WO2010015188A1

WO2010015188A1 - Method, device and system for accessing mobile core network of access points

Info

Publication number: WO2010015188A1
Application number: PCT/CN2009/073068
Authority: WO
Inventors: 曹文利
Original assignee: 华为技术有限公司
Priority date: 2008-08-04
Filing date: 2009-08-04
Publication date: 2010-02-11
Also published as: CN101645814B; CN101645814A

Abstract

A method for accessing a mobile core network of access points is provided. The method includes the following steps: IP security protocol tunnels are established toward a security gateway through IP address of the security gateway; an access gateway of the mobile core network is accessed through IP address of the access gateway on the IP security protocol tunnels; the access of at least one access point is received; the access points are forwarded to the access gateway of the mobile core network. An assembling entity of the access points is further provided.

Description

Method, device and system for access point accessing mobile core network. The present application claims to be submitted to Chinese Patent Office on August 4, 2008, application number is 200810041477.9, and the invention name is "an access point access mobile core network method" The priority of the Chinese Patent Application, the entire disclosure of which is incorporated herein by reference.

Technical field

The present invention relates to the field of network communication technologies, and in particular, to a method, device and system for an access point to access a mobile core network.

Background technique

Access Point (AP, Access Point) is a network device that provides wireless access services for home, small office and home office (SOHO) based on the fixed Internet (IP, Internet Protocol) transmission network. .

See Figure 1, which is a block diagram of an AP applied to a home network.

The user equipment (UE, User Equipment) accesses the AP through the air interface, and the AP accesses the IP transmission network through the home gateway (HGW, Home Gateway), and then connects to the security gateway (SeGW, Security Gateway) in the mobile core network through the IP transmission network. , then connect to the access gateway (AG, Access Gateway). The HGW can be integrated on the AP, and the SeGW can be integrated on the AG.

The AP has a Subscriber Identity Module (SIM) card or a Universal Mobile Telecommunications System Subscriber Identity Module (USIM) card. When the AP and SeGW establish an Internet Security Protocol (IPSec) protocol, the AP needs to authenticate the AP through the SIM or USIM to ensure that only the legal AP can access the mobile mobile core network. The IPSec tunnel also ensures the AP. The security of information transmitted over a public IP transport network. The AP and AG can be a Universal Mobile Telecommunications System (UMTS), a Global System for Mobile Communications (GSM), or a Code Division Multiple Access (CDMA). .

In addition to being applied to the home network, the AP can also be applied to a corporate or school network. See Figure 2, which is a block diagram of an AP applied to a corporate network or a school network.

The first user equipment UE, the second user equipment UE, and the third user equipment UE respectively access the first access Point AP, second access point AP and third access point AP. Each AP needs to establish an IPSec tunnel through the enterprise gateway or the campus gateway and the SeGW. As a result, multiple IPSec tunnels exist between the enterprise gateway or the campus gateway and the SeGW, which wastes the egress bandwidth of the enterprise gateway or campus gateway. Local calls and local data interaction between multiple APs or APs and other devices must be implemented by AG transfer, which wastes the bandwidth of the mobile core network and requires the use of mobile core network resources, so such local calls and local calls Data interaction is not free. In addition, the enterprise network or the campus network needs the AP network to provide a large range of continuous coverage, and the handover function between the APs is implemented by the AG, which wastes the mobile core network resources. Since each AP has a SIM card or a USIM card, and multiple APs are distributed in the enterprise or school building, it is easy to cause the SIM card or the USIM card to be stolen, and there is no guarantee for security.

It can be seen that when multiple APs of an enterprise or campus access the mobile core network through the enterprise gateway or the campus gateway, not only the mobile core network resources are wasted, but also the SIM card or the USIM card carried by each AP also has security problems.

Summary of the invention

Embodiments of the present invention provide a method, device, and system for an access point to access a mobile core network, which saves resources of a mobile core network.

An embodiment of the present invention provides a method for an access point to access a mobile core network, including: an access point aggregation entity establishes an IP network security protocol tunnel between the security gateway and an IP gateway; and the access point aggregates The entity accesses the access gateway of the mobile core network by using the IP address of the access gateway through the foregoing IP network security protocol tunnel; the access point aggregation entity receives access of at least one access point; the access point convergence entity Transferring the access point to an access gateway of the mobile core network.

