WO2008134985A1 - Procédé, système et dispositif permettant d'effectuer un contrôle de sécurité - Google Patents

Procédé, système et dispositif permettant d'effectuer un contrôle de sécurité Download PDF

Info

Publication number
WO2008134985A1
WO2008134985A1 PCT/CN2008/070866 CN2008070866W WO2008134985A1 WO 2008134985 A1 WO2008134985 A1 WO 2008134985A1 CN 2008070866 W CN2008070866 W CN 2008070866W WO 2008134985 A1 WO2008134985 A1 WO 2008134985A1
Authority
WO
WIPO (PCT)
Prior art keywords
policy
information
user
control
firewall
Prior art date
Application number
PCT/CN2008/070866
Other languages
English (en)
French (fr)
Inventor
Jinwen Di
Feng Chen
Zhipeng Hou
Shibi Huang
Shiyong Tan
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to EP08734222A priority Critical patent/EP2106070A4/en
Publication of WO2008134985A1 publication Critical patent/WO2008134985A1/zh
Priority to US12/543,971 priority patent/US20090307746A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/088—Access security using filters or firewalls

Definitions

  • the present invention relates to the field of communications, and in particular, to a method, system and policy control and charging rule function entity, policy and charging execution entity for performing security control. Background technique
  • PCC Policy Charging Control
  • the function is as follows:
  • the Policy Control and Charging Rules Function (PCRF) obtains the user according to the restriction of the user access network and the operator policy, and the ⁇ SPR (Subscription Profile Repository) functional entity.
  • the policy of the subscription, and the policy of determining the current service information of the user from the application function (the application layer), and the policy is provided to the PCEF (Policy and Charging Enforcement Function).
  • PCEF Policy and Charging Enforcement Function
  • the policy includes the detection rule of the service data flow (the completion of a certain service, such as a voice IP flow set), whether the gate is controlled, the QoS (Quality of Service) corresponding to the service data flow, and the flow-based charging rule.
  • PCEF The entity performs the policy that is sent or specified by the PCRF. Specifically, it performs the detection and measurement of the service data flow, ensures the QoS of the service data flow, handles the user plane traffic, and triggers the session management of the control plane.
  • SPR The functional entity provides user subscription data to the PCRF
  • the function entity dynamically provides session information of the application layer to the PCRF, and the PCRF dynamically generates or modifies the corresponding rule according to the information.
  • IP-CAN When the user roams within the access network (when the location changes), the IP service continuity can still be saved (ie, the service is not interrupted).
  • the access network with such a nature is called IP-CAN, such as GPRS (General Packet Radio). Service, general packet radio service) network, I-WLAN (wireless local area network and 3GPP network interworking system) network, etc.;
  • IP-CAN bearer IP-CAN bearer, IP transmission path with clear rate, delay and error bit rate (this path refers to the access network to PCEF).
  • IP-CAN bearer corresponds to PDP (Packet) Data Protocol, packet data protocol) context;
  • IP-CAN session IP-CAN session, which refers to the connection relationship between the UE (User Equipment) and the PDN (Packet Data Network), such as the IP address of the UE. And the identity of the UE to identify.
  • the IP-CAN exists as long as the UE is assigned an IP address and can be identified by the IP network.
  • An IP-CAN session can contain one or more IP-CAN payloads.
  • IP-CAN sessions and IP-CAN bearer establishment can be implemented.
  • the UE allocates an addressable IP address to the PDN
  • the UE establishes an IP-CAN session.
  • IP-CAN bearers with different QoS requirements can be established in the same IP-CAN session.
  • There may be multiple IP flows in the IP-CAN bearer for example, users can download files on different servers at the same time
  • PCEF is based on PCC rules (PCC rules include IP quintuple, ie IP source, destination address, source port number, purpose) Port number, protocol to identify IP flows.
  • PCC rules include IP quintuple, ie IP source, destination address, source port number, purpose
  • Port number protocol to identify IP flows.
  • Each PCC rule can contain one or more IP flows, which are called Service Data Flows.
  • the gate In the PCC rules passed to the PCEF by the PCRF through the Gx interface, the gate is included. Control information, QoS control parameters, and charging parameters of the service data flow, the PCEF can perform traffic flow admission control, traffic policing, and accounting operations according to the control parameters in the PCC rules.
  • the current PCC architecture is limited to application scenarios in which service data flows are determined, such as application scenarios such as IMS. Applicable to data service access control application scenarios.
  • the network cannot implement different security policy control functions according to different policy conditions, thereby improving network security and promoting the extensive development and application of data services. Summary of the invention
  • Embodiments of the present invention provide a method, system, and policy control and charging rule function entity, policy, and charging execution entity for performing security control, which are used to solve the problem of providing security control for a user session in a PCC architecture.
  • An embodiment of the present invention provides a method for performing security control, including the following steps:
  • the policy and charging execution entity receives security control policy information from a policy control and charging rule function entity;
  • the policy and charging enforcement entity performs security control of the user based on the security control policy information.
  • the embodiment of the present invention further provides a system for performing security control, including a policy and charging execution entity, a policy control and charging rule function entity, a receiving module, and an executing module, where: a receiving module, and a policy and charging execution entity Connected, configured to receive security control policy information from a policy control and charging rule function entity;
  • the execution module is connected to the policy and charging execution entity, and is configured to perform security control of the user according to the security control policy information.
  • the embodiment of the present invention further provides a policy control and charging rule function entity, including a sending module, configured to: after determining according to the policy condition information of the user, and generating security control policy information, sending the security control policy information to Policy and billing execution entity;
  • a sending module configured to: after determining according to the policy condition information of the user, and generating security control policy information, sending the security control policy information to Policy and billing execution entity;
  • the policy and charging enforcement entity performs security control of the user based on the security control policy information.
  • the embodiment of the invention further provides a policy and charging execution entity, including:
  • a receiving module configured to receive a security control policy letter from a policy control and charging rule function entity Interest rate
  • the policy and charging execution entity After the policy and charging enforcement entity receives the security control policy information from the policy control and charging rule function entity, the policy and charging execution entity performs the user security control according to the security control policy information, thereby performing the user access session. The ability to control. DRAWINGS
  • FIG. 1 is a schematic flowchart of an implementation process of the method for performing security control according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of an implementation process of an embodiment of the present invention
  • FIG. 3 is a schematic flow chart of an implementation of another embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of an embodiment of an execution security control system according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of still another embodiment of the execution security control system according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of still another embodiment of the execution security control system according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of an embodiment of a policy control and charging rule function entity according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of another embodiment of a policy control and charging rule function entity according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic structural diagram of an embodiment of a policy and charging execution entity according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of another embodiment of a policy and charging execution entity according to an embodiment of the present invention. detailed description
  • FIG. 1 is a schematic diagram of an implementation process of executing a security control method. As shown in FIG. 1, the following steps may be included in performing security control:
  • Step 501 The policy and charging execution entity receives security control policy information from the policy control and charging rule function entity.
  • Step 502 The policy and charging execution entity performs security control of the user according to the security control policy information.
  • the security control policy information includes access control list information and firewall mode information.
  • Executive user security controls include:
  • the performing access control may be performing access control on the user service data flow according to one of the IP addresses, ports, protocols, application types or combinations thereof allowed in the access control list specified by the access control list information;
  • the firewall function may be a firewall that selects one of the packet filtering mode, the deep detection mode, the anti-spam filtering, the anti-virus filtering, or a combination thereof according to the firewall mode specified by the firewall mode information, and performs a firewall function for the user service data flow.
  • the security control policy information may be sent by the policy control and charging rule function entity to the policy and charging enforcement entity through a credit control request message or a re-authentication request message.
  • the security control policy information may be access control list information, and/or firewall mode information sent to the policy and charging enforcement entity through the credit control request message or the re-authentication request message.
  • the access control list information may be represented by adding an access control list number ACL-Number A VP in the Diameter protocol of the Gx interface;
  • the firewall mode information can be represented by adding the firewall mode number Firewal-Mode-Number A VP to the Diameter protocol of the Gx interface.
  • the security control policy information is sent to the policy and charging execution entity;
  • the policy and charging enforcement entity then performs security control of the user based on the security control policy information.
  • the policy control and charging rule function entity determines and generates the access control list information according to the policy condition information of the user, where the policy condition information of the user may be one of the policy and charging execution entity, the network management system, the device management system, or Combining the acquired terminal software version of the user terminal, the operating system version, the operating system patch, whether the anti-virus software and the software version are installed, or a combination of the policy condition information;
  • firewall mode information that is determined and generated by the policy control and charging rule function entity according to the policy condition information of the user, where the user's policy condition information is user subscription data, the user's access network type, and the user's roaming. Information about one of the states or a combination thereof.
  • This embodiment describes the policy decision based on the terminal software version of the user terminal, the operating system version, the operating system patch, and/or whether the anti-virus software and the software version are installed, and determines and generates the security control policy information through security control.
  • policy information implements user admission control.
  • the PCRF obtains the terminal software version, operating system version, operating system patch, and/or whether antivirus software and software version of the user terminal are obtained from the device management system;
  • the information, the security control policy information is determined and generated, and the security control policy information includes an access control list applicable to the user terminal, and the information is sent to the PCEF for admission control processing.
  • FIG. 2 is a schematic diagram of an implementation process of an embodiment. As shown in FIG. 2, the method includes the following steps: Step 601: The user initiates an IP access session establishment request to the PCEF.
  • Step 602 The PCEF sends a credit control request message to the PCRF, and is used to trigger the PCRF feedback security control policy information, where the credit control request message carries the user terminal device information.
  • Step 603 The PCRF obtains information about the terminal software version, the operating system version, the operating system patch, and/or whether the antivirus software and the software version are installed by the device management system.
  • Step 604 The PCRF determines, and generates security control policy information, and determines, according to the obtained information, that the access control list 1 applied to the user terminal is determined, and the access control list 1 is included in the security control policy information.
  • Step 605 The PCRF sends a credit control response message to the PCEF, where the message has an access control list information of the user terminal.
  • Step 606 The PCEF performs admission control according to the received access control list information, and performs an admission or rejection operation on the user-related data stream that passes through the PCEF.
  • Step 607 The PCEF sends an IP access session setup response message to the user terminal.
  • Step 608 When the device management system finds that the software version of the user terminal is not the latest version expected, the device management system may prompt the user to upgrade the terminal software version in time.
  • Step 609 The user terminal performs software upgrade through the device management system.
  • Step 610 The device management system sends the upgraded terminal software information of the user terminal to the PCRF.
  • Step 611 The PCRF determines and generates the security control policy information, and determines, according to the upgraded terminal software information of the user terminal, the access control list that is applicable to the user terminal. Second, the security control policy information includes the access control list 2.
