WO2010108357A1

WO2010108357A1 - Method and system for policy control

Info

Publication number: WO2010108357A1
Application number: PCT/CN2009/074022
Authority: WO
Inventors: 佘坤
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-03-25
Filing date: 2009-09-18
Publication date: 2010-09-30
Also published as: CN101521930A; CN101521930B

Abstract

The present invention provides a method and system for policy control. The method comprises the following steps: a Wireless Local Area Network (WLAN) terminal accesses WLAN through an Access Point (AP); WLAN Policy Decision Function (WLAN-PDF) obtains the WLAN terminal information from the AP; the WLAN terminal initiates registration to IP Multimedia Subsystem (IMS) network. Proxy Call Session Control Function (P-CSCF) of IMS network obtains the WLAN terminal information from WLAN-PDF; P-CSCF sends the obtained terminal information to Serving Call Session Control Function (S-CSCF); S-CSCF performs policy control according to the received terminal information and local policy. Applying the method and system of the present invention, a manner for obtaining terminal service capability can be provided for IMS core network and a service server. Compared with the capability parameters provided by the terminal, the parameters obtained through the solution of the present invention are more reliable.

Description

Strategy control method and system

Technical field

The present invention relates to the field of 3G wireless communication technologies, and further relates to the field of IMS services, and in particular, to a policy control method and system.

Background technique

IP Multimedia Subsystem (IMS) is the business framework and operation platform of 3G wireless communication network. IMS is based on the standard Internet Protocol Transmission Control Protocol/Internet Protocol (TCP/IP), Session Initial Protocol (SIP) and HyperText Transfer Protocol (HTTP). ), etc., based on IMS, it is very convenient to transplant existing Internet services and wireless communication network services, such as web browsing and video on demand, and the wireless communication network services include voice calls and short messages (substituting instant messages) ), MMS and ring tones, etc. At the same time, the IMS is controlled, that is, the operator can control the usage of the user according to the customized service and the operation strategy. Rel 5 version of IMS supports access to IMS with General Packet Radio Service (GPRS), while Rel 6 and later versions are access-independent, which can be accessed via Digital Subscriber Line (DSL). ), cable TV cable network (referred to as CABLE network), Integrated Services Digital Network (ISDN) and other fixed mode access, wireless access methods have also been extended, such as the Rel 6 version added wireless LAN (Wireless Local Area Network, referred to as WLAN) access.

The rapid maturity of wireless LAN technology in terms of bandwidth and security has made it a powerful competitor for fixed access methods such as DSL and optical fiber. However, the need for IMS access is different from Internet access. For Internet access, the WLAN only replaces the cable between the connected user terminal and the Internet Service Provider (ISP). As a controlled network, IMS requires all access paths to be controllable.

The 3rd Generation Partnership Project (3GPP) technical specification includes verification, authorization, and access to the packet switched domain service of the WLAN access 3GPP network. (Packet Switching, PS for short) and emergency calls. For related content, refer to the document "3GPP TS 23.234 3 GPP system to Wireless Local Area Network WLAN interworking", but there is no policy control mechanism for using IMS services through WLAN. . Summary of the invention

The technical problem to be solved by the present invention is to provide a policy control method for using IMS services through WLAN.

In order to solve the above technical problem, the present invention provides a policy control method using an IP multimedia subsystem IMS service, which includes:

The wireless local area network WLAN terminal accesses the WLAN by connecting to the access point AP, and the wireless local area network policy decision function WLAN-PDF collects information of the WLAN terminal from the AP, wherein the information includes the terminal identity, or the terminal identity and the link layer information. ;

The user initiates registration with the IMS network by using the WLAN terminal, and the proxy call session control function P-CSCF of the IMS network acquires information of the WLAN terminal from the WLAN-PDF and sends it to the service call session control of the IMS network. Function S-CSCF; and,

The S-CSCF performs policy control according to the received information of the WLAN terminal and a local policy.

Further, the step of the S-CSCF performing policy control when the user can only access the IMS service by using the IMS user corresponding to the WLAN terminal used by the user includes:

When the user registers the IMS user identity corresponding to the WLAN terminal in the IMS network by using the WLAN terminal, the S-CSCF allows the registration request of the user, otherwise the S-CSCF rejects the registration request of the user.

