CN101335675A

CN101335675A - Policy control method

Info

Publication number: CN101335675A
Application number: CNA2008101108056A
Authority: CN
Inventors: 周晓云; 宗在峰; 芮通
Original assignee: ZTE Corp
Current assignee: ZTE Corp
Priority date: 2008-01-09
Filing date: 2008-06-10
Publication date: 2008-12-31
Anticipated expiration: 2028-06-10
Also published as: CN101335675B; CN101232442A

Abstract

The invention provides a policy control method. User equipment (UE) is accessed by a trusty non-3GPP (Third Generation Partnership Project) access system. When the user equipment establishes the session of a packet data network, if the data of a user plane is encrypted, the gateway of the packet data network (P-GW) sends an indication that the data of the user plane is encrypted to policy and charging rule function (PCRF); the PCRF makes and sends policy control rules to an access gateway of the trusty non-3GPP; a filter of the policy control rules only contains the data of the user plane that is visible to the access gateway of the trusty non-3GPP.

Description

A kind of policy control method

Technical field

The present invention relates to the grouping system (EPS:Evolved Packet System) of 3GPP (3rd Generation Partnership Project, third generation partner program) evolution, particularly a kind of policy control method in this system.

Background technology

The grouping system of 3GPP evolution is the UTRAN (E-UTRAN of EPS by evolution, EvolvedUniversal Terrestrial Radio Access Network, the universal terrestrial access network of evolution), MME (mobile management unit, Mobility Management Entity), S-GW (gateway, ServingGateway), PDN GW (P-GW, Packet Data Network GateWay, grouped data network gateway), HSS (home subscriber server, Home Subscriber Server), 3GPP aaa server (3GPP authentication and authorization charging server), PCRF (Policy and Charging Rules Function, "Policy and Charging Rules Function), reaching other support nodes forms.Wherein MME is responsible for the processing of mobile management, Non-Access Stratum signaling, user's chain of command related works such as the contextual management of mobile management; S-GW is the accessing gateway equipment that links to each other with E-UTRAN, transmits data between E-UTRAN and PDN GW, and is responsible for pending datas such as paging are carried out buffer memory.P-GW then is the grouping system (EPS, Evolved Packet System) of 3GPP evolution and the borde gateway of PDN (Packet Data Network, packet data network) network, is responsible for the access of PDN, transmits function such as data between EPS and PDN.PCRF is the "Policy and Charging Rules Function entity, it is by Rx interface and the IP of operator (procotol) business network interface, obtain business information, it links to each other another side with gateway device in the network by S7/S7a/S7c, be responsible for initiating the foundation of IP carrying, guarantee the QoS (service quality) of business datum, and the control of chargeing.

EPS supports the intercommunication with non-3GPP network.Realize that by the S2a/b/c interface P-GW is as 3GPP and the internetwork anchor point of non-3GPP with the intercommunication of non-3GPP network.Wherein non-3 GPP system is divided into the non-3GPP IP access of trusted and trustless non-3GPP IP access.The non-3GPP IP of trusted inserts can be directly by S2a and P-GW interface; Trustless non-3GPP IP inserts to be needed to link to each other with P-GW through ePDG (Evolved Packet Data Gateway, the packet data gateway of evolution), and the interface between ePDG and P-GW is S2b.Simultaneously, S2c is the interface between UE (subscriber equipment) and the P-GW, adopts DSMIPv6 (Dual Stack MIPv6, two stack mobile internet protocol edition 6s) agreement to provide user's face relevant control and mobile management.The EPS system supports many PDN to insert simultaneously, and promptly UE can be linked into a plurality of PDN simultaneously by a plurality of P-GW or a P-GW.

MIPv6 (Moblie IPv6, mobile IP v 6) is by to mobile node (Mobile Node, the binding of IPv6 Care-of Address CoA MN) and IPv6 home address HoA support the MN accessibility and the continuity of session when mobile in network.But because IPv6 is not also disposed widely, in very long from now on a period of time, the network of IPv4 also will exist in a large number.The MN of IPv6 tends to move on the network of not supporting IPv6, therefore must expand MIPv6.DSMIPv6 is a kind of effective solution, and it is a kind of MIP based on client (Client-based) (mobile IP) agreement, requires mobile node MN and home agent Home Agent all to need to support DSMIPv6.The binding of the MN that supports DSMIPv6 by its IPv4/IPv6 Care-of Address and IPv4/IPv6 home address is supported in the mobility on IPv4 or the IPv6 network.

In traditional 3GPP network, strategy and charge execution function (PCEF, Policy and chargingenforcement function) exists only among the P-GW, PCRF needs only the control that can finish all functions with the P-GW interface, passes through S7 interface (see figure 1) exchange message between PCRF and P-GW.Interface when between P-GW and S-GW is based on PMIPv6 (Proxy Mobile IPv6, proxy mobile IPv 6) time, policy enforcement function part in the PCEF function also is present among the S-GW, be called gateway control function (GWCF, Gateway Control Function), such as, the binding functions of carrying etc. pass through S7c interface (see figure 1) exchange message between S-GW and the PCRF.When inserting by the non-3GPP connecting system of trusted, the also resident GWCF in the trusted non-3 GPP access network Central Shanxi Plain.Pass through S7a interface (see figure 1) exchange message between trusted non-3 GPP access network pass and the PCRF.When UE roamed, the S9 interface was as the interface of ownership place PCRF and visit ground PCRF.For providing professional AF (Application Function, application function), UE passes through Rx simultaneously ⁺Interface sends the business information that is used to generate PCC (Policy and ChargingControl, policy and charging control) strategy to PCRF.

We consider to pass through the non-3GPP IP of trusted Access Network as UE, adopt DSMIPv6 (being the S2c interface) to insert the scene of EPS.Fig. 2 is under the above-mentioned scene, and UE inserts the initial attachment flow of EPS.By this flow process, UE has set up an IP to PDN and has connected.Simultaneously set up a DSMIPv6 tunnel between UE and P-GW, the trusted non-3 GPP access network closes on this tunnel.DSMIPv6 can set up the Security Association that is used for chain of command and user's face respectively according to security strategy.In the EPS system; adopt IKEv2/IPSec (Internet Key Exchange version 2/Internet ProtocolSecurity, the Internet Key Exchange version 2/internet protocol secure) agreement that chain of command and the user's face of DSMIPv6 carried out safeguard protection.Wherein the encrypting and authenticating agreement of IKEv2/IPSec employing is ESP (Encapsulating Security Payload, an ESP), and cipher mode is a tunnel mode.And in the EPS system, IKEv2/IPSec is necessary to the protection of DSMIPv6 chain of command, and is optional to the protection of its user's face.If user face data is not carried out encrypting and authenticating, then the Care-of Address CoA of UE, the address of Correspondent Node in the packet, professional source and destination port numbers and upper-layer protocol type (IP five-tuple), it all is visible that the trusted non-3 GPP access network is closed.The trusted non-3 GPP access network closes can carry out policy control to user face data according to the business datum flow filter based on the IP five-tuple.

If adopted the tunnel mode of ESP agreement to carry out encrypting and authenticating to the user side data bag, having only the Care-of Address CoA of UE and the address of Correspondent Node so in the packet is visible for trusted non-3 GPP access network pass, and promptly the GWCF that shuts at the trusted non-3 GPP access network can only filter and policy control the IP bag according to the address of CoA and Correspondent Node.If PCRF must cause can't matching correct policy control rule through the enciphered data message that the trusted non-3 GPP access network closes according to IP five-tuple distributing policy control law.

In addition, in the time of the business that please look for novelty as UE, PCRF is according to the policy control rule that issues based on the IP five-tuple, the trusted non-3 GPP access network close can according to this policy control rule will be in the non-3GPP connecting system of trusted newly-built radio bearer.But again can only be when Packet Filtering detects according to the address of CoA and Correspondent Node, therefore newly-built carrying will be used never, and this can cause waste of radio resources.

Summary of the invention

The technical problem to be solved in the present invention provides a kind of policy control method, when the user face data bag carried out encrypting and authenticating, the enciphered data message that the trusted non-3 GPP access network closes can't match the problem that correct policy control rule reaches the waste of radio resources that causes thus in the solution prior art.

In order to solve the problems of the technologies described above, the invention provides a kind of policy control method, user equipment (UE) inserts by the non-third generation affiliate of trusted 3GPP connecting system, it is characterized in that, when described subscriber equipment is established to the session of packet data network, if user face data is encrypted, grouped data network gateway P-GW sends the indication that user face data is encrypted to "Policy and Charging Rules Function PCRF, and described PCRF issues according to this indication decision-making control law.

Further, said method also can have following characteristics, the issuing of described PCRF decision-making control law comprises not the distributing policy control law or formulate special policy control rule and be sent to the trusted non-3 GPP access network closes, and the filter of described special policy control rule only comprises the trusted non-3 GPP access network is closed visible user face data.

Further, said method also can have following characteristics, described the trusted non-3 GPP access network is closed the Care-of Address CoA that visible user face data is described subscriber equipment and the address of Correspondent Node, described filter only comprises the Care-of Address CoA of described subscriber equipment and the address of Correspondent Node.