  • Step 612 The PCRF sends a re-authentication request message to the PCEF, where the message has the access control list information of the user terminal.
  • Step 613 The PCEF performs admission control according to the received access control list information, and performs an admission or rejection operation on the user-related data stream passing through the PCEF.
  • Step 614 The PCEF sends a re-authentication response message to the PCRF.
  • the embodiment can perform admission admission control on the user according to the terminal software information.
  • the software version or configuration of the user terminal does not meet the network security requirements, you can limit the network resources that the terminal can access. For example, you can only access the device management system for software upgrade. After the software version or configuration of the terminal meets the network security requirements, the terminal is allowed. Access network resources subscribed by other users. This can avoid terminals that do not meet the security requirements.
  • the operating system has security vulnerabilities and terminals that do not have anti-virus software installed on the network. This poses a potential danger to the network security threats, improves the overall security of the network, and reduces the network. Security incidents reduce network operating and maintenance costs.
  • This embodiment describes determining the firewall mode that should be provided for the user according to the user subscription data, or the type of the access network of the user, or whether the user is roaming, and sends it to the PCEF for processing.
  • FIG. 3 is a schematic flowchart of another embodiment. As shown in FIG. 3, the method includes the following steps: Step 701: A user initiates an IP access session establishment request to a PCEF.
  • Step 702 The PCEF sends a credit control request message to the PCRF, and is used to trigger the PCRF feedback security control policy information, where the credit control request message carries information such as the currently used access network type, whether roaming, or the like.
  • Step 703 The PCRF obtains the subscription information of the user by using the SPR, and includes the information about the firewall mode signed by the user.
  • Step 704 The PCRF determines and generates security control policy information according to the user subscription data, or the access network type of the user, or the roaming user, and the security control policy information includes firewall mode information that should be provided for the user. For example, according to the subscription information of the user, if the user subscribes to the firewall mode, the user subscription information is used; otherwise, the operator defines a different firewall mode for different user access network types, such as WLAN (Wireless Local Area Network).
  • the WLAN user mode provided by the user accessing the WLAN is different from the user using WCDMA (Wideband CDMA) access; or the firewall function is not provided for the roaming user.
  • Step 705 The PCRF sends a credit control response message to the PCEF, where the message carries the user's Firewall Mode Number information.
  • Step 706 The PCEF performs a firewall mode selection and starts a corresponding firewall function according to the received firewall mode information.
  • Step 707 The PCEF sends an IP access session setup response message to the user terminal.
  • the user can provide different combinations of firewall functions for the user through the user subscription information, the access network type, whether the roaming user, and other possible policy condition information, so that the user firewall function is fully applied. To provide users with security assurance.
  • the embodiment of the present invention further provides a system for performing security control, and a specific implementation manner of the system will be described below with reference to the accompanying drawings.
  • FIG. 4 is a schematic structural diagram of an embodiment of an execution security control system. As shown in FIG. 4, the system includes a policy and charging execution entity, a policy control and charging rule function entity, a receiving module, and an execution module, where:
  • the receiving module and the executing module are connected to the policy and charging execution entity;
  • the receiving module receives security control policy information from the policy control and charging rule function entity; the executing module performs security control of the user according to the security control policy information.
  • the security control policy information may include access control list information and firewall mode information.
  • FIG. 5 is a schematic structural diagram of still another embodiment of an execution security control system. As shown in FIG. 5, the execution module of this embodiment may include an access control unit, and/or a firewall unit, where:
  • An access control unit configured to perform access control on the user service data flow according to the access control list information
  • a firewall unit configured to select a corresponding mode firewall for the user service data flow according to the firewall mode information, and execute a firewall function.
  • the access control unit may be further configured to use one of an IP address, a port, a protocol, an application type, or a combination thereof that is allowed to be accessed in the access control list specified according to the access control list information.
  • User traffic data flow performs access control;
  • the firewall unit may be further configured to select a firewall of one of a packet filtering mode, a deep detection mode, an anti-spam filtering, an anti-virus filtering, or a combination thereof according to a firewall mode specified by the firewall mode information, and execute a firewall for the user service data flow.
  • the receiving module may receive the security control policy information through a credit control request message or a re-authentication request message.
  • the security control policy information may be access control list information, and/or firewall mode information.
  • the access control list information can be represented by adding an access control list number ACL-Number A VP in the Diameter protocol of the Gx interface;
  • the firewall mode information can be represented by adding the firewall mode number Firewal-Mode-Number A VP to the Diameter protocol of the Gx interface.
  • the system may further include a sending module, configured to: after the policy control and charging rule function entity determines according to the policy condition information of the user, and generates security control policy information, send the security control policy information to the policy and charging execution entity. ;
  • the policy and charging enforcement entity performs security control of the user based on the security control policy information.
  • FIG. 6 is a schematic structural diagram of still another embodiment of the execution security control system. As shown in FIG. 6, the system may further include a first acquisition module, and/or a second acquisition module, where:
  • the first obtaining module is configured to obtain, according to one of the policy and charging execution entity, the network management system, the device management system, or a combination thereof, the terminal software version, the operating system version, the operating system patch, whether the anti-virus software and the software are installed, Policy condition information for one or a combination of versions;
  • the policy control and charging rule function entity determines and generates access control list information according to the policy condition information
  • a second acquiring module configured to acquire policy condition information of a user including user subscription data, a user access network type, a user roaming state, or a combination thereof;
  • the policy control and charging rule function entity determines and generates firewall mode information according to the policy condition information of the user.
  • the embodiment of the present invention further provides a policy control and charging rule function entity.
  • the specific implementation manner of the PCRF is described below with reference to the accompanying drawings.
  • FIG. 7 is a schematic structural diagram of an embodiment of a policy control and charging rule function entity, as shown in FIG.
  • the PCRF includes:
  • the sending module is configured to send the security control policy information to the policy and charging execution entity after determining and generating the security control policy information according to the policy condition information of the user;
  • the policy and charging execution entity performs security control of the user according to the security control policy information.
  • FIG. 8 is a schematic structural diagram of another embodiment of a policy control and charging rule function entity. As shown in FIG. 8, the embodiment may further include a first policy generation module, a first acquisition module, and/or a second policy generation. Module, second acquisition module, only the first acquisition module and the first policy generation module are shown in the figure, wherein:
  • the first obtaining module is configured to obtain, according to one of the policy and charging execution entity, the network management system, the device management system, or a combination thereof, the terminal software version, the operating system version, the operating system patch, whether the anti-virus software and the software are installed, Policy condition information for one or a combination of versions;
  • a first policy generating module configured to determine, according to the policy condition information, and generate access control list information of the security control policy information
  • a second acquiring module configured to acquire policy condition information of a user including user subscription data, a user access network type, a user roaming state, or a combination thereof;
  • the second policy generating module is configured to determine, according to the policy condition information of the user, and generate firewall mode information of the security control policy information.
  • the embodiment of the invention further provides a policy and charging execution entity, which is described below with reference to the accompanying drawings.
  • FIG. 9 is a schematic structural diagram of an embodiment of a policy and charging execution entity. As shown in FIG. 9, the PCEF includes:
  • a receiving module configured to receive security control policy information from a policy control and charging rule function entity
  • an execution module configured to perform security control of the user according to the security control policy information.
  • 10 is a schematic structural diagram of another embodiment of a policy and charging enforcement entity. As shown in FIG. 10, the execution module of this embodiment may include an access control unit, and/or a firewall unit, where: an access control unit is used according to the The access control list information performs access control on the user service data stream;
  • a firewall unit configured to select a corresponding mode firewall for the user service data flow according to the firewall mode information, and execute a firewall function.
  • the receiving module is further configured to receive the security control policy information by using a credit control request message or a re-authentication request message.
  • the operator may pre-define some access control lists according to requirements, and are set in the firewall function module of the PCEF.
  • the PCRF obtains the terminal software version, operating system version, operating system patch, and/or anti-virus software of the user terminal from the PCEF, the network management system, or the Device Management system. Information such as the software version, based on these policy condition information, the access control list information that should be provided to the user.
  • the PCRF may send the corresponding access control list number (ACL number) information configured on the PCEF to the PCEF through a Diameter CCA (Credit Control Request) or RAR (Re-Authentication Request) message.
  • ACL number access control list number
  • ACL-Number AVP can be expressed by adding ACL-Number AVP to the Diameter protocol of the Gx interface.
  • This AVP is a 32-bit integer type and can have different values depending on the access control list.
  • the PCRF can also directly send specific definitions of the access control list to the PCEF, such as the IP address, port, protocol, and application type that are allowed to be accessed, in addition to the ACL.
  • the PCEF can perform corresponding admission control according to the access control list information delivered by the PCRF.
  • the operator can package multiple control modes of the firewall (such as packet filtering mode, deep detection mode) or different functions (such as anti-spam filtering and anti-virus filtering) according to requirements, and preset to multiple firewall function modes.
  • the PCRF determines the firewall mode that should be provided for the user according to the user subscription data, or the user's access network type or roaming status.
  • the PCRF passes the user's firewall mode information to the PCEF through the Gx interface with the PCEF.
  • the PCRF can send the user's firewall mode information to the PCEF through a Diameter RAR (Re-Authentication Request) or CCA (Credit Control Request) message. It can be represented by adding Firewal-Mode-Number A VP to the Diameter protocol of the Gx interface, which is a 32-bit integer type.
  • the PCEF performs the corresponding firewall mode selection and starts the corresponding firewall function according to the firewall mode information delivered by the PCRF.
  • the introduction of these security protection functions improves the overall network security. Reducing network security incidents and reducing operators' network operation and maintenance costs have important application significance.
  • the method, system, and device for performing security control according to the embodiments of the present invention can be implemented according to the complex and changed policy conditions.
  • the embodiment of the present invention achieves the purpose of enhancing the function of the PCC architecture, so that the PCEF can effectively implement security protection functions such as security admission control, access control, and firewall function mode selection according to the security control policy information delivered by the PCRF.
  • the operator can pre-define some access control lists according to the requirements.
  • the PCRF can pass information such as the operating system, operating system patches, and anti-virus software of the user terminal.
  • the analysis determines the access control list information that the user should match, and sends the information to the PCEF through the Gx interface to control the service data flow of the user terminal.
  • the operator can package various control modes or different functions of the firewall according to requirements, and set the firewall mode to perform different firewall functions in advance.
  • the PCRF can determine the firewall mode that should be provided to the user according to the user's subscription data, or the current access network type of the user, whether the user is roaming, and the like, and send the packet to the PCEF device through the Gx interface.
  • a choice is made to be able to make a firewall mode for the traffic flow.