Further, after rejecting the registration request of the user, the S-CSCF notifies the AP of the information of the WLAN terminal through the P-CSCF and the WLAN-PDF, and the AP disconnects from the WLAN terminal.

Further, when the local policy is that the user can only access the IMS service whose connection parameters of the WLAN terminal are allowed, the S-CSCF performs policy control: When the S-CSCF receives the IMS service call of the user of the WLAN terminal as the terminating call, check whether the connection parameter in the link layer information of the WLAN terminal meets the service requirement of the IMS service, and if not, Then the S-CSCF rejects the IMS service call.

Further, the connection parameter is a connection rate.

Further, after the user is successfully registered, the S-CSCF stores the information of the WLAN terminal, and sends the IMS user identity of the user and the information of the corresponding WLAN terminal to the AP through the WLAN-PDF.

Further, when the WLAN terminal is connected to the AP, the WLAN terminal is used to authenticate and secure the infrastructure authentication WAPI certificate authentication and key management, thereby allowing the WLAN terminal to access the IMS service with high security requirements.

Further, when the WLAN terminal is connected to the AP, the WAPI pre-shared key authentication and key management are used, and only the WLAN terminal is allowed to access the IMS service with low security requirements.

Further, the terminal identity is a holder name in a certificate of the WLAN terminal. Another technical problem to be solved by the present invention is to provide a policy control system that uses IMS services over a WLAN.

In order to solve the above technical problem, the present invention provides a wireless communication system including a wireless local area network WLAN and an IP multimedia subsystem IMS network, the WLAN includes an access point AP, and the IMS network includes a proxy call session control function P-CSCF. , the service call session control function S-CSCF and the logical function entity WLAN-PDF; wherein

The WLAN-PDF is connected to the AP and the P-CSCF, and is configured to pass the

The connection interface of the WLAN collects information of the WLAN terminal from the AP, where the information includes a terminal identity, or a terminal identity and link layer information;

The P-CSCF is configured to acquire information of the WLAN terminal from the WLAN-PDF, and send information of the WLAN terminal to the S-CSCF;

The S-CSCF is configured to perform policy control according to the received information of the WLAN terminal and the local policy, and is further configured to store the information of the WLAN terminal when the user successfully registers the IMS service.

The method and system of the present invention, corresponding to the WLAN access service and the IMS service User identity association allows operators to apply flexible control policies when providing both services. In the meantime, the present invention provides a way for the IMS core network and the service server to obtain terminal service capabilities (such as bandwidth), so as to provide differentiated services, for example, automatically adjusting the bit rate of the media coding according to the terminal connection rate, compared to the capability parameters provided by the terminal. The parameters obtained by the present invention are more reliable. BRIEF abstract

Figure 1 shows the topology of the WLAN and IMS network interconnection.

Figure 2 is a flow chart of the P-CSCF (Proxy-Call Session Control Function) exchanging identity information with the WLAN AP.

FIG. 3 is a process flow diagram of an example policy 1 in the embodiment.

4 is a process flow diagram of an example strategy 2 in the embodiment.

Figure 5 is a process flow diagram of an example strategy 3 in an embodiment.

The preferred embodiment of the present invention, when using the 802.11x standard of the wireless local area network, should use the WLAN Authentication and Privacy Infrastructure (WAPI) or Wi-Fi network secure access, referred to as WPA (Wireless Fidelity). , ie, Wireless Fidelity, WPA (Wi-Fi Protected Access); but there is no requirement for specific wireless access methods, such as access to 802. l lx or WIMAX, the full name of WINMAX is Worldwide Interoperability for Microwave Access , namely the global microwave interconnection access, or 802.16 wireless metropolitan area network.

In the present invention, the WLAN access verification process verifies the "terminal identity", and the verification in the IMS registration process is the verification of the "user identity", and the two identities are independent. If the operator does not perform access policy control, IMS users can access IMS services using any WLAN terminal authorized to access the network.

In order to implement the policy of associating the WLAN with the IMS and using the IMS service through the WLAN, as shown in the network topology diagram of FIG. 1, the present invention adds a logical functional entity to the original IMS architecture: Wireless LAN policy decision function (WLAN Policy Decision Function, Jane WLAN-PDF), the interface between the access point (Access Point, AP for short) and the IMS network element P-CSCF is called a reference point, which is respectively referred to as a reference point Qo and a reference point Qq, P-CSCF (Proxy-CSCF), which is the proxy CSCF.

