WO2005069533A1

WO2005069533A1 - A method of acquiring permanent user identification by the packet data gateway (pdg) in the wlan

Info

Publication number: WO2005069533A1
Application number: PCT/CN2005/000061
Authority: WO
Inventors: Yingxin Huang; Wenlin Zhang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2004-01-14
Filing date: 2005-01-14
Publication date: 2005-07-28
Also published as: CN1642076A; CN100411335C

Abstract

The present invention provides a method of acquiring permanent user identification by the packet data gateway (PDG) in the WLAN, and it is characterized in that: AAA server acquires permanent user identification information according to the request authentication message comprising temporary user identification information sent by PDG, so that PDG acquires the permanent user identification information of WLAN user. Further, PDG relates the permanent user identification information acquired and the tunnel identification information of the user terminal, and stores them, so that PDG manages the user terminal of WLAN, for example, accounting to user and/or accessing control, and so on. The present invention is easy to implement, and it has better compatibility with current associated process.

Description

Method for obtaining permanent identity of user in packet data gateway in wireless local area network

The present invention relates to the field of wireless access technology, and particularly to a method for obtaining a permanent user identity in a packet data gateway (PDG, Packet Data Gateway) in a wireless local area network. Background of the invention

With the development of society, users have higher and higher requirements for wireless access rates. Since wireless local area networks (WLAN, Wireless Local Area Network) can provide high-speed wireless data access in a small range, it is widely used. Wireless local area network includes a variety of different technologies. One of the more widely used technical standards is IEEE 802.11b, which uses the 2.4GHz frequency band and has a maximum data transmission rate of 11Mbps. IEEE 802.11g and Bluetooth technologies are also used in this frequency band. Among them, the highest data transmission rate of 802.11g can reach 54Mbps. Other wireless LAN technologies, such as IEEE 802.11a and ETSI BRAN Hiperlan2, use the 5GHz band, and the highest transmission rate can reach 54Mbps.

Although there are many different WLAN wireless access technologies, most WLANs use Internet Protocol (IP) packet data packets for data transmission. For a wireless IP network, the specific WLAN access technology it uses is generally transparent to the upper-layer IP. Its basic structure uses an access point (AP) to complete the wireless access of user terminals, and is controlled and connected through the network. The IP transmission network composed of equipment is used for data transmission.

With the rise and development of WLAN technology, WLA and various wireless mobile communication networks, such as: Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, Time Division Duplex -Interworking of synchronous code division multiple access (TD-SCDMA) system and CDMA2000 system is becoming the focus of current research. In the 3rd Generation Partnership Project (3GPP) standardization organization, user terminals can both access the network through WLAN It is connected to the Internet (Internet) and the corporate intranet (Intranet), and can also be connected to the home network of the 3GPP system or the access network of the 3GPP system via a WLAN access network.

Figure 1 shows the schematic diagram of the networking structure between the WLAN system and the 3GPP system in the case of roaming. When a WLAN user terminal roams and connects, it is connected to the 3GPP access network via the WLAN access network. As some entities in the 3GPP access network are interconnected with corresponding entities in the 3GPP home network, such as: 3GPP authentication authorization in the 3GPP access network Accounting (AAA) proxy and 3GPP Authentication, Authorization and Accounting (AAA) server in 3GPP home network; Wireless Local Area Network Access Gateway (WAG) in 3GPP access network and Packet Data Gateway (PDG) in 3GPP home network, etc. Therefore, it is achieved that the WLAN user terminal accesses the 3GPP home network. The shaded part in the figure is the 3GPP packet switching (PS) domain service, that is, the Scenario3 service in the 3GPP network.

Figure 2 shows a schematic diagram of the networking structure of the WLAN system and the 3GPP system in the non-roaming situation. When a WLAN user terminal accesses locally, it is directly connected to the 3GPP home network via the WLAN access network. The shaded part in the figure is the 3GPP packet switching (PS) domain service, that is, the Scenario3 service in the 3GPP home network.

