WO2009082910A1

WO2009082910A1 - Method and device for network configuration to user terminal

Info

Publication number: WO2009082910A1
Application number: PCT/CN2008/073466
Authority: WO
Inventors: Chuan Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-12-25
Filing date: 2008-12-11
Publication date: 2009-07-09
Also published as: CN101197721A; CN101197721B

Abstract

A method for network configuration to a user terminal is disclosed, the user terminal is applied in a Worldwide Interoperability for Microwave Access network, the method includes: acquiring an IP address of a configuration server, establishing a Transport Layer Security (TLS) tunnel between the user terminal and the configuration server based on the IP address (101); acquiring configuration data through the established TLS tunnel, and configuring parameters of the user terminal based on the acquired configuration data (102).

Description

Method and device for network configuration of user terminal This application claims to be submitted to the Chinese Patent Office on December 25, 2007, and the application number is 200710301584. 6. The Chinese patent entitled "Method and Device for Network Configuration of User Terminal" Priority of the application, the entire contents of which are incorporated herein by reference.

Technical field

The present invention relates to the field of communications, and in particular, to a method and apparatus for network configuration of user terminals in a global network access interoperability (WMAX) network.

Background technique

In the prior art, when the user terminal accesses the WiMAX network, in order to ensure that the user terminal can operate normally, the user terminal must be configured with a network. At present, most of the market uses the framework proposed by the Open Mobile Terminal Alliance (OMA) to perform network configuration on the user terminal.

Network configuration of user terminals using the OMA framework can be divided into two processes: an initial configuration process and a reconfiguration process. During the initial configuration process, the authentication, authorization, and accounting protocol (Authentication, Authorization, Account, AAA for short) informs the Open Mobile Terminal Alliance Data Management (OMADM) server that the user terminal accesses the network, and the OMA DM server initiates the The network configuration process of the user terminal; in the process of the user terminal performing the reconfiguration process, the AAA server provides related information of the user terminal to the OMA DM server, and the OMA DM server initiates network configuration of the user terminal according to the related information of the user terminal.

In the process of implementing the present invention, the inventors have found that the prior art has at least the following problems: In an actual network architecture, the AAA server and the OMA DM server belong to different subnets (the AAA server is a service processing domain). The OMA DM server is a device that operates the maintenance domain. In the process of networking, the two devices are separately networked. In the two isolated subnets, the two devices can be enabled. To communicate, it is necessary to consider the deployment of the device, making the deployment of the AAA server and the MADM server difficult. In addition, for the sake of security, the Access Service Network Gate (ASN-GW) needs to be connected to a firewall or has Network Address Translation (NAT). A function device, the AAA server is connected to a firewall or a device with a NAT function. The firewall and the device with the NAT function only allow the request message initiated by the device on the inner side (user terminal side) of the ASN-GW to pass, and can receive the response message sent by the device outside the ASN-GW (the OMA DM server side) that matches the request message. However, it does not allow the request message that is initiated by the outside (OMA DM server side) device to pass. During the initial configuration and reconfiguration of the user terminal, the configuration file sent by the OMA DM server to the user terminal fails to pass the firewall or the device with the NAT function, so that the OMA DM server fails to perform network configuration on the user terminal. Summary of the invention

Embodiments of the present invention provide a method and apparatus for network configuration of a user terminal. When a device with a firewall or a NAT function exists in the current global microwave access interoperability network, the configuration server cannot perform network configuration on the user terminal. The problem.

One embodiment of the present invention that solves the above technical problems is:

A method for network configuration of a user terminal is applied to a global microwave access interoperability network; and includes the following steps:

Obtaining an IP address of the configuration server, establishing a secure transport layer protocol tunnel between the user terminal and the configuration server according to the IP address; acquiring configuration data through the established secure transport layer protocol tunnel, and configuring the user according to the acquired configuration data The parameters of the terminal.

