WO2012119399A1

WO2012119399A1 - Service bypass method, access network device and security gateway

Info

Publication number: WO2012119399A1
Application number: PCT/CN2011/078620
Authority: WO
Inventors: 张勇; 朱伟; 陈项
Original assignee: 华为技术有限公司
Priority date: 2011-08-19
Filing date: 2011-08-19
Publication date: 2012-09-13
Also published as: CN102726075A; CN102726075B

Abstract

Provided are a service bypass method, an access network device and a security gateway. The service bypass method includes: an access network device receives a service request data packet sent by User Equipment (UE), and determines to carry out security gateway (SeGW) bypass on the service request data packet according to context information about the UE; generates a charging request message and sends the same to the SeGW, so that the SeGW performs NAT on the charging request message and sends the same to a Wireless Application Protocol Gateway (WAP GW); after receiving a charging response message sent by the WAP GW, sends the service request data packet to the SeGW, so that the SeGW performs NAT on the service request data packet sent by the access network device and then sends the service request data packet to the WAP GW. The present invention can bypass the WAP service, thus bandwidth resources can be saved.

Description

Service bypass method, access network device and security gateway

Technical field

The embodiments of the present invention relate to the field of communications technologies, and in particular, to a service bypass method, an access network device, and a security gateway. Background technique

An Access Point (AP) is a network device that provides wireless access services for homes/enterprises based on the Internet Protocol (IP) transmission network. The user equipment (User Equipment; hereinafter referred to as UE) accesses the AP through the air interface. The AP accesses the IP transport network through the Home Gateway (HGW), and then connects to the security gateway in the mobile core network through the IP transport network. (Security Gateway; hereinafter referred to as: SeGW), and then connected to the access gateway (Access Gateway; hereinafter referred to as: AG). The AG is connected to the Circuit Switched (hereinafter referred to as CS) domain core network and the Packet Switched (PS) domain core network.

In this way, when the UE accesses the Internet (Internet) through the AP, it needs to pass the Gateway GPRS Support Node (hereinafter referred to as GGSN) network element through the gateway of the PS domain core network. The Gi interface, to connect to the Internet. In this way, the UE accesses the Internet through the mobile core network, which wastes the bandwidth of the mobile core network.

The prior art provides a solution for data bypassing by using an AP or an AG. However, in the solution for data bypassing by an AP or an AG provided by the prior art, a Wireless Application Protocol (hereinafter referred to as WAP) service gateway ( Gateway; hereinafter referred to as: GW) will authenticate the data packet and need to be based on the IP address and the mobile station International Integrated Services Digital Network (ISDN) number (Mobile Station International ISDN Number; hereinafter referred to as: MSISDN Correspondence relationship Record each MSISDN packet. Therefore, the solution provided by the prior art to implement data bypassing through an AP or an AG cannot bypass the WAP service. Summary of the invention

The embodiments of the present invention provide a service bypass method, an access network device, and a security gateway, so as to bypass the WAP service and save bandwidth resources.

An embodiment of the present invention provides a service bypass method, including:

The access network device receives the service request data packet sent by the user equipment, and determines, according to the context information of the user equipment, that the service request data packet is bypassed by the security gateway;

The access network device generates an accounting request message and sends the charging request message to the security gateway, where the charging request message carries an Internet Protocol address of the user equipment and a mobile station international integrated service digital network number, so that the security gateway refers to the The fee request message is sent to the wireless application protocol service gateway after performing network address translation;

After receiving the charging response message sent by the wireless application protocol service gateway, the access network device sends a service request data packet to the security gateway, so that the security gateway sends a service request to the access network device. The data packet is sent to the wireless application protocol service gateway after performing network address translation.

The embodiment of the invention further provides a service bypass method, including:

The security gateway receives the charging request message sent by the access network device, where the charging request message is that the access network device receives the service request data packet sent by the user equipment, and determines, according to the context information of the user equipment, The service request packet is sent to the security gateway after the security gateway is bypassed, and the charging request message carries an Internet Protocol address of the user equipment and a mobile station international integrated service digital network number;

The security gateway performs network address translation on the charging request message, and then sends the information to the wireless application protocol service gateway, receives the charging response message sent by the wireless application protocol service gateway, and performs network address translation on the charging response message. And then sent to the access network device; The security gateway receives the service request data packet sent by the access network device, performs network address translation on the service request data packet sent by the access network device, and sends the service request data packet to the wireless application protocol service gateway.

An embodiment of the present invention further provides an access network device, including:

a receiving module, configured to receive a service request data packet sent by the user equipment, and receive a charging response message sent by the wireless application protocol service gateway;

a determining module, configured to determine, according to the context information of the user equipment, performing a security gateway bypass on the service request data packet;

a generating module, configured to generate a charging request message, where the charging request message carries an Internet Protocol address of the user equipment and a mobile station international integrated service digital network number;

a sending module, configured to send the charging request message generated by the generating module to the security gateway, so that the security gateway performs network address translation on the charging request message, and then sends the information to the wireless application protocol service gateway; After receiving the charging response message sent by the wireless application protocol service gateway, the receiving module sends a service request data packet to the security gateway, so that the security gateway performs network address translation on the service request data packet sent by the sending module. Then sent to the wireless application protocol service gateway.