Referring to FIG. 1 and FIG. 2, in the 3GPP system, it mainly includes a Home Subscriber Subscriber Server (HSS) / Home Location Register (HLR), a 3GPPAAA server, a 3GPPAAA proxy, a WAG, a packet data gateway, and a charging gateway (CGw) / Charging Information Collection System (CCF) and Online Charging System (OCS). The user terminal, the WLAN access network, and all entities of the 3GPP system together constitute a 3GPP-WLAN interactive network, and the 3GPP-WLAN interactive network can serve as a wireless local area network service system. Among them, the 3GPP AAA server is responsible for user authentication, authorization, and charging, and collects and transmits the charging information sent by the WLAN access network to the charging system; the packet data gateway (PDG) is responsible for accessing user data from the WLAN The network is transmitted to the 3GPP network or other packet networks. The charging system mainly receives and records user charging information from the network. OCS indicates the network cycle according to the online charging user's fee situation. Send online cost information, and perform statistics and control.

If the WLAN user terminal wants to access the Internet / Intranet, it must send an access request message containing its permanent user identity information, such as the International Mobile Subscriber Identity (IMSI), to the AAA server (AS) through the WLAN access network. Basic access authentication and authorization. After passing the access authentication and authorization of the AS, the "WLAN user terminal can access the Internet / Intmnet through the WLAN access network. The permanent user identity is unique to each user.

In the basic access authentication and authorization process, the AS assigns a temporary user identity to the WLAN user terminal to be applied for access, and the WLAN user authenticated and authorized uses the temporary user identity instead of the permanent user identity for communication. Alternatively, the AS may assign a temporary user identity to the user in a subsequent re-authentication process or service authentication process, or update the temporary user identity in a subsequent re-authentication process or service authentication process.

If the WLAN user terminal authorized by the basic access authentication wants to access the PS domain services of 3GPP, it may further apply to the 3GPP home network for an interworking scenario 3 (Scenario3) service, that is:

The WLAN user terminal obtains a PDG address in the 3GPP packet network that can provide user-requested services from a domain name resolution server (DNS), and sends a tunnel establishment request message containing temporary user identification information to the PDG, and the PDG forwards the received request message Authenticate the AS. After the AS completes the final authentication process for the WLAN user, it authorizes the user to access the 3GPP PS domain services through the PDG. At this time, the PDG receiving the request is responsible for allocating a tunnel identifier, establishing a tunnel connection, and providing the required service to the WLAN user terminal that initiated the application.

The shortcomings of the existing solutions are: The PDG does not have a process of obtaining the permanent user identity of the WLAN user. Therefore, PDG does not know the true identity of the user when communicating with the WLAN terminal, so it cannot implement the control industry related to the user's permanent identity. Services, such as charging users or controlling access to users. Summary of the invention

In view of this, an object of the present invention is to provide a method for a PDG to obtain a permanent identity of a user in a wireless local area network, so that the PDG can obtain a permanent user identity of a WLAN user.

To achieve the above object, the technical solution of the present invention is implemented as follows:

A method for obtaining a permanent user identity through a packet data gateway (PDG) in a wireless local area network. The wireless local area network includes an AAA server, and there is information exchange between the AAA server and the PDG. The method includes the following steps:

a. The AAA server assigns a temporary user identity to a user terminal that has passed basic access authentication, and stores the correspondence between the permanent user identity and the temporary user identity of the user terminal;

b. The PDG sends a message requesting identity authentication to the user terminal to the AAA server, and the message includes the temporary user identity of the user terminal applying for the service;

After receiving the request message from the PDG, the AAA server performs authentication processing on the user terminal. If the authentication is successful, the AAA server obtains the request according to the temporary user identity and the corresponding relationship between the permanent user identity and the temporary user identity in the request message. The permanent user identity of the user terminal sends a successful authorization message containing the permanent user identity to the PDG, and performs step c. If the authentication is unsuccessful, the AAA server directly sends a failed authorization message to the PDG, and the process ends;

c. After receiving the successful authorization message from the AAA server, the PDG obtains and saves the permanent user identity of the user terminal.