Another embodiment of the present invention that solves the above technical problems is:

A user terminal, the user terminal accessing a global microwave access interoperability network, including:

An obtaining unit, configured to obtain an IP address of the configuration server;

a tunnel creation unit, configured to establish a secure transport layer protocol tunnel between the user terminal and the configuration server according to the IP address; And a configuration unit, configured to acquire configuration data by using the established secure transport layer protocol tunnel, and configure parameters of the user terminal according to the acquired configuration data.

Still another embodiment of the present invention that solves the above technical problems is:

A configuration server, the configuration server being connected to a global microwave access interoperability network, including:

a tunnel creation unit, configured to establish a secure transport layer protocol tunnel between the user terminal and the configuration server;

And a configuration data sending unit, configured to send configuration data to the user terminal by using the secure transport layer protocol tunnel.

The method and device for performing network configuration on a user terminal according to the embodiment of the present invention, the user terminal actively initiates establishment of a secure transport layer protocol tunnel to the configuration server according to the IP address of the configuration server, and the user terminal passes the The method for obtaining the configuration data by the secure transport layer protocol tunnel overcomes the prior art. In the presence of a firewall or a device with a NAT function, the configuration data actively sent by the configuration server cannot pass through a firewall or a device with a NAT function, thereby configuring The problem that the server cannot perform network configuration on the user terminal ensures the communication security between the user terminal and the configuration device. Since the secure transport layer protocol tunnel is initiated by the user terminal to the configuration server, it does not need to be The AAA server notifies the configuration server that the user terminal is connected to the network. Therefore, the network layout problem between the AAA server and the configuration server is not considered in the process of networking, which makes the networking more flexible and reduces the cost of networking and maintaining the network.

DRAWINGS

FIG. 1 is a flowchart of a method for performing network configuration on a user terminal according to an embodiment of the present invention; FIG. 2 is a timing diagram of initially configuring a user terminal by using a method for performing network configuration on a user terminal according to the embodiment of the present invention; Figure

FIG. 3 is a timing diagram of establishing a TLS tunnel between an MS/SS and an OMA DM server according to a method for performing network configuration on a user terminal according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a network configuration method for a user terminal according to an embodiment of the present invention shown in FIG. 2, A timing diagram of network configuration of the MS/SS by the OMA DM server;

FIG. 5 is a sequence diagram of reconfiguring a user terminal by using a method for performing network configuration on a user terminal shown in FIG. 1 according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic structural diagram of a user terminal and a configuration server according to an embodiment of the present invention.

detailed description

The present invention solves the problem that the configuration data sent by the configuration server cannot pass through a firewall or a device having a NAT function, so that the configuration server cannot perform network configuration on the user terminal, in the prior art, in the presence of a device having a firewall or a NAT function. Embodiments provide a method of network configuration for a user terminal. The present invention will be described in detail below with reference to the accompanying drawings and embodiments. In this embodiment, the method for network configuration of a user terminal is applied to a WiMAX network, and the user terminal is a mobile station (Mobile Station, referred to as MS). / Subscriber station (Subscribe Station, referred to as: SS), the configuration server is an OMA DM server. As shown in FIG. 1, the method includes the following steps:

Step 101: Obtain an IP address of the OMADM server, and establish a Transport Layer Security (TLS) tunnel between the MS/SS and the OMA DM server according to the IP address.

Step 102: Acquire configuration data by using the established TLS tunnel, and configure parameters of the MS/SS according to the acquired configuration data.

In an actual network, the network configuration of the MS/SS in step 101 can be divided into two types: one is, when the MS/SS enters the network for the first time, the MS/SS is initially configured; the other is After the MS/SS has accessed the network, the network configuration of the MS/SS is updated, that is, the MS/SS is reconfigured. The following describes them separately:

In the first case, as shown in FIG. 2, the method for performing initial configuration on the MS/SS by using the method for performing network configuration on the user terminal provided by the embodiment of the present invention includes:

Step 201: The MS/SS and the BS negotiate air interface parameters, and the air interface parameters are negotiated to enable the MS/SS and the BS to perform normal communication. Step 202: The AAA server performs identity authentication on the MS/SS.

In the process of authenticating the MS/SS by the AAA server, first, the ASN-GW sends a requesting user terminal identity message to the MS/SS; in order to enable the AAA server to actively determine whether the MS/SS needs network configuration, the MS After receiving the requesting user terminal identity message, the SS returns the identity information carrying the identity of the user terminal to the AAA server, where the identity of the user terminal includes: the service type, the user name, and the domain to which the user terminal belongs, in this embodiment. The identity format of the user terminal is: {service type} user name@domain to which the user terminal belongs. When the MS/SS first accesses the network, the MS/SS finds that it lacks data of the network configuration, so it is The service type field in the identity is set to require network configuration. When the MS/SS loses its network configuration data due to an abnormality in the network, the MS/SS may also set the service type field in its identity to be needed. Perform network configuration; After receiving the MS/SS identity information, the AAA server uses the extended authentication protocol - Transport Layer Security (Ext Ensible Authentication Protocol - Transport Layer Security (EAP-TLS), or the Extensible Authentication Protocol - Tunneled Transport Layer Security (EAP-TTLS) protocol for the identity of the MS/SS Certification.

Step 203: After the AAA server successfully authenticates the MS/SS, the AAA server may determine, according to the service type field in the MS/SS identity, that the MS/SS needs to perform network configuration. Of course, the AAA server may also determine the MS by itself. Whether the SS needs to perform network configuration; when the AAA server sends an authentication success message to the MS/SS, the authentication success message carries a command ASN-GW to start a pre-configured message to the MS/SS;

In this embodiment, the authentication success message carries a message that the ASN-GW is enabled to enable the hotline function on the MS/SS, where the function of the hotline function is: causing the ASN-GW to prohibit the user terminal from other than the network configuration process. Business data is passed;

In order to enable the MS/SS to obtain the IP address of the OMA DM server, and then initiate the process of establishing a TLS tunnel to the OMA DM server according to the IP address, the AAA server can successfully authenticate the IP address of the pre-configured OMA DM server. a message is sent to the MS/SS;

In order to enable the MS/SS to periodically update its network configuration during future network operations, the AAA server may also set the time for updating the MS/SS network configuration for the MS/SS, the update MS/SS network configuration. The time can be manually set by the network administrator, for example: 2 hours, 1 day or 1 month, etc. The specific update time of the MS/SS network configuration can be determined according to the actual network operation needs, and the AAA server will update the MS. The time of the /SS network configuration is sent to the MS/SS through the authentication success message.

Step 204: When the authentication success message sent by the AAA server to the MS/SS passes the ASN-GW, the ASN-GW discovers that the authentication success message carries the command to start the hotline function, and the ASN-GW starts the hotline function on the MS/SS. And establishing a pre-configured service flow for the MS/SS; Step 205: After the MS/SS receives the authentication success message, the pre-configured service flow established by the ASN-GW is configured to the dynamic host configuration protocol (Dynamic Host) Configuration Protocol, abbreviation: DHCP) The server applies for an IP address;

In the process of the MS/SS requesting the IP address from the DHCP server, in order to enable the MS/SS to obtain the IP address of the OMA DM server, the process of establishing a TLS tunnel is initiated to the OMA DM server according to the IP address of the OMA DM server. The DHCP server may add the IP of the pre-configured OMA DM server to the Option field of the DHCP message, and transmit the DHCP message to the MS/SS. The ASN-GW may also transmit the DHCP message. The process of adding the IP address information of the pre-stored OMA DM server to the Option field of the DHCP message, so as to transmit the IP address of the OMA DM server to the MS/SS;

In the process of the MS/SS requesting the IP address from the DHCP server, the DHCP server or the ASN-GW may also set the time for updating the MS/SS network configuration for the MS/SS, and add the time for updating the MS/SS network configuration. The HCP packet is transmitted to the MS/SS through the HCP packet in the Option field of the HCP packet.

Step 206: After the MS/SS obtains the IP address assigned by the DHCP server, the ASN-GW reports the charging bill of the pre-configured service flow to the AAA server. In order to make the charging situation of the charging bill more reasonable, in the embodiment, the charging bill separately records the pre-configured data traffic and the data traffic of the user terminal. The pre-configured data traffic is data traffic transmitted between the MS/SS and the OMA DM server, and the ASN-GW can determine whether the data is based on whether the IP packet header of the transmitted data contains an IP address of the OMADM server. Data traffic transmitted between the MS/SS and the OMA DM server; the data traffic of the user terminal is data traffic other than the pre-configured data traffic. The pre-configured data traffic is not the data traffic generated by the MS/SS itself. Therefore, the ASN network operator to which the ASN-GW belongs may charge the CSN network operator to which the AAA server belongs.

Step 207: The MS/SS initiates a process of establishing a TLS tunnel to the OMA DM server according to an IP address of the OMA DM server.

The steps of establishing a TLS tunnel between the MS/SS and the OMADM server mainly include:

The MS/SS is based on the process of mutual authentication between the IP address of the OMA DM server and the OMA DM server.

As shown in Figure 3, the specific steps include:

Step 301: The MS/SS sends a ClientHello (Client Negotiation) message to the OMA DM server to indicate that the TLS handshake process starts. The ClientHello message requests the OMA DM server to negotiate a TLS-related security service, where the message is by version number, random number, and session. ID, cipher suite, compression method, etc.

Step 302: After receiving the ClientHello message, the OMA DM server sends a ServerHello (Server Negotiation) message to the MS/SS. The composition of the ServerHello message is the same as the ClientHello message. Usually, the ClientHello message gives the recommended value of each field. The OMADM server Send the final selection result to the MS/SS through the ServerHello message;

Step 303, the OMADM server sends its own digital certificate, together with a trusted CA certificate, to the MS/SS through a Certificate message;

Step 304: If the RSA public key is relatively long and cannot be placed in the Certificate message in step 303, the OMADM server passes the ServerKeyExchange (Server Public Key Exchange) message. Distributing an RSA public key to the MS/SS;

Step 305: The OMA DM server sends a ServerRequest message to apply for a digital certificate to the MS/SS.

Step 306, the OMADM server sends a ServerHelloDone (Server Negotiation Complete) message to notify the MS/SS that the OMA DM server has completed the negotiation process; the ServerHelloDone message itself does not carry any information, and the MS/SS only successfully receives the message. After entering the interaction of subsequent messages;

Step 307: The MS/SS authenticates the digital certificate of the OMA DM server by using the CA certificate, that is, whether the authentication OMA DM server is legal, and the OMA DM server authenticates the TLS key through the RSA algorithm;

Step 308, the MS/SS sends its own digital certificate to the OMA DM server through a Certificate (Certificate) message, and the same trusted CA certificate;

Step 309, if the RSA public key is relatively long and cannot be placed in the Certificate message in step 308, the MS/SS then distributes the RSA public key to the OMADM server through a ClientKeyExchange (Client Public Key Exchange) message;

Step 310: The MS/SS sends a ChangeCipherSpec (Change Password Rule) message to the OMADM server, and activates the TLS negotiation option of the OMA DM server, where the TLS negotiation option includes: a TLS session key, a validity of the cipher suite, and the like;

Step 311: The MS/SS sends a Finished message to the OMA DM server, and checks whether the TLS negotiation option activated in step 310 is valid.

Step 312: The OMA DM server authenticates the digital certificate of the MS/SS by using the CA certificate, that is, whether the authentication MS/SS is legal, and the AAA key is calculated by the RSA algorithm for the authenticated MS/SS;

Step 313: The OMA DM server activates the TLS negotiation option of the MS/SS by sending a ChangeCipherSpec message.

Step 314, the OMA DM server sends a Finished message to the MS/SS, checking Whether the TLS negotiation option activated in step 313 is valid.

A TLS tunnel can be established between the MS/SS and the OMA DM server by the steps shown in FIG.

Step 208: The OMA DM server transmits the network configuration data to the MS/SS by using the TLS tunnel established in the step 207. As shown in FIG. 4, the OMA DM server includes:

Step 401: The OMADM server sends a startup configuration file to the MS/SS, where the startup configuration file includes: an address of the OMA DM server and a management object tree. The management object tree contains manageable attributes defined in the OMA protocol, and is managed by a tree structure.

Step 402: After receiving the startup configuration file, the MS/SS reports the identity information of the running user and the MS/SS on the MS/SS to the OMADM server.

Step 403: The OMA DM server determines the legality according to the identity information reported by the MS/SS, and sends its own identity information to the MS/SS, and performs network configuration on the MS/SS. The network configuration includes: SS performs operations such as reading, writing, replacing, or creating node attributes;

Step 404: After the MS/SS authentication is performed, the OMA DM server performs an indication of network configuration on the OMA DM server, and returns an execution result to the OMA DM server.

Step 209: After the OMA DM server ends the network configuration of the MS/SS, the MS/SS initiates the process of re-entering the network configuration data sent by the OMA DM server.

In this embodiment, when the MS/SS is initially configured, the MS/SS sends an identity to the AAA server, and the AAA server can determine whether the MS/SS needs to be determined by the identity identifier. Performing network configuration, the MS/SS automatic startup pre-configuration process that requires network configuration, the WiMAX network operation is more autonomous and flexible than the prior art; since the TLS tunnel is initiated by the MS/SS according to the IP address of the OMADM server Initiated, so when there is a firewall or a NAT-enabled device in the WiMAX network, the OMA DM server can also perform network configuration on the MS/SS through the TLS tunnel, and the OMA DM server needs to perform network configuration through the TLS tunnel. The MS/SS communicates directly, and the network layout between the AAA server and the configuration server does not have to be considered in the process of networking, so that the networking is more flexible. Live, reducing the cost of networking; since the configuration data between the MS/SS and the OMA DM server is transmitted through the TLS tunnel, communication security between the MS/SS and the OMA DM server is guaranteed; The authentication process used in the embodiment is the same as the original authentication process of the WiMAX network in the prior art, which reduces the maintenance and allocation of the network, and separately counts the pre-configured data traffic, so that the charging method of the WiMAX network is more reasonable.

In the second case, as shown in FIG. 5, the method for reconfiguring the MS/SS by using the method for performing network configuration on the user terminal provided by the embodiment of the present invention includes:

Step 501: Determine whether the MS/SS needs to update a network configuration.

In this embodiment, not only the OMA DM server may determine whether the MS/SS needs to update the network configuration, but also may be configured by the MS/SS according to the updated user terminal network sent by the AAA server, the DHCP server, or the ASN-GW. Time to determine if you need to update your network configuration.

Since the MS/SS can determine whether it needs to update the network configuration according to the time of updating the network configuration of the user terminal, the MS/SS can directly obtain the time to update the network configuration of the user (when the time of updating the network configuration expires), and the OMA DM The server saves the process that the OMA DM server sends a request to update the network configuration message to the MS/SS compared to whether the MS/SS needs to update the network configuration, thereby saving network resources.

Step 502: When it is determined that the MS/SS needs to update the network configuration, the MS/SS initiates the establishment of the TLS tunnel to the OMA DM server according to the IP address of the OMA DM server, and the specific establishment process of the TLS tunnel is as shown in FIG. , will not repeat them here;

Step 503: The OMA DM server delivers configuration data to the MS/SS through the TLS tunnel, and the network configuration process of the OMA DM server to update the MS/SS through the TLS tunnel is shown in FIG. 4, and details are not described herein again.

The method for performing network configuration on a user terminal according to the embodiment of the present invention, when performing network configuration on the user terminal, the user terminal initiates a secure transport layer protocol tunnel to the configuration server according to the IP address of the configuration server, and The configuration server passes the secure transmission The transport layer protocol tunnel performs network configuration on the user terminal, and overcomes the prior art. When a firewall or a device with a NAT function exists, the configuration data sent by the configuration server cannot pass through a firewall or a device with a NAT function, so that the configuration server cannot The problem of network configuration for the user terminal, and ensuring communication security between the user terminal and the configuration device; since the secure transport layer protocol tunnel is initiated by the user terminal to the configuration server, it is not required to be AAA. The server notifies the configuration server that the user terminal is connected to the network. Therefore, the network layout between the AAA server and the configuration server is not considered in the networking process, which makes the networking more flexible and reduces the cost of networking and maintaining the network.

The present invention solves the problem that the configuration data sent by the configuration server cannot pass through a firewall or a device having a NAT function, so that the configuration server cannot perform network configuration on the user terminal, in the prior art, in the presence of a device having a firewall or a NAT function. Embodiments provide a user terminal and a configuration server. The present invention is described in detail below with reference to the accompanying drawings and embodiments. In this embodiment, the user terminal is an MS/SS, and the configuration server is an OMA DM server, and the configuration server performs network configuration on the user terminal through the WiMAX network.

As shown in FIG. 6, the MS/SS includes:

The obtaining unit 601 is configured to obtain an IP address of the OMA DM server, where the IP address of the OMA DM server can be obtained by using an authentication success message sent by the AAA server, or when the MS/SS applies for an IP address to the DHCP server, The server or the ASN-GW obtains the IP address information of the OMA DM server added in the Option field of the DHCP message.

In order to be able to periodically update the network configuration after the MS/SS is connected to the network, that is, to perform reconfiguration, the obtaining unit 601 is further configured to acquire a time for updating the network configuration of the user terminal, where the time for updating the network configuration of the user terminal can be The authentication success message sent by the AAA server is obtained. When the MS/SS requests the IP address from the DHCP server, the DHCP server or the ASN-GW adds the time address of the network configuration of the user terminal added in the Option field of the DHCP message. Information is obtained. Through the timing unit 602, the MS/SS can detect whether it needs to update the network configuration, so as to initiate the process of updating the network configuration in time, and send a request to the MS/SS to update the network configuration message by the OMA DM server, the MS/SS Compared with the process of initiating the update of the network configuration after receiving the request message, the network resources are saved, and the speed of updating the network configuration to the MS/SS is improved.

a tunnel creation unit 603, configured to establish a TLS tunnel between the MS/SS and the OMA DM server according to the IP address;

In the process of establishing a TLS tunnel, the tunnel creation unit 603 may perform identity authentication between the authentication unit 604 and the OMA DM server, thereby establishing a TLS tunnel. For the specific establishment process, refer to the method shown in FIG. 3, where No longer;

In the process of reconfiguring the MS/SS, the timing of updating the network configuration of the user terminal received by the obtaining unit 601 is counted by the timing unit 602. When the timing expires, the tunnel creation unit 603 initiates establishment of the TLS tunnel. the process of.

The configuration unit 605 is configured to obtain the configuration data through the established secure transport layer protocol tunnel, and configure the parameters of the user terminal according to the obtained configuration data. The specific configuration process is shown in FIG. 4, and details are not described herein.

As shown in FIG. 6, the OMA DM server includes:

The tunnel creation unit 606 is configured to establish a TLS tunnel between the MS/SS and the OMA DM server. In the process of establishing the TLS tunnel, the tunnel creation unit 606 can perform identity authentication between the authentication unit 607 and the MS/SS. For the establishment of a TLS tunnel, refer to the method shown in Figure 3 for details.

The configuration data sending unit 608 is configured to send configuration data to the MS/SS through the TLS tunnel, and the specific configuration process is shown in FIG. 4, and details are not described herein again.

The user terminal and the configuration server provided by the embodiment of the present invention, because the user terminal actively initiates establishment of a secure transport layer protocol tunnel according to the IP address of the configuration server, and transmits the configuration data through the secure transport layer protocol tunnel Therefore, the prior art is overcome when the configuration data sent by the configuration server is not present in a firewall or a device having a NAT function. The problem that the configuration server cannot perform network configuration on the user terminal through the firewall or the device having the NAT function, and the communication security between the user terminal and the configuration device is ensured; since the secure transport layer protocol tunnel is the user terminal Proactively initiated to the configuration server, so the AAA server does not need to notify the configuration server that the user terminal is connected to the network. Therefore, the network layout between the AAA server and the configuration server is not considered in the networking process, which makes the networking more flexible and reduces. The cost of networking and maintaining the network.

The method and apparatus for network configuration of a user terminal provided by the present invention can be applied to a WiMAX network, and the MS/SS is configured by the framework provided by the OMA.

A person skilled in the art can understand that all or part of the steps of implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, such as ROM/RAM, magnetic. Disc or CD.

The foregoing is only a specific embodiment of the embodiments of the present invention, but the scope of protection of the embodiments of the present invention is not limited thereto, and any changes made by those skilled in the art within the technical scope disclosed by the present invention may be Alternatives are intended to be covered by the scope of the present invention. Therefore, the scope of protection of the embodiments of the present invention should be determined by the scope of the claims.

Claims

Claim

A method for network configuration of a user terminal, which is characterized in that it is applied to a global microwave access interoperability network; and includes the following steps:

Obtaining an IP address of the configuration server, and establishing a secure transport layer protocol tunnel between the user terminal and the configuration server according to the IP address;

The configuration data is obtained through the established secure transport layer protocol tunnel, and the parameters of the user terminal are configured according to the obtained configuration data.

The method for performing network configuration on a user terminal according to claim 1, wherein the obtaining an IP address of the configuration server includes:

Obtain the IP address of the configuration server from the authentication, authorization, and accounting protocol server.

The method for performing network configuration on a user terminal according to claim 2, wherein the obtaining, by the verification, authorization, and accounting protocol server, the IP address of the configuration server includes:

The authentication, authorization, and accounting protocol server sends the IP address of the configuration server to the user terminal through the identity authentication success message.

Obtaining an IP address of the configuration server from the dynamic host configuration protocol server, where the dynamic host configuration protocol server is pre-configured with an IP address of the configuration server; or

Obtaining an IP address of the configuration server from the access service network gateway, where the access service network gateway is configured with an IP address of the configuration server.

The method for performing network configuration on a user terminal according to claim 4, wherein the obtaining the IP address of the configuration server from the dynamic host configuration protocol server comprises: the user terminal initiating acquisition of an IP address from the dynamic host configuration protocol server In the process, obtaining the IP address of the configuration server from the dynamic host configuration protocol server;

The obtaining the IP address of the configuration server from the access service network gateway includes: obtaining, by the user terminal, the configuration from the access service network gateway during the process of obtaining the IP address from the dynamic host configuration protocol server The IP address of the server.

The method for performing network configuration on a user terminal according to claim 4, wherein the obtaining the IP address of the configuration server from the dynamic host configuration protocol server comprises: the dynamic host sent by the user terminal from the dynamic host configuration protocol server Configure the IP address of the configuration server in the Option field of the protocol packet.

The obtaining, by the access service network gateway, the IP address of the configuration server includes: obtaining, by the user terminal, an IP address of the configuration server from an Option field of the dynamic host configuration protocol packet transmitted by the access service network gateway.

The method for performing network configuration on a user terminal according to claim 1, wherein before the establishing a secure transport layer protocol tunnel between the user terminal and the configuration server according to the IP address, the method further comprises: according to the user terminal The identity identifies whether the network configuration of the user terminal is performed.

The method for performing network configuration on a user terminal according to claim 7, wherein the identity identifier of the user terminal includes: a service type, a user name, and a domain to which the user terminal belongs;

Determining whether to perform network configuration on the user terminal according to the identity of the user terminal includes: determining, according to a service type field in the identity identifier of the user terminal, whether to perform network configuration on the user terminal.

The method for performing network configuration on a user terminal according to claim 1, wherein before the establishing a secure transport layer protocol tunnel between the user terminal and the configuration server according to the IP address, the method further comprises:

Get the time to update the user terminal network configuration.

The method for performing network configuration on a user terminal according to claim 9, wherein the obtaining the time for updating the network configuration of the user terminal comprises:

The time for updating the network configuration of the user terminal is obtained from the authentication, authorization, and accounting protocol server.

The method for performing network configuration on a user terminal according to claim 10, wherein the time for obtaining the updated user terminal network configuration from the verification, authorization, and accounting protocol server comprises: The authentication, authorization, and accounting protocol server sends the time when the user terminal network configuration is updated to the user terminal through the identity authentication success message.

Obtaining a time for updating the network configuration of the user terminal from the dynamic host configuration protocol server, where the dynamic host configuration protocol server is pre-configured with a time for updating the network configuration of the user terminal; or

And obtaining, by the access service network gateway, a time for updating the network configuration of the user terminal, where the access service network gateway is pre-configured with a time for updating the network configuration of the user terminal.

The method for performing network configuration on a user terminal according to claim 12, wherein the obtaining, by the dynamic host configuration protocol server, the time for updating the network configuration of the user terminal comprises: the user terminal initiating acquisition to the dynamic host configuration protocol server During the process of obtaining an IP address, the time of updating the network configuration of the user terminal is obtained from the dynamic host configuration protocol server;

The obtaining, by the access service network gateway, the time for updating the network configuration of the user terminal comprises: obtaining, by the user terminal, the time for updating the network configuration of the user terminal from the access service network gateway in the process of initiating the obtaining of the IP address from the dynamic host configuration protocol server.

The method for performing network configuration on a user terminal according to claim 12, wherein the obtaining, by the dynamic host configuration protocol server, the time for updating the network configuration of the user terminal comprises: sending, by the user terminal, the dynamic host configuration protocol server Obtaining the time for updating the network configuration of the user terminal in the Option field of the dynamic host configuration protocol packet;

The time for obtaining the updated user terminal network configuration from the access service network gateway includes: obtaining, by the user terminal, the time for updating the network configuration of the user terminal from an Option field of the dynamic host configuration protocol message transmitted by the access service network gateway.

The method for network configuration of a user terminal according to any one of claims 9 to 14, further comprising:

The user terminal establishes a secure transport layer protocol tunnel between the user terminal and the configuration server according to the time when the network configuration of the user terminal is updated.

The method for performing network configuration on a user terminal according to any one of claims 1 to 14, wherein the establishing a secure transport layer protocol tunnel between the user terminal and the configuration server according to the IP address comprises:

According to the IP address, the user terminal and the configuration server authenticate each other.

The method for performing network configuration on a user terminal according to any one of claims 1 to 14, wherein before the configuring the parameter of the user terminal according to the acquired configuration data, the method further includes: A pre-configured service flow is established, and the charging CDR of the pre-configured service flow is sent to the authentication, authorization, and accounting protocol server, where the pre-configured data traffic is data traffic transmitted between the user terminal and the configuration server.

18. A user terminal, wherein the user terminal accesses a global microwave access interoperability network, and includes:

a tunnel creation unit, configured to establish a security transport layer protocol tunnel between the user terminal and the configuration server according to the IP address;

And a configuration unit, configured to acquire configuration data by using the established secure transport layer protocol tunnel, and configure parameters of the user terminal according to the obtained configuration data.

19. The user terminal of claim 18, wherein

The obtaining unit is further configured to acquire a time for updating a network configuration of the user terminal;

The tunnel creation unit initiates tunnel creation according to the time of the configuration of the updated user terminal network acquired by the acquisition unit.

The user terminal according to claim 18, further comprising:

The timing unit is configured to control the tunnel creation unit to establish a secure transport layer protocol tunnel between the user terminal and the configuration server.

The user terminal according to claim 18, wherein the tunnel creation unit comprises: an authentication unit, configured to perform identity authentication between the IP address and the configuration server.

22. A configuration server, wherein the configuration server is connected to global microwave access In an interoperability network, including:

The configuration server according to claim 22, wherein the tunnel creation unit comprises: an authentication unit, configured to perform identity authentication with the user terminal.