Description

一种执行安全控制的方法、 系统及设备 技术领域
本发明涉及通信领域， 特别涉及执行安全控制的方法、 系统及策略控 制和计费规则功能实体、 策略和计费执行实体。 背景技术
目前, 3GPP ( 3rd Genera t i on Par tner shi p Proj ec t , 第三代合作伙 伴计划 ) 在 TS 23.203里定义了 PCC ( Policy Charging Control, 策略和计 费控制）的架构， PCC中各个功能实体及其作用如下： PCRF( Policy Control and Charging Rules Function, 策略控制和计费规则功能实体）根据用户接 入网络的限制、 运营商策略， λλ SPR ( Subscription Profile Repository, 用 户签约数据数据库）功能实体获取用户签约数据、 以及从 AF ( Application Function, 应用层功能实体） 获取用户当前正在进行的业务信息等决定对 应的策略， 并将该策略提供给 PCEF ( Policy and Charging Enforcement Function, 策略和计费执行实体） ， 由 PCEF执行这些策略。 策略包括业 务数据流（完成某一业务， 比如语音的 IP流集合） 的检测规则、 是否门 控、 业务数据流对应的 QoS ( Quality of Service, 服务质量） 和基于流的 计费规则等。
PCEF: 该实体执行 PCRF下发或者指定的策略， 具体来说就是执行业 务数据流的检测和测量， 保证业务数据流的 QoS、 用户面流量处理、 触发 控制面的会话管理等；
SPR: 该功能实体向 PCRF提供用户签约数据；
AF: 该功能实体向 PCRF动态提供应用层的会话信息， PCRF根据该 信息动态生成或者修改对应的规则。 与 IP-CAN会话流程有关的几个术语阐述如下：
IP-CAN: 当用户在接入网络内漫游（位置改变时） 仍能保存 IP业务 连续性 （即不中断业务） ， 具有这样性质的接入网络称为 IP-CAN, 比如 GPRS ( General Packet Radio Service, 通用分组无线业务） 网络， I-WLAN (无线本地局域网同 3GPP网络互通系统） 网络等；
IP-CAN bearer: IP-CAN承载， 具有明确速率， 延迟和错误比特率的 IP传输路径（该路径指的是接入网到 PCEF之间），对于 GPRS来说 IP-CAN bearer对应 PDP ( Packet Data Protocol, 分组数据协议） 上下文；
IP-CAN session: IP-CAN会话， 指的是 UE ( User Equipment, 用户设 备）和 PDN ( Packet Data Network, 分组数据网， 比如 internet )标识之间 的连接关系， 该连接关系通过 UE的 IP地址和 UE的标识来识别。 只要 UE分配了 IP地址并且能被 IP网络识别， 则 IP-CAN存在。 IP-CAN会话 可以包含一到多个 IP-CAN 载。
在该 PCC架构的基础上， 可以实现 IP -CAN会话、 IP-CAN承载的建 立等流程。 当 UE在 PDN分配了可寻址的 IP地址后， UE就建立 IP-CAN 会话， 为了满足不同的 QoS要求， 在同一个 IP-CAN会话里可以建立不同 QoS要求的 IP-CAN承载， 在每个 IP-CAN承载里可以有多个 IP流（比如 用户可以同时在不同服务器下载文件） ， PCEF是根据 PCC规则 （PCC规 则包含 IP五元组， 即 IP源、 目的地址、 源端口号、 目的端口号、 协议来 识别 IP流。 每个 PCC规则可以包含一到多个 IP流， 它们称为业务数据流 ( Service Data Flow ) 。 在 PCRF通过 Gx接口传递给 PCEF的 PCC规则 中， 包含了门控信息、 QoS控制参数、 业务数据流的计费参数， PCEF可 以根据 PCC规则中的这些控制参数来进行业务流的准入控制、 流量监管 和计费等操作。
发明人在发明过程中发现， 现有技术至少存在以下缺陷： 目前 PCC 架构仅限于应用在确定业务数据流的应用场景， 如 IMS等应用场景， 无法 适用于数据业务接入控制应用场景。 不能使网络根据不同策略条件实现不 同的安全策略控制功能， 从而提高网络安全性， 促进数据业务的广泛开展 和应用。 发明内容
本发明实施例提供一种执行安全控制的方法、 系统及策略控制和计费 规则功能实体、 策略和计费执行实体， 用以解决提供在 PCC架构中对用 户会话提供安全控制的问题。
本发明实施例提供了一种执行安全控制的方法， 包括如下步骤： 策略和计费执行实体从策略控制和计费规则功能实体接收安全控制 策略信息；
所述策略和计费执行实体根据安全控制策略信息执行用户的安全控 制。
本发明实施例还提供了一种执行安全控制的系统， 包括策略和计费执 行实体、 策略控制和计费规则功能实体、 接收模块、 执行模块， 其中： 接收模块， 与策略和计费执行实体相连， 用于从策略控制和计费规则 功能实体接收安全控制策略信息；
执行模块， 与策略和计费执行实体相连， 用于根据所述安全控制策略 信息执行用户的安全控制。
本发明实施例又提供了一种策略控制和计费规则功能实体， 包括发送 模块， 用于在根据所述用户的策略条件信息判断， 并生成安全控制策略信 息后， 将安全控制策略信息发送至策略和计费执行实体；
策略和计费执行实体根据所述安全控制策略信息执行用户的安全控 制。
本发明实施例还提供了一种策略和计费执行实体， 包括：
接收模块， 用于从策略控制和计费规则功能实体接收安全控制策略信 息；
执行模块， 用于根据所述安全控制策略信息执行用户的安全控制。 本发明实施例有益效果如下：
由于策略和计费执行实体从策略控制和计费规则功能实体接收安全 控制策略信息后， 策略和计费执行实体再根据安全控制策略信息执行用户 的安全控制， 从而具备了对用户接入会话进行控制的能力。 附图说明
图 1为本发明实施例中所述执行安全控制方法的实施流程示意图； 图 2为本发明所述一个实施例实施流程示意图；
图 3为本发明所述另一个实施例实施流程示意图；
图 4为本发明实施例中所述执行安全控制系统的一个实施例结构示意 图；
图 5为本发明实施例中所述执行安全控制系统的又一实施例结构示意 图；
图 6为本发明实施例中所述执行安全控制系统的再一实施例结构示意 图；
图 7为本发明实施例中所述策略控制和计费规则功能实体一个实施例 的结构示意图；
图 8为本发明实施例中所述策略控制和计费规则功能实体另一个实施 例的结构示意图；
图 9为本发明实施例中所述策略和计费执行实体一个实施例的结构示 意图；
图 10为本发明实施例中所述策略和计费执行实体另一个实施例的结 构示意图。 具体实施方式
下面结合附图对本发明的具体实施方式进行说明。
图 1为执行安全控制方法的实施流程示意图， 如图 1所示， 在执行安 全控制时可以包括如下步骤：
步骤 501、 策略和计费执行实体从策略控制和计费规则功能实体接收 安全控制策略信息；
步骤 502、 所述策略和计费执行实体根据安全控制策略信息执行用户 的安全控制。
实施例中， 安全控制策略信息包含访问控制列表信息、 防火墙模式信 息。
执行用户的安全控制功能包括：
根据所述访问控制列表信息对用户业务数据流执行访问控制； 和 /或，根据所述防火墙模式信息为用户业务数据流选择相应模式的防 火墙并执行防火墙功能。
其中， 执行访问控制可以是根据访问控制列表信息指定的访问控制列 表中允许访问的 IP地址、 端口、 协议、 应用类型之一或者其组合， 对用 户业务数据流执行准入访问控制；