The embodiment of the present invention further provides an access point aggregation device, including: an establishing unit, configured to establish an IP network security protocol tunnel between the security gateway and the security gateway by using an IP address of the security gateway; The IP network security protocol tunnel established by the unit, the access gateway of the mobile core network is accessed by the IP address of the access gateway; the receiving unit is configured to receive the access of the access point, and the access point has at least one; a unit, configured to transfer the access point to an access gateway of the mobile core network.

The embodiment of the present invention further provides a system for an access point to access a mobile core network, including: an access point, a security gateway, an access gateway, and an access point aggregation device provided by the foregoing embodiment; Providing a wireless access service for the user equipment to access the mobile core network; the security gateway is configured to protect the mobile core network side entity; and the access gateway is configured to provide an interface for the user equipment to access the mobile core network. In the above technical solution, an IPSec tunnel is established between the AP aggregation entity and the SeGW, and the AG of the mobile core network is accessed through the IPSec tunnel. At the same time, the AP aggregation entity receives access of multiple APs, and transfers the AP to the AG of the mobile core network. Since the AP aggregation entity is added, an IPSec tunnel is established between each AP and the SeGW, and the egress bandwidth of the local area network (such as an enterprise gateway or a campus gateway) is saved.

DRAWINGS

Figure 10 is a schematic view of a second embodiment of the apparatus based on the present invention;

11 is a structural diagram of a first embodiment of the system based on the present invention;

Figure 12 is a structural view of a second embodiment of the system based on the present invention;

Figure 13 is a block diagram showing a third embodiment of the system based on the present invention.

detailed description

A method for accessing a mobile core network by using an access point is described in the first embodiment of the present invention, including:

The access point aggregation entity establishes an IP network security protocol tunnel between the security gateway and the security gateway. The access point aggregation entity accesses the mobile core network through the IP network security protocol tunnel of the access gateway. An access gateway; an access point aggregation entity receives access of at least one access point; and an access point aggregation entity transfers the access point to an access gateway of the mobile core network.

The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

Method embodiment one:

Referring to Figure 3, a flow chart of a method based on a first embodiment of the present invention. This example uses an AP as an example to describe the process for an AP to access an AG through an AP aggregation entity.

101. The AP aggregation entity establishes an IPSec tunnel with the SeGW by the IP address of the SeGW. The AP aggregation entity may have the IP address of the SeGW, so that the IPSec tunnel between the SeGW and the SeGW can be directly established by the IP address of the SeGW.

When the AP aggregation entity does not have the IP address of the SeGW, the AP aggregation entity can resolve the IP address corresponding to the Fully Qualified Domain Name (FQDN) of the SeGW through the Domain Name System (DNS) server on the IP transport network. .

The IPSec tunnel between the AP aggregation entity and the SeGW can be one or two. When the IPSec tunnel is one, the IPSec tunnel is used for voice and data services. When two IPSec tunnels are used, one IPSec tunnel can be used for voice services. One IPSec tunnel is used for data services.

In this embodiment, the AP aggregation entity carries a SIM card or a USIM card. When establishing an IPSec tunnel with the SeGW, the SeGW can authenticate the AP aggregation entity through the SIM card or the USIM card, and check whether the AP aggregation entity is legal. . When the AP aggregation entity carries the SIM card, the EAP-SIM uses the Extensible Authentication Protocol (EAP-SIM), and the Extensible Authentication ID is correct. The AP aggregation entity is legal. When the AP aggregation entity carries the USIM card, it is used. The Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AK) protocol checks whether the user ID carried by the USIM card is correct. If it is correct, the AP aggregation entity is legal.

102. Access the AG of the mobile core network by using the IP address of the AG through the IPSec tunnel.

The AP aggregation entity may have the IP address of the AG so that the AG can be directly accessed by the AG's IP address.

When the AP aggregation entity does not have an IP address of the AG, the AP aggregation entity can resolve the IP address corresponding to the FQDN of the AG through the DNS server on the mobile core network.

103. The AP aggregation entity receives the access of the AP.

It should be noted that there is no chronological order between step 103 and steps 101 and 102, and step 103 may be between step 101 or 102, or between step 101 and step 102.

AP can be configured through dynamic host configuration (DHCP, Dynamic Host Configuration) Protocol) Access to the AP aggregation entity. The AP aggregation entity can check the media access control (MAC, Media Access Control) address, access link identifier, or device identifier and the configured MAC address in the AP packet, and the AP does not carry the SIM card or the USIM card. If the inbound link ID or the device ID is the same, the AP is legal and the AP is allowed to access.