Preferably, the method further includes: assigning, by the PDG, a tunnel identifier to the authenticated user terminal, storing association information of a permanent user identity of the user terminal and the tunnel identifier, and establishing A tunnel for communication with user terminals.

Preferably, the tunnel identifier allocated by the PDG to the authenticated user terminal is one or more, and the method by which the PDG saves the association information of the permanent user identity of the user terminal and the tunnel identifier is: Association information of the permanent user identity of the user terminal and one or one of the identity of the tunnel.

Preferably, the method further includes: dismantling the communication tunnel, and the PDG deletes the associated information of the permanent user identity information and the tunnel identity of the removed tunnel.

Preferably, the method further includes: the PDG determines whether there is association information between the permanent user identity and one or more tunnel identities; if so, no processing is performed; otherwise, the permanent user identity is deleted.

Preferably, the method further includes: obtaining, by the PDG ^ tunnel identification information, the user's permanent user identification information to implement charging or access control for the user terminal.

Preferably, the permanent user identity information is an international mobile subscriber identity IMSI. In the present invention, the AAA server obtains the permanent user identity information of the user according to the request authentication message containing the temporary user identity information sent by the PDG, and sends an authorization message containing the permanent user identity information to the PDG, thereby Enable PDG to obtain permanent user identity information of WLAN users. Further, the PDG associates and saves the obtained permanent user identification information with the tunnel identification information of the user terminal, so that the PDG implements management of the WLAN user terminal, such as charging and / or access control for the user. The present invention realizes a simple order, and has good compatibility with existing related processes. Brief description of the drawings

Figure 1 shows the schematic diagram of the networking structure of interworking between the WLAN system and the 3GPP system in the case of roaming;

'Figure 2 shows the networking structure of the WLAN system and the 3GPP system in a non-roaming situation. Schematic

FIG. 3 is a flowchart of obtaining permanent user identity information by using the PDG of the present invention;

Figure 4 shows the association between permanent user identification information and more than one tunnel identification information. Mode of Carrying Out the Invention

To make the technical solution of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings.

The idea of the present invention is: the AAA server allocates temporary user identity information to a user who has passed basic access authentication, and at the same time saves the correspondence between the permanent user identity of the user and the temporary user identity; when the AAA server receives the After applying for the message of requesting the identity information of the temporary user of the business user to authenticate the user, the user terminal is authenticated. If the authentication is successful, the permanent user identity information of the user is obtained according to the saved correspondence, and After sending a successful authorization message containing the permanent user identity information to the PDG, the PDG saves the user's permanent user identity information. If the authentication is unsuccessful, the AAA server directly sends a failure message to the PDG; the PDG receives the above successful authorization message After that, the permanent user identification letter of the user is obtained and saved. FIG. 3 is a flowchart of obtaining the permanent user identification information by the PDG applying the present invention.

Step 301: The WLAN user sends an access request message including the permanent user identity information such as IMSI to the AAA server through the WLAN access network to perform basic access authentication, and the AS assigns a temporary user to the user terminal that passed the basic access authentication. Identity information, and at the same time, the correspondence between the permanent user identity and the temporary user identity of the user is saved; Or, the AS assigns a temporary user identity to the user in a subsequent re-authentication process or service authentication process, or updates the temporary user identity in a subsequent re-authentication process or service authentication process.

Step 302: After the WLAN user authorized by the basic access authentication obtains an address for providing the requested service PDG from the DNS, the WLAN user sends a tunnel establishment request message including the temporary user identity information to the PDG.

Step 303: The PDG sends to the AAA server an authentication message containing a request for the identity information of the user's temporary user to request authentication of the user to request the AAA server to authenticate and authorize the identity of the user terminal.

Step 304: The AAA server performs authentication processing on the user terminal designated by the PDG. 'If the authentication is successful, step 305 is performed. If the authentication is unsuccessful, the AAA server directly sends a failure response message to the PDG and ends the process.