执行防火墙功能可以是根据防火墙模式信息指定的防火墙模式选择 报文过滤模式、 深度检测模式、 防垃圾邮件过滤、 防病毒过滤之一或者其 组合的防火墙， 并为用户业务数据流执行防火墙功能。
安全控制策略信息可以是由策略控制和计费规则功能实体通过信用 控制请求消息或重鉴权请求消息发送至策略和计费执行实体。
安全控制策略信息可以是通过信用控制请求消息或重鉴权请求消息 发送至策略和计费执行实体的访问控制列表信息、 和 /或防火墙模式信息。
其中， 访问控制列表信息可以通过在 Gx接口的 Diameter协议中增加 访问控制列表编号 ACL-Number A VP来表示； 防火墙模式信息可以通过在 Gx接口的 Diameter协议中增加防火墙模 式编号 Firewal-Mode-Number A VP来表示。
实施中， 策略控制和计费规则功能实体根据所述用户的策略条件信息 判断并生成安全控制策略信息后， 将安全控制策略信息发送至策略和计费 执行实体；
策略和计费执行实体再根据所述安全控制策略信息执行用户的安全 控制。
策略控制和计费规则功能实体根据用户的策略条件信息判断并生成 的访问控制列表信息， 所述用户的策略条件信息可以是从策略和计费执行 实体、 网管系统、 设备管理系统之一或者其组合获取的用户终端的终端软 件版本、 操作系统版本、 操作系统补丁、 是否安装了防病毒软件及软件版 本之一或者其组合的策略条件信息；
和 /或，所述策略控制和计费规则功能实体根据用户的策略条件信息判 断并生成的防火墙模式信息， 所述用户的策略条件信息是用户签约数据、 用户的接入网类型、 用户的漫游状态之一或者其组合的信息。
下面以为用户提供各种安全控制策略信息的实施例来进一步说明执 行安全控制的实施方式。
本实施例描述了根据用户终端的终端软件版本、 操作系统版本、 操作 系统补丁、 和 /或是否安装了防病毒软件及软件版本等信息进行策略决策， 判断并生成安全控制策略信息， 通过安全控制策略信息实现用户的准入控 制的应用示例。 用户在 IP接入会话建立时， PCRF从设备管理系统获得用 户终端的终端软件版本、 操作系统版本、 操作系统补丁、 和 /或是否安装了 防病毒软件及软件版本等信息； PCRF根据所获得的信息， 判断并生成安 全控制策略信息， 安全控制策略信息中包括针对此用户终端所适用的访问 控制列表， 并将信息发送给 PCEF进行准入控制处理。
图 2为一个实施例实施流程示意图， 如图 2所示， 包括如下步骤： 步骤 601、 用户发起 IP接入会话建立请求到 PCEF。
步骤 602、 PCEF发送信用控制请求消息到 PCRF, 用于触发 PCRF反 馈安全控制策略信息， 其中信用控制请求消息中携带用户终端设备信息。
步骤 603、 PCRF通过设备管理系统获得用户终端的终端软件版本、 操作系统版本、操作系统补丁、和 /或是否安装了防病毒软件及软件版本等 信息。
步骤 604、 PCRF进行判断， 并生成安全控制策略信息， 根据所获得 的信息， 判断决定针对此用户终端所适用的访问控制列表一， 在安全控制 策略信息中包括了访问控制列表一。
步骤 605、 PCRF发送信用控制应答消息到 PCEF, 消息中带有此用户 终端的访问控制列表一信息。
步骤 606、 PCEF根据收到的访问控制列表一信息进行准入控制， 对 经过 PCEF的用户相关数据流进行允许接纳或拒绝操作。
步骤 607、 PCEF向用户终端发送 IP接入会话建立应答消息。
步骤 608、 当设备管理系统发现用户终端软件版本不是所期望的最新 版本时， 设备管理系统可以提示用户及时升级终端软件版本。
步骤 609、 用户终端通过设备管理系统进行软件升级。
步骤 610、 设备管理系统向 PCRF发送用户终端升级后的终端软件信 息。
步骤 611、 PCRF进行判断并生成安全控制策略信息， 根据用户终端 升级后的终端软件信息， 判断决定针对此用户终端所适用的访问控制列表 二， 在安全控制策略信息中包括访问控制列表二。
步骤 612、 PCRF发送重鉴权请求消息到 PCEF, 消息中带有此用户终 端的访问控制列表二信息。
步骤 613、 PCEF根据收到的访问控制列表二信息进行准入控制， 对 经过 PCEF的用户相关数据流进行允许接纳或拒绝操作。 步骤 614、 PCEF向 PCRF发送重鉴权响应消息。
通过本实施例实施可知， 实施例可以根据终端软件信息对用户进行准 入接纳控制。 当用户终端的软件版本或配置不符合网络安全要求时， 可以 限制终端能够访问的网络资源， 如仅允许访问设备管理系统进行软件升 级， 当终端的软件版本或配置满足网络安全要求后再允许终端访问其它的 用户订阅的网络资源。 这样可以避免不符合安全要求的终端， 如操作系统 存在安全漏洞、 没有安装防病毒软件的终端接入网络， 从而对网络的安全 威胁带来潜在的危险， 提升了网络整体的安全性， 减少网络安全事故， 降 低网络的运行和维护成本。
本实施例描述了根据用户签约数据、 或用户的接入网类型、 或是否漫 游用户等条件，判断应为用户提供的防火墙模式，并送给 PCEF进行处理。
图 3为另一个实施例实施流程示意图， 如图 3所示， 包括以下步骤： 步骤 701、 用户发起 IP接入会话建立请求到 PCEF。
步骤 702、 PCEF发送信用控制请求消息到 PCRF, 用于触发 PCRF反 馈安全控制策略信息， 其中信用控制请求消息中携带用当前使用的接入网 类型、 是否漫游等信息。
步骤 703、 PCRF通过 SPR获得用户的签约信息， 包括用户签约的防 火墙模式信息。
步骤 704、 PCRF根据用户签约数据， 或者用户的接入网类型、 或者 是否漫游用户等策略条件判断并生成安全控制策略信息， 安全控制策略信 息中包括应为用户提供的防火墙模式信息。 如根据用户的签约信息， 如果 用户签约了防火墙模式， 则使用用户签约信息； 否则， 由运营商预先定义 的， 对不同用户接入网类型提供不同的防火墙模式， 比如对 WLAN ( Wireless Local Area Network, 无线局域网 )接入的用户提供的防火墙功 能模式区别与于采用 WCDMA ( Wideband CDMA, 宽带 CDMA )接入的 用户； 或者对漫游用户不提供防火墙功能等。 步骤 705、 PCRF发送信用控制应答消息到 PCEF, 消息中带有用户的 防火墙模式 （ Firewall Mode Number )信息。
步骤 706、 PCEF根据收到的防火墙模式信息针对此接入用户进行防 火墙模式选择并启动相应的防火墙功能。
步骤 707、 PCEF向用户终端发送 IP接入会话建立应答消息。
从以上描述， 可以知道本实施例通过对用户签约信息、 接入网类型、 是否漫游用户， 以及其他可能的策略条件信息， 可以为用户提供不同组合 的防火墙功能， 使用户防火墙功能得到充分的应用， 从而为用户提供安全 保证。
本发明实施例还提供了一种执行安全控制的系统， 下面结合附图对本 系统的具体实施方式进行说明。
图 4为执行安全控制系统的一个实施例结构示意图， 如图 4所示， 系 统中包括策略和计费执行实体、策略控制和计费规则功能实体、接收模块、 执行模块， 其中：
接收模块、 执行模块与策略和计费执行实体相连；
接收模块从策略控制和计费规则功能实体接收安全控制策略信息； 执行模块根据所述安全控制策略信息执行用户的安全控制。
安全控制策略信息可以包含访问控制列表信息、 防火墙模式信息。 图 5为执行安全控制系统的又一实施例结构示意图， 如图 5所示， 本 实施例执行模块可以包括访问控制单元、 和 /或防火墙单元， 其中：
访问控制单元， 用于根据所述访问控制列表信息对用户业务数据流执 行访问控制；
防火墙单元， 用于根据所述防火墙模式信息为用户业务数据流选择相 应模式的防火墙并执行防火墙功能。
访问控制单元可以进一步用于根据访问控制列表信息指定的访问控 制列表中允许访问的 IP地址、 端口、 协议、 应用类型之一或者其组合对 用户业务数据流执行准入访问控制；