104. The AP aggregation entity transfers the AP to the AG of the mobile core network.

The AP can configure the software version, AP wireless parameters, mobile core network parameters, AG address, and AP signing service parameters through the ACS (Automatic Configuration Server).

Alternatively, the AP aggregation entity may temporarily store the software version, the AP radio parameters, the mobile core network parameters, the AG address, and the AP-signed service parameters to the user, and then the AP configures the software version, the AP wireless parameters, and the mobile through the AP aggregation entity. Core network parameters, AG address, and AP signing business parameters.

If there is a proprietary connection link between the AP and the AP aggregation entity, the AP aggregation entity transfers the AP to the AG of the mobile core network through the proprietary connection link.

For example, the proprietary connection link is a virtual local area network (VLAN, Virtual Local Area).

Network), the AP convergence entity transfers the AP to the AG of the mobile core network through the VLAN.

If there is no proprietary connection between the AP and the AP aggregation entity, an IPSec tunnel can be established between the AP and the AP aggregation entity. The AP aggregation entity transfers the AP to the AG of the mobile core network through the IPSec tunnel.

An AP aggregation entity can aggregate multiple APs.

The SeGW may be integrated on the AG or may be an independent physical entity.

The method in the first embodiment of the method achieves the purpose of accessing the AG of the mobile core network by adding an AP aggregation entity. Since one or two IPSec tunnels are established between the AP aggregation entity and the SeGW, the egress bandwidth of the LAN gateway (such as an enterprise gateway or a campus gateway) is saved. At the same time, because the AP aggregation entity carries the SIM card or the USIM card, the SeGW can directly authenticate the AP aggregation entity, and the AP aggregation entity can be located in the same equipment room as the LAN gateway (such as the enterprise gateway or the campus gateway), thereby avoiding the AP carrying. Security issues when using a SIM card or USIM card. Method Embodiment 2:

Referring to Figure 4, a flow chart of a method based on a second embodiment of the present invention.

In the second embodiment, it is assumed that the AP aggregation entity does not have the IP addresses of the SeGW and the AG, and the AP and the AP. There are no proprietary connection links between the aggregation entities.

201. The AP aggregation entity parses the IP address of the SeGW.

If the AP aggregation entity has the FQDN of the SeGW, or the AP aggregation entity can derive the FQDN of the SeGW, the AP aggregation entity can resolve the IP address corresponding to the FQDN of the SeGW through the DNS server on the IP transmission network.

202. The AP aggregation entity establishes an IPSec tunnel with the SeGW.

The IPSec tunnel between the AP aggregation entity and the SeGW can be one or two. When the IPSec tunnel is one, the IPSec tunnel is used for voice and data services. An IPSec tunnel is used for voice services when an IPSec tunnel is used. An IPSec tunnel is used for data services.

The AP aggregation entity carries a SIM card or a USIM card. When establishing an IPSec tunnel with the SeGW, the SeGW can authenticate the AP aggregation entity through the SIM card or the USIM card to check whether the AP aggregation entity is legal. When the AP aggregation entity carries the SIM card, check whether the user ID carried by the SIM card is correct by using the EAP-SIM protocol. If the AP aggregation entity is correct, the AP aggregation entity is legal. When the AP aggregation entity carries the USIM card, the EAP-AKA protocol checks whether the user ID carried by the USIM card is correct. If the AP aggregation entity is correct, the AP aggregation entity is legal.

In addition, when the AP aggregation entity establishes an IPSec tunnel with the SeGW, the SeGW can also authenticate the AP aggregation entity by using a pre-shared key or a digital certificate, and check whether the AP aggregation entity is legal.

203. The AP aggregation entity parses the IP address of the AG.

If the AP aggregation entity has the FQDN of the AG, or the AP aggregation entity can derive the AG's

FQDN, the AP aggregation entity can resolve the IP address corresponding to the FQDN of the AG through the DNS server on the mobile network.

204. The AP aggregation entity accesses the AG of the mobile core network by the IP address of the AG.

205. The AP aggregation entity is configured through the ACS.

The AP aggregation entity mainly configures mobile core network parameters and software versions.

The step 206 of the second embodiment is similar to the step 103 of the first embodiment, and is not described here.