Step 305: The AAA server obtains the permanent user identity information of the user according to the corresponding relationship saved in step 301, and sends a successful authorization message containing the permanent user identity information to the PDG, allowing the applicant user terminal to access services through the PDG;

Step 306: After receiving the authorization message from the AAA server, the PDG allocates tunnel identification information, such as a tunnel identifier, to the user terminal, and determines whether the user ’s permanent user identity information is stored locally. If so, the PDG directly saves the information. After the user's permanent user identity information is associated with the tunnel identity information, step 307 is performed, otherwise, the user's permanent user identity information is saved first, and then the user's permanent user identity information and the user's permanent user identity information are stored. After the associated information of the tunnel identification information, step 307 is performed; since a PDG may support multiple services, a WLAN user terminal may have multiple tunnel connections with a PDG, that is, a permanent user identity of a WLAN user may be simultaneously associated with Multiple tunnel identities are associated; as shown in FIG. 4, a user's permanent user identity 1 is associated with a PDG tunnel ID of 1, 2, 3 tunnels at the same time, and A user's permanent user identity 2 is associated with a tunnel with the PDG tunnel identifiers 4 and 5 at the same time;

Step 307: The PDG establishes a tunnel for communication with the user terminal.

Step 308: During the service communication process, the PDG obtains the permanent user identity information of the user according to the tunnel identity information in the service information of the user terminal, and implements services related to the permanent user identity, such as charging the user terminal. , And or access control, etc.

The so-called charging means that when a user terminal uses one or more services of a PDG, that is, one or more tunnels, PDG> according to the correspondence between the tunnel identifier and the user's permanent identity, to achieve the user Billing for all application services on the terminal.

The so-called implementation of access control refers to a certain type of business, and PDG implements more detailed control. Generally, the AAA server provided by the operator is limited to checking whether the user terminal has ordered the service without performing a more detailed check. By applying the present invention, the PDG can check the user terminal for more detailed information. For example, a WLAN user terminal orders a certain game service. After checking that the user has indeed ordered the game service, the AAA server will authorize the user to access the PDG that provides game services. One PDG usually provides multiple game services, and users generally only order For one or more of them, the PDG can determine whether the WLAN user can participate in a certain game and implement control through the permanent user identity of the user.

In addition, when a user finishes using a tunnel and tears it down, PDG will delete the association information between the tunnel identity and the permanent user identity. When PDG finds that a permanent user identity has no associated tunnel identity information, PDG The permanent user identification information will be deleted.

The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall be included in the present invention. Within the scope of protection.

Claims

Claim

1. A method for obtaining a permanent user identity through a packet data gateway (PDG) in a wireless local area network. The wireless local area network includes an AAA server, and information exchange between the AAA server and the PDG is characterized in that the method includes the following steps:

2. The method according to claim 1, further comprising: PDG assigning a tunnel identifier to the authenticated user terminal, storing association information of the permanent user identity of the user terminal and the tunnel identifier, and establishing a connection with the tunnel identifier. A tunnel through which user terminals communicate.

3. The method according to claim 2, wherein the PDG assigns one or more tunnel identifiers to the authenticated user terminal, and the PDG stores the permanent user identifier of the user terminal and the user identifier. The method for associating information of the tunnel identifier is: storing the permanent user identity of the user terminal and one or one of the association information using the tunnel identifier. Interest.

4. The method according to claim 2 or 3, further comprising: dismantling a communication tunnel, and deleting, by the PDG, the associated information of the permanent user identity information and the tunnel identity of the removed tunnel.

5. The method according to claim 4, further comprising:

The PDG determines whether the permanent user identity is associated with one or more tunnel identities. If so, no processing is performed, otherwise the permanent user identity is deleted.

6. The method according to claim 2 or 3, further comprising: obtaining, by the PDG, the user's permanent user identification information according to the tunnel identification information, realizing charging for the user, and / or access control.

7. The method according to claim 1, wherein the permanent user identification information is an International Mobile Subscriber Identity (IMSI).