所述防火墙单元可以进一步用于根据防火墙模式信息指定的防火墙 模式选择报文过滤模式、 深度检测模式、 防垃圾邮件过滤、 防病毒过滤之 一或者其组合的防火墙， 并为用户业务数据流执行防火墙功能。
接收模块可以通过信用控制请求消息或重鉴权请求消息接收所述安 全控制策略信息。
安全控制策略信息可以是访问控制列表信息、 和 /或防火墙模式信息。 访问控制列表信息可以通过在 Gx接口的 Diameter协议中增加访问控 制列表编号 ACL-Number A VP来表示；
防火墙模式信息可以通过在 Gx接口的 Diameter协议中增加防火墙模 式编号 Firewal-Mode-Number A VP来表示。
系统中还可以包括发送模块， 用于在策略控制和计费规则功能实体根 据所述用户的策略条件信息判断， 并生成安全控制策略信息后， 将安全控 制策略信息发送至策略和计费执行实体；
策略和计费执行实体根据所述安全控制策略信息执行用户的安全控 制。
图 6为执行安全控制系统的再一实施例结构示意图， 如图 6所示， 系 统系统中还可以包括第一获取模块、 和 /或第二获取模块， 其中：
第一获取模块， 用于从策略和计费执行实体、 网管系统、 设备管理系 统之一或者其组合获取用户终端的终端软件版本、 操作系统版本、 操作系 统补丁、 是否安装了防病毒软件及软件版本之一或者其组合的策略条件信 息；
所述策略控制和计费规则功能实体根据所述策略条件信息判断并生 成访问控制列表信息；
第二获取模块， 用于获取包括用户签约数据、 用户的接入网类型、 用 户的漫游状态之一或者其组合的用户的策略条件信息； 所述策略控制和计费规则功能实体根据用户的策略条件信息判断并 生成防火墙模式信息。
本发明实施例还提供了一种策略控制和计费规则功能实体， 下面结合 附图对 PCRF的具体实施方式进行说明。
图 7为策略控制和计费规则功能实体一个实施例的结构示意图， 如图
7所示， 在 PCRF中包括：
包括发送模块， 用于在根据所述用户的策略条件信息判断并生成安全 控制策略信息后， 将安全控制策略信息发送至策略和计费执行实体；
则策略和计费执行实体根据所述安全控制策略信息执行用户的安全 控制。
图 8为策略控制和计费规则功能实体另一个实施例的结构示意图， 如 图 8所示，本实施例进一步的可以包括第一策略生成模块、第一获取模块、 和 /或第二策略生成模块、第二获取模块， 图中仅示出了第一获取模块和第 一策略生成模块， 其中：
第一获取模块， 用于从策略和计费执行实体、 网管系统、 设备管理系 统之一或者其组合获取用户终端的终端软件版本、 操作系统版本、 操作系 统补丁、 是否安装了防病毒软件及软件版本之一或者其组合的策略条件信 息；
第一策略生成模块， 用于根据所述策略条件信息判断， 并生成安全控 制策略信息的访问控制列表信息；
第二获取模块， 用于获取包括用户签约数据、 用户的接入网类型、 用 户的漫游状态之一或者其组合的用户的策略条件信息；
第二策略生成模块， 用于根据用户的策略条件信息判断， 并生成安全 控制策略信息的防火墙模式信息。
本发明实施例还提供了一种策略和计费执行实体， 下面结合附图对
PCEF的具体实施方式进行说明。 图 9为策略和计费执行实体一个实施例的结构示意图， 如图 9所示， PCEF中包括：
接收模块， 用于从策略控制和计费规则功能实体接收安全控制策略信 息；
执行模块， 用于根据所述安全控制策略信息执行用户的安全控制。 图 10为策略和计费执行实体另一个实施例的结构示意图， 如图 10所 示， 本实施例执行模块可以包括访问控制单元、 和 /或防火墙单元， 其中： 访问控制单元， 用于根据所述访问控制列表信息对用户业务数据流执 行访问控制；
防火墙单元， 用于根据所述防火墙模式信息为用户业务数据流选择相 应模式的防火墙并执行防火墙功能。
接收模块， 进一步用于通过信用控制请求消息或重鉴权请求消息接收 所述安全控制策略信息。
实施例中， 运营商可以根据需求预先定义了一些访问控制列表， 在 PCEF的防火墙功能模块设置。当用户 IP-CAN会话建立时， PCRF从 PCEF、 网管系统或设备管理（ Device Management )系统等获得用户终端的终端软 件版本、 操作系统版本、 操作系统补丁、 和 /或是否安装了防病毒软件及软 件版本等信息， 根据这些策略条件信息决策应为用户提供的访问控制列表 信息。 PCRF可以通过 Diameter CCA (信用控制请求）或者 RAR (重鉴权 请求）消息把相应配置在 PCEF上的访问控制列表编号（ ACL number )信 息发送到 PCEF。可以通过在 Gx接口的 Diameter协议中增加 ACL-Number AVP来表示， 这个 AVP是 32位整数类型， 可以根据访问控制列表的不同 而具有不同的取值。 除 PCRF下发访问控制列表编号方法外， PCRF还可 以直接向 PCEF下发访问控制列表的具体定义， 如允许访问的 IP地址、 端 口、 协议、 应用类型等信息。 PCEF可以根据 PCRF下发的访问控制列表 信息执行相应的准入控制。 同时， 运营商可以根据需求将防火墙的多种控制模式（例如报文过滤 模式、 深度检测模式）， 或不同功能（例如防垃圾邮件过滤和防病毒过滤） 打包， 预先设置为多个防火墙功能模式， 其中每种模式可以用一个号码来 唯一标识， 并在 PCEF设置。 用户接入时， PCRF根据用户签约数据， 或 者用户的接入网类型或漫游状态，判断应为用户提供的防火墙模式。 PCRF 通过和 PCEF之间的 Gx接口， 把用户的防火墙模式信息传递给 PCEF。 如 PCRF可以通过 Diameter RAR (重鉴权请求）或 CCA (信用控制请求）消 息把用户的防火墙模式信息发送到 PCEF。可以通过在 Gx接口的 Diameter 协议中增加 Firewal-Mode-Number A VP来表示， 这个 AVP是 32位整数类 型。 PCEF根据 PCRF下发的防火墙模式信息执行相应的防火墙模式选择 并启动相应的防火墙功能。
随着网络安全问题在电信网络的漫延， 在 PCEF上提供集成防火墙功 能和准入控制等网络安全防护功能， 已经成为网关设备的一个重要功能， 这些安全防护功能的引入对于提升整体网络安全度， 减少网络安全事故， 降低运营商的网络运行和维护成本具有重要的应用意义。 本发明实施例的 执行安全控制的方法、 系统及设备能够实现根据复杂、 变化的策略条件进 由上述实施例可以看出， 在现有技术中的 PCC架构还不具备安全策 略控制的能力时， 本发明实施例达到了增强 PCC架构功能的目的， 使得 PCEF可以根据 PCRF下发的安全控制策略信息， 有效地实现对用户的安 全准入控制、 访问控制、 防火墙功能模式的选择等安全防护功能。
同时， 对于业务的准入控制方面， 使得运营商可以根据需求预先定义 一些访问控制列表， 当用户会话接入后， 使 PCRF可以通过对用户终端的 操作系统、 操作系统补丁、 防病毒软件等信息的分析， 来决策用户应匹配 的访问控制列表信息， 并通过 Gx接口下发到 PCEF执行， 从而达到对用 户终端的业务数据流的控制。 在对于对用户业务流执行防火墙的模式选择的控制方面， 使得运营商 可以根据需求， 将防火墙的多种控制模式， 或不同功能打包， 预先设置为 不同的执行防火墙功能的防火墙模式。 当用户接入时， 使得 PCRF可以根 据用户签约数据、 或者用户当前的接入网类型、 用户是否漫游等条件， 判 断应为用户提供的防火墙模式， 并通过 Gx接口下发到 PCEF设备执行， 从而达到了能够对业务流进行防火墙模式的选择。 本发明的精神和范围。 这样， 倘若本发明的这些修改和变型属于本发明权 利要求及其等同技术的范围之内， 则本发明也意图包含这些改动和变型在 内。