Further, said method also can have following characteristics, if PCRF not distributing policy control law to trusted non-3 GPP access network close, so PCRF also not the distributing policy control law to P-GW.If PCRF issues special policy control rule and closes to the trusted non-3 GPP access network, PCRF also issues special policy control rule to P-GW so.

Further, said method also can have following characteristics, and the policy control rule that is handed down to trusted non-3 GPP access network pass is rules for quality of service, and the policy control rule that is handed down to P-GW is control rule of policy billing.

Further, said method also can have following characteristics, if the distributing policy control law is not to trusted non-3 GPP access network pass and P-GW for PCRF, PCRF can further not start dynamic PCC indication to trusted non-3 GPP access network pass and P-GW transmission.

Further, said method also can have following characteristics, if the trusted non-3 GPP access network closes and P-GW does not have the acquisition strategy control law or receive that not starting dynamic PCC indicates, and uses local pre-configured policy charging rule.

Further, said method also can have following characteristics, when user face data was not encrypted, described P-GW sent the indication that user face data do not encrypt or does not send the customer side encryption indication to PCRF, and the filter of the policy control rule that described PCRF formulates is the IP five-tuple.

Further, said method also can have following characteristics, and described IP five-tuple comprises the Care-of Address CoA of subscriber equipment and the address of Correspondent Node, professional source port number, the type of destination port numbers and upper-layer protocol.

Further, said method also can have following characteristics, and described P-GW sets up in indication request message or the IP-CAN session modification request message in the PCRF Internet Protocol connection Access Network IP-CAN session that sends to and carries the indication whether user's face is encrypted.

Further, said method also can have following characteristics, and the encrypting and authenticating agreement that the user face data encrypting and authenticating is adopted is an ESP, and cipher mode is a tunnel style.

Adopt method of the present invention, by sending the indication whether user face data is encrypted to PCRF, PCRF carries out issuing of policing rule according to this indication, solved in the prior art when the user face data bag carries out encrypting and authenticating, the enciphered data message that the trusted non-3 GPP access network closes can't match the correct policy control rule and the problem of waste of radio resources.

Description of drawings

Fig. 1 is the non-roaming Organization Chart of existing EPS system;

Fig. 2 is existing by the non-3GPP IP of trusted connecting system, the attachment flow figure that adopts the DSMIPv6 agreement to insert;

Fig. 3 is that the embodiment of the invention 1 is passed through the non-3GPP IP of trusted connecting system, the attachment flow figure that adopts the DSMIPv6 agreement to insert;

Fig. 4 is under the embodiment of the invention 2 non-roaming situations, and UE inserts from 3GPP and switches to the flow chart that the non-3GPP IP of trusted inserts.

Embodiment

Main thought of the present invention is whether PCRF advances encrypting and authenticating according to the user face data bag in the DSMIPv6 tunnel, carry out issuing of policing rule, when UE is established to the IP-CAN session of PDN, P-GW is sending IP-CAN (IP-Connectivity Access Network to PCRF, IP connects Access Network) whether notice PCRF carries out encrypting and authenticating to the user face data bag in the DSMIPv6 tunnel between UE and the P-GW when request is set up in session or during the IP-CAN session modification request, and whether PCRF determines the distributing policy control law or issues different policy control rules according to this notice.

Further describe in detail below in conjunction with the method for accompanying drawing invention.

Embodiment one

What present embodiment was described is to work as UE under non-roaming situation, and non-3GPP IP inserts by trusted, the attachment flow when adopting the DSMIPv6 agreement to insert.Wherein the DSMIPv6 user face data carries out encrypting and authenticating.Sending the IP-CAN session at P-GW to PCRF sets up and carries customer side encryption authentication indication in the indication request message, PCRF formulates the QoS rule according to this indication, filter attributes in the rule is the Care-of Address CoA of UE and the address of Correspondent Node, does not consider source, destination port numbers and upper-layer protocol type.The flow chart of present embodiment as shown in Figure 3, each step is described below:

302, the initial specific layer 2 of UE inserts and carries out verification process;

304, the layer of setting up UE and the non-3GPP connecting system of trusted behind the authentication success 3 is connected, and Access Network is the Care-of Address CoA of UE distribution local ip address as DSMIPv6;

306, the trusted non-3 GPP access network closes to PCRF and sends " gateway control session foundation " request, carries network access Identifier NAI and Care-of Address CoA in the message;

308, PCRF returns gateway control session and sets up acknowledge message;

310, UE obtains the IP address of the P-GW that will insert according to APN, and sets up the Security Association of UE and P-GW, and UE obtains home address HoA;

312, UE sends " Binding Update " request to P-GW, carries HoA and CoA in the message;

314, P-GW sends " indication is set up in the IP-CAN session " message to PCRF, carries the customer side encryption indication in the message, and the user face data bag in the notice PCRF DSMIPv6 tunnel is with encrypted.Carry HoA simultaneously, CoA, APN are used for closing registration with the trusted non-3 GPP access network with NAI and carry out related.PCRF indicates according to customer side encryption, only considers the address of CoA and Correspondent Node in the business datum flow filter of the PCC rule of formulation, and source, destination port numbers and upper-layer protocol type are not considered;

316, PCRF returns the IP-CAN session and sets up affirmation, carries the PCC rule in the message;

318, P-GW returns binding acknowledgement;

320, PCRF gives information to trusted non-3 GPP access network pass transmission gateway control and QoS rule; Only consider the address of CoA and Correspondent Node in the business datum flow filter of the QoS rule of carrying in the message, source, destination port numbers and upper-layer protocol type are not considered;

322, the trusted non-3 GPP access network close to upgrade the QoS rule and returns gateway control and the QoS rule provides acknowledge message.

If the user face data of DSMIPv6 does not carry out encrypting and authenticating, then P-GW does not carry customer side encryption authentication indication or carries the not encrypting and authenticating indication of user's face in " indication is set up in the IP-CAN session " message that sends to PCRF, and PCRF closes to P-GW and trusted non-3 GPP access network respectively according to network strategy etc. and issues PCC rule and QoS rule.Comprise CoA in the filter in the above-mentioned rule, the address of Correspondent Node, source, destination port and upper-layer protocol type.

Embodiment two

What present embodiment was described is to work as UE under non-roaming situation, inserts from 3GPP and switches to the flow process that the non-3GPP IP of trusted inserts.Wherein insert, adopt the DSMIPv6 agreement, and user face data is carried out encrypting and authenticating by the non-3GPP IP of trusted.In PCRF transmission IP-CAN session modification request message, carry customer side encryption authentication indication at P-GW, PCRF formulates the QoS rule according to this indication, filter attributes in the rule is the Care-of Address CoA of UE and the address of Correspondent Node, does not consider source, destination port numbers and upper-layer protocol type.The flow chart of present embodiment as shown in Figure 4, each step is described below:

402, UE uses the 3GPP system;

404, UE finds non-3GPP connecting system of trusted and decision initiation switching, promptly switches to the non-3GPP connecting system of trusted;

406, the initial specific layer 2 of UE inserts and carries out verification process;

408, the layer of setting up UE and the non-3GPP connecting system of trusted behind the authentication success 3 is connected, and Access Network is the Care-of Address CoA of UE distribution local ip address as DSMIPv6;

410, the trusted non-3 GPP access network closes to PCRF and sends " gateway control session foundation " request, carries network access Identifier NAI and Care-of Address CoA in the message and is used for registering at PCRF;

412, PCRF returns gateway control session and sets up acknowledge message;

414, UE finds the IP address of the P-GW that will insert by the automatic layoutprocedure of MIPv6;

416, set up Security Association between UE and the P-GW, UE obtains home address HoA;

418, UE sends " Binding Update " request to P-GW, carries HoA and CoA in the message, is used for binding at P-GW;

420, P-GW sends " IP-CAN session modification " request message to PCRF, carries the customer side encryption indication in the message, and the user face data bag in the notice PCRF DSMIPv6 tunnel is with encrypted.Carry HoA simultaneously, CoA, APN are used for closing registration with the trusted non-3 GPP access network with NAI and carry out related.PCRF indicates according to customer side encryption, only considers the address of CoA and Correspondent Node in the business datum flow filter of the PCC rule of formulation, and source, destination port numbers and upper-layer protocol type are not considered;

422, PCRF returns the IP-CAN session and sets up affirmation;

424, P-GW returns binding acknowledgement;

426, PCRF gives information to trusted non-3 GPP access network pass transmission gateway control and QoS rule, only consider the address of Care-of Address CoA and Correspondent Node in the business datum flow filter of the QoS rule of carrying in the message, source, destination port numbers and upper-layer protocol type are not considered;

428, the trusted non-3 GPP access network close to upgrade the QoS rule, and returns gateway control and the QoS rule provides acknowledge message.

If the user face data of DSMIPv6 does not carry out encrypting and authenticating, then P-GW does not carry customer side encryption authentication indication in " IP-CAN session modification " message that sends to PCRF, perhaps carry the not encrypting and authenticating indication of user's face, PCRF closes to P-GW and trusted non-3 GPP access network respectively according to network strategy etc. and issues PCC rule and QoS rule.Comprise CoA in the filter in the above-mentioned rule, the address of Correspondent Node, source, destination port numbers and upper-layer protocol type.

According to basic principle of the present invention, the foregoing description can also carry out multiple conversion, for example:

(1) after PCRF receives the customer side encryption indication, can not issue above-mentioned special PCC rule yet, do not close simultaneously and issue above-mentioned special QoS rule to the trusted non-3 GPP access network to P-GW.Further, PCRF can also not start dynamic PCC indication to P-GW and the transmission of trusted non-3 GPP access network pass respectively.P-GW and trusted non-3 GPP access network close do not receive PCC rule and QoS rule or receive do not start dynamic PCC indication after, use the pre-configured policy charging rule in this locality.

(2) after P-GW has cancelled customer side encryption between UE and the P-GW, P-GW can send to PCRF and carry not " IP-CAN session modification " message of encrypting and authenticating indication of user's face, PCRF indicates according to this, issues PCC rule and QoS rule to P-GW and trusted non-3 GPP access network pass respectively.Comprise CoA in the filter in the above-mentioned rule, the address of Correspondent Node, source, destination port numbers and upper-layer protocol type restart dynamic PCC.

Certainly; the present invention also can have other various embodiments; under the situation that does not deviate from spirit of the present invention and essence thereof; those of ordinary skill in the art work as can make various corresponding changes and distortion according to the present invention, but these corresponding changes and distortion all should belong to the protection range of the appended claim of the present invention.

Claims

1, a kind of policy control method, user equipment (UE) inserts by the non-third generation affiliate of trusted 3GPP connecting system, it is characterized in that, when described subscriber equipment is established to the session of packet data network, if user face data is encrypted, grouped data network gateway P-GW sends the indication that user face data is encrypted to "Policy and Charging Rules Function PCRF, and described PCRF issues according to this indication decision-making control law.

2, the method for claim 1, it is characterized in that, the issuing of PCRF decision-making control law comprises that distributing policy control law to trusted non-3 GPP access network closes or formulates special policy control rule and is sent to the trusted non-3 GPP access network closes, and the filter of described special policy control rule only comprises the trusted non-3 GPP access network is closed visible user face data.

3, method as claimed in claim 2, it is characterized in that, described the trusted non-3 GPP access network is closed the Care-of Address CoA that visible user face data is described subscriber equipment and the address of Correspondent Node, described filter only comprises the Care-of Address CoA of described subscriber equipment and the address of Correspondent Node.

4, method as claimed in claim 2 is characterized in that, if PCRF not distributing policy control law to trusted non-3 GPP access network close, PCRF not the distributing policy control law to P-GW; If PCRF issues special policy control rule and closes to the trusted non-3 GPP access network, PCRF issues special policy control rule to P-GW.

As claim 2 or 4 described methods, it is characterized in that 5, the policy control rule that is handed down to trusted non-3 GPP access network pass is rules for quality of service, the policy control rule that is handed down to P-GW is control rule of policy billing.

6, method as claimed in claim 4 is characterized in that, if the distributing policy control law is not to trusted non-3 GPP access network pass and P-GW for PCRF, PCRF does not start the indication of dynamic strategy charging control PCC to trusted non-3 GPP access network pass and P-GW transmission.

7, method as claimed in claim 6 is characterized in that, if the trusted non-3 GPP access network closes and P-GW does not have the acquisition strategy control law or receive that not starting dynamic PCC indicates, and uses local pre-configured policy charging rule.

8, the method for claim 1, it is characterized in that, when user face data was not encrypted, described P-GW sent the indication that user face data do not encrypt or does not send the customer side encryption indication to PCRF, and the filter of the policy control rule that described PCRF formulates is the IP five-tuple.

9, method as claimed in claim 8 is characterized in that, described IP five-tuple comprises the Care-of Address CoA of subscriber equipment and the address of Correspondent Node, professional source port number, the type of destination port numbers and upper-layer protocol.

10, as claim 1 or 2 or 9 described methods, it is characterized in that described P-GW sets up in indication request message or the IP-CAN session modification request message in the PCRF Internet Protocol connection Access Network IP-CAN session that sends to and carries the indication whether user's face is encrypted.

11, as the arbitrary described method of claim 10, it is characterized in that the encrypting and authenticating agreement that the user face data encrypting and authenticating is adopted is an ESP, cipher mode is a tunnel style.