207. The AP establishes an IPSec tunnel with the AP aggregation entity.

208. The AP performs self-configuration through the AP aggregation entity. The configuration content is software version, AP wireless parameters, mobile core network parameters, AG address, and AP signing service parameters.

209. The AP aggregation entity transfers the AP to the AG of the mobile core network.

The AP aggregation entity transfers the AP to the AG of the mobile core network through the IPSec tunnel established in step 207.

It should be noted that step 208 may also be: The AP performs self-configuration (automatic configuration) through the ACS. In the embodiment of the present invention, the AP aggregation entity aggregates multiple AP access points, and controls the access of the AP by checking the MAC address, the access link identifier, or the device identifier of the AP. The AP aggregation entity has an AP local call and local data interaction. Switching function between the AP and the AP. The process of receiving AP access by the AP aggregation entity is described in detail below with reference to FIG.

Method embodiment three:

Referring to FIG. 5, a flow chart of receiving AP access by an AP aggregation entity according to the present invention.

301. The AP sends a DHCP discovery message to the AP aggregation entity.

302. The AP aggregation entity checks whether the AP is legal. If it is legal, go to step 303.

An AP aggregation entity can check the legality of an AP in the following three ways:

1) The AP aggregation entity checks whether the MAC address of the AP is legal through the source MAC address of the DHCP discovery message.

2) checking whether the AP is accessed from the configured link by using the access link identifier corresponding to the link that receives the DHCP discovery message;

3) Check the device ID in the message through DHCP to check whether the AP is legal.

303. The AP aggregation entity sends a DHCP providing message to the AP.

304. The AP sends a DHCP request message to the AP aggregation entity.

305 is similar to step 302. The AP aggregation entity checks the legality of the AP. If it is legal, step 306 is performed.

306. The AP aggregation entity sends a DHCP acknowledgement message to the AP.

It should be noted that the AP aggregation entity can receive the access of multiple APs at the same time, and the process of accessing each AP is the same as the access procedure described in Embodiment 3 of the method. The AP aggregation entity has the function of inter-AP handover. The following describes in detail how the AP aggregation entity implements inter-AP handover, and the UMTS AP is taken as an example for description.

Method Embodiment 4:

Referring to FIG. 6, a flow chart of implementing inter-AP handover based on the AP aggregation entity of the present invention.

401 and 402. When the source AP determines that the UE needs to initiate a handover, the source AP sends a packet switch (PS,

Packet Switched) The RANAP (Radio Access Network Application Part) of the CS and Circuit Switched domain relocates the Relocation Required message to the AP aggregation entity for migration.

403 and 404. After receiving the relocation request message, the AP aggregation entity sends a Relocation Request message to the destination AP according to the destination cell identifier, and requests the destination AP to allocate resources.

405. After receiving the relocation request message, the AP allocates related resources and establishes a radio link. 406 and 407. The destination AP returns a Relocation Request Ack message to the AP aggregation entity.

408 and 409. After receiving the relocation request response message, the AP aggregation entity sends a Relocation Command message to the source AP.

410. After receiving the relocation command message, the source AP stops sending data to the UE, and sends a radio bearer (RB, Radio Bear) reconfiguration message to the UE.

411. The UE performs the air interface layer 1 synchronization with the destination AP.

After the 412 and 413 are synchronized with the air interface layer 1, the destination AP sends a Relocation Detect message to the AP aggregation entity.

414. The UE sends a radio bearer configuration completion (RB Reconfiguration Complete) message to the destination AP.

415 and 416. After receiving the radio bearer reconfiguration complete message, the destination AP starts to send and receive data, and sends a Relocation Complete message to the AP aggregation entity, and the AP aggregation entity starts to send data to the destination AP.

417 and 418, the AP aggregation entity sends an Iu Release Command (Release Command) message to the source AP, and releases the interface Iu resource between the AP and the AG.

419. The source AP releases the UE related resources.

420 and 421, the source AP sends an Iu Release Complete message to the AP aggregation. Entity, complete the switching process.

It should be noted that the AP aggregation entity implements the inter-AP handover, which is performed in the AP aggregation entity, and moves the UE context from the source AP to the destination AP. This process does not go through the mobile core network. In the prior art, the handover between the APs depends on the AG, which wastes the resources of the mobile core network. Now, the AP aggregation entity directly implements the handover between the APs, and does not pass through the mobile core network, thereby saving the resources of the mobile core network. The following describes in detail how the AP aggregation entity implements the AP local call in conjunction with Figure 7, and uses UMTS.

The AP is described as an example.

Method Embodiment 5:

Referring to FIG. 7, an AP aggregation entity implements an AP local call flow chart according to an embodiment of the present invention. In this embodiment, the AP aggregation entity integrates the mobile switching center (MSC, Mobile Switching).

Center) features.

501. Establish a radio resource control (RRC) connection between the calling UE and the AP.

502. The calling UE sends an RRC initial direct transmission message to the AP, where the message has a service request of the calling UE.

503. The AP sends an initial UE message to the AP aggregation entity.

504. Perform an authentication and security mode control process between the calling UE and the AP aggregation entity.

505. The calling UE sends a Setup message to the AP, where the message has the called number information.

506. The AP forwards the setup message of the calling UE to the AP convergence entity.

507. The AP aggregation entity determines, according to the called number information in the setup message, whether the current call is a local call, and if it is a local loopback call, enters a local call procedure.

Local call process:

508. The AP aggregation entity initiates a paging request to the called UE.

509. The called UE responds to a paging request of the AP aggregation entity.

510. Perform an authentication and security mode control process between the called UE and the AP aggregation entity.

511. The AP aggregation entity sends a setup message to the AP.

512. The AP forwards the setup message to the UE. 513. The called UE sends a Call Confirmed message to the AP.

514. The AP forwards the call confirmation message to the AP convergence entity.

515. Establish a radio access bearer (RAB) between the AP aggregation entity and the called UE.

516. The called UE sends an alerting message to the AP.

517. The AP forwards the ringing message to the AP aggregation entity.

518. The called UE sends a Connect message to the AP.

519. The AP forwards the connection message to the AP aggregation entity.

520. The AP aggregation entity sends a Connect Ack message to the AP.

521. The AP forwards a connection response message to the called UE.

522. Start a voice call between the calling UE and the called UE.

It should be noted that, in the prior art, the local call must be implemented by the interaction between the AP and the AG, so that not only the mobile core network bandwidth is wasted, but also the local call between the APs is charged due to the use of the mobile core network resources. of. In the method of the embodiment of the present invention, the local call between the APs is completed by the AP aggregation entity, and does not need to go through the AG, which not only saves the core network resources, but also makes the local call of the AP free. The following describes in detail how the AP aggregation entity implements AP local data processing in conjunction with FIG. 8 and uses the UMTS AP as an example for description.

Method Embodiment 6:

Referring to FIG. 8, an AP aggregation entity based on the present invention implements a flow chart of AP local data processing. In this embodiment, the AP aggregation entity integrates the functions of the GPRS (General Packet Radio Service) support node (SGSN).

6 f]匕

dagger.

601. When the UE has a data service to be initiated, the UE sends a PDP (Packet Data Protocol) context request message to the AP aggregation entity.

602. The AP aggregation entity identifies an access point name (APN, Access Point Name) in the activated PDP context request message, and if it is the same as the local data processing, performs a local data processing procedure. Local data processing flow:

603. The AP aggregation entity allocates a local address to the UE.

604. Establish an RAB between the AP aggregation entity and the UE. This step is optional.

605. The AP aggregation entity sends an activation PDP context accept message to the UE, where the message has a local address assigned to the UE.

606. The UE performs data transmission, and the AP aggregation entity determines that the source address of the packet is a local address, and performs local data processing.

It should be noted that the AP aggregation entity implements AP local data processing, and the process does not pass through the mobile core network. In the prior art, the local data processing of the AP relies on the AG, which wastes the resources of the mobile core network. Now, the AP aggregation entity is directly used to implement the local data processing of the AP, and the mobile core network resources are saved without going through the mobile core network. The embodiments of the present invention provide a device for accessing a mobile core network, such as an access point convergence device.

Equipment embodiment 1:

Referring to Figure 9, a schematic diagram of a first embodiment of the apparatus based on the present invention.

The device in the embodiment of the present invention includes: an establishing unit 901, an access unit 902, a receiving unit 903, and a switching unit 904.

The establishing unit 901 establishes an IP network security protocol tunnel with the security gateway by the IP address of the security gateway.

The access unit 902 accesses the access gateway of the mobile core network by using the IP address of the access gateway through the IP network security protocol tunnel established by the establishing unit 901.

The receiving unit 903 receives the access of the access point, and the access point has at least one.

The switching unit 904 transfers the access point to the access gateway of the mobile core network.

There is no proprietary connection link between the AP and the AP aggregation entity. The device forwards the AP to the AG through an IPSec tunnel.

If there is a proprietary connection link between the AP and the AP aggregation entity, the AP aggregation entity transfers the access point to the access gateway of the mobile core network through the proprietary connection link.

For example, the proprietary connection link is a virtual local area network (VLAN, Virtual Local Area). Network ).

Equipment Embodiment 2:

Referring to Figure 10, a schematic diagram of a second embodiment of the apparatus based on the present invention.

The difference between the device embodiment 2 and the device embodiment 1 is that the AP aggregation entity does not have the IP addresses of the SeGW and the AG, so the first obtaining unit and the second obtaining unit are added. In order to enable a legitimate AP to access the AG, an inspection unit is set up.

The first obtaining unit 1001 parses the IP address corresponding to the fully qualified domain name of the security gateway by using the domain name naming system on the IP transmission network. The first obtaining unit 1001 is connected to the establishing unit 1002.

The second obtaining unit 1003 parses the IP address corresponding to the fully qualified domain name of the access gateway by using the domain name naming system on the mobile core network. The second obtaining unit 1003 is connected to the access unit 1004.

The checking unit 1005 determines whether the access point is legal by checking the MAC address, access link identifier or device identifier of each access point. The checking unit 1005 is connected to the receiving unit 1006.

The device carries a SIM or USIM;

The device performs authentication between the SIM and the security gateway; or

Authenticating between the USIM and the security gateway; or,

Authenticating with the security gateway through a pre-shared key; or,

Authentication is performed between the security gateway and the digital gateway. The invention also provides a system for an access point to access a mobile core network. The system includes the access point aggregation device described in the above embodiments.

System embodiment one:

Referring to Figure 11, a block diagram of a first embodiment of the system based on the present invention.

The system in the embodiment of the present invention includes: an access point 1101, an access point aggregation device 1102, a security gateway 1103, and an access gateway 1104.

The access point 1101 provides a wireless access service for the user equipment to access the mobile core network; the security gateway 1103 protects the mobile core network side entity and establishes an IPSec tunnel with the access point 1101;

The access gateway 1104 provides an interface for the user equipment to access the mobile core network; The access point aggregation device 1102 establishes an IPSec tunnel with the SeGW; accesses the AG of the mobile core network by the IP address of the AG through the IPSec tunnel; receives the access of the AP, and transfers the AP to Said AG.

The AP can access the AP aggregation device through the Dynamic Host Configuration Protocol (DHCP). The AP does not carry the SIM card or the USIM card. The AP aggregation device can check whether the MAC address, access link identifier, or device ID of the AP packet is the same as the configured MAC address, access link identifier, or device ID. When the packets are consistent, the AP is legal and the AP is allowed to access.

If there is a proprietary connection link between the AP and the AP aggregation device, the AP aggregation device transfers the access point to the access gateway of the mobile core network through the proprietary connection link. For example, the proprietary connection link is a VLAN.

If there is no proprietary link between the AP and the AP aggregation device, an IPSec tunnel can be established between the AP and the AP aggregation device. The AP aggregation device transfers the access point to the mobile core network through the IPSec tunnel. Into the gateway.

The security gateway 1103 can be integrated on the access gateway 1104.

The system embodiment 1 achieves the purpose of accessing the AG1104 of the mobile core network by adding the AP aggregation device 1102. Since the AP aggregation device 1102 establishes one or two IPSec tunnels with the AG1104 of the mobile core network, the egress bandwidth of the LAN gateway (such as an enterprise gateway or a campus gateway) is saved. At the same time, the AP aggregation device 1102 is configured to carry the SIM card or the USIM card to avoid the authentication of the API 101. The AP aggregation device 1102 can be located in the same equipment room as the enterprise gateway or the campus gateway, ensuring that each AP aggregation device 1102 carries the SIM card. Or security issues when using a USIM card. In addition, the SeGW can also authenticate the AP aggregation entity 1102 by using a pre-shared key or a digital certificate, so that the AP aggregation device 1102 does not need to carry a SIM card or a USIM card, thereby avoiding the security problem of the SIM card or the USIM card. System Embodiment 2:

Referring to Figure 12, a block diagram of a second embodiment of the system based on the present invention.

The difference between the system embodiment 2 and the system embodiment 1 is: the AP aggregation device does not have the IP addresses of the SeGW and the AG, and the system embodiment 2 adds the IP transport network domain name naming system 1203 and the mobile core network. The domain name naming system 1205 also adds an auto-configuration server 1207.

The access point aggregation device 1202 parses the IP address corresponding to the fully qualified domain name of the security gateway 1204 through the IP transport network domain name naming system 1203.

The access point aggregation device 1202 parses the IP address corresponding to the fully qualified domain name of the access gateway 1206 by using the domain name naming system of the mobile core network.

The access point aggregation device 1202 performs configuration of mobile core network parameters and software versions and the like through the automatic configuration server 1207.

The access point 1201 performs configuration of a software version, an AP radio parameter, a mobile core network parameter, an AG address, and an AP-signed service parameter through the access point aggregation device 1202 or the automatic configuration server 1203. System Embodiment 3:

Referring to Figure 13, a block diagram of a third embodiment of the system based on the present invention.

The third embodiment of the present invention is a scenario in which the AP aggregation device of the present invention is applied to an enterprise network, and can of course be applied to a campus network or other local area network.

An AP aggregation device can aggregate multiple APs. Referring to Figure 13, three APs access the AP aggregation entity through an IPSec tunnel or a dedicated connection link. Each UE accesses the corresponding AP through an air interface.

The AP aggregation device accesses the IP transport network through the enterprise gateway, and then establishes one or two IPSec tunnels with the mobile core network SeGW through the IP transport network, connects to the SeGW through the IPSec tunnel, and accesses the mobile core network through the SeGW. AG.

Since the AP has access to the AP aggregation device and the AP aggregation device has access to the AG, the AP aggregation device transfers the AP to the AG to implement the AP access to the AG.

The AP aggregation device carries a SIM card or a USIM card. Each AP does not carry a SIM card or USIM. The AP aggregation device is secure. The SIM card or USIM card is secure. In addition, the SeGW can also authenticate the AP aggregation device 1102 by using a pre-shared key or a digital certificate, so that the AP aggregation device 1102 does not need to carry a SIM card or a USIM card, thereby avoiding the security problem of the SIM card or the USIM card. A minimum of one IPSec tunnel can be established between the AP aggregation device and the SeGW to save the egress bandwidth of the enterprise gateway.

One of ordinary skill in the art can understand all or part of the steps in implementing the above method embodiments. The program can be executed by instructing related hardware, and the program can be stored in a computer readable storage medium, and when executed, the program can include the contents of various embodiments of the foregoing communication method. The storage medium referred to herein is, for example, a ROM/RAM, a magnetic disk, an optical disk, or the like.

In summary, in an embodiment of the present invention, an access point accesses a mobile core network, and an IPSec tunnel is established between the AP aggregation entity and the SeGW, and the AG of the mobile core network is accessed through the IPSec tunnel. At the same time, the AP aggregation entity receives access of multiple APs, and transfers the AP to the AG of the mobile core network. Since the AP aggregation entity is added, it is avoided that each AP establishes an IPSec tunnel with the SeGW, thereby saving the egress bandwidth of the enterprise gateway or the campus gateway. At the same time, the AP aggregation entity is located in the same equipment room as the enterprise gateway or campus gateway. This avoids the problem that each AP is distributed in the enterprise or school building, which may cause the SIM card or USIM card to be stolen. A person skilled in the art can understand that all or part of the steps of implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, and the program is executed. The method includes the following steps: establishing an IP network security protocol tunnel between the security gateway and the security gateway by using the IP address of the security gateway; accessing the access gateway of the mobile core network by using the IP address of the access gateway; Receiving access to at least one access point; and transferring the access point to an access gateway of the mobile core network.

Claims

Rights request

A method for an access point to access a mobile core network, the method comprising:

The access point aggregation entity establishes an IP network security protocol tunnel between the security gateway and the security gateway;

The access point aggregation entity accesses the access gateway of the mobile core network by using the IP network security protocol tunnel and the IP address of the access gateway;

The access point aggregation entity receives the access of the access point, and the access point has at least one; the access point aggregation entity transfers the access point to the access gateway of the mobile core network.

2. The method according to claim 1, wherein the receiving the access point comprises:

Receive a dynamic host configuration protocol DHCP discovery message of the access point;

Sending a DHCP providing message to the access point when determining that the access point is legal according to the DHCP discovery message;

Receiving a DHCP request message of the access point;

When it is determined that the access point is legal according to the DHCP request message, the dynamic host configuration protocol acknowledgement message is sent to the access point.

The method according to claim 1 or 2, wherein before the IP network security protocol tunnel between the security gateway and the security gateway is established, the IP address of the security gateway is obtained, specifically: The domain name naming system on the IP transport network resolves the IP address corresponding to the fully qualified i or name of the security gateway.

The method of claim 1 or 2, wherein before accessing the access gateway of the mobile core network by the IP address of the access gateway, the method further includes obtaining an IP address of the access gateway, specifically: The domain name naming system on the core network resolves the IP address corresponding to the fully qualified domain name of the access gateway.

5. A method according to claim 1 or 2, characterized in that

When the IP network security protocol tunnel is one, the IP network security protocol tunnel is used for voice services and data services; or

When the IP network security protocol tunnel is two, one is used for voice services and the other is used for data services.

The method according to claim 1 or 2, further comprising: authenticating between the security gateway by using a subscriber identity module card; or

Authentication between the universal mobile communication system subscriber identity module card and the security gateway; or

Authenticating with the security gateway through a pre-shared key; or,

Authentication is performed between the security gateway and the digital gateway.

The method according to any one of claims 1 to 6, further comprising: an access point convergence entity to implement switching between access points, comprising:

After receiving the relocation requirement information sent by the source access point, the access point aggregation entity sends the relocation request information to the destination access point, and requests the destination access point to allocate resources;

After receiving the relocation request response message sent by the destination access point, the access point aggregation entity sends a relocation command message to the source access point;

The access point aggregation entity receives the relocation complete message of the destination access point, and delivers the data to the destination access point.

The method according to any one of claims 1 to 6, further comprising: an access point aggregation entity to implement a local call of the access point, comprising:

The access point aggregation entity receives a setup message of the calling user equipment forwarded by the access point, where the establishment message carries the number information of the called user equipment;

The access point aggregation entity determines whether the current call is a local call according to the called number information in the setup message, and if yes, enters the local call process.

The method according to any one of claims 1 to 6, further comprising: an access point convergence entity for implementing local data processing, comprising:

The access point aggregation entity identifies the access point name in the context request message sent by the user equipment. The access point name in the PDP is the same as the access point name of the local data processing. If yes, local data processing is performed.

10. An access point convergence device, which is characterized by:

Establishing a unit, configured to establish an IP network security protocol tunnel between the security gateway and the security gateway by using an IP address of the security gateway;

An access unit, configured to access an IP network security protocol tunnel established by the establishing unit, by access The IP address of the gateway accesses the access gateway of the mobile core network;

a receiving unit, configured to receive access of an access point, where the access point has at least one;

And a switching unit, configured to transfer the access point to an access gateway of the mobile core network.

The access point aggregation device according to claim 10, wherein the device further comprises a first obtaining unit connected to the establishing unit, configured to parse out the complete security gateway by using a domain name naming system on the IP transmission network. The IP address corresponding to the qualified domain name.

The access point aggregation device according to claim 10 or 11, wherein the device further includes a second obtaining unit connected to the access unit, configured to parse and connect through a domain name naming system on the mobile core network. The IP address corresponding to the fully qualified domain name of the gateway.

The access point aggregation device according to claim 10 or 11, wherein the device further comprises an inspection unit connected to the receiving unit, configured to check a MAC address and an access chain of each access point. The road identifier or device identifier determines whether the access point is legal.

The access point aggregation device according to claim 10 or 11, wherein the device carries a subscriber identity module card or a universal mobile communication system subscriber identity module card,

The access point aggregation device performs authentication between the security gateway through the user identity module card; or

Authenticating with the security gateway through a pre-shared key; or,

A system for accessing a mobile core network by an access point, comprising: an access point, a security gateway, an access gateway, and the access point aggregation device according to any one of claims 10 to 14. ; among them,

The access point is configured to provide a radio access service for the user equipment to access the mobile core network; the security gateway is configured to protect the mobile core network side entity;

The access gateway is configured to provide an interface for the user equipment to access the mobile core network.

The system according to claim 15, wherein the system further comprises an automatic configuration server, and the access point aggregation device performs configuration of the mobile core network parameter and the software version by using the automatic configuration server.

The system according to claim 16, wherein the access point performs software version, AP wireless parameter, and AP signing through the access point aggregation device or the automatic configuration server.