Claims

权利 要求 书
1、 一种执行安全控制的方法， 其特征在于， 包括如下步骤： 策略和计费执行实体从策略控制和计费规则功能实体接收安全控制 策略信息；
所述策略和计费执行实体根据所述安全控制策略信息执行用户的安 全控制。
2、 如权利要求 1所述的方法， 其特征在于， 所述安全控制策略信息 包含访问控制列表信息、 防火墙模式信息。
3、 如权利要求 2所述的方法， 其特征在于， 所述执行用户的安全控 制包括如下步骤：
根据所述访问控制列表信息对用户业务数据流执行访问控制； 和 /或，根据所述防火墙模式信息为用户业务数据流选择相应模式的防 火墙并执行防火墙功能。
4、 如权利要求 3所述的方法， 其特征在于， 所述执行用户的安全控 制包括如下步骤：
根据访问控制列表信息指定的访问控制列表中允许访问的 IP地址、 端口、 协议、 应用类型之一或者其组合， 对用户业务数据流执行准入访问 控制；
根据防火墙模式信息指定的防火墙模式选择报文过滤模式、 深度检测 模式、 防垃圾邮件过滤、 防病毒过滤之一或者其组合的防火墙， 并为用户 业务数据流执行防火墙功能。
5、 如权利要求 1或 2所述的方法， 其特征在于， 所述策略和计费执 行实体从策略控制和计费规则功能实体接收安全控制策略信息具体包括： 所述策略和计费执行实体接收所述策略控制和计费规则功能实体通过信 用控制请求消息或重鉴权请求消息发送的安全控制策略信息。
6、 如权利要求 5所述的方法， 其特征在于， 所述策略和计费执行实 体接收通过信用控制请求消息或重鉴权请求消息发送的， 访问控制列表信 息、 和 /或防火墙模式信息的安全控制策略信息。
7、 如权利要求 6所述的方法， 其特征在于， 所述访问控制列表信息 通过在 Gx接口的 Diameter协议中增加访问控制列表编号 ACL-Number AVP来表示；
防火墙模式信息通过在 Gx接口的 Diameter协议中增加防火墙模式编 号 Firewal-Mode-Number AVP来表示。
8、 如权利要求 1所述的方法， 其特征在于， 所述策略和计费执行实 体从策略控制和计费规则功能实体接收安全控制策略信息具体包括如下 步骤：
策略和计费执行实体接收策略控制和计费规则功能实体根据所述用 户的策略条件信息判断并生成的安全控制策略信息。
9、 如权利要求 8所述的方法， 其特征在于， 所述策略控制和计费规 则功能实体根据所述用户的策略条件信息判断并生成的安全控制策略信 息具体包括： 所述策略控制和计费规则功能实体根据用户的策略条件信息 判断并生成的访问控制列表信息， 所述用户的策略条件信息是从策略和计 费执行实体、 网管系统、 设备管理系统之一或者其组合获取的用户终端的 终端软件版本、 操作系统版本、 操作系统补丁、 是否安装了防病毒软件及 软件版本之一或者其组合的策略条件信息；
和 /或，所述策略控制和计费规则功能实体根据用户的策略条件信息判 断并生成的防火墙模式信息， 所述用户的策略条件信息是用户签约数据、 用户的接入网类型、 用户的漫游状态之一或者其组合的信息。
10、 一种执行安全控制的系统， 包括策略和计费执行实体、 策略控制 和计费规则功能实体， 其特征在于， 还包括接收模块、 执行模块， 其中： 接收模块， 与策略和计费执行实体相连， 用于从策略控制和计费规则 功能实体接收安全控制策略信息； 执行模块， 与策略和计费执行实体相连， 用于根据所述安全控制策略 信息执行用户的安全控制。
11、 如权利要求 10所述的系统， 其特征在于， 所述安全控制策略信 息包含访问控制列表信息、 防火墙模式信息。
12、 如权利要求 11所述的系统， 其特征在于， 所述执行模块包括访 问控制单元、 和 /或防火墙单元， 其中：
访问控制单元， 用于根据所述访问控制列表信息对用户业务数据流执 行访问控制；
防火墙单元， 用于根据所述防火墙模式信息为用户业务数据流选择相 应模式的防火墙并执行防火墙功能。
13、 如权利要求 12所述的系统， 其特征在于， 所述访问控制单元进 一步用于根据访问控制列表信息指定的访问控制列表中允许访问的 IP地 址、 端口、 协议、 应用类型之一或者其组合对用户业务数据流执行准入访 问控制；
所述防火墙单元进一步用于根据防火墙模式信息指定的防火墙模式 选择报文过滤模式、 深度检测模式、 防垃圾邮件过滤、 防病毒过滤之一或 者其组合的防火墙， 并为用户业务数据流执行防火墙功能。
14、 如权利要求 10或 11所述的系统， 其特征在于， 接收模块， 进一 步用于接收所述策略控制和计费规则功能实体通过信用控制请求消息或 重鉴权请求消息发送的所述安全控制策略信息。
15、 如权利要求 14所述的系统， 其特征在于， 所述安全控制策略信 息是访问控制列表信息、 和 /或防火墙模式信息。
16、 如权利要求 15所述的系统， 其特征在于， 所述访问控制列表信 息通过在 Gx接口的 Diameter协议中增加访问控制列表编号 ACL-Number A VP来表示；
防火墙模式信息通过在 Gx接口的 Diameter协议中增加防火墙模式编 号 Firewal-Mode-Number AVP来表示。
17、 如权利要求 10所述的系统， 其特征在于， 进一步包括发送模块， 用于所述策略控制和计费规则功能实体根据所述用户的策略条件信息判 断， 并生成的安全控制策略信息后， 将该安全控制策略信息发送至策略和 计费执行实体。
18、 如权利要求 17所述的系统， 其特征在于， 进一步包括第一获取 模块、 和 /或第二获取模块， 其中：
第一获取模块， 用于从策略和计费执行实体、 网管系统、 设备管理系 统之一或者其组合获取用户终端的终端软件版本、 操作系统版本、 操作系 统补丁、 是否安装了防病毒软件及软件版本之一或者其组合的策略条件信 息；
则， 所述接收模块具体用于所述策略控制和计费规则功能实体根据所 述策略条件信息判断， 并生成访问控制列表信息；
第二获取模块， 用于获取包括用户签约数据、 用户的接入网类型、 用 户的漫游状态之一或者其组合的用户的策略条件信息；
则， 所述接收模块具体用于所述策略控制和计费规则功能实体根据用 户的策略条件信息判断并生成防火墙模式信息。
19、 一种策略和计费执行实体， 其特征在于， 包括：
接收模块， 用于从策略控制和计费规则功能实体接收安全控制策略信 息；
执行模块， 用于根据所述安全控制策略信息执行用户的安全控制。
20、 如权利要求 19所述的策略和计费执行实体， 其特征在于， 所述 执行模块包括访问控制单元、 和 /或防火墙单元， 其中：
访问控制单元， 用于根据访问控制列表信息对用户业务数据流执行访 问控制；
防火墙单元， 用于根据所述防火墙模式信息为用户业务数据流选择相 应模式的防火墙并执行防火墙功能。
21、 如权利要求 19或 20所述的策略和计费执行实体， 其特征在于， 接收模块， 进一步用于接收所述策略控制和计费规则功能实体通过信用控 制请求消息或重鉴权请求消息发送的所述安全控制策略信息。
22、一种策略控制和计费规则功能实体， 其特征在于， 包括发送模块， 用于在根据所述用户的策略条件信息判断并生成安全控制策略信息后， 将 用于策略和计费执行实体执行用户的安全控制的安全控制策略信息发送 至所述策略和计费执行实体。
23、 如权利要求 22所述的策略控制和计费规则功能实体， 其特征在 于， 进一步包括第一策略生成模块、 第一获取模块、 和 /或第二策略生成模 块、 第二获取模块， 其中：
第一获取模块， 用于从策略和计费执行实体、 网管系统、 设备管理系 统之一或者其组合获取用户终端的终端软件版本、 操作系统版本、 操作系 统补丁、 是否安装了防病毒软件及软件版本之一或者其组合的策略条件信 息；
第一策略生成模块， 用于根据所述策略条件信息判断， 并生成访问控 制列表信息；
第二获取模块， 用于获取包括用户签约数据、 用户的接入网类型、 用 户的漫游状态之一或者其组合的用户的策略条件信息；
第二策略生成模块， 用于根据用户的策略条件信息判断， 并生成防火 墙模式信息。
PCT/CN2008/070866 2007-04-30 2008-04-30 Procédé, système et dispositif permettant d'effectuer un contrôle de sécurité WO2008134985A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP08734222A EP2106070A4 (en) 2007-04-30 2008-04-30 METHOD, SYSTEM AND DEVICE FOR CARRYING OUT A SAFETY CHECK
US12/543,971 US20090307746A1 (en) 2007-04-30 2009-08-19 Method, system and device for implementing security control