The reference point Qo between the WLAN-PDF and the AP can implement the following functions:

1. Collecting information of the WLAN terminal from the AP, where the information includes the verified identity, the physical address of the device, and information related to policy control (referred to as policy control information), and the information related to the policy control may be a connection parameter. The connection parameters include parameters such as a connection rate, and the policy control related information is not limited to the above information, and may be set according to a policy control function to be implemented.

2. Feed back the IMS registration status of the user to the AP.

The reference point Qq between the WLAN-PDF and the network element P-CSCF can implement the following functions:

1. Collecting, from the P-CSCF, the registration identity information of the IMS user and the contact address of the terminal used, the contact address including the domain name or the IP address;

2. Feed back to the P-CSCF for changes to the WLAN terminal access information, such as feedback IP address changes.

WLAN-PDF associates the IMS identity of the user with the WLAN terminal used by collecting information from the AP and the P-CSCF, and further implements the operator-predetermined control strategy based on the association. Possible control strategies include but are not limited to the following two categories:

1. Bind the identity of the WLAN terminal to the IMS user identity. For example, when the WLAN terminal authenticated by the access network can only access the IMS service through the corresponding IMS identity, the P-CSCF can be added to the IMS registration request of the user. The WLAN terminal identity information is sent to the S-CSCF (Service Call Session Control Function), which verifies whether the two types of identities correspond, thereby agreeing or refusing the user registration.

2. Automatically set IMS service capabilities based on WLAN access status (eg, access bit rate). The P-CSCF can determine its IMS service capability through the WLAN terminal access information collected by the WLAN-PDF, and send it to the S-CSCF along with the IMS registration request, according to which the latter can automatically reject the service when the WLAN terminal is used as the service termination call. call. This policy is the step after the terminal identity is successfully associated with the IMS user identity. The above two policy controls are implemented based on the technical solution "how to associate the WLAN terminal identity with the IMS user identity". The contribution of the present invention is to provide a basis for implementing a similar control strategy, enabling the implementation of various control strategies. In fact, operators can extend other control strategies based on "associating terminal identity with IMS user identity." For example, the operation strategy may simply associate the WLAN terminal with the IMS user for identity exchange, so as to further implement the control strategy.

The following is a detailed description of how the P-CSCF and the WLAN AP are successfully associated with each other after switching the identity of the terminal and the identity of the IMS user.

The procedure of WLAN terminal identity and IMS user identity verification is not part of the present invention and is therefore omitted in the following embodiment description.

If the operator wants to implement a control policy, it can configure the AP and/or S-CSCF at the same time. The WLAN-PDF associates the WLAN terminal identity with the IMS user identity according to the correspondence between the contact address in the IMS registration request and the physical address of the WLAN device. As shown in FIG. 2, the process of exchanging identity information between the Ρ-CSCF and the WLAN AP is as follows:

Step (1): After the AP completes the verification of the identity of the WLAN terminal, the WLAN terminal's physical address, the verified terminal identity, and any link layer information related to the preset policy control are notified to the WLAN-PDF, WLAN-PDF. The above information is stored. For example, when the preset policy control is "User can only access the IMS service allowed by the terminal connection rate", the information related to the policy control includes connection parameters, such as the connection rate. When the preset policy is controlled as "the user can only access the IMS service as the IMS user corresponding to the WLAN terminal used", the collected "information related to the policy control" may not include the connection rate, or even the connection parameters, but includes Other link layer information. When the preset policy control is other embodiments not listed in the present invention, the WLAN and IMS according to the present invention may be configured correspondingly according to preset policy control.