The embodiment of the invention further provides a security gateway, including:

a message receiving module, configured to receive an accounting request message sent by the access network device, where the charging request message is that the access network device receives the service request data packet sent by the user equipment, according to the context information of the user equipment Determining, after the security request gateway of the service request data packet is sent to the security gateway, the charging request message carries an Internet Protocol address of the user equipment and a mobile station international integrated service digital network number; and a receiving station And a charging response message sent by the wireless application protocol service gateway; and receiving a service request data packet sent by the access network device;

An address translation module, configured to perform network address translation on the charging request message received by the message receiving module, and perform the charging response message received by the message receiving module Network address translation, and performing network address translation on the service request data packet received by the message receiving module;

a message sending module, configured to send a network address translated charging request message to the wireless application protocol service gateway, and send a network address translated charging response message to the access network device, and the network is to be performed. The address-converted service request data packet is sent to the wireless application protocol service gateway.

After receiving the service request data packet sent by the user equipment, the access network device may determine, according to the context information of the user equipment, the service request data packet.

The SeGW is bypassed. At this time, the access network device generates an accounting request message and sends it to the SeGW. The SeGW performs network address translation (NAT Address Translation) (hereinafter referred to as NAT) on the charging request message and sends it to the WAP GW. After the charging response message is sent by the WAP GW, the access network device sends a service request data packet to the SeGW, so that the SeGW performs NAT on the service request data packet sent by the access network device, and then sends the service request data packet to the WAP GW. Therefore, the WAP service can be bypassed, thereby saving bandwidth resources. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a flowchart of an embodiment of a service bypass method according to the present invention;

2 is a flowchart of another embodiment of a service bypass method according to the present invention;

3 is a schematic diagram of an embodiment of an application scenario of the present invention;

4 is a flowchart of an embodiment of a method for configuring a network in the present invention;

FIG. 5 is a flowchart of still another embodiment of a service bypass method according to the present invention; FIG.

6 is a schematic structural diagram of an embodiment of an access network device according to the present invention; 7 is a schematic structural diagram of another embodiment of an access network device according to the present invention;

8 is a schematic structural diagram of an embodiment of a security gateway according to the present invention;

FIG. 9 is a schematic structural diagram of another embodiment of a security gateway according to the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

FIG. 1 is a flowchart of an embodiment of a service bypass method according to the present invention. As shown in FIG. 1, the service bypass method may include:

Step 101: The access network device receives the service request data packet sent by the UE, and determines to perform SeGW bypass on the service request data packet according to the context information of the UE.

Further, before the access network device receives the service request data packet sent by the UE, the access network device may further receive a packet data protocol (Packet Data Protocol; PDP) context establishment request message sent by the UE, according to the PDP context. The access point name (Access Point Name; APN) carried in the request message is determined to perform SeGW bypass on the UE, and record the context information of the UE. In this embodiment, the APN that needs to perform the SeGW bypass may be configured on the access network device in advance. For example, the access network device may save the APN that needs to be bypassed by the SeGW in a data table or a database, so that the UE is sent. After the PDP context setup request message, the access network device may determine to perform SeGW bypass on the UE according to the APN carried in the PDP context setup request message.

Next, after receiving the service request data packet sent by the UE, the subsequent access network device may determine to perform SeGW bypass on the service request data packet according to the context information of the UE recorded by the access network device. In this embodiment, when the UE registers, the access network device corresponds to The home register may configure the MSISDN of the UE in the admission list, and the access network device may obtain the context identifier of the UE and the MSISDN of the UE from the home register corresponding to the access network device, establish a context identifier of the UE, and establish the UE Correspondence of MSISDN. Therefore, after receiving the service request data packet sent by the UE, the access network device may obtain the context identifier corresponding to the MSISDN according to the MSISDN of the UE carried in the service request data packet; and then the access network device may search according to the obtained context identifier. To the context information corresponding to the context identifier, the access network device may determine, according to the found context information, a SeGW bypass of the service request data packet.

Step 102: The access network device generates an accounting request message and sends the message to the SeGW, where the charging request message carries the IP address of the UE and the MSISDN, so that the SeGW sends the NAT to the WAP GW by performing NAT on the charging request message.

Further, after the SeGW performs NAT on the charging request message and sends the message to the WAP GW, the WAP GW establishes and stores the correspondence between the MSISDN of the UE and the IP address after NAT.

Step 103: After receiving the charging response message sent by the WAP GW, the access network device sends a service request data packet to the SeGW, so that the SeGW performs NAT on the service request data packet sent by the access network device, and then sends the data to the WAP GW.

In this embodiment, after determining that the service request data packet is subjected to the SeGW bypass, the access network device caches the service request data packet. In this case, sending the service request data packet to the SeGW may be: the access network device deleting the cached service. After the user plane of the request packet is GPRS Tunneling Protocol-User plane (GTP-U), the service request packet of the GTP-U header is deleted and sent to the SeGW through the tunnel. The tunnel may be the same as the Internet Security (IP Security) (hereinafter referred to as IPsec) tunnel, or may be a dedicated IPsec tunnel, or may be another tunnel. The specific form of the tunnel in the embodiment of the present invention Not limited.

In this embodiment, further, generating an accounting request message on the access network device and sending the message to the SeGW After receiving the charging response message sent by the WAP GW, if the access network device receives another service request message sent by the UE, the access network device discards the another service request message.