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2007101015803A CN101299660B (zh) 2007-04-30 2007-04-30 一种执行安全控制的方法、系统及设备
CN200710101580.3 2007-04-30

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/543,971 Continuation US20090307746A1 (en) 2007-04-30 2009-08-19 Method, system and device for implementing security control

Publications (1)

Publication Number Publication Date
WO2008134985A1 true WO2008134985A1 (fr) 2008-11-13

Family

ID=39943140

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2008/070866 WO2008134985A1 (fr) 2007-04-30 2008-04-30 Procédé, système et dispositif permettant d'effectuer un contrôle de sécurité

Country Status (4)

Country Link
US (1) US20090307746A1 (zh)
EP (1) EP2106070A4 (zh)
CN (1) CN101299660B (zh)
WO (1) WO2008134985A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102438201A (zh) * 2010-09-29 2012-05-02 阿尔卡特朗讯 用于基于在线计费信息确定业务流的定向的方法和装置

Families Citing this family (76)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8406748B2 (en) 2009-01-28 2013-03-26 Headwater Partners I Llc Adaptive ambient services
US8548428B2 (en) 2009-01-28 2013-10-01 Headwater Partners I Llc Device group partitions and settlement platform
US8402111B2 (en) 2009-01-28 2013-03-19 Headwater Partners I, Llc Device assisted services install
US8635335B2 (en) 2009-01-28 2014-01-21 Headwater Partners I Llc System and method for wireless network offloading
US8391834B2 (en) 2009-01-28 2013-03-05 Headwater Partners I Llc Security techniques for device assisted services
US8832777B2 (en) 2009-03-02 2014-09-09 Headwater Partners I Llc Adapting network policies based on device service processor configuration
US8346225B2 (en) 2009-01-28 2013-01-01 Headwater Partners I, Llc Quality of service for device assisted services
US8898293B2 (en) 2009-01-28 2014-11-25 Headwater Partners I Llc Service offer set publishing to device agent with on-device service selection
US8626115B2 (en) 2009-01-28 2014-01-07 Headwater Partners I Llc Wireless network service interfaces
US8340634B2 (en) 2009-01-28 2012-12-25 Headwater Partners I, Llc Enhanced roaming services and converged carrier networks with device assisted services and a proxy
US8229812B2 (en) 2009-01-28 2012-07-24 Headwater Partners I, Llc Open transaction central billing system
US8924469B2 (en) 2008-06-05 2014-12-30 Headwater Partners I Llc Enterprise access control and accounting allocation for access networks
US8275830B2 (en) 2009-01-28 2012-09-25 Headwater Partners I Llc Device assisted CDR creation, aggregation, mediation and billing
US8725123B2 (en) 2008-06-05 2014-05-13 Headwater Partners I Llc Communications device with secure data path processing agents
US8589541B2 (en) 2009-01-28 2013-11-19 Headwater Partners I Llc Device-assisted services for protecting network capacity
US8924543B2 (en) 2009-01-28 2014-12-30 Headwater Partners I Llc Service design center for device assisted services
US10237757B2 (en) 2009-01-28 2019-03-19 Headwater Research Llc System and method for wireless network offloading
US10798252B2 (en) 2009-01-28 2020-10-06 Headwater Research Llc System and method for providing user notifications
US9270559B2 (en) 2009-01-28 2016-02-23 Headwater Partners I Llc Service policy implementation for an end-user device having a control application or a proxy agent for routing an application traffic flow
US10326800B2 (en) 2009-01-28 2019-06-18 Headwater Research Llc Wireless network service interfaces
US9351193B2 (en) 2009-01-28 2016-05-24 Headwater Partners I Llc Intermediate networking devices
US8893009B2 (en) 2009-01-28 2014-11-18 Headwater Partners I Llc End user device that secures an association of application to service policy with an application certificate check
US9253663B2 (en) 2009-01-28 2016-02-02 Headwater Partners I Llc Controlling mobile device communications on a roaming network based on device state
US9955332B2 (en) 2009-01-28 2018-04-24 Headwater Research Llc Method for child wireless device activation to subscriber account of a master wireless device
US9706061B2 (en) 2009-01-28 2017-07-11 Headwater Partners I Llc Service design center for device assisted services
US8745191B2 (en) 2009-01-28 2014-06-03 Headwater Partners I Llc System and method for providing user notifications
US9609510B2 (en) 2009-01-28 2017-03-28 Headwater Research Llc Automated credential porting for mobile devices
US8606911B2 (en) 2009-03-02 2013-12-10 Headwater Partners I Llc Flow tagging for service policy implementation
US10264138B2 (en) 2009-01-28 2019-04-16 Headwater Research Llc Mobile device and service management
US10484858B2 (en) 2009-01-28 2019-11-19 Headwater Research Llc Enhanced roaming services and converged carrier networks with device assisted services and a proxy
US10841839B2 (en) 2009-01-28 2020-11-17 Headwater Research Llc Security, fraud detection, and fraud mitigation in device-assisted services systems
US9858559B2 (en) 2009-01-28 2018-01-02 Headwater Research Llc Network service plan design
US10057775B2 (en) 2009-01-28 2018-08-21 Headwater Research Llc Virtualized policy and charging system
US11218854B2 (en) 2009-01-28 2022-01-04 Headwater Research Llc Service plan design, user interfaces, application programming interfaces, and device management
US9392462B2 (en) * 2009-01-28 2016-07-12 Headwater Partners I Llc Mobile end-user device with agent limiting wireless data communication for specified background applications based on a stored policy
US9647918B2 (en) 2009-01-28 2017-05-09 Headwater Research Llc Mobile device and method attributing media services network usage to requesting application
US10200541B2 (en) 2009-01-28 2019-02-05 Headwater Research Llc Wireless end-user device with divided user space/kernel space traffic policy system
US8793758B2 (en) 2009-01-28 2014-07-29 Headwater Partners I Llc Security, fraud detection, and fraud mitigation in device-assisted services systems
US9578182B2 (en) 2009-01-28 2017-02-21 Headwater Partners I Llc Mobile device and service management
US10064055B2 (en) 2009-01-28 2018-08-28 Headwater Research Llc Security, fraud detection, and fraud mitigation in device-assisted services systems
US9954975B2 (en) 2009-01-28 2018-04-24 Headwater Research Llc Enhanced curfew and protection associated with a device group
US9572019B2 (en) 2009-01-28 2017-02-14 Headwater Partners LLC Service selection set published to device agent with on-device service selection
US9565707B2 (en) 2009-01-28 2017-02-07 Headwater Partners I Llc Wireless end-user device with wireless data attribution to multiple personas
US10783581B2 (en) 2009-01-28 2020-09-22 Headwater Research Llc Wireless end-user device providing ambient or sponsored services
US9980146B2 (en) 2009-01-28 2018-05-22 Headwater Research Llc Communications device with secure data path processing agents
US10715342B2 (en) 2009-01-28 2020-07-14 Headwater Research Llc Managing service user discovery and service launch object placement on a device
US10779177B2 (en) 2009-01-28 2020-09-15 Headwater Research Llc Device group partitions and settlement platform
US10492102B2 (en) 2009-01-28 2019-11-26 Headwater Research Llc Intermediate networking devices
US9755842B2 (en) 2009-01-28 2017-09-05 Headwater Research Llc Managing service user discovery and service launch object placement on a device
US10248996B2 (en) 2009-01-28 2019-04-02 Headwater Research Llc Method for operating a wireless end-user device mobile payment agent
US9557889B2 (en) 2009-01-28 2017-01-31 Headwater Partners I Llc Service plan design, user interfaces, application programming interfaces, and device management
US9098820B2 (en) * 2009-02-23 2015-08-04 International Business Machines Corporation Conservation modeling engine framework
US9009293B2 (en) * 2009-11-18 2015-04-14 Cisco Technology, Inc. System and method for reporting packet characteristics in a network environment
US9015318B1 (en) 2009-11-18 2015-04-21 Cisco Technology, Inc. System and method for inspecting domain name system flows in a network environment
US9148380B2 (en) 2009-11-23 2015-09-29 Cisco Technology, Inc. System and method for providing a sequence numbering mechanism in a network environment
US8792495B1 (en) 2009-12-19 2014-07-29 Cisco Technology, Inc. System and method for managing out of order packets in a network environment
US9350876B2 (en) * 2010-01-04 2016-05-24 Tekelec, Inc. Methods, systems, and computer readable media for detecting initiation of a service data flow using a Gx rule
US9535762B2 (en) 2010-05-28 2017-01-03 At&T Intellectual Property I, L.P. Methods to improve overload protection for a home subscriber server (HSS)
US9319433B2 (en) 2010-06-29 2016-04-19 At&T Intellectual Property I, L.P. Prioritization of protocol messages at a server
US8787303B2 (en) 2010-10-05 2014-07-22 Cisco Technology, Inc. Methods and apparatus for data traffic offloading at a router
WO2012086816A1 (ja) * 2010-12-24 2012-06-28 日本電気株式会社 通信システム、制御装置、ポリシ管理装置、通信方法およびプログラム
US9003057B2 (en) 2011-01-04 2015-04-07 Cisco Technology, Inc. System and method for exchanging information in a mobile wireless network environment
US9154826B2 (en) 2011-04-06 2015-10-06 Headwater Partners Ii Llc Distributing content and service launch objects to mobile devices
US8737221B1 (en) 2011-06-14 2014-05-27 Cisco Technology, Inc. Accelerated processing of aggregate data flows in a network environment
US8948013B1 (en) 2011-06-14 2015-02-03 Cisco Technology, Inc. Selective packet sequence acceleration in a network environment
US8743690B1 (en) 2011-06-14 2014-06-03 Cisco Technology, Inc. Selective packet sequence acceleration in a network environment
RU2477520C1 (ru) 2012-03-14 2013-03-10 Закрытое акционерное общество "Лаборатория Касперского" Система и способ динамической адаптации функционала антивирусного приложения на основе конфигурации устройства
CN102819709B (zh) * 2012-08-15 2016-03-30 小米科技有限责任公司 一种实现系统安全的方法及装置
US9871765B2 (en) * 2012-09-04 2018-01-16 Alcatel Lucent DIAMETER firewall using reception IP address or peer identity
WO2016053232A1 (en) * 2014-09-29 2016-04-07 Hewlett Packard Enterprise Development Lp Security control
US10602000B2 (en) 2014-10-29 2020-03-24 Nokia Of America Corporation Policy decisions based on offline charging rules when service chaining is implemented
US9756016B2 (en) 2014-10-30 2017-09-05 Alcatel Lucent Security services for end users that utilize service chaining
CN107086978B (zh) * 2016-02-15 2019-12-10 中国移动通信集团福建有限公司 一种识别木马病毒的方法及装置
US11190450B2 (en) 2016-06-30 2021-11-30 Intel Corporation System to monitor and control data in a network
US11616782B2 (en) * 2018-08-27 2023-03-28 Box, Inc. Context-aware content object security
US20200067975A1 (en) * 2018-08-27 2020-02-27 Box, Inc. Ransomware remediation in collaboration environments