Step (2): When the user performs IMS registration, the P-CSCF sends an IMS user equipment identity query request to the WLAN-PDF, where the request includes the contact address in the IMS user terminal registration request; Step (3): WLAN-PDF will be the IMS user The domain name contained in the terminal contact address is resolved to an IP address by the DNS, and the physical address of the terminal is further obtained. For the protocol with the version number of the IP protocol being 4 (abbreviated as IPv4), the address resolution protocol (ARP) is resolved by the address resolution protocol (ARP). For the IP protocol version number 6 protocol (referred to as IPv6), through the neighbor The discovery process, and then querying the physical address in the stored WLAN terminal device information to find the corresponding WLAN terminal device identity;

Step (4): The WLAN-PDF sends a device identity query response to the P-CSCF, where the response includes the verified WLAN terminal identity and information related to policy control, such as connection parameters; Step (5): The P-CSCF will WLAN terminal The identity and information related to policy control, such as connection parameters, are inserted into the user registration request, and sent to the S-CSCF via the I-CSCF for IMS registration, and the S-CSCF verifies the identity of the IMS user;

Step (6): The S-CSCF completes the IMS user identity verification, and sends the registration response back to the P-CSCF; if the registration is successful, the S-CSCF stores the connection parameters of the user terminal;

Step (7): If the user is successfully registered, the P-CSCF notifies the WLAN-PDF of the verified IMS user identity and the corresponding WLAN device identity information, and the WLAN-PDF stores the above information;

Step (8): WLAN-PDF notifies the WLAN terminal identity and the corresponding IMS user identity

AP.

Through the above steps, the P-CSCF associates with the AP successfully and completes the user identity exchange.

In the following, specific descriptions of the embodiments of the two policy examples described in the present invention are made, but possible control strategies and possible implementations are not limited thereto.

Example strategy 1 :

For example, it is assumed that according to the operation policy, the user can only access the IMS service by the IMS user corresponding to the WLAN terminal used. If the user violates this policy, as shown in Figure 3, the possible processing procedure is as follows:

Steps (1) to (5) are the same as steps (1) to (5) in the flow shown in Fig. 2.

Step (6): The S-CSCF queries the database to check whether the identity that the user wants to register corresponds to the identity of the WLAN terminal, and the result is "No";

Step (7): The S-CSCF rejects the registration request of the user, and sends the response back to the P-CSCF;

Step (8): The P-CSCF notifies the WLAN-PDF of the identity of the user who failed to register and the identity information of the corresponding WLAN terminal; Step (9): The WLAN-PDF notifies the AP of the identity of the user who failed to register and the identity information of the corresponding WLAN terminal;

Step (10): The AP terminates the connection with the user terminal.

Example Strategy 2:

For another example, according to the operation policy, the user can only access the IMS service allowed by the terminal connection rate, and the terminal used by the user does not meet the requirement. As shown in FIG. 4, FIG. 4 omits the step of the service call, and assumes that the caller and the caller The terminating user belongs to the same IMS network. The possible processing flow is as follows:

(1) The S-CSCF receives the service call from the end user to check whether the connection parameters of the user terminal meet the service requirements, and the result is "No";

(2) The S-CSCF rejects this service call.

Example strategy 3

For example, the WLAN terminal performs identity authentication through the WLAN Authentication and Privacy Infrastructure (WAPI standard), and the implementation steps of the example strategy 1 can be further refined. WAPI verifies the identity of the terminal through a pre-issued certificate. Assuming that the certificate already exists in the terminal, the certificate issuance process is omitted. In addition, the WAPI authentication involves three logical entities: an Authenticator Entity (abbreviated as ΑΕ), an Authentication Supplicant Entity (ASUE), and an Authentication Service Entity (ASE). Remaining in the UE (ie, WLAN terminal), the AE resides in the AP, and the ASE resides in an authentication service unit (ASU). The process flow of the example strategy 1 is re-described as follows:

Step (1): When the WLAN terminal is associated with the AP, sending an access authentication request to the AP, where the terminal includes an identity certificate, where the identity certificate further includes a holder name;

Step (2): After receiving the WLAN terminal access authentication request, the AP sends a certificate authentication request to the ASU, where the WLAN terminal identity certificate is included;

Step (3): After receiving the certificate authentication request of the AP, the ASU verifies the certificate of the WLAN terminal, and after the verification is completed, sends the certificate authentication response back to the AP, including the verification result of the WLAN terminal certificate; Step (4): The AP controls the WLAN terminal access according to the WLAN terminal certificate verification result in the certificate authentication response; if the authentication fails, disconnects from the WLAN terminal, the process ends; Steps (5) ~ (14) The same example The steps (1) ~ (10) of the strategy 1 and the "terminal identity" therein are specifically the holder names in the WLAN terminal identity certificate.

According to the basic principle of the present invention, the foregoing embodiment may also have multiple transformation manners, for example: the policy control related information (link layer information) may further include: an authentication and a key used when the WLAN terminal is connected to the AP. Management method;

Accordingly, the local policy of the S-CSCF is:

The authentication and key management methods used when the WLAN terminal is connected to the AP are: WAPI certificate authentication and key management, allowing access to IMS services with high security requirements;

The authentication and key management methods used when the WLAN terminal is connected to the AP are: WAPI pre-shared key authentication and key management, only allowing access to IMS services with low security requirements.

Industrial applicability

The method and system of the present invention associates a WLAN access service with a user identity corresponding to the IMS service, so that the operator can apply a flexible control policy when providing two services at the same time. In the meantime, the present invention provides a way for the IMS core network and the service server to obtain terminal service capabilities (such as bandwidth), so as to provide differentiated services, for example, automatically adjusting the bit rate of the media coding according to the terminal connection rate, compared to the capability parameters provided by the terminal. The parameters obtained by the present invention are more reliable.

Claims

Claim

1. A policy control method comprising:

The user initiates registration with the IP multimedia subsystem IMS network using the WLAN terminal, the proxy call session control function P-CSCF of the IMS network acquires the information of the WLAN terminal from the WLAN-PDF, and the information is a service call session control function S-CSCF sent to the IMS network;

2. The method of claim 1 wherein

The local policy refers to: when the user can only access the IMS service by using the IMS user corresponding to the WLAN terminal, the step of the S-CSCF performing policy control includes:

When the user registers the IMS user identity corresponding to the WLAN terminal in the IMS network by using the WLAN terminal, the S-CSCF allows the registration request of the user, otherwise the S-CSCF rejects the registration of the user. request.

3. The method of claim 2, further comprising:

After the S-CSCF rejects the registration request of the user, notifying the AP of the information of the WLAN terminal by using the P-CSCF and the WLAN-PDF, the AP disconnecting from the WLAN terminal Connection.

4. The method of claim 1, wherein

The local policy refers to: when the user can only access the IMS service in which the connection parameter of the WLAN terminal is allowed, the step of performing policy control by the S-CSCF includes:

When the S-CSCF receives the IMS service call of the user of the WLAN terminal as the terminating call, check whether the connection parameter in the link layer information of the WLAN terminal meets the service requirement of the IMS service, if If satisfied, the S-CSCF accepts the IMS service call, otherwise The S-CSCF rejects the IMS service call.

5. The method of claim 4, wherein the connection parameter is a connection rate.

6. The method of claim 2, further comprising:

After the user is successfully registered, the S-CSCF stores the information of the WLAN terminal, and sends the IMS user identity of the user and the information of the corresponding WLAN terminal to the AP through the WLAN-PDF.

7. The method of claim 1 further comprising:

When the WLAN terminal is connected to the AP, the WLAN terminal is authenticated and the security infrastructure WAPI certificate authentication and key management is enabled, and the WLAN terminal is allowed to access the IMS service with high security requirements.

8. The method of claim 1 further comprising:

When the WLAN terminal is connected to the AP, the pre-shared key authentication and key management of the security infrastructure WAPI is used, and only the WLAN terminal is allowed to access the IMS service with low security requirements.

The method of any one of claims 1 to 6, wherein the terminal identity is a holder name in a certificate of the WLAN terminal.

10. A wireless communication system comprising a wireless local area network WLAN and an IP multimedia subsystem IMS network,

The WLAN includes an access point AP,

The IMS network includes a proxy call session control function P-CSCF, a service call session control function S-CSCF, and a logical function entity WLAN-PDF;

The WLAN-PDF is connected to the AP and the P-CSCF, and is configured to collect information of a WLAN terminal from the AP through a connection interface with the WLAN, where the information includes a terminal identity, or a terminal identity and a chain Road layer information;

The P-CSCF is configured to acquire the information of the WLAN terminal from the WLAN-PDF, and send the information of the WLAN terminal to the S-CSCF;

Setting the S-CSCF according to the received information and the local policy of the WLAN terminal The policy control is slightly performed, and is also set to store the information of the WLAN terminal when the user successfully registers the IMS service.