Further, after receiving the PDP context deletion request message sent by the UE, the access network device sends a PDP context deletion request message to the general packet radio service support node (X GPRS Support Node; hereinafter referred to as xGSN), where the xGSN may be a GGSN Or the Serving GPRS Support Node (hereinafter referred to as: SGSN); after receiving the PDP Context Delete Accept message sent by the xGSN, the access network device deletes the context information of the UE.

In addition, after the PDP Context Delete Request message is sent to the xGSN, the access network device sends an Accounting End Request message to the SeGW, so that the SeGW sends the NAT to the WAP GW after the NAT is sent to the WAP GW; The network access device may receive the charging end response message sent by the SeGW, and the charging end response message is sent by the SeGW to the access network device by performing NAT on the charging end response message sent by the WAP GW.

The access network device in this embodiment may be an access network device such as an AP, a micro (Micro) device, a base station (NodeB), or a radio network controller (Radio Network Controller; hereinafter referred to as RNC). The device can also be an access network device of different standards, for example: Global System of Mobile communication (hereinafter referred to as GSM), Code Division Multiple Access (CDMA) system, Interoperability for Microwave Access (WMAX) system, Long Term Evolution (LTE) system or Ultra Mobile Broadband (UMB) system Access network equipment. The specific implementation form of the access network device is not limited in the embodiment of the present invention.

In the foregoing embodiment, after receiving the service request data packet sent by the UE, the access network device may determine, according to the context information of the user equipment, performing SeGW bypass on the service request data packet. The access network device sends an accounting request message to the SeGW, and the SeGW sends the charging request message to the WAP GW. After receiving the charging response message sent by the WAP GW, the access network device sends the service. The request packet is sent to the SeGW, so that the SeGW performs NAT on the service request packet sent by the access network device, and then sends the packet to the WAP GW. Therefore, the WAP service can be bypassed, thereby saving bandwidth resources.

2 is a flowchart of another embodiment of a service bypass method according to the present invention. As shown in FIG. 2, the service bypass method may include:

Step 201: The SeGW receives an accounting request message sent by the access network device, where the charging request message is that the access network device receives the service request data packet sent by the UE, and determines, according to the context information of the UE, the SeGW for the service request data packet. After the bypass is sent to the foregoing SeGW, the charging request message carries the IP address of the UE and the MSISDN.

Step 202: The SeGW performs NAT on the charging request message, and then sends the charging response message to the WAP GW, and receives the charging response message sent by the WAP GW, and sends the charging response message to the access network device.

Step 203: The SeGW receives the service request data packet sent by the access network device, and performs NAT on the service request data packet sent by the access network device, and then sends the service request data packet to the WAP GW.

In this embodiment, the SeGW sends the charging request message to the WAP GW after the NAT is sent to the WAP GW. The SeGW may replace the IP address of the UE carried in the IP header of the foregoing charging request message with the idle IP address in the address pool configured by the SeGW. The address, and the IP address of the UE included in the charging information carried by the charging request message is replaced with an idle IP address in the address pool configured by the SeGW, and the IP address of the UE and the idle IP address are established and saved. Correspondence relationship

At this time, the NAT of the charging response message is sent to the access network device. The SeGW may replace the IP address carried in the charging response message with the IP address of the UE according to the saved correspondence.

In this embodiment, the service request data packet sent by the access network device is sent after NAT. The WAP GW may be: The SeGW replaces the IP address of the UE in the service request packet sent by the access network device with the idle IP address according to the saved correspondence, and sends the replaced service request packet to the WAP. GW.

Further, the SeGW may further receive the charging end request message sent by the access network device, and perform NAT on the charging end request message, and then send the message to the WAP GW; after receiving the charging end response message sent by the WAP GW. The SeGW deletes the context information of the UE, and performs NAT on the charging end response message, and then sends the information to the access network device.

In this embodiment, after the SeGW sends the charging end request message sent by the access network device to the WAP GW, the SeGW may start a timer, and if the timer expires, the WAP GW does not receive the meter. When the fee ends the response message, the SeGW deletes the context information of the UE.

In the foregoing embodiment, after receiving the charging request message sent by the access network device, the S eG W sends the charging request message to the WAP GW, and performs NAT on the charging response message sent by the WAP GW. After being sent to the access network device, the SeGW may receive the service request data packet sent by the access network device, and perform NAT on the service request data packet sent by the access network device, and then send the service request data packet to the WAP GW. Therefore, the WAP service can be bypassed, thereby saving bandwidth resources.

The service bypass method provided by the embodiment shown in FIG. 1 and FIG. 2 can be applied to the scenario shown in FIG. 3. FIG. 3 is a schematic diagram of an embodiment of an application scenario of the present invention. In the following description of the embodiments of the present invention, an access network device is used as an AP for description. In Figure 3, the function of the GGSN is integrated in the AP, and the local data bypass operation is performed. Before the service request packet is sent for the first time, the charging request message needs to be sent first, and the MSISDN and IP address of the UE are carried in the charging request message. . The SeGW parses the charging request message sent by the AP, replaces the source IP address of the charging request message, and performs 1:1 NAT on the charging request message, and then sends the charging request message to the WAP GW. Before performing the SeGW bypass on the WAP service, you need to configure the IP address pool on the SeGW. In the Generic Routing Encapsulation (GRE) router (Router) As shown in FIG. 4, FIG. 4 is a flowchart of an embodiment of a method for configuring a network in the present invention. The method may include:

Step 401: The SeGW configures a GRE tunnel between the SeGW and the GRE router, applies for an IP address segment allocated to the UE, configures an IP address pool on the SeGW, and configures a static route on the GRE Router.

Specifically, the IP address segment that the SeGW applies for allocation to the UE is an IP address segment that is allocated by the SeGW to the UE, independent of the GGSN. The number of IP addresses included in the IP address segment of the SeGW application depends on the number of UEs that the operator intends to support for concurrent SeGW bypass WAP services. For example, the IP address segment configured on the GGSN for allocation to the UE may be IP _g i~IP _g 2 , and the IP address segment requested by the SeGW may be IP _sl ~IP _{s2 o}

In addition, static routes need to be configured on the GRE Router. For example, for the packets with the destination IP address in IPgi~IP _g2 , the GRE Router routes to the GGSN. For the packets with the destination IP address in IP _sl ~ IP _s2 , The GRE Router routes to SeGW.

Step 402: Enable the Gi function switch of the AP through the access point manager (AP Manager; hereinafter referred to as APM), and configure the routing rule of the SeGW bypass service on the AP.

Specifically, the AP's Gi function switch includes Gi Enable and authorized user switches.

The routing rule for configuring the SeGW bypass service on the AP can be: Configure an APN that needs to be bypassed by the SeGW on the AP. For example, the access network device can save the APN that needs to be bypassed by the SeGW in a data table or a database. After receiving the PDP context setup request message sent by the UE, the access network device may determine to perform SeGW bypass on the UE according to the APN carried in the PDP context setup request message.

Step 403: When the UE registers, the AP obtains the context identifier (Context ID) and the MSISDN of the UE from the AP Home Register (hereinafter referred to as AHR), and establishes the context identifier of the UE and the MSISDN on the AP. Correspondence relationship.

Step 404: The AP receives the service request data packet sent by the UE, and determines that the service is requested. After requesting the packet to perform the SeGW bypass, the service request packet is sent to the SeGW through the SeGW.

WAP GW, that is, the service path is UE<-> AP<-> SeGW<-> WAP GW (GRE Router).

For example, the manner in which the AP determines the SeGW bypass of the service request data packet, and the manner in which the service request data packet is sent to the WAP GW through the SeGW may refer to the description in the embodiment shown in FIG. 1 of the present invention. Let me repeat.

FIG. 5 is a flowchart of still another embodiment of a service bypass method according to the present invention. This embodiment uses an access network device as an AP as an example for description.

As shown in FIG. 5, the service bypass method may include:

Step 501: The UE sends a PDP context setup request message to the AP.

Step 502: The AP determines to perform SeGW bypass on the UE according to the APN carried in the PDP context setup request message, and records context information of the UE.

In this embodiment, the APN that needs to perform the SeGW bypass may be configured on the AP in advance. For example, the AP may save the APN that needs to be bypassed by the SeGW in a data table or a database, so that the PDP context setup request message sent by the UE is received. Afterwards, the AP may determine to perform SeGW bypass on the UE according to the APN carried in the PDP context setup request message.

Step 503: The AP sends a PDP context establishment request message to the GGSN.

Step 504, the GGSN dials the authentication system to the remote user (Remote Authentication Dial

In User Service; hereinafter referred to as: RADIUS) The server sends an access authentication request.

Step 505: The RADIUS server authenticates the UE, and then returns an authentication response message to the GGSN.

Step 506: The GGSN sends an Accounting Start Request message to the RADIUS server.

Step 507: The RADIUS server forwards the foregoing charging start request message to the WAP GW. Step 508: The WAP GW sends a charging start response message to the RADIUS server, and then the WAP GW creates UE session information, starts real-time session monitoring for the UE, and collects charging information such as traffic and duration.

Step 509: The RADIUS server forwards a charging start response message to the GGSN. Step 510: The GGSN sends a PDP context establishment accept message to the UE.

The foregoing steps 501 to 510 are for the UE to go online.

Step 511: The UE sends a webpage request to the AP, and the AP determines, according to the context information of the UE, that the webpage request is required to perform a SeGW bypass, and the AP caches the webpage request, and performs step 512. In addition, if the AP determines that the fault is incorrect according to the context information of the UE. When the webpage is requested to perform the SeGW bypass, it is processed according to other existing bypass rules, and details are not described herein again.

In this embodiment, after receiving the webpage request sent by the UE, the AP may obtain the context identifier corresponding to the MSISDN according to the MSISDN of the UE carried in the webpage request, and then the AP may find the corresponding context identifier according to the obtained context identifier. Context information, and the AP may determine to perform SeGW bypass on the webpage request according to the found context information.

Step 512: The AP generates an accounting request message and sends the message to the SeGW, where the charging request message carries the IP address of the UE and the MSISDN. In this embodiment, the IP address of the UE may be represented as IP _X .

Specifically, the AP may send the charging request message to the SeGW through a tunnel. The above-mentioned tunnel may be the same IPsec tunnel as the Iuh, or may be a dedicated IPsec tunnel, or may be another tunnel. The specific form of the tunnel is not limited in the embodiment of the present invention.

Step 513: The SeGW parses the foregoing charging request message, and performs a 1: 1 NAT on the charging request message, and then sends the message to the WAP GW.

Specifically, the SeGW exchanges the IP address carried in the foregoing charging request message with an idle IP address in the address pool configured by the SeGW. In combination with the embodiment shown in FIG. 4, the SeGW can replace the IP _X with the IP _sl. ~: A free IP address in IP _s2 , for example: IP _y , establish and save 1? Correspondence with IP _y .

Step 514: The WAP GW establishes and stores the correspondence between the MSISDN of the UE and the IP address after the NAT; that is, the WAP GW establishes and stores the correspondence between the MSISDN and the IPy of the UE.

Step 515: The WAP GW sends a charging response message to the SeGW. Step 516: The SeGW sends the charging response message to the AP after performing a 1: 1 NAT.

Specifically, the SeGW replaces the IP _y carried in the charging response message with ΙΡχ according to the recorded correspondence, and sends the charging response message after performing the 1:1 NAT to the ΑΡ.

Exception handling: If the charging response message is not received for a long time after sending the charging request message, the charging request message is resent, and if the charging request message is not received after 3 consecutive charging request messages are received, Then, the charging request message is stopped, and the corresponding bypass rule is automatically changed to "Gi Bypass Rule", and the "Accounting Request is unsuccessful, and the Bypass Rule is changed from "SeGW Bypass" to "Gi" in the AP log. Bypass".

In addition, between the sending of the charging request message and the receiving of the charging response message, if the AP receives another service request from the UE, the AP discards the other service request, that is, the AP only needs to buffer a service request of the UE.

Step 517: After receiving the charging response message, the AP deletes the GTP-U header of the cached webpage request, and sends the webpage request for deleting the GTP-U header to the SeGW through the tunnel.

In this embodiment, the tunnel may be the same IPsec tunnel as the Iuh, or may be a dedicated IPsec tunnel, or may be another tunnel. The specific form of the tunnel is not limited in the embodiment of the present invention.

Step 518: The SeGW sends the received webpage request to the WAP after 1 : 1 NAT

GW.

Specifically, the SeGW may replace the IP _X in the received webpage request with the IP _y according to the recorded correspondence, and then send the webpage request after the 1:1 NAT to the WAP GW.

Step 519, the WAP GW sends the received webpage request to the service provider (Service Provider; hereinafter referred to as SP) / content provider (Content Provider; hereinafter referred to as CP) „ Step 520, SP/CP sends a webpage request response to WAP GW.

Step 521: The WAP GW sends a webpage request response to the SeGW.

Step 522: The SeGW sends the 1:1 response to the webpage request response to the AP. Specifically, the SeGW may respond to the webpage request response according to the recorded correspondence. IP _{y is} replaced with IP _X , and then a web page request response after 1:1 NAT is sent to the AP.

Step 523: The AP sends the received webpage request response to the UE.

In this way, after receiving the webpage request response, the UE can perform normal service browsing. When the AP sends the subsequent service request packet of the UE, it does not need to send the charging request message again.

The NAT context on the SeGW is sufficient.

The above steps 511 to 523 are SeGW bypass processes.

Step 524: The UE sends a PDP context deletion request message to the AP.

Step 525: The AP sends a PDP context delete request message to the xGSN.

The above xGSN may be a GGSN or an SGSN.

Step 526: The AP sends a charging end request message to the SeGW.

Step 527: The SeGW sends the 1 to 1 NAT to the charging end request message and sends the message to the WAP.

GW, and starts a timer to wait for the WAP GW's charging end response message.

Specifically, the SeGW may replace the IP _X in the received charging end request message with the IP _y according to the recorded correspondence, and then send the webpage request after performing the 1:1 NAT to the WAP.

GW.

Step 528: The WAP GW sends an Accounting End Response message to the SeGW.

Step 529: The SeGW sends 1:1 NAT to the foregoing charging end response message, and then sends the context information of the UE.

It should be noted that: Under normal circumstances, the SeGW receives the charging end response message of the WAP GW before the timer ends. After receiving the charging end response message, the SeGW sends the 1:1 end NAT to the AP, and deletes the context information of the UE. If the SeGW does not receive the WAP GW after the timer expires, the SeGW does not receive the WAP GW. The charging end response message, the SeGW deletes the context information of the UE. In this case, the SeGW does not send a charging end response message to the AP.

Step 530: The xGSN sends a PDP context delete accept message to the AP.

Step 531: The AP deletes the context information of the UE. In other words, ΑΡ received xGSN After the PDP context deletion accept message is sent, the context information of the UE may be deleted, and the context information of the UE may not be deleted after receiving the charging end response message of the SeGW.

Step 532: The AP sends a PDP context deletion accept message to the UE.

The foregoing steps 524 to 532 are the UE offline process.

The foregoing embodiment can implement bypassing the WAP service, thereby saving bandwidth resources. A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The foregoing steps include the steps of the foregoing method embodiments; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Figure 6 is a schematic structural diagram of an embodiment of an access network device according to the present invention. The access network device in this embodiment can implement the process of the embodiment shown in Figure 1 of the present invention. As shown in Figure 6, the access network device can be Includes:

The receiving module 61 is configured to receive a service request data packet sent by the user equipment, and receive a charging response message sent by the WAP GW;

The determining module 62 is configured to perform SeGW bypass on the service request data packet according to the context information of the user equipment.

The generating module 63 is configured to generate a charging request message, where the charging request message carries an IP address of the user equipment and an MSISDN;

The sending module 64 is configured to send the charging request message generated by the generating module 63 to the SeGW, so that the SeGW sends the charging request message to the WAP GW after receiving the NAT, and receives the charging response sent by the WAP GW at the receiving module 61. After the message, the service request packet is sent to the SeGW, so that the SeGW performs NAT on the service request packet sent by the sending module 64, and then sends the packet to the WAP GW.

In the foregoing access network device, the receiving module 61 receives the number of service requests sent by the user equipment. After the packet, the determining module 62 may determine, according to the context information of the user equipment, that the service request data packet is subjected to SeGW bypass, and the generating module 63 generates a charging request message, and the sending module 64 sends the information to the SeGW for the SeGW to calculate. The fee request message is sent to the WAP GW after the NAT is sent; after the receiving module 61 receives the charging response message sent by the WAP GW, the sending module 64 sends the service request data packet to the SeGW, so that the SeGW sends the service request data to the sending module 64. After the packet is NAT, it is sent to the WAP GW. Therefore, the WAP service can be bypassed, thereby saving bandwidth resources.

FIG. 7 is a schematic structural diagram of another embodiment of an access network device according to the present invention. The difference is that the access network device shown in FIG. 7 may further include: a recording module. 65;

Further, the receiving module 61 is further configured to receive a PDP context establishment request message sent by the user equipment;

The determining module 62 is further configured to perform a SeGW bypass on the user equipment according to the APN carried in the PDP context setup request message;

The recording module 65 is configured to record context information of the user equipment.

Further, the access network device may further include: a cache module 66 and a deletion module 67; a cache module 66, configured to cache the service request data packet received by the receiving module 61; and a deletion module 67, configured to delete the cached service of the cache module 66 Request the GTP-U header of the packet;

The sending module 64 is specifically configured to send the service request data packet after deleting the GTP-U header to the SeGW through the tunnel.

The tunnel may be the same IPsec tunnel as the Iuh, or may be a dedicated IPsec tunnel, or may be another tunnel. The specific form of the tunnel is not limited in the embodiment of the present invention.

Further, the foregoing access network device may further include:

The discarding module 68 is configured to send, after the sending module 64 sends the charging request message to the SeGW, Before the receiving module 61 receives the charging response message sent by the WAP GW, when the receiving module 61 receives another service request message sent by the user equipment, the receiving module 61 discards another service request message.

Further, the access network device may further include: a context deletion module 69;

Specifically, the receiving module 61 is further configured to receive a PDP context deletion request message sent by the user equipment, and receive a PDP context deletion accept message sent by the xGSN.

The sending module 64 is further configured to: after the receiving module 61 receives the PDP context delete request message, send a PDP context delete request message to the xGSN;

The context deletion module 69 is configured to delete the context information of the user equipment after the receiving module 61 receives the PDP context deletion accept message.

In this embodiment, the sending module 64 is further configured to send a charging end request message to the SeGW, so that the SeGW performs NAT on the charging end request message and sends the message to the WAP GW.

The receiving module 61 is further configured to receive a charging end response message sent by the SeGW, where the charging end response message is sent by the S eG W to the access network device by performing NAT on the charging end response message sent by the WAP GW.

The access network device can bypass the WAP service, thereby saving bandwidth resources.

FIG. 8 is a schematic structural diagram of an embodiment of a security gateway according to the present invention. The SeGW in this embodiment may implement the process of the embodiment shown in FIG. 2 of the present invention. As shown in FIG. 8, the SeGW may include:

The message receiving module 81 is configured to receive an accounting request message sent by the access network device, where the charging request message is that the access network device receives the service request data packet sent by the user equipment, and determines the service according to the context information of the user equipment. After the request packet is sent to the SeGW by the SeGW, the charging request message carries the IP address and the MSISDN of the user equipment; and receives the charging response message sent by the WAP GW; and receives the service request data sent by the access network device. The packet conversion module 82 is configured to perform the charging request message received by the message receiving module 81. NAT, and performing NAT on the charging response message received by the message receiving module 81, and performing NAT on the service request data packet received by the message receiving module 81;

The message sending module 83 is configured to send the charging request message after performing the NAT to the WAP GW, and send the charging response message after performing the NAT to the access network device, and send the service request data packet after the NAT is sent to the WAP GW.

In the foregoing SeGW, after the message receiving module 81 receives the charging request message sent by the access network device, the address converting module 82 performs NAT on the charging request message, and then sends the charging request to the WAP GW, and sends the charging response to the WAP GW. After the message is sent to the NAT, the message is sent to the access network device, and then the message sending module 83 can receive the service request data packet sent by the access network device, and the address conversion module 82 sends the service request to the access network device. After the packet is NATed, it is sent to the WAP GW. Therefore, the WAP service can be bypassed, thereby saving bandwidth resources.

FIG. 9 is a schematic structural diagram of another embodiment of the security gateway of the present invention. The difference is that, in the SeGW shown in FIG. 9, the address translation module 82 can include:

The sub-module 821 is configured to replace the IP address of the user equipment carried in the IP header of the charging request message with the IP address in the address pool configured by the SeGW, and the charging information carried in the charging request message. The IP address of the UE is replaced with an idle IP address in the address pool configured by the foregoing SeGW;

Establishing a sub-module 822, configured to establish a correspondence between an IP address of the user equipment and the idle IP address;

The saving submodule 823 is configured to save the correspondence established by the establishing submodule 822.

In this embodiment, the replacement sub-module 821 is further configured to replace the IP address carried in the charging response message with the IP address of the user equipment according to the corresponding relationship saved by the saving sub-module 823.

Further, the replacement sub-module 821 may further replace the IP address of the user equipment in the service request data packet sent by the access network device with the idle IP address according to the corresponding relationship saved by the storage sub-module 823; thus, the message sending module 83 The service request packet replaced by the replacement submodule 821 can be sent to the WAP GW. Further, the foregoing SeGW may further include: an information deletion module 84;

The message receiving module 81 is further configured to receive an charging end request message sent by the access network device, and receive a charging end response message sent by the WAP GW;

The address conversion module 82 is further configured to perform NAT on the charging end request message received by the message receiving module 81, and perform NAT on the charging end response message received by the message receiving module 81. The message sending module 83 is further configured to perform NAT. The subsequent charging end request message is sent to the WAP GW, and the charging end response message after the NAT is sent to the access network device. The information deleting module 84 is configured to: after the message receiving module 81 receives the charging end response message, , delete the context information of the above user equipment.

Further, the security gateway may further include: a startup module 85;

Specifically, the startup module 85 is configured to start a timer. At this time, the information deletion module 84 may delete the foregoing after the timer ends, if the message receiving module 81 still does not receive the charging end response message sent by the WAP GW. Context information of the user device.

The foregoing SeGW can bypass the WAP service, thereby saving bandwidth resources. A person skilled in the art can understand that the drawings are only a schematic diagram of a preferred embodiment, and the modules or processes in the drawings are not necessarily required to implement the invention.

Those skilled in the art can understand that the modules in the apparatus in the embodiments may be distributed in the apparatus of the embodiment according to the description of the embodiments, or may be correspondingly changed in one or more apparatuses different from the embodiment. The modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced. The modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

Rights request

A service bypass method, characterized in that it comprises:

The method according to claim 1, wherein before the access network device receives the service request data packet sent by the user equipment, the method further includes:

Receiving, by the access network device, a packet data protocol context establishment request message sent by the user equipment, and determining, by the access point name carried in the packet data protocol context establishment request message, performing a security gateway bypass on the user equipment, And recording context information of the user equipment.

The method according to claim 1 or 2, wherein, after determining, according to the context information of the user equipment, the security gateway bypassing the service request data packet, the method further includes:

The access network device buffers the service request data packet;

The sending the service request data packet to the security gateway includes:

After the access network device deletes the user plane general packet radio service tunnel protocol header of the buffered service request data packet, the user plane general packet radio service tunnel protocol header is deleted. The service request packet of the department is sent to the security gateway through a tunnel.

The method according to claim 1 or 2, wherein after the access network device generates a charging request message and sends the message to the security gateway, the access network device receives the wireless application protocol service gateway to send Before the billing response message, it also includes:

And if the access network device receives another service request message sent by the user equipment, the access network device discards the another service request message.

The method according to claim 1 or 2, further comprising: after the access network device receives the packet data protocol context deletion request message sent by the user equipment, to the general packet radio service support node Sending a packet data protocol context delete request message;

After receiving the packet data protocol context deletion accept message sent by the general packet radio service support node, the access network device deletes the context information of the user equipment.

The method according to claim 5, wherein after the sending the packet data protocol context deletion request message to the general packet radio service support node, the method further includes:

The access network device sends a charging end request message to the security gateway, so that the security gateway performs network address translation on the charging end request message and sends the information to the wireless application protocol service gateway;

The access network device receives the charging end response message sent by the security gateway, where the charging end response message is that the security gateway performs network address translation on the charging end response message sent by the wireless application protocol service gateway. And then sent to the access network device.

The method according to claim 1 or 2, wherein after the security gateway performs network address translation on the charging request message and sends the message to the wireless application protocol service gateway, the method further includes:

The wireless application protocol service gateway establishes and stores a correspondence between the mobile station international integrated service digital network number of the user equipment and an internet protocol address after performing network address translation.

8. A service bypass method, characterized in that:

The security gateway performs network address translation on the charging request message, and then sends the information to the wireless application protocol service gateway, receives the charging response message sent by the wireless application protocol service gateway, and performs network address translation on the charging response message. And transmitting to the access network device; the security gateway receives the service request data packet sent by the access network device, performs network address translation on the service request data packet sent by the access network device, and sends the service request data packet to the Wireless Application Protocol Service Gateway.

The method according to claim 8, wherein the security gateway performs network address translation on the charging request message, including:

The security gateway replaces an Internet Protocol address of the user equipment carried in an Internet Protocol Head of the Accounting Request message with an Internet Protocol address that is idle in an address pool configured by the security gateway, and the charging request is The Internet Protocol address of the user equipment included in the charging information carried by the message is replaced with an Internet Protocol address that is free in the address pool configured by the security gateway, and the Internet Protocol address of the user equipment is established and saved. Correspondence of Internet Protocol addresses;

The performing network address translation on the charging response message includes:

The security gateway replaces the Internet Protocol address carried in the charging response message with the Internet Protocol address of the user equipment according to the saved correspondence.

The method according to claim 9, wherein the performing the network address translation on the service request data packet sent by the access network device and transmitting the information to the wireless application protocol service gateway comprises: The security gateway replaces the Internet Protocol address of the user equipment in the service request data packet sent by the access network device with the idle Internet protocol address according to the saved correspondence, and replaces the replaced service The request packet is sent to the wireless application protocol service gateway.

The method according to any one of claims 8 to 10, further comprising: the security gateway receiving an charging end request message sent by the access network device, and the charging end request message Transmitting to the wireless application protocol service gateway after performing network address translation;

The security gateway receives the charging end response message sent by the wireless application protocol service gateway, deletes the context information of the user equipment, and performs network address translation on the charging end response message, and then sends the information to the access network. device.

12. The method according to claim 11, further comprising:

The security gateway starts a timer, and if the charging end response message sent by the wireless application protocol service gateway is not received after the timer ends, the security gateway deletes the context information of the user equipment.

13. An access network device, comprising:

a sending module, configured to send the charging request message generated by the generating module to the security gateway, so that the security gateway performs network address translation on the charging request message, and then sends the information to the wireless application protocol service gateway; After receiving the charging response message sent by the wireless application protocol service gateway, the receiving module sends a service request data packet to the security gateway, to The security gateway performs network address translation on the service request data packet sent by the sending module, and then sends the service request data packet to the wireless application protocol service gateway.

The access network device according to claim 13, further comprising: a recording module;

The receiving module is further configured to receive a packet data protocol context establishment request message sent by the user equipment;

The determining module is further configured to: perform a security gateway bypass on the user equipment according to an access point name carried in the packet data protocol context setup request message;

The recording module is configured to record context information of the user equipment.

The access network device according to claim 13 or 14, further comprising: a deleting module and a cache module;

The cache module is configured to cache a service request data packet received by the receiving module, and the deleting module is configured to delete a user-side general packet radio service tunnel protocol header of the service request data packet buffered by the cache module;

The sending module is specifically configured to send, by using a tunnel, a service request data packet that is deleted from the user plane general packet radio service tunneling protocol header to the security gateway.

The access network device according to claim 13 or 14, further comprising: a discarding module, configured to: after the sending module sends the charging request message to the security gateway, the receiving Before receiving the charging response message sent by the wireless application protocol service gateway, the module discards the another service request message when the receiving module receives another service request message sent by the user equipment.

The access network device according to claim 13 or 14, further comprising: a context deletion module;

The receiving module is further configured to receive a packet data protocol context deletion request message sent by the user equipment, and receive a packet data protocol context deletion accept message sent by the general packet radio service support node; The sending module is further configured to: after the receiving module receives the packet data protocol context deletion request message, send a packet data protocol context deletion request message to the general packet radio service support node;

The context deletion module is configured to delete context information of the user equipment after the receiving module receives the packet data protocol context deletion accept message.

18. The access network device of claim 17, wherein

The sending module is further configured to send a charging end request message to the security gateway, so that the security gateway performs network address translation on the charging end request message and sends the information to the wireless application protocol service gateway.

The receiving module is further configured to receive a charging end response message sent by the security gateway, where the charging end response message is a network that is sent by the security gateway to the charging end response message sent by the wireless application protocol service gateway. The address is translated and sent to the access network device.

19. A security gateway, comprising:

An address translation module, configured to perform network address translation on the charging request message received by the message receiving module, and perform network address translation on the charging response message received by the message receiving module, and the message Receiving, by the receiving module, the service request data packet to perform network address translation;

a message sending module, configured to send a charging request message after performing network address translation to a wireless application protocol service gateway, and send a charging response message after performing network address translation to The access network device, and the service request data packet that performs network address translation, is sent to the wireless application protocol service gateway.

The security gateway according to claim 19, wherein the address translation module comprises:

a replacement submodule, configured to replace an internet protocol address of the user equipment carried in an internet protocol header of the charging request message with an idle internet protocol address in an address pool configured by the security gateway, and The Internet Protocol address of the user equipment included in the charging information carried in the fee request message is replaced with an idle Internet protocol address in the address pool configured by the security gateway;

Establishing a submodule, configured to establish a correspondence between an Internet Protocol address of the user equipment and the idle Internet Protocol address;

The saving submodule is configured to save the correspondence established by the establishing submodule.

21. The security gateway of claim 20, wherein

The replacement sub-module is further configured to replace the Internet Protocol address carried in the charging response message with the Internet Protocol address of the user equipment according to the correspondence relationship saved by the saving sub-module.

22. The security gateway of claim 20, wherein

The replacement sub-module is further configured to: replace the Internet Protocol address of the user equipment in the service request data packet sent by the access network device with the idle relationship according to the correspondence relationship saved by the save submodule Internet protocol address;

The message sending module is specifically configured to send the service request data packet that is replaced by the replacement submodule to the wireless application protocol service gateway.

The security gateway according to any one of claims 19 to 22, further comprising: an information deletion module;

The message receiving module is further configured to receive a charging end request message sent by the access network device, and receive a charging end response message sent by the wireless application protocol service gateway; The address translation module is further configured to: perform network address translation on the charging end request message received by the message receiving module, and perform network address translation on the charging end response message received by the message receiving module;

The message sending module is further configured to send a charging end request message after performing network address translation to the wireless application protocol service gateway, and send a charging end response message after performing network address translation to the access Network equipment;

The information deleting module is configured to delete the context information of the user equipment after the message receiving module receives the charging end response message.

The security gateway according to claim 23, further comprising: a startup module;

The startup module is configured to start a timer;

The information deleting module is specifically configured to delete the context of the user equipment if the message receiving module does not receive the charging end response message sent by the wireless application protocol service gateway after the timer is ended. information.