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1567863A (zh) * 2003-06-17 2005-01-19 华为技术有限公司 一种对外部网络接入的控制方法
CN1889499A (zh) * 2006-07-31 2007-01-03 华为技术有限公司 实现在不同网络之间协商策略信息的方法和系统
US20070066286A1 (en) * 2005-08-31 2007-03-22 Tuija Hurtta Inter-access mobility and service control

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100433899C (zh) * 2004-12-28 2008-11-12 华为技术有限公司 一种保证移动通信系统数据业务安全的方法及系统
CN100417070C (zh) * 2005-05-30 2008-09-03 华为技术有限公司 一种内容计费实现方法和系统
CN100596161C (zh) * 2005-06-18 2010-03-24 华为技术有限公司 一种策略和计费规则决策的实现方法
US7940659B2 (en) * 2006-06-02 2011-05-10 Telefonaktiebolaget Lm Ericsson (Publ) Devices and method for guaranteeing quality of service per service data flow through the bearer layer
US9871872B2 (en) * 2007-04-13 2018-01-16 Nokia Technologies Oy Mechanism for executing server discovery
EP2153621B1 (en) * 2007-04-27 2018-12-26 Telefonaktiebolaget LM Ericsson (publ) A method and a device for improved service authorization

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1567863A (zh) * 2003-06-17 2005-01-19 华为技术有限公司 一种对外部网络接入的控制方法
US20070066286A1 (en) * 2005-08-31 2007-03-22 Tuija Hurtta Inter-access mobility and service control
CN1889499A (zh) * 2006-07-31 2007-01-03 华为技术有限公司 实现在不同网络之间协商策略信息的方法和系统

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Policy and Charging Control Architecture; (Release 7)", 3GPP TS 23.203 V0.1.0, October 2005 (2005-10-01), XP008125213, Retrieved from the Internet <URL:http://www.iscarch.ctsi.org/3GPPScarch/isysquery/038065c2-8b0a-4f9a-9c8b-4bcc84cf4bf/1/doc/sub/23203-010_CLEAN.DOC> *
See also references of EP2106070A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102438201A (zh) * 2010-09-29 2012-05-02 阿尔卡特朗讯 用于基于在线计费信息确定业务流的定向的方法和装置
CN102438201B (zh) * 2010-09-29 2017-06-09 阿尔卡特朗讯 用于基于在线计费信息确定业务流的定向的方法和装置

Also Published As

Publication number Publication date
EP2106070A4 (en) 2012-07-25
CN101299660A (zh) 2008-11-05
US20090307746A1 (en) 2009-12-10
EP2106070A1 (en) 2009-09-30
CN101299660B (zh) 2010-12-08

Similar Documents

Publication Publication Date Title
WO2008134985A1 (fr) Procédé, système et dispositif permettant d&#39;effectuer un contrôle de sécurité
US11647085B2 (en) Service redirection from a policy and charging control architecture
JP4402714B2 (ja) フローベース課金におけるイベント・トリガと再認証トリガを取り扱う方法
WO2009018759A1 (fr) Dispositif de commande, dispositif d&#39;execution, procede et systeme de production de regle de filtre
WO2010108356A1 (zh) 一种终端通过多接入网接入的计费方法和系统及上报方法
WO2007143940A1 (fr) procédé, système et équipement de contrôle des conditions d&#39;utilisation et de la facturation lorsque l&#39;utilisateur est mobile
WO2009046678A1 (fr) Procédé et dispositif pour obtenir la capacité de fonction d&#39;application de politique et de facturation
US20150063328A9 (en) System, policy nodes, and methods to perform policy provisioning of traffic offloaded at a fixed broadband network
WO2008154840A1 (fr) Procédé, système et entité permettant de mettre en œuvre une commande de politique
WO2009086734A1 (zh) 非漫游场景下策略和计费规则功能实体的选择方法
JP2013511175A (ja) サービスイベントトリガ
WO2006017985A1 (en) A method of implementing the service treatment by the functional entity in the service control layer
WO2013064004A1 (zh) 一种更新服务质量的方法及系统
WO2009024056A1 (fr) Procédé, système et dispositif relatifs à une règle de commande de politique et de facturation d&#39;extension
WO2011029289A1 (zh) 漫游场景下承载控制模式的发送方法和系统
WO2013044730A1 (zh) 一种策略与计费规则的服务质量更新方法及系统
WO2008016323A9 (en) Policy management in a roaming or handover scenario in an ip network
WO2009026795A1 (fr) Entité, et système et procédé de mise en oeuvre d&#39;un service autonome de politique utilisateur
WO2009132536A1 (zh) 一种策略授权方法、系统及设备
WO2014048197A1 (zh) 用户设备选择拜访公共陆地移动网络的方法、系统和设备
WO2012071956A1 (zh) 漫游场景支持被赞助数据连接的方法、系统和装置
WO2011088702A1 (zh) 在全业务融合网络中控制资源的方法和系统
WO2009026812A1 (fr) Procédé, dispositif et système d&#39;application d&#39;une politique de contrôle
WO2012129992A1 (zh) 被赞助数据连接的处理方法及策略与计费规则功能实体
WO2010118673A1 (zh) 策略和计费控制的处理方法、系统及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 08734222

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2008734222

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE