined that the authentication fails; as well as

The AN-AAA returns the authentication result to the WAG.

12. A home gateway access management system, including: a home gateway (HGW) and a wireless access gateway (WAG);

The HGW is configured to send a query message carrying the International Mobile Subscriber Identity (IMSI) of the mobile phone with a newly established wireless fidelity (WiFi) link to the WAG, and query the WAG for the authentication result of the mobile phone. , receive the response message returned by the WAG carrying the authentication result for the mobile phone, and control the WiFi link data transmission of the mobile phone according to the authentication result; and

The WAG is configured to receive a query message sent by the HGW carrying the IMSI of the mobile phone with a newly established WiFi link, and send a response message to the HGW, where the response message carries the authentication result of the mobile phone.

13. The home gateway access management system according to claim 12, wherein,

The HGW is also configured to obtain the Internet Protocol (IP) address of the WAG at startup and establish a route to the WAG.

14. The home gateway access management system according to claim 12, wherein,

The WAG is also configured to receive the registration request of the mobile phone, authenticate the mobile phone, and store the authentication result of the mobile phone and the IMSI of the mobile phone in correspondence.