WO2012130068A1 - Data packet transmission method and related apparatus - Google Patents

Data packet transmission method and related apparatus Download PDF

Info

Publication number
WO2012130068A1
WO2012130068A1 PCT/CN2012/072705 CN2012072705W WO2012130068A1 WO 2012130068 A1 WO2012130068 A1 WO 2012130068A1 CN 2012072705 W CN2012072705 W CN 2012072705W WO 2012130068 A1 WO2012130068 A1 WO 2012130068A1
Authority
WO
WIPO (PCT)
Prior art keywords
tunnel
priority value
data packet
security
base station
Prior art date
Application number
PCT/CN2012/072705
Other languages
French (fr)
Chinese (zh)
Inventor
张爱琴
朱文若
刘海
靳维生
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2012130068A1 publication Critical patent/WO2012130068A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels

Definitions

  • the present invention relates to the field of wireless communication technologies, and in particular, to a data packet transmission method and related devices.
  • the Home NodeB (H(e)NB) is a type of base station that is deployed as a dedicated resource in a home, group, company, or school.
  • the home base station is connected through an Internet Protocol (IP) broadband network communication network.
  • IP Internet Protocol
  • IPsec Internet Protocol Security
  • SeGW security gateway
  • Traffic under the home base station is transmitted through the secure tunnel.
  • the transmitting end for example, the home base station, after receiving the data packet to be transmitted, assigns the serial number to the data packet in order, and then transmits it to the receiving end (for example, the security gateway) through the established IPsec tunnel.
  • the data packet sent by the sender is forwarded through a Broadband Remote Access Server (BRAS) or a Broadband Network Gateway (BNG) in the broadband network.
  • BRAS Broadband Remote Access Server
  • BNG Broadband Network Gateway
  • the broadband network gateway or the broadband access server performs different priority processing according to the Differentiated Services Code Point (DSCP) of the outer IP packet in the data packet, and the differentiated service point code indicates the priority value.
  • DSCP Differentiated Services Code Point
  • the transmitting end transmits the data packet through at least one secure tunnel, and the DSCP has a higher priority and the data packet with a larger sequence number is preferentially processed, and the DSCP has a lower priority and a smaller serial number.
  • the data packets are delayed by BRAS or BNG. When these data packets arrive at the receiving end, the receiving end needs to perform anti-replay processing. The receiving end determines whether the sequence number of the received data packet is smaller than the maximum sequence number of the previously received data packet, and if so, treats the data packet with the smaller sequence number as the replayed data packet, and directly discards the data. Packet, which causes packet loss with a packet with a smaller sequence number. Summary of the invention
  • the present invention provides a data packet transmission method and related equipment, which can transmit data packets of different DSCP priorities through multiple secure tunnels.
  • a data packet transmission method including:
  • the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • a data packet transmission method including:
  • the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • a base station including:
  • a first priority acquiring unit configured to obtain a priority value of an uplink data packet to be transmitted
  • a first correspondence relationship searching unit configured to search for a priority value set according to a priority value obtained by the first priority acquiring unit Corresponding relationship between the tunnel identifier and each of the tunnel identifiers, each priority value corresponding to at least one tunnel identifier;
  • the uplink data sending unit is configured to: when the first correspondence search unit finds the corresponding tunnel identifier, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • a security gateway including:
  • a second priority acquiring unit configured to obtain a priority value of the downlink data packet to be transmitted
  • a second correspondence relationship searching unit configured to search for the priority value set according to the priority value obtained by the second priority acquiring unit Corresponding relationship between the tunnel identifier and each of the tunnel identifiers, each priority value corresponding to at least one tunnel identifier;
  • a downlink data sending unit configured to search for a corresponding tunnel in the second correspondence search unit
  • the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the base station acquires the tunnel identifier of the corresponding security tunnel according to the priority value of the uplink data packet, and the base station may use the uplink data packet because each priority value corresponds to at least one tunnel identifier.
  • Transmission through multiple secure tunnels so that after receiving the data packet, the security gateway separately performs anti-replay processing on the data packets received by each secure tunnel, thereby reducing the number of packets that are determined by the security gateway to be played back. , in turn, can reduce the probability of packet loss.
  • FIG. 1 is a flowchart of a data packet transmission method according to Embodiment 1 of the present invention.
  • FIG. 2 is a flowchart of a data packet transmission method according to Embodiment 2 of the present invention.
  • FIG. 3 is a flowchart of a data packet transmission method according to Embodiment 3 of the present invention.
  • FIG. 4 is a flowchart of a data packet transmission method according to Embodiment 4 of the present invention.
  • FIG. 5 is a flowchart of a method for establishing a correspondence between a base station establishing a priority value and a tunnel identifier of at least one security tunnel in a data packet transmission method according to an embodiment of the present disclosure
  • FIG. 6 is a flowchart of a data packet transmission method according to Embodiment 5 of the present invention.
  • FIG. 7 is a flowchart of a data packet transmission method according to Embodiment 6 of the present invention.
  • FIG. 8 is a flowchart of a data packet transmission method according to Embodiment 7 of the present invention.
  • Embodiment 8 of the present invention is a flowchart of a data packet transmission method according to Embodiment 8 of the present invention.
  • FIG. 10 is a flowchart of a data packet transmission method according to Embodiment 9 of the present invention.
  • FIG. 11 is a flowchart of a data packet transmission method according to Embodiment 10 of the present invention.
  • FIG. 13 is an application scenario diagram of a data packet transmission method according to an embodiment of the present invention.
  • FIG. 14 is a schematic structural diagram of a base station according to Embodiment 12 of the present invention.
  • FIG. 15 is a schematic structural diagram of a base station according to Embodiment 13 of the present invention.
  • 16 is a schematic structural diagram of a base station according to Embodiment 14 of the present invention
  • 17 is a schematic structural diagram of a base station according to Embodiment 15 of the present invention
  • FIG. 18 is a schematic structural diagram of a base station according to Embodiment 16 of the present invention.
  • FIG. 19 is a schematic structural diagram of a security gateway according to Embodiment 17 of the present invention.
  • FIG. 20 is a schematic structural diagram of a security gateway according to Embodiment 18 of the present invention.
  • FIG. 21 is a schematic structural diagram of a security gateway according to Embodiment 19 of the present invention.
  • FIG. 22 is a schematic structural diagram of a security gateway according to Embodiment 20 of the present invention.
  • FIG. 23 is a schematic structural diagram of a security gateway according to Embodiment 21 of the present invention.
  • the invention provides a data packet transmission method, a base station and a security gateway.
  • FIG. 1 is a flowchart of a data packet transmission method according to Embodiment 1 of the present invention.
  • the data packet transmission method provided in Embodiment 1 of the present invention includes.
  • the base station may receive an uplink data packet sent by the user equipment.
  • the priority value can be carried in the upstream packet.
  • the priority value may be a differentiated service point code (DSCP) of the data packet, or may be a QoS Class Identifier (QCI) of the radio bearer.
  • DSCP differentiated service point code
  • QCI QoS Class Identifier
  • the base station can use the DSCP value of the inner IP packet of the data packet as the priority value of the data packet.
  • the base station searches for the correspondence between the set priority value and the tunnel identifier according to the obtained priority value.
  • the different tunnel identifiers in the corresponding relationship respectively correspond to different priority values, and each priority value corresponds to at least one tunnel identifier, and the corresponding relationship may be established in advance when establishing a secure tunnel, or may receive a bearer setup request at the base station.
  • the secure tunnel may also be referred to as a Child Security Association (Child SA).
  • the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • the base station transmits the uplink data packet by using a secure tunnel corresponding to the found tunnel identifier.
  • the tunnel identifier is marked in the encapsulation process of the uplink data packet header.
  • the base station acquires the tunnel identifier of the corresponding security tunnel according to the priority value of the uplink data packet, and the base station may use the uplink data packet because each priority value corresponds to at least one tunnel identifier.
  • Transmission through multiple secure tunnels so that after receiving the data packet, the security gateway separately performs anti-replay processing on the data packets received by each secure tunnel, thereby reducing the number of packets that are determined by the security gateway to be played back. , in turn, can reduce the probability of packet loss.
  • the base station can obtain the priority value of the inner layer IP packet in the uplink data packet to be transmitted, and use the priority value as the priority value of the uplink data packet.
  • the priority value of the inner IP packet is in the original IP Header field of the packet.
  • FIG. 2 is a flowchart of a data packet transmission method according to Embodiment 2 of the present invention.
  • the established secure tunnel includes an uplink secure tunnel and a downlink secure tunnel, and each uplink or downlink secure tunnel has a tunnel identifier.
  • the key exchange request message may carry one or more priority values to mark the priority value attribute of the secure tunnel.
  • the tunnel identifier includes an uplink tunnel identifier and a downlink tunnel identifier.
  • Table 1 is the correspondence between the tunnel identifier and the priority value of the security tunnel established in the embodiment of the present invention. This correspondence is synchronized between the base station and the security gateway, or The uplink security tunnel and the downlink security tunnel of a security tunnel have the same priority value (including a combination of multiple priority values).
  • the priority value of the uplink data packet or the downlink data packet includes 9 levels, which are 1 to 9 levels respectively.
  • multiple security tunnels are respectively established for different priority values.
  • the correspondence between the priority value and the tunnel identifier is as shown above. For example, 1A indicates the uplink tunnel identifier of the first security tunnel, and 1B indicates the downlink tunnel identifier of the first security tunnel.
  • the base station and the security gateway establish multiple security tunnels by using multiple key exchange requests and key exchange response messages.
  • the base station establishes a correspondence between a priority value and a tunnel identifier of at least one secure tunnel.
  • the corresponding relationship between the tunnel identifier and the priority value of the secure tunnel established by the local base station and the security gateway respectively is maintained on both sides of the base station and the security gateway, and synchronization is not required. That is to say, in the same security tunnel (including the uplink security tunnel and the downlink security, the two correspondences are independently set and maintained on both sides of the base station and the security gateway, as shown in Table 2 and Table 3, for example: 1A indicates the first security tunnel.
  • the uplink tunnel identifier, 1B represents the downlink tunnel identifier of the first security tunnel.
  • Table 3 is the correspondence between the downlink tunnel identifier and the priority value established by the security gateway.
  • the data packet transmission method provided by the second embodiment of the present invention may further include:
  • the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • the execution process of the steps 203-205 in the embodiment of the present invention is the same as the execution process of the steps 101-103 in the foregoing embodiment, and the description is not repeated here.
  • the data transmission method provided in the second embodiment of the present invention may further include:
  • the base station sends a key exchange request message to the security gateway to establish a new secure tunnel if the corresponding tunnel identifier is not found.
  • the security gateway 207 Receive a key exchange response message returned by the security gateway to establish a new security tunnel with the security gateway, and establish a correspondence between the tunnel identifier and the priority value of the new security tunnel. Correspondence between the tunnel ID and the priority value of the new security tunnel. Among them, the established correspondence The relationship includes the correspondence between the uplink tunnel identifier of the security tunnel and the priority value and/or the correspondence between the downlink tunnel identifier and the priority value.
  • the base station transmits the uplink data packet to the security gateway by using the newly established security tunnel.
  • the secure tunnel corresponding to the priority value of the data packet is established or independently established between the base station and the security gateway.
  • the base station acquires the tunnel identifier of the corresponding security tunnel according to the priority value of the uplink data packet, and each priority value corresponds to the tunnel for transmission, and then the security gateway receives the data packet for each security tunnel after receiving the data packet.
  • the packet is separately subjected to anti-replay processing, thereby reducing the number of packets that are considered to be playback packets by the security gateway, thereby reducing the probability of packet loss.
  • the base station If the base station does not find the corresponding tunnel identifier, the base station establishes a new security tunnel and establishes a correspondence between the tunnel identifier and the priority value of the new security tunnel, so that the uplink data packet with the same priority value can be subsequently received.
  • the tunnel identifier is obtained according to the corresponding relationship, and the uplink data packet is transmitted through the corresponding secure tunnel of the tunnel identifier.
  • FIG. 3 is a flowchart of an improved data packet transmission method according to Embodiment 3 of the present invention.
  • the data packet transmission method provided in Embodiment 3 of the present invention includes:
  • the base station may send at least two key exchange request messages to the security gateway when the power is turned on.
  • the sending at least two key agreement exchange requests may be used to establish at least two secure tunnels.
  • Each of the newly established security tunnels includes an uplink security tunnel and a downlink security tunnel.
  • the uplink tunnel identifier and the downlink tunnel identifier of the security tunnel correspond to each other.
  • the base station may also establish a secure tunnel between the base station and the security gateway when the bearer of the user equipment is established. For example, the base station receives the radio bearer setup request or the base station receives the radio bearer. A key exchange request message is sent to the security gateway when the establishment or initial context establishment request or the initial context establishment is completed, the returned key exchange response message is received, and the security gateway establishes a secure tunnel.
  • the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • the execution process of the steps 302-304 in the embodiment of the present invention is the same as the execution process of the steps 101-103 in the foregoing embodiment, and the description is not repeated here.
  • the data transmission method provided in Embodiment 3 of the present invention may further include:
  • the base station determines the currently existing unused security tunnel if the corresponding tunnel identifier is not found according to the set correspondence.
  • the so-called unused secure tunnel is a secure tunnel for transmitting data packets, i.e., the uplink or downlink secure tunnel is not assigned a packet priority attribute.
  • the uplink data packet is transmitted to the security gateway by using the unused security tunnel, and the correspondence between the tunnel identifier and the priority value of the unused security tunnel is established.
  • step 301 establishes a security tunnel that is not used.
  • the unused security tunnel may be determined.
  • the base station also establishes a correspondence between the tunnel identifier of the determined unused security tunnel and the priority value, so as to subsequently search for the corresponding tunnel identifier according to the correspondence.
  • the data packet transmission method provided by the embodiment of the present invention further includes:
  • the secure tunnel transmits the uplink data packet to the security gateway through the new secure tunnel, and establishes a correspondence between the tunnel identifier and the priority value of the new secure tunnel.
  • the base station when the base station does not find the corresponding tunnel identifier and determines that there is no unused security tunnel, for example, the initially established unused security tunnel is used to transmit data of other priority values, the base station The security gateway sends a key exchange request message, receives a key exchange response message returned by the security gateway, and establishes a new secure tunnel with the security gateway. Established in a new secure tunnel After the completion, the uplink packet is transmitted to the security gateway through the new secure tunnel, and the correspondence between the tunnel identifier and the priority value of the new secure tunnel is established.
  • the security gateway may obtain the priority value of the uplink data packet, and establish a correspondence between the priority value and the tunnel identifier of the security tunnel that receives the data packet. And then forward the upstream packet.
  • the step of establishing a correspondence between the tunnel identifier and the priority value of the new security tunnel, or establishing the correspondence between the tunnel identifier and the priority value of the unused security tunnel may be adopted.
  • the key exchange message carries the packet priority to implement.
  • the steps 201 and 202 in the foregoing Embodiment 2 are shown; or the method in which the base station and the security gateway are independently set locally, as shown in steps 201 and 202 in Embodiment 2, of course, the two methods are The priority value of the uplink packet is obtained.
  • the data packet is transmitted through the unused secure tunnel, and the priority value and the unused security tunnel are established.
  • the tunnel identifiers so that the base station and the security gateway do not need to establish a correspondence between the priority value and the tunnel identifier of the newly established security tunnel after establishing the security tunnel, but wait until the data packet is transmitted. And determining the correspondence between the priority value and the tunnel identifier of the unused security tunnel when there is an unused security tunnel.
  • FIG. 4 is a flowchart of a data packet transmission method according to Embodiment 4 of the present invention.
  • the data packet transmission method provided in Embodiment 4 of the present invention includes:
  • the base station may receive a radio bearer setup request or an initial context setup request sent by the mobility management entity, where the user priority, the service priority, and the service quality level identifier are carried (Quantity of Service Class) Identifier, QCI).
  • QCI Quality of Service Class
  • the base station sends a notification (Notify) message to the security gateway, where the priority is carried. 403.
  • the security gateway after receiving the notification message, the security gateway sends a key exchange request message carrying a priority value to the base station, and the base station returns a key exchange response message to the security gateway, and the security gateway establishes at least one security tunnel, including the uplink. Secure tunnel and downlink security tunnel.
  • the base station triggers the security gateway to establish a secure tunnel.
  • the embodiment of the present invention may also directly start the process of establishing a secure tunnel by the base station. For example, after the base station obtains the priority value corresponding to the QoS level identifier, the base station sends a key exchange request message to the security gateway.
  • the key exchange request message may carry a priority value, as shown in step 201 above. Or the key exchange request message does not carry a priority value, as shown in step 201 above.
  • the base station receives the returned key exchange response message and establishes at least one secure tunnel with the security gateway.
  • step 404 Establish a correspondence between a priority value and a tunnel identifier of at least one security tunnel.
  • the corresponding relationship may be implemented by, for example, step 202 as shown in Table 1, or the corresponding relationship is as shown in Table 2 or 3, and is implemented by step 202.
  • the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • the execution process of the steps 405-407 is similar to the execution process of the steps 101-103 in the foregoing embodiment. For details, refer to the description of the foregoing embodiment, which is not repeated here.
  • the tunnel identifier corresponding to the priority value may be searched, and if the corresponding tunnel identifier is not found, the security gateway is sent to the security gateway.
  • the key exchange request message receives the returned key exchange response message to establish at least one secure tunnel with the security gateway.
  • the base station After the base station establishes at least one security tunnel with the security gateway, the base station establishes a correspondence between the priority value and the tunnel identifier of the at least one security tunnel. If the corresponding tunnel identifier is found, the uplink data packet is transmitted through the secure tunnel corresponding to the found tunnel identifier.
  • the embodiment of the present invention receives the radio bearer setup request or the initial context setup request that carries the priority value, and searches for the tunnel identifier corresponding to the priority value, if no corresponding The tunnel identifier determines that there is an unused secure tunnel, and transmits an uplink packet to the security gateway through the unused secure tunnel. After the base station determines that there is an unused security tunnel, it establishes
  • FIG. 5 is a flowchart of a method for establishing a correspondence between a base station establishing a priority value and a tunnel identifier of at least one security tunnel in a data packet transmission method according to an embodiment of the present invention.
  • the radio bearer setup request or the initial context setup request carries information such as user priority or service priority or whether the core network has the capability of interworking with the fixed network, and the priority is
  • the value may specifically be a differentiated service point code, and the process of the base station performing the correspondence between the establishment of the priority value and the tunnel identifier of the at least one security tunnel may include:
  • the priority value is a differentiated service point code
  • the differentiated service point code includes a differentiated service point code value and other idle fields, and the differentiated service point code value may occupy 4 bits.
  • the base station may fill the user priority or the service priority or the core network with the information of the fixed network interworking capability into the field of the differentiated service point code, and use the padded differentiated service point code as the priority value.
  • the user priority may be, for example, a level of gold, silver, or copper.
  • the service priority may be, for example, a voice service or a non-voice service.
  • the base station establishes a correspondence between the padded differentiated service point code and the tunnel identifier. Further, after the data packet transmission method provided in the fourth embodiment of the present invention establishes the correspondence between the priority value and the tunnel identifier, the correspondence between the tunnel identifier and the priority value of the uplink data packet is established through S1. Sending to the mobility management entity, so that the mobility management entity sends the correspondence to the packet data network gateway, and the packet data network gateway sends the correspondence to the Policy and Charging Rule Function (PCRF) device.
  • the PCRF device sends the corresponding relationship and the aggregated Quality of Service (QoS) requirements to the Broadband Policy Control Framework (BPCF) device, so that the BPCF device in the fixed network can secure each tunnel according to QoS.
  • QoS Quality of Service
  • BPCF Broadband Policy Control Framework
  • the base station sends the priority value, and the correspondence between the priority value and the tunnel identifier to the mobility management entity, so that the fixed network device, for example, the BRAS device, can combine the priority of the user in the priority value.
  • the level or service priority schedules the data packet, for example, when the network is congested, the data packet of the user with high priority is preferentially guaranteed.
  • the BPCF device in the fixed network controls the QoS of each security tunnel according to the QoS, and can implement QoS control of the entire network of the user equipment.
  • FIG. 6 is a flowchart of a data packet transmission method according to Embodiment 5 of the present invention.
  • the data packet transmission method provided in Embodiment 5 of the present invention includes:
  • a secure tunnel may be established in advance between the base station and the security gateway when the base station is powered on.
  • the base station can receive the downlink data packet sent by the security gateway through the secure tunnel.
  • the base station acquires a priority value of an inner layer IP packet in the downlink data packet and a priority value of the outer layer IP packet.
  • the priority value of the outer IP packet may change during the transmission of the downlink data packet, and the priority value of the inner IP packet remains unchanged.
  • the base station may forward the downlink data packet, and then obtain an uplink data packet that needs to be forwarded.
  • the step of the base station transmitting the uplink data packet to the security gateway by using the tunnel tunnel corresponding to the discovered tunnel identifier may specifically include: 606.
  • the correspondence between the tunnel identifier and the priority value of the inner IP packet, and the correspondence between the tunnel identifier and the priority value of the outer IP packet, and the priority of the inner IP packet of the uplink data packet may specifically include: 606.
  • the value finds the priority value of the outer IP packet of the uplink packet and the corresponding tunnel identifier.
  • the base station first searches for the correspondence between the tunnel identifier and the priority value of the inner layer IP packet according to the priority value of the inner IP packet of the uplink data packet, obtains the tunnel identifier, and searches for the security according to the previously found tunnel identifier.
  • the correspondence between the tunnel identifier of the tunnel and the priority value of the outer IP packet obtains the priority value of the outer IP packet.
  • the base station uses the priority value of the outer IP packet of the uplink data packet as the priority value of the uplink data packet. Specifically, the base station may update the priority value of the outer IP packet of the uplink data packet to the found priority value.
  • the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • the base station since the data packet priority of the outer IP packet determines the processing priority of the data packet in the fixed network, the base station uses the priority value of the outer IP packet of the found uplink data packet as the uplink data.
  • the priority value of the packet can ensure that the downlink data packet of the same service has the same priority as the uplink data packet in the transmission of the fixed network device (for example, BRAS), so that the fixed network device performs the downlink symmetry of the same service.
  • FIG. 7 is a flowchart of a data packet transmission method according to Embodiment 6 of the present invention.
  • a secure tunnel may be established in advance between the base station and the security gateway when the base station is powered on.
  • the base station can receive the downlink data packet sent by the security gateway through the secure tunnel.
  • the base station may obtain the downlink data packet received by the first time through a certain security tunnel, obtain the priority value of the downlink data packet, and establish a correspondence between the priority value and the tunnel identifier of the security tunnel.
  • the base station may forward the downlink data packet to the user equipment.
  • the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • the execution process of the steps 704-706 is similar to the execution process of the steps 101-103 in the foregoing embodiment. For details, refer to the description of the foregoing embodiment, which is not repeated here.
  • the data packet transmission method provided by the embodiment of the present invention is described above from the base station side.
  • the data packet transmission method provided by the embodiment of the present invention is described below from the security gateway side.
  • FIG. 8 is a flowchart of a data packet transmission method according to Embodiment 7 of the present invention.
  • the security gateway may receive downlink data packets sent by the core network (for example, a packet data network gateway, a base station gateway, etc.).
  • the downstream packet carries a priority value.
  • the security gateway may use the priority value of the Internet Protocol IP packet of the downlink data packet as the priority value of the downlink data packet.
  • the security gateway searches for the correspondence between the set priority value and the tunnel identifier according to the obtained priority value.
  • the different tunnel identifiers in the corresponding relationship respectively correspond to different priority values, and each priority value corresponds to at least one tunnel identifier, which may be established in advance when establishing a secure tunnel, or when there is a downlink data transmission requirement. Specifies the correspondence between an unused security tunnel ID and a priority value.
  • the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the security gateway When the security gateway transmits the downlink data packet through the secure tunnel, the tunnel identifier is identified in the header encapsulation of the downlink data packet.
  • the security gateway acquires the tunnel identifier of the corresponding security tunnel according to the priority value of the downlink data packet. Since each priority value corresponds to at least one tunnel identifier, the security gateway may The downlink data packets with different packet priorities are transmitted through multiple secure tunnels, so that after receiving the data packets, the base station separately performs anti-replay processing on the data packets received by each secure tunnel, thereby reducing the considered by the receiving end. It is the number of replayed packets, which in turn reduces the probability of packet loss.
  • FIG. 9 is a flowchart of a data packet transmission method according to Embodiment 8 of the present invention.
  • the base station and the security gateway may pre-establish at least one secure tunnel when the base station is powered on, and the security gateway first receives the uplink data packet sent by the base station through the secure tunnel.
  • the uplink data packet carries a priority value.
  • the priority value may be a DSCP value.
  • the security gateway establishes a correspondence between the tunnel identifier of the security tunnel and the priority value.
  • the correspondence between the tunnel identifier and the priority value of the security tunnel that establishes the security tunnel is as shown in Table 1.
  • the correspondence between the uplink tunnel identifier and the priority value of the security tunnel is established by the security gateway.
  • the relationship established by the security gateway is shown in Table 1, and can also be shown in Table 3.
  • the method and logic it creates are similar to steps 201 and 202; methods similar to 20 ⁇ , 202 can also be used.
  • the only difference is that in this embodiment, the key exchange request is initiated by the security gateway instead of the base station, and the key response message is sent by the base station.
  • the security gateway forwards the data packet to the base station gateway or the packet data network gateway. There is no order between the security gateway forwarding the uplink data packet and establishing the foregoing correspondence relationship. After the security gateway forwards the upper and lower data packets, it can receive the downlink data packet of the user equipment, and the security device begins to perform step 904. 904. Obtain a priority value of a downlink data packet that needs to be transmitted.
  • the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the execution process of the steps 904-906 is similar to the execution process of the steps 801-803 in the above embodiment 8, and the description is not repeated here.
  • FIG. 10 is a flowchart of a data packet transmission method according to Embodiment 9 of the present invention.
  • the data packet transmission method provided by the embodiment of the present invention includes:
  • the security gateway receives the key exchange request message that carries the priority value sent by the base station, returns a key exchange response message, and establishes at least one secure tunnel with the base station.
  • the relationship established by the security gateway is shown in Table 1, and can also be shown in Table 3.
  • the method and logic it creates are similar to steps 201 and 202; methods similar to 20 ⁇ , 202 can also be used.
  • the only difference is that in this embodiment, the key exchange request is initiated by the security gateway instead of the base station, and the key response message is sent by the base station.
  • the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the execution process of the steps 1003-1005 is similar to the execution process of the steps 801-803 in the foregoing embodiment 8. The description is not repeated here. Further, the data packet transmission method provided by the embodiment of the present invention may further include:
  • the security gateway sends a key exchange request message to the security gateway to establish a new secure tunnel if the corresponding tunnel identifier is not found.
  • the established security tunnel includes an uplink security tunnel and a downlink security tunnel.
  • the security gateway establishes the correspondence between the tunnel ID and the priority value of the new security tunnel.
  • the corresponding relationship between the uplink tunnel identifier and the priority value of the security tunnel and the correspondence between the downlink tunnel identifier and the priority value are included.
  • the security gateway transmits the downlink data packet to the base station by using the newly established security tunnel.
  • a secure tunnel corresponding to the priority value of the data packet is established between the base station and the security gateway.
  • the security gateway obtains the tunnel identifier of the corresponding security tunnel according to the priority value of the downlink data packet. Since each priority value corresponds to at least one tunnel identifier, the security gateway can transmit the downlink data packet through multiple secure tunnels, thereby enabling the base station to After receiving the data packet, the data packet received by each secure tunnel is separately subjected to anti-replay processing, thereby reducing the number of playback data packets, thereby reducing the probability of packet loss.
  • FIG. 11 is a flowchart of a data packet transmission method according to Embodiment 10 of the present invention.
  • the data packet transmission method provided by the embodiment of the present invention includes:
  • the security gateway may receive a notification message sent by the base station during the bearer process of establishing the user equipment, where the notification message is used to trigger the security gateway to establish a secure tunnel.
  • a secure tunnel is established between the security gateway and the base station. At least one secure tunnel is established between the security gateway and the base station.
  • the security gateway establishes a correspondence between the priority value and the tunnel identifier of at least one security tunnel.
  • the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the execution process of the steps 1104-1106 is similar to the execution process of the steps 801-803 in the foregoing embodiment 8. The description is not repeated here.
  • the data packet transmission method provided by the embodiment of the present invention may further include:
  • the security gateway determines that there is an unused security tunnel when the corresponding tunnel identifier is not found according to the set correspondence.
  • the so-called unused secure tunnel is a secure tunnel that has never been used to transmit data packets, i.e., this upstream or downstream secure tunnel is not given a packet priority attribute.
  • the security gateway when the base station is powered on, the security gateway establishes one or more secure tunnels that are not used, and then send the downlink data packet to the base station.
  • the security gateway also establishes a correspondence between the tunnel identifier of the unused security tunnel and the priority value, so as to find the corresponding tunnel identifier according to the correspondence.
  • the data packet transmission method provided by the embodiment of the present invention may further include: 1109. If the corresponding tunnel identifier is not found, and it is determined that there is no unused security tunnel, send a key exchange request message to the base station, and receive a key exchange response message returned by the base station to establish a new secure tunnel with the base station.
  • the downlink data packet is transmitted to the base station through the new secure tunnel, and the correspondence between the tunnel identifier and the priority value of the new secure tunnel is established.
  • the security gateway If the security gateway does not find the unused tunnel, for example, the initially established unused tunnel is used to transmit data of other priority values, the security gateway sends a key exchange request message to the base station. Receiving a key exchange response message returned by the base station to establish a new secure tunnel with the base station. After the new security tunnel is established, the downlink packet is transmitted to the base station through the new secure tunnel, and the correspondence between the tunnel identifier and the priority value of the new security tunnel is established.
  • the data packet is transmitted through the unused secure tunnel, and the priority value and the unused security tunnel are established.
  • the tunnel identifiers so that the base station and the security gateway do not need to establish a correspondence between the priority value and the tunnel identifier of the newly established security tunnel after establishing the security tunnel, but wait until the data packet is transmitted. And determining the correspondence between the priority value and the tunnel identifier of the unused security tunnel when there is an unused security tunnel.
  • the base station can obtain the priority value of the downlink data packet, and establish a correspondence between the priority value and the tunnel identifier of the security tunnel that receives the data packet. And then forward the downstream packet.
  • FIG. 12 is a flowchart of a data packet transmission method according to Embodiment 11 of the present invention.
  • the data packet transmission method provided by the embodiment of the present invention includes:
  • a secure tunnel may be established in advance between the base station and the security gateway when the base station is powered on.
  • the security gateway can receive uplink data packets sent by the base station through the secure tunnel.
  • the base station acquires a priority value of an inner layer IP packet in the uplink data packet and a priority value of the outer layer IP packet.
  • the priority value of the outer IP packet may change during the transmission of the uplink data packet, and the priority value of the inner IP packet remains unchanged.
  • the base station may forward the downlink data packet and obtain a downlink data packet that needs to be forwarded.
  • the step of the security gateway transmitting the downlink data packet to the security gateway by the security tunnel corresponding to the discovered tunnel identifier may specifically include:
  • the priority value finds the priority value of the outer IP packet of the downlink packet and the corresponding tunnel identifier.
  • the security gateway first searches for the correspondence between the tunnel identifier and the priority value of the inner layer IP packet according to the priority value of the inner IP packet of the downlink data packet, obtains the tunnel identifier, and further searches according to the previously found tunnel identifier.
  • the correspondence between the tunnel identifier of the security tunnel and the priority value of the outer IP packet obtains the priority value of the outer IP packet of the downlink data packet.
  • the priority value of the outer IP packet of the downlink data packet is used as the priority value of the uplink data packet.
  • the base station uses the priority value of the outer IP packet of the downlink data packet as the priority value of the downlink data packet. Specifically, the base station may update the priority value of the outer IP packet of the downlink data packet to the found priority value.
  • the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the security gateway since the data packet priority of the outer IP packet determines the processing priority of the data in the fixed network, the security gateway uses the priority value of the outer IP packet of the found downlink data packet as the downlink data.
  • the priority value of the packet can guarantee that the downlink data packet for the same service is in the fixed network device.
  • the transmission e.g., BRAS
  • BRAS has the same priority as the upstream packet, so that the fixed network device performs the symmetry of the downlink transmission on the same service.
  • FIG. 13 is an application scenario diagram of a data packet transmission method according to an embodiment of the present invention.
  • the data packet transmission method provided by the embodiment of the present invention includes:
  • the base station receives an initial context setup request that carries the QCI and the user priority or service priority.
  • the base station receives an initial context establishment request for establishing an initial context in the process of establishing a bearer of the user equipment.
  • the initial context establishment request carries the QCI and the user priority or the service priority.
  • the user priority is taken as an example in the embodiment of the present invention.
  • the tunnel identifiers of the security tunnel are 1A and 1B.
  • 1A is the uplink tunnel identifier of the security tunnel
  • 1B is the downlink tunnel identifier of the security tunnel.
  • the tunnel identifier may be specifically a Security Parameter Index (SPI) of the security tunnel.
  • SPI Security Parameter Index
  • the base station acquires a priority value.
  • the base station obtains the differentiated service point code corresponding to the QCI according to the mapping policy between the network (the fixed network and the core network), and then fills the user priority or the service priority into the reserved field of the converted differentiated service point code, and The populated differentiated service point code is used as the priority value.
  • the information to be filled is illustrated by taking the user priority as an example.
  • the differentiated service point code corresponding to the QCI is 1, and the user priority is the gold medal, and the flag is 1, and the differentiated service point code obtained by the base station is obtained. Specifically, it can be:
  • 0-1 digits identify user priority
  • 01 identifies gold medal users
  • 10 identifies 4 plaque users
  • 11 identifies bronze users.
  • the 2-5 digits identify the differentiated service point code value
  • the 0001 identifier differentiates the service point code to 1.
  • the CU field in the priority value can also fill the service priority. For example, a 1 flag is an interworking guarantee, and a 0 flag is not an interworking guarantee.
  • S12. The base station sends a notification message carrying a priority value to the security gateway.
  • the security gateway sends a key exchange request message carrying a priority value to the base station.
  • the base station sends a key exchange response message to the security gateway to establish a secure tunnel.
  • the establishment of the secure tunnel between the base station and the security gateway is completed, and the tunnel identifier of the established security tunnel is 2A and 2B.
  • 2A is the identifier of the uplink security tunnel
  • 2B is the identifier of the downlink security tunnel.
  • the base station establishes a correspondence between the tunnel identifier and the priority value.
  • the correspondence between the tunnel identifier and the priority value in the base station may be as shown in Table 4.
  • the above table also contains an unused security tunnel.
  • the tunnel ID of the security tunnel is 1A/1B.
  • the base station sends the foregoing correspondence to the mobility management entity.
  • the base station sends the foregoing correspondence to the mobility management entity by using an S1 setup message.
  • the mobility management entity sends the S1 setup message to a Packed Data Network Gateway (PDNGW).
  • PDN GW is sent to the PCRF through the Gx interface.
  • the PCRF sends the tunnel identification and the QoS requirements of the aggregation to the BPCF through the S9* interface.
  • the BPCF transmits the tunnel identifier and the aggregation to the BRAS in the fixed network.
  • the BRAS receives the correspondence between the tunnel identifier and the bearer QCI and the aggregation.
  • the data packet in the security tunnel is directly processed according to the tunnel identifier, and whether the DSCP value of the outer IP packet of the IP data packet received by the BRAS changes, the BRAS does not affect the processing of the IP data packet.
  • the BRAS can control the QoS of each secure tunneled packet according to the aggregated QoS requirements.
  • the update of the security tunnel between the H(e)NB and the SeGW includes the creation, deletion, and update of the security tunnel (for example, the update of the tunnel information due to the end of the Ipsec lifetime), causing the foregoing relationship to occur.
  • Update the updated correspondence is sent to the mobility management entity through the S1 setup message. 517.
  • the base station receives an uplink data packet of the user equipment.
  • the base station receives an uplink IP data packet sent by the user equipment.
  • the base station acquires a priority value of the uplink data packet.
  • the priority value of the inner layer IP packet of the uplink data packet and the priority value of the outer layer IP packet are the same.
  • the base station can obtain the priority value of the inner IP packet of the uplink data packet, and can also obtain the priority value of the outer IP packet of the uplink data packet.
  • the priority value of the uplink data packet is specifically 0001.
  • the base station queries, according to the obtained priority value, a correspondence relationship between the set priority value and the tunnel identifier.
  • the base station queries the upper ten relationship according to the priority value obtained in step S18, and obtains the corresponding tunnel identifier.
  • the base station searches for a corresponding tunnel identifier according to 0001, which is specifically 2A/2B.
  • the base station sends the uplink data packet to the security gateway by using an uplink secure tunnel corresponding to the 2A. Specifically, the base station sends the uplink data packet to the security gateway by using the uplink secure tunnel corresponding to the 2A, and the security gateway receives the uplink data packet sent by the base station by using the secure tunnel corresponding to the 2A.
  • the priority value includes the user priority
  • devices in the fixed network such as the BRAS, preferentially process the data packets of the gold medal user when encountering congestion.
  • the security gateway obtains a priority value of the uplink data packet, and establishes a correspondence between a tunnel identifier of the security tunnel that receives the uplink data packet and a priority value of the uplink data packet.
  • the security gateway After receiving the uplink data packet sent by a certain security tunnel for the first time, the security gateway obtains the priority value 0001 of the uplink data packet and the tunnel identifier 2A of the security tunnel, and then establishes the uplink and downlink tunnel identifiers 2A, 2B and priority of the security tunnel.
  • the correspondence between the level values when the security tunnel between the base station and the security gateway is updated, the correspondence between the priority value and the tunnel identifier to be updated should be inherited to the new secure tunnel.
  • the correspondence between the tunnel identifier and the priority value in the security gateway may be as shown in Table 5.
  • the security gateway forwards the uplink data packet.
  • the security gateway may forward the uplink data packet to a core network (for example, a base station gateway, a packet data network gateway).
  • a core network for example, a base station gateway, a packet data network gateway.
  • the security gateway sends the foregoing correspondence to the PCRF.
  • the corresponding relationship saved on the security gateway SeGW is sent/synchronized to the PCRF through the S16 interface.
  • the PCRF converts the above relationship into a correspondence between the QCI value and the tunnel identifier and saves it.
  • the PCRF stores the correspondence between the priority value and the QCI value negotiated between the mobile operator and the fixed network operator.
  • the PCRF aggregates the QoS requirements (QCI, ARP, bandwidth, etc.) of the bearer to become the QoS requirement of the granularity of the home base station.
  • the PCRF sends the correspondence between the tunnel identifier and the carried QCI and the aggregated QoS request to the BPCF through the S9* interface, and the BPCF sends the correspondence and the QoS requirement to the BRAS.
  • the BRAS After receiving the correspondence between the tunnel identifier and the carried QCI and the aggregated QoS requirements, the BRAS directly processes the data packet in the security tunnel according to the tunnel identifier, regardless of the outer IP packet of the IP data packet received by the BRAS. Whether the DSCP value changes will not affect the BRAS's processing of IP packets.
  • the BRAS can control the QoS of each secure tunneled packet according to the aggregated QoS requirements.
  • the update of the security tunnel between the H(e)NB and the SeGW includes the creation, deletion, and update of the security tunnel (for example, the update of the tunnel information due to the end of the Ipsec lifetime), causing the foregoing relationship to occur.
  • the security gateway sends the updated correspondence to the PCRF to facilitate the QoS guarantee of the fixed network.
  • the security gateway receives the downlink data packet, and obtains a priority value of the downlink data packet.
  • the security gateway can receive the downlink data packet of the user equipment, and obtain the priority value of the downlink data packet.
  • the priority value of the downlink data packet of the user equipment is equal to the priority value of the uplink data packet, and all are 0001.
  • the security gateway searches for the corresponding relationship according to the obtained priority value of the downlink data packet, and obtains a corresponding tunnel identifier.
  • the security gateway finds that the corresponding tunnel identifier is 2B according to 0001.
  • the security gateway sends the downlink data packet to the base station by using a secure tunnel corresponding to the 2B. After receiving the downlink data packet sent by the security gateway, the base station forwards the downlink data packet to the user equipment.
  • the priority value in the correspondence relationship received by the BRAS further includes a user priority or a service priority, which may enable the BRAS to distinguish different levels of users or different levels according to different tunnel identifiers.
  • the IP packets corresponding to the service perform different processing on the security packets in different security tunnels. For example, when network congestion occurs, the data packets of the gold card users are preferentially forwarded or the packets with Interworking guarantee are preferentially forwarded.
  • FIG. 14 is a schematic structural diagram of a base station according to Embodiment 12 of the present invention.
  • the first priority obtaining unit 11 is configured to obtain a priority value of the uplink data packet that needs to be transmitted.
  • the first correspondence relationship searching unit 12 is configured to search for the priority of the priority value according to the priority value obtained by the first priority acquiring unit 11. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the uplink data sending unit 13 is configured to: when the first correspondence search unit 12 finds the corresponding tunnel identifier, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • the base station provided by the embodiment of the present invention can be used in the foregoing first embodiment of the method. For details, refer to the description of the first embodiment, which is not repeated here.
  • the base station provided by the embodiment of the present invention obtains the tunnel identifier of the corresponding security tunnel according to the priority value of the uplink data packet. Since each priority value corresponds to at least one tunnel identifier, the base station may perform the uplink data packet through multiple secure tunnels.
  • the transmission after receiving the data packet, separately performs anti-replay processing on the data packets received by each security tunnel, thereby reducing the number of playback data packets, thereby reducing the probability of packet loss.
  • the base station provided by the embodiment of the present invention may further include:
  • the second tunnel establishing unit 14 is configured to send at least two key exchanges to the security gateway at the time of power-on before the first priority acquiring unit 11 obtains the priority value of the uplink data packet to be transmitted.
  • the request message receives the returned key exchange response message to establish at least two secure tunnels with the security gateway.
  • FIG. 15 is a schematic structural diagram of a base station according to Embodiment 13 of the present invention.
  • the first tunnel establishing unit 21 is configured to send a key exchange request message carrying the priority value to the security gateway at the time of power-on before the first priority acquiring unit 23 obtains the priority value of the uplink data packet to be transmitted. Receiving a returned key exchange response message to establish at least one secure tunnel with the security gateway; or
  • the first correspondence establishing unit 22 is configured to establish a correspondence between the priority value obtained by the first priority acquiring unit 23 and the tunnel identifier of the at least one security tunnel established by the first tunnel establishing unit;
  • the first priority obtaining unit 23 is configured to obtain a priority value of the uplink data packet to be transmitted, and the first correspondence relationship searching unit 24 is configured to search for the priority of the setting according to the priority value acquired by the first priority acquiring unit 23 a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the uplink data sending unit 25 is configured to: when the corresponding tunnel identifier is found, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • FIG. 16 is a schematic structural diagram of a base station according to Embodiment 14 of the present invention.
  • the first priority obtaining unit 31 is configured to obtain a priority value of the uplink data packet to be transmitted;
  • the first correspondence relationship searching unit 32 is configured to search for the priority of the priority value according to the priority value obtained by the first priority acquiring unit 31. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the uplink data sending unit 33 is configured to: when the corresponding tunnel identifier is found, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
  • the third tunnel establishing unit 34 is configured to send a key exchange request message to the security gateway after receiving the corresponding tunnel identifier, and receive a key exchange response message returned by the security gateway to establish a new with the security gateway. Safe tunnel
  • the uplink data sending unit 33 is further configured to transmit the uplink data packet to the security gateway by using a new secure tunnel established by the third tunnel establishing unit 34;
  • the second correspondence relationship establishing unit 35 is configured to establish a new tunnel identifier and the first priority established by the third tunnel establishing unit 34.
  • the base station provided by the embodiment of the present invention may be in the foregoing corresponding method embodiment 2. Description of the embodiments. Referring to FIG. 17, FIG. 17 is a schematic structural diagram of a base station according to Embodiment 15 of the present invention.
  • the first priority obtaining unit 41 is configured to obtain a priority value of the uplink data packet to be transmitted;
  • the first correspondence relationship searching unit 42 is configured to search for the priority of the setting according to the priority value acquired by the first priority acquiring unit 41. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the uplink data sending unit 43 is configured to: when the corresponding tunnel identifier is found, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the discovered tunnel identifier.
  • the tunnel judging unit 44 is configured to determine that there is a secure tunnel that is not used when the corresponding tunnel identifier is not found;
  • the uplink data sending unit 43 is further configured to: when the tunnel determining unit 44 determines that there is a secure tunnel that is not used, transmit the uplink data packet to the security gateway by using the unused secure tunnel; the third correspondence relationship establishing unit 45 And a correspondence between the tunnel identifier of the unused security tunnel determined by the tunnel judging unit 44 and the priority value obtained by the first priority acquiring unit 41.
  • the base station provided by the embodiment of the present invention may further include:
  • the tunnel judging unit 44 is configured to determine that there is no unused security tunnel when the corresponding tunnel identifier is not found;
  • the fourth tunnel establishing unit 46 is configured to: when the tunnel determining unit 44 determines that there is no unused secure tunnel, send a key exchange request message to the security gateway, and receive a key exchange response message returned by the security gateway, Establishing a new secure tunnel with the security gateway, and transmitting the uplink data packet to the security gateway by using the new secure tunnel;
  • the third correspondence establishing unit 45 is further configured to establish a correspondence between the tunnel identifier of the new security tunnel established by the fourth tunnel establishing unit 46 and the priority value acquired by the first priority acquiring unit 41.
  • FIG. 18 is a schematic structural diagram of a base station according to Embodiment 16 of the present invention.
  • the first priority obtaining unit 51 is configured to obtain a priority value of the uplink data packet to be transmitted;
  • the first correspondence relationship searching unit 52 is configured to search for the priority of the setting according to the priority value acquired by the first priority acquiring unit 51. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the uplink data sending unit 53 is configured to: when the corresponding tunnel identifier is found, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the discovered tunnel identifier.
  • the first receiving unit 54 is configured to receive, after the first priority acquiring unit 51 obtains the priority value of the uplink data packet to be transmitted, the downlink data packet sent by the security gateway through the secure tunnel;
  • the first priority obtaining unit 51 is further configured to acquire a priority value of the downlink data packet received by the first receiving unit 54;
  • the fourth correspondence establishing unit 55 is configured to establish a correspondence between the priority value acquired by the first priority acquiring unit 51 and the tunnel identifier of the security tunnel;
  • the first forwarding unit 56 is configured to forward the downlink data packet received by the first receiving unit 54.
  • the base station provided by the embodiment of the present invention may be in the foregoing corresponding method embodiment 6.
  • the base station provided by the embodiment of the present invention is described in detail above.
  • the embodiment of the present invention further provides a corresponding security gateway embodiment.
  • FIG. 19 is a schematic structural diagram of a security gateway according to Embodiment 17 of the present invention.
  • the security gateway provided by the embodiment of the present invention includes:
  • the second priority obtaining unit 61 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 62 is configured to search for the priority of the priority value according to the priority value obtained by the second priority acquiring unit 61. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the downlink data sending unit 63 is configured to: when the second correspondence search unit 62 finds the corresponding tunnel identifier, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • security gateway provided by the embodiment of the present invention may further include:
  • the fifth tunnel establishing unit 64 is configured to receive a key exchange request message carrying a priority value sent by the base station, and return a key before the second priority acquiring unit 61 obtains the priority value of the downlink data packet to be transmitted. Exchanging a response message to establish at least one secure tunnel with the base station;
  • the fifth correspondence establishing unit 65 is configured to establish a correspondence between the priority value acquired by the second priority acquiring unit 61 and the tunnel identifier of the at least one security tunnel established by the fifth tunnel establishing unit 64.
  • the security gateway provided by the embodiment of the present invention may be used in the foregoing corresponding method embodiment 7.
  • the security gateway obtains the tunnel identifier of the corresponding security tunnel according to the priority value of the downlink data packet. Since each priority value corresponds to at least one tunnel identifier, the security gateway may pass the downlink data packet through multiple security tunnels. Transmitting, so that the base station receives the data After the packet, the data packets received by each secure tunnel are separately subjected to anti-replay processing, thereby reducing the number of playback packets, thereby reducing the probability of packet loss.
  • FIG. 20 is a schematic structural diagram of a security gateway according to Embodiment 18 of the present invention.
  • the security gateway provided by the embodiment of the present invention includes:
  • the second priority obtaining unit 71 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 72 is configured to search for the priority of the setting according to the priority value acquired by the second priority acquiring unit 71. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the downlink data sending unit 73 is configured to: when the corresponding tunnel identifier is found, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the first notification message receiving unit 74 is configured to receive, after the second priority acquiring unit 71 obtains the priority value of the downlink data packet to be transmitted, the notification message sent by the base station gateway, where the notification message carries the priority value. ;
  • the sixth tunnel establishing unit 75 is configured to send a key exchange request message carrying the priority value received by the first notification message receiving unit 74 to the base station, and receive the returned key exchange response message to establish at least one with the base station.
  • the sixth correspondence establishing unit 76 is configured to establish a correspondence between the priority value acquired by the second priority acquiring unit 71 and the tunnel identifier of the at least one security tunnel established by the sixth tunnel establishing unit 75.
  • FIG. 21 is a schematic structural diagram of a security gateway according to Embodiment 19 of the present invention.
  • the security gateway provided by the embodiment of the present invention includes:
  • the second priority obtaining unit 81 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 82 is configured to search for the priority of the setting according to the priority value acquired by the second priority acquiring unit 81. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the downlink data sending unit 83 is configured to: when the corresponding tunnel identifier is found, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the second notification message receiving unit 84 is configured to: before the second priority acquiring unit 81 obtains the priority value of the downlink data packet to be transmitted, receive a notification message sent by the base station gateway, where the notification message carries a quality of service level Identification
  • the seventh tunnel establishing unit 85 is configured to send, to the base station, a key exchange request message carrying the quality of service level identifier received by the second notification message receiving unit 84, and receive the returned key exchange response message to establish at least one security with the base station.
  • the seventh correspondence establishing unit 86 is configured to obtain a priority value corresponding to the QoS level identifier, and establish a correspondence between the priority value and a tunnel identifier of at least one security tunnel established by the seventh tunnel establishing unit 85.
  • FIG. 22 is a schematic structural diagram of a security gateway according to Embodiment 20 of the present invention.
  • the security gateway provided by the embodiment of the present invention includes:
  • the second priority obtaining unit 91 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 92 is configured to search for the priority of the setting according to the priority value acquired by the second priority acquiring unit 91. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the downlink data sending unit 93 is configured to: when the corresponding tunnel identifier is found, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the security gateway may further include:
  • the eighth tunnel establishing unit 94 is configured to: when the second correspondence search unit 92 does not find the corresponding tunnel identifier, send a key exchange request message to the base station, and receive a key exchange response message returned by the base station, to Establish a new secure tunnel;
  • the downlink data sending unit 93 is further configured to transmit the downlink data packet to the base station by using a new secure tunnel established by the eighth tunnel establishing unit 94;
  • the eighth correspondence establishing unit 95 is configured to establish a correspondence between the tunnel identifier of the new security tunnel established by the eighth tunnel establishing unit 94 and the priority value acquired by the second priority acquiring unit 91.
  • FIG. 23 is a schematic structural diagram of a security gateway according to Embodiment 21 of the present invention.
  • the security gateway provided by the embodiment of the present invention includes:
  • the second priority acquiring unit 110 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 120 is configured to search for the priority of the setting according to the priority value acquired by the second priority acquiring unit 110. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
  • the downlink data sending unit 130 is configured to: when the corresponding tunnel identifier is found, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
  • the second receiving unit 140 is configured to receive an uplink data packet sent by the base station through the secure tunnel before the second priority acquiring unit 110 obtains the priority value of the downlink data packet to be transmitted.
  • the second priority acquiring unit 110 is further configured to acquire a priority value of the uplink data packet received by the second receiving unit 140.
  • the ninth correspondence establishing unit 150 is configured to establish a correspondence between the priority value obtained by the second priority acquiring unit 110 and the tunnel identifier of the security tunnel;
  • the second forwarding unit 160 is configured to forward the uplink data packet.
  • the security gateway provided by the embodiment of the present invention may be used in the foregoing corresponding method embodiment XI.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

Abstract

Disclosed are a data packet transmission method and a related apparatus; the method comprises: obtaining the priority level value of an uplink data packet that needs to be transmitted; searching for a corresponding relationship between the set priority level value and a tunnel identifier according to the priority level value, each priority level value corresponding to at least one tunnel identifier; if a corresponding tunnel identifier is found, then transmitting the uplink data packet to a security gateway via a secure tunnel corresponding to the found tunnel identifier. The present invention can reduce the number of data packets determined by the security gateway to be re-transmitted data packets, thereby reducing the probability of packet loss.

Description

数据包传输方法和相关装置 本申请要求于 2011年 3月 30日提交的， 申请号为 201110078843.X, 发 明名称为 "数据包传输方法和相关装置" 的中国申请的优先权， 其全部内容 通过引用结合在本申请中。 技术领域  The present invention claims the priority of the Chinese application filed on March 30, 2011, the application number is 201110078843.X, and the invention name is "data packet transmission method and related device", the entire contents of which are The citations are incorporated herein by reference. Technical field
本发明涉及无线通信技术领域， 具体涉及一种数据包传输方法和相关装 置。  The present invention relates to the field of wireless communication technologies, and in particular, to a data packet transmission method and related devices.
背景技术 Background technique
家庭基站（Home NodeB, H(e)NB )是基站的一种， 作为专属资源被部署 在家庭、 团体、公司或者学校等场。 家庭基站通过网际协议（Internet Protocol, IP ) 宽带网络通信网络连接。  The Home NodeB (H(e)NB) is a type of base station that is deployed as a dedicated resource in a home, group, company, or school. The home base station is connected through an Internet Protocol (IP) broadband network communication network.
在现有技术中， 基站在上电时， 和安全网关（Security Gate, SeGW )之 间建立一条网际协议安全（ Internet Protocol Security, IPsec ) 隧道（简称安全 隧道）。 家庭基站下的流量均通过该安全隧道进行传输。 发送端， 例如家庭基 站， 在接收到需要传输的数据包后， 按照先后顺序对数据包分配序列号， 然 后通过建立的 IPsec隧道向接收端 （例如安全网关）传输。 其中， 发送端发送 的数据包经过宽带网络中的宽带接入服务器 （Broadband Remote Access Server, BRAS )或宽带网络网关 （ Broadband Network Gateway, BNG )进行 转发。宽带网络网关或宽带接入服务器根据数据包中外层 IP包的差异化业务点 码（ Differentiated Services Code Point, DSCP )进行不同优先级的处理， 上述 差异化业务点码表示了优先级值。  In the prior art, when the base station is powered on, an Internet Protocol Security (IPsec) tunnel (referred to as a secure tunnel) is established between the security gateway and the security gateway (SeGW). Traffic under the home base station is transmitted through the secure tunnel. The transmitting end, for example, the home base station, after receiving the data packet to be transmitted, assigns the serial number to the data packet in order, and then transmits it to the receiving end (for example, the security gateway) through the established IPsec tunnel. The data packet sent by the sender is forwarded through a Broadband Remote Access Server (BRAS) or a Broadband Network Gateway (BNG) in the broadband network. The broadband network gateway or the broadband access server performs different priority processing according to the Differentiated Services Code Point (DSCP) of the outer IP packet in the data packet, and the differentiated service point code indicates the priority value.
在现有技术中在进行数据包传输时， 发送端通过至少一条安全隧道传输 数据包， DSCP优先级较高且序列号较大的数据包优先处理， 而 DSCP优先级 较低且序列号较小的数据包被 BRAS或 BNG滞后处理， 当这些数据包到达接收 端后， 接收端需要进行抗重放处理。 其中， 接收端判断接收到的数据包的序 列号是否小于之前接收到的数据包的最大序列号， 若是， 则将序列号较小的 数据包视为重放的数据包， 直接丟弃该数据包， 导致序列号较小的数据包发 生丟包。 发明内容 In the prior art, when the data packet is transmitted, the transmitting end transmits the data packet through at least one secure tunnel, and the DSCP has a higher priority and the data packet with a larger sequence number is preferentially processed, and the DSCP has a lower priority and a smaller serial number. The data packets are delayed by BRAS or BNG. When these data packets arrive at the receiving end, the receiving end needs to perform anti-replay processing. The receiving end determines whether the sequence number of the received data packet is smaller than the maximum sequence number of the previously received data packet, and if so, treats the data packet with the smaller sequence number as the replayed data packet, and directly discards the data. Packet, which causes packet loss with a packet with a smaller sequence number. Summary of the invention
本发明提供一种数据包传输方法和相关设备， 可以将不同 DSCP优先级的 数据包通过多条安全隧道进行传输。  The present invention provides a data packet transmission method and related equipment, which can transmit data packets of different DSCP priorities through multiple secure tunnels.
为解决上述技术问题， 本发明实施例是通过以下技术方案来实现的： 根据本发明的一个方面， 提供一种数据包传输方法， 包括：  To solve the above technical problem, the embodiment of the present invention is implemented by the following technical solutions: According to an aspect of the present invention, a data packet transmission method is provided, including:
获得需要传输的上行数据包的优先级值；  Obtain a priority value of an upstream packet that needs to be transmitted;
根据所述优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识；  And determining, according to the priority value, a correspondence between the set priority value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧道向 安全网关传输所述上行数据包。  If the corresponding tunnel identifier is found, the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
根据本发明的一个方面， 提供一种数据包传输方法， 包括：  According to an aspect of the present invention, a data packet transmission method is provided, including:
获得需要传输的下行数据包的优先级值；  Obtain a priority value of a downlink packet that needs to be transmitted;
根据所述优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识；  And determining, according to the priority value, a correspondence between the set priority value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧道向 基站传输所述下行数据包。  If the corresponding tunnel identifier is found, the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
根据本发明的一个方面， 提供一种基站， 包括：  According to an aspect of the present invention, a base station is provided, including:
第一优先级获取单元， 用于获得需要传输的上行数据包的优先级值； 第一对应关系查找单元， 用于根据所述第一优先级获取单元获得的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  a first priority acquiring unit, configured to obtain a priority value of an uplink data packet to be transmitted; a first correspondence relationship searching unit, configured to search for a priority value set according to a priority value obtained by the first priority acquiring unit Corresponding relationship between the tunnel identifier and each of the tunnel identifiers, each priority value corresponding to at least one tunnel identifier;
上行数据发送单元， 用于在所述第一对应关系查找单元查找到对应的隧 道标识时， 通过查找到的隧道标识对应的安全隧道向安全网关传输所述上行 数据包。  The uplink data sending unit is configured to: when the first correspondence search unit finds the corresponding tunnel identifier, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
根据本发明的一个方面， 提供一种安全网关， 包括：  According to an aspect of the present invention, a security gateway is provided, including:
第二优先级获取单元， 用于获得需要传输的下行数据包的优先级值； 第二对应关系查找单元， 用于根据所述第二优先级获取单元获得的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  a second priority acquiring unit, configured to obtain a priority value of the downlink data packet to be transmitted; a second correspondence relationship searching unit, configured to search for the priority value set according to the priority value obtained by the second priority acquiring unit Corresponding relationship between the tunnel identifier and each of the tunnel identifiers, each priority value corresponding to at least one tunnel identifier;
下行数据发送单元， 用于在所述第二对应关系查找单元查找到对应的隧 道标识时， 通过查找到的隧道标识对应的安全隧道向基站传输所述下行数据 包。 a downlink data sending unit, configured to search for a corresponding tunnel in the second correspondence search unit When the track is identified, the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
在本发明实施例提供的数据包传输方法中， 基站根据上行数据包的优先 级值获取对应的安全隧道的隧道标识， 由于每个优先级值对应至少一个隧道 标识， 则基站可以将上行数据包通过多个安全隧道进行传输， 进而使得安全 网关在接收到数据包后， 对每个安全隧道接收到的数据包单独进行抗重放处 理， 因而减少了被安全网关判定为重放数据包的数量， 进而可以降低丟包的 概率。  In the data packet transmission method provided by the embodiment of the present invention, the base station acquires the tunnel identifier of the corresponding security tunnel according to the priority value of the uplink data packet, and the base station may use the uplink data packet because each priority value corresponds to at least one tunnel identifier. Transmission through multiple secure tunnels, so that after receiving the data packet, the security gateway separately performs anti-replay processing on the data packets received by each secure tunnel, thereby reducing the number of packets that are determined by the security gateway to be played back. , in turn, can reduce the probability of packet loss.
附图说明 DRAWINGS
为了更清楚地说明本发明实施例中的技术方案， 下面将对现有技术和实 施例中所需要使用的附图作简单地介绍， 显而易见地， 下面描述中的附图仅 仅是本发明的一些实施例， 对于本领域普通技术人员来讲， 在不付出创造性 劳动的前提下， 还可以根据这些附图获得其他的附图。  In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the prior art and the embodiments will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work.
图 1是本发明实施例一提供的数据包传输方法的流程图；  1 is a flowchart of a data packet transmission method according to Embodiment 1 of the present invention;
图 2是本发明实施例二提供的数据包传输方法的流程图；  2 is a flowchart of a data packet transmission method according to Embodiment 2 of the present invention;
图 3是本发明实施例三提供的数据包传输方法的流程图；  3 is a flowchart of a data packet transmission method according to Embodiment 3 of the present invention;
图 4是本发明实施例四提供的数据包传输方法的流程图；  4 is a flowchart of a data packet transmission method according to Embodiment 4 of the present invention;
图 5是本发明实施例提供的数据包传输方法中基站建立优先级值和至少 一条安全隧道的隧道标识之间的对应关系的方法流程图；  5 is a flowchart of a method for establishing a correspondence between a base station establishing a priority value and a tunnel identifier of at least one security tunnel in a data packet transmission method according to an embodiment of the present disclosure;
图 6是本发明实施例五提供的数据包传输方法的流程图；  6 is a flowchart of a data packet transmission method according to Embodiment 5 of the present invention;
图 7是本发明实施例六提供的数据包传输方法的流程图；  7 is a flowchart of a data packet transmission method according to Embodiment 6 of the present invention;
图 8是本发明实施例七提供的数据包传输方法的流程图；  8 is a flowchart of a data packet transmission method according to Embodiment 7 of the present invention;
图 9是本发明实施例八提供的数据包传输方法的流程图；  9 is a flowchart of a data packet transmission method according to Embodiment 8 of the present invention;
图 10是本发明实施例九提供的数据包传输方法的流程图；  10 is a flowchart of a data packet transmission method according to Embodiment 9 of the present invention;
图 11是本发明实施例十提供的数据包传输方法的流程图；  11 is a flowchart of a data packet transmission method according to Embodiment 10 of the present invention;
图 12是本发明实施例十一提供的数据包传输方法的流程图；  12 is a flowchart of a data packet transmission method according to Embodiment 11 of the present invention;
图 13是本发明实施例提供的数据包传输方法的应用场景图；  13 is an application scenario diagram of a data packet transmission method according to an embodiment of the present invention;
图 14是本发明实施例十二提供的基站的结构示意图；  14 is a schematic structural diagram of a base station according to Embodiment 12 of the present invention;
图 15是本发明实施例十三提供的基站的结构示意图；  15 is a schematic structural diagram of a base station according to Embodiment 13 of the present invention;
图 16是本发明实施例十四提供的基站的结构示意图； 图 17是本发明实施例十五提供的基站的结构示意图； 16 is a schematic structural diagram of a base station according to Embodiment 14 of the present invention; 17 is a schematic structural diagram of a base station according to Embodiment 15 of the present invention;
图 18是本发明实施例十六提供的基站的结构示意图；  18 is a schematic structural diagram of a base station according to Embodiment 16 of the present invention;
图 19是本发明实施例十七提供的安全网关的结构示意图；  19 is a schematic structural diagram of a security gateway according to Embodiment 17 of the present invention;
图 20是本发明实施例十八提供的安全网关的结构示意图；  20 is a schematic structural diagram of a security gateway according to Embodiment 18 of the present invention;
图 21是本发明实施例十九提供的安全网关的结构示意图；  21 is a schematic structural diagram of a security gateway according to Embodiment 19 of the present invention;
图 22是本发明实施例二十提供的安全网关的结构示意图；  22 is a schematic structural diagram of a security gateway according to Embodiment 20 of the present invention;
图 23是本发明实施例二十一提供的安全网关的结构示意图。  FIG. 23 is a schematic structural diagram of a security gateway according to Embodiment 21 of the present invention.
具体实施方式 detailed description
下面将结合本发明实施例中的附图， 对本发明实施例中的技术方案进行 清楚、 完整地描述， 显然， 所描述的实施例仅仅是本发明一部分实施例， 而 不是全部的实施例。 基于本发明中的实施例， 本领域普通技术人员在没有做 出创造性劳动前提下所获得的所有其他实施例， 都属于本发明保护的范围。  The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.
本发明提供了一种数据包传输方法、 基站和安全网关。 为了更好的理解 本发明的技术方案， 下面结合附图对本发明提供的实施例进行详细地描述。  The invention provides a data packet transmission method, a base station and a security gateway. In order to better understand the technical solutions of the present invention, the embodiments provided by the present invention will be described in detail below with reference to the accompanying drawings.
参见图 1 , 图 1是本发明实施例一提供的数据包传输方法的流程图。  Referring to FIG. 1, FIG. 1 is a flowchart of a data packet transmission method according to Embodiment 1 of the present invention.
在本发明实施例一提供的数据包传输方法包括。  The data packet transmission method provided in Embodiment 1 of the present invention includes.
101、 获得需要传输的上行数据包的优先级值。  101. Obtain a priority value of an uplink data packet that needs to be transmitted.
在本发明实施例中， 基站可以接收用户设备发送的上行数据包。 上行数 据包中可以携带优先级值。  In the embodiment of the present invention, the base station may receive an uplink data packet sent by the user equipment. The priority value can be carried in the upstream packet.
在本发明实施例中，优先级值可以为数据包的差异化业务点码 DSCP,还 可以为无线承载的服务质量等级标识（QoS Class Identifier, QCI )。 基站可以 在接收到数据包后，将数据包的内层 IP包的 DSCP值作为数据包的优先级值。  In the embodiment of the present invention, the priority value may be a differentiated service point code (DSCP) of the data packet, or may be a QoS Class Identifier (QCI) of the radio bearer. After receiving the data packet, the base station can use the DSCP value of the inner IP packet of the data packet as the priority value of the data packet.
102、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识。  102. Search for a correspondence between the set priority value and the tunnel identifier according to the priority value, where each priority value corresponds to at least one tunnel identifier.
具体的， 基站根据获取的优先级值查找设置的优先级值和隧道标识之间 的对应关系。 其中， 该对应关系中不同的隧道标识分别对应不同的优先级值， 每个优先级值对应至少一个隧道标识， 该对应关系可以在建立安全隧道时预 先建立， 也可以在基站收到承载建立请求消息或承载建立完成消息或初始上 下文建立请求消息或初始上下文建立完成消息或基站收到上行数据包时建 立。在本发明所有的实施例中，安全隧道也可以称为安全子关联（ Child Security Association, Child SA ) 。 Specifically, the base station searches for the correspondence between the set priority value and the tunnel identifier according to the obtained priority value. The different tunnel identifiers in the corresponding relationship respectively correspond to different priority values, and each priority value corresponds to at least one tunnel identifier, and the corresponding relationship may be established in advance when establishing a secure tunnel, or may receive a bearer setup request at the base station. When the message or bearer setup complete message or the initial context setup request message or the initial context setup complete message or the base station receives the uplink data packet Standing. In all embodiments of the present invention, the secure tunnel may also be referred to as a Child Security Association (Child SA).
103、 若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧 道向安全网关传输上行数据包。  103. If the corresponding tunnel identifier is found, the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
具体的， 基站通过查找到的隧道标识对应的安全隧道传输该上行数据包。 其中， 基站通过安全隧道传输上行数据包时， 在上行数据包包头的封装过程 中标记该隧道标识。  Specifically, the base station transmits the uplink data packet by using a secure tunnel corresponding to the found tunnel identifier. When the base station transmits the uplink data packet through the secure tunnel, the tunnel identifier is marked in the encapsulation process of the uplink data packet header.
在本发明实施例提供的数据包传输方法中， 基站根据上行数据包的优先 级值获取对应的安全隧道的隧道标识， 由于每个优先级值对应至少一个隧道 标识， 则基站可以将上行数据包通过多个安全隧道进行传输， 进而使得安全 网关在接收到数据包后， 对每个安全隧道接收到的数据包单独进行抗重放处 理， 因而减少了被安全网关判定为重放数据包的数量， 进而可以降低丟包的 概率。  In the data packet transmission method provided by the embodiment of the present invention, the base station acquires the tunnel identifier of the corresponding security tunnel according to the priority value of the uplink data packet, and the base station may use the uplink data packet because each priority value corresponds to at least one tunnel identifier. Transmission through multiple secure tunnels, so that after receiving the data packet, the security gateway separately performs anti-replay processing on the data packets received by each secure tunnel, thereby reducing the number of packets that are determined by the security gateway to be played back. , in turn, can reduce the probability of packet loss.
进一步的， 本发明实施例中基站可以获得需要传输的上行数据包中内层 IP包的优先级值， 将该优先级值作为上行数据包的优先级值。 其中， 内层 IP 包的优先级值位于数据包的原始 IP头 （ Original IP Header )字段中。 参见图 2, 图 2是本发明实施例二提供的数据包传输方法的流程图。  Further, in the embodiment of the present invention, the base station can obtain the priority value of the inner layer IP packet in the uplink data packet to be transmitted, and use the priority value as the priority value of the uplink data packet. The priority value of the inner IP packet is in the original IP Header field of the packet. Referring to FIG. 2, FIG. 2 is a flowchart of a data packet transmission method according to Embodiment 2 of the present invention.
本发明实施例二提供的数据包传输方法包括：  The data packet transmission method provided by the second embodiment of the present invention includes:
201、 在基站上电时向安全网关发送携带优先级值的密钥交换请求消息， 接收返回的密钥交换响应消息， 以与安全网关建立至少一条安全隧道。  201. Send a key exchange request message carrying a priority value to the security gateway when the base station is powered on, and receive the returned key exchange response message to establish at least one secure tunnel with the security gateway.
其中， 建立完成的安全隧道包括上行安全隧道和下行安全隧道， 每条上 行或者下行安全隧道具有一个隧道标识。 密钥交换请求消息中可以携带一个 或多个优先级值来标记安全隧道的优先级值属性。 通过多个密钥交换请求和 密钥交换响应消息的交互， 基站和安全网关之间建立多条双向安全隧道。  The established secure tunnel includes an uplink secure tunnel and a downlink secure tunnel, and each uplink or downlink secure tunnel has a tunnel identifier. The key exchange request message may carry one or more priority values to mark the priority value attribute of the secure tunnel. Through the interaction of multiple key exchange requests and key exchange response messages, multiple two-way secure tunnels are established between the base station and the security gateway.
202、 建立优先级值和至少一条安全隧道的隧道标识之间的对应关系。 具体的， 基站建立优先级值和至少一条安全隧道的隧道标识之间的对应 关系。 其中， 隧道标识包括上行隧道标识和下行隧道标识。  202. Establish a correspondence between a priority value and a tunnel identifier of at least one security tunnel. Specifically, the base station establishes a correspondence between the priority value and the tunnel identifier of the at least one security tunnel. The tunnel identifier includes an uplink tunnel identifier and a downlink tunnel identifier.
参见表 1 ,表 1是本发明实施例建立的安全隧道的隧道标识和优先级值之 间的对应关系。 这种对应关系在基站和安全网关是同步的， 或者说， 对于同 一安全隧道的上行安全隧道和下行安全隧道， 其所对应的优先级值（包括多 个优先级值的组合）是相同的。 Referring to Table 1, Table 1 is the correspondence between the tunnel identifier and the priority value of the security tunnel established in the embodiment of the present invention. This correspondence is synchronized between the base station and the security gateway, or The uplink security tunnel and the downlink security tunnel of a security tunnel have the same priority value (including a combination of multiple priority values).
Figure imgf000008_0001
Figure imgf000008_0001
表 1  Table 1
其中， 上行数据包或下行数据包的优先级值包括 9级， 分别为 1到 9级。 本发明实施例中针对不同的优先级值分别建立了多条安全隧道。 优先级值和 隧道标识之间的对应关系如上所示。 如： 1A表示第一安全隧道的上行隧道标 识， 1B表示第一安全隧道的下行隧道标识。  The priority value of the uplink data packet or the downlink data packet includes 9 levels, which are 1 to 9 levels respectively. In the embodiment of the present invention, multiple security tunnels are respectively established for different priority values. The correspondence between the priority value and the tunnel identifier is as shown above. For example, 1A indicates the uplink tunnel identifier of the first security tunnel, and 1B indicates the downlink tunnel identifier of the first security tunnel.
进一步的， 作为上述 201、 202步骤的另外一种实现方法，  Further, as another implementation method of the foregoing steps 201 and 202,
201，、在基站上电时向安全网关发送密钥交换请求消息，接收返回的密钥 交换响应消息， 和安全网关建立至少一条安全隧道。  201. Send a key exchange request message to the security gateway when the base station is powered on, receive the returned key exchange response message, and establish at least one secure tunnel with the security gateway.
具体的， 基站和安全网关之间通过多个密钥交换请求和密钥交换响应消 息， 建立多条安全隧道。  Specifically, the base station and the security gateway establish multiple security tunnels by using multiple key exchange requests and key exchange response messages.
202'、 基站建立优先级值和至少一条安全隧道的隧道标识之间的对应关 系。  202. The base station establishes a correspondence between a priority value and a tunnel identifier of at least one secure tunnel.
具体的， 基站和安全网关可以分别在本地建立的安全隧道的隧道标识和 优先级值之间的对应关系， 建立的对应关系在基站和安全网关两侧分别维护 , 而不需要同步。 也就是说在同一条安全隧道（包括上行安全隧道和下行安全 两组对应关系在基站和安全网关两侧分别独立设置、 维护， 如表二和表三所 示， 如： 1A表示第一安全隧道的上行隧道标识， 1B表示第一安全隧道的下行 隧道标识。  Specifically, the corresponding relationship between the tunnel identifier and the priority value of the secure tunnel established by the local base station and the security gateway respectively is maintained on both sides of the base station and the security gateway, and synchronization is not required. That is to say, in the same security tunnel (including the uplink security tunnel and the downlink security, the two correspondences are independently set and maintained on both sides of the base station and the security gateway, as shown in Table 2 and Table 3, for example: 1A indicates the first security tunnel. The uplink tunnel identifier, 1B represents the downlink tunnel identifier of the first security tunnel.
Figure imgf000008_0002
2A 2、
Figure imgf000008_0002
2A 2
3A 3  3A 3
4A 4、 5、 6  4A 4, 5, 6
5A 7、 8、 9  5A 7, 8, 9
表 2  Table 2
其中， 表 2 站侧建立的上行隧道标识和优先级值的对应关系。  The correspondence between the uplink tunnel identifier and the priority value established on the station side of Table 2.
Figure imgf000009_0001
Figure imgf000009_0001
表 3  table 3
其中， 表 3是安全网关建立的下行隧道标识和优先级值之间的对应关系。 本发明实施例二提供的数据包传输方法还可以包括：  Table 3 is the correspondence between the downlink tunnel identifier and the priority value established by the security gateway. The data packet transmission method provided by the second embodiment of the present invention may further include:
203、 获得需要传输的上行数据包的优先级值。  203. Obtain a priority value of an uplink data packet that needs to be transmitted.
204、 根据优先级值查找优先级值和隧道标识之间的对应关系， 每个优先 级值对应至少一个隧道标识。  204. Search for a correspondence between the priority value and the tunnel identifier according to the priority value, where each priority value corresponds to at least one tunnel identifier.
205、 若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧 道向安全网关传输上行数据包。  205. If the corresponding tunnel identifier is found, the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
其中， 本发明实施例中步骤 203-205 的执行过程和上述实施例中步骤 101-103的执行过程相同， 在此不再重复描述。  The execution process of the steps 203-205 in the embodiment of the present invention is the same as the execution process of the steps 101-103 in the foregoing embodiment, and the description is not repeated here.
进一步的， 在本发明实施例二提供的数据传输方法还可以包括：  Further, the data transmission method provided in the second embodiment of the present invention may further include:
206、若未查找到对应的隧道标识，则向安全网关发送密钥交换请求消息。 具体的， 基站在未查找到对应的隧道标识的情况下， 向安全网关发送密 钥交换请求消息， 用于建立新的安全隧道。  206. If the corresponding tunnel identifier is not found, send a key exchange request message to the security gateway. Specifically, the base station sends a key exchange request message to the security gateway to establish a new secure tunnel if the corresponding tunnel identifier is not found.
207、 接收安全网关返回的密钥交换响应消息， 以与安全网关建立新的安 全隧道， 建立新的安全隧道的隧道标识和优先级值之间的对应关系。 立新的安全隧道的隧道标识和优先级值之间的对应关系。 其中， 建立的对应 关系中包括安全隧道的上行隧道标识和优先级值之间的对应关系和 /或下行隧 道标识和优先级值之间的对应关系。 207. Receive a key exchange response message returned by the security gateway to establish a new security tunnel with the security gateway, and establish a correspondence between the tunnel identifier and the priority value of the new security tunnel. Correspondence between the tunnel ID and the priority value of the new security tunnel. Among them, the established correspondence The relationship includes the correspondence between the uplink tunnel identifier of the security tunnel and the priority value and/or the correspondence between the downlink tunnel identifier and the priority value.
208、 通过新的安全隧道向安全网关传输上行数据包。  208. Transmit uplink data packets to the security gateway by using a new secure tunnel.
具体的， 基站通过新建立的安全隧道向安全网关传输上行数据包。  Specifically, the base station transmits the uplink data packet to the security gateway by using the newly established security tunnel.
在本发明实施例二提供的数据包传输方法中， 基站和安全网关之间同步 建立或者独立建立了与数据包的优先级值对应的安全隧道。 基站根据上行数 据包的优先级值获取对应的安全隧道的隧道标识， 由于每个优先级值对应至 隧道进行传输， 进而使得安全网关在接收到数据包后， 对每个安全隧道接收 到的数据包单独进行抗重放处理， 因而减少了被安全网关认为是重放数据包 的数量， 进而可以降低丟包的概率。  In the data packet transmission method provided by the second embodiment of the present invention, the secure tunnel corresponding to the priority value of the data packet is established or independently established between the base station and the security gateway. The base station acquires the tunnel identifier of the corresponding security tunnel according to the priority value of the uplink data packet, and each priority value corresponds to the tunnel for transmission, and then the security gateway receives the data packet for each security tunnel after receiving the data packet. The packet is separately subjected to anti-replay processing, thereby reducing the number of packets that are considered to be playback packets by the security gateway, thereby reducing the probability of packet loss.
基站在未查找到对应的隧道标识的情况下， 建立新的安全隧道并建立新 的安全隧道的隧道标识和优先级值之间的对应关系， 可以使得后续接收到相 同优先级值的上行数据包时， 根据该对应关系获取隧道标识， 并通过隧道标 识对应的安全隧道传输上行数据包。  If the base station does not find the corresponding tunnel identifier, the base station establishes a new security tunnel and establishes a correspondence between the tunnel identifier and the priority value of the new security tunnel, so that the uplink data packet with the same priority value can be subsequently received. The tunnel identifier is obtained according to the corresponding relationship, and the uplink data packet is transmitted through the corresponding secure tunnel of the tunnel identifier.
另外， 本发明实施例将不同优先级值的数据包通过的多条安全隧道进行 传输， 不同的优先级值可以对应不同的业务， 因而本发明实施例可以将不同 的业务通过多条隧道进行传输。 参见图 3 , 图 3是本发明实施例三提高的数据包传输方法的流程图。 本发明实施例三提供的数据包传输方法包括：  In addition, the embodiment of the present invention transmits multiple security tunnels with different priority value data packets, and different priority values may correspond to different services. Therefore, the embodiments of the present invention may transmit different services through multiple tunnels. . Referring to FIG. 3, FIG. 3 is a flowchart of an improved data packet transmission method according to Embodiment 3 of the present invention. The data packet transmission method provided in Embodiment 3 of the present invention includes:
301、 在基站上电时向安全网关发送至少两次密钥交换请求消息， 接收返 回的密钥交换响应消息， 以与安全网关建立至少两条安全隧道。  301: Send at least two key exchange request messages to the security gateway when the base station is powered on, and receive the returned key exchange response message to establish at least two security tunnels with the security gateway.
在本发明实施例中， 基站可以在上电时， 向安全网关发送至少两次密钥 交换请求消息。 其中， 发送至少两次密钥协商交换请求可以用于建立至少两 条安全隧道。 其中， 新建立的每条安全隧道包括一条上行安全隧道和下行安 全隧道， 安全隧道的上行隧道标识和下行隧道标识是对应的。  In the embodiment of the present invention, the base station may send at least two key exchange request messages to the security gateway when the power is turned on. The sending at least two key agreement exchange requests may be used to establish at least two secure tunnels. Each of the newly established security tunnels includes an uplink security tunnel and a downlink security tunnel. The uplink tunnel identifier and the downlink tunnel identifier of the security tunnel correspond to each other.
另外， 基站还可以在用户设备的承载建立时， 建立基站与安全网关之间 的安全隧道。 例如基站在接收到无线承载建立请求或基站在接收到无线承载 建立完成或初始上下文建立请求或初始上下文建立完成时向安全网关发送密 钥交换请求消息， 接收返回的密钥交换响应消息， 和安全网关建立安全隧道。 In addition, the base station may also establish a secure tunnel between the base station and the security gateway when the bearer of the user equipment is established. For example, the base station receives the radio bearer setup request or the base station receives the radio bearer. A key exchange request message is sent to the security gateway when the establishment or initial context establishment request or the initial context establishment is completed, the returned key exchange response message is received, and the security gateway establishes a secure tunnel.
302、 获得需要传输的上行数据包的优先级值。  302. Obtain a priority value of an uplink data packet that needs to be transmitted.
303、 根据所述优先级值查找设置的优先级值和隧道标识之间的对应关 系， 每个优先级值对应至少一个隧道标识；  303. Search, according to the priority value, a correspondence between the set priority value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier.
304、 若查找到对应的隧道标识 , 则通过查找到的隧道标识对应的安全隧 道向安全网关传输上行数据包。  304. If the corresponding tunnel identifier is found, the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
其中， 本发明实施例中步骤 302-304 的执行过程和上述实施例中步骤 101-103的执行过程相同， 在此不再重复描述。  The execution process of the steps 302-304 in the embodiment of the present invention is the same as the execution process of the steps 101-103 in the foregoing embodiment, and the description is not repeated here.
进一步的， 在本发明实施例三提供的数据传输方法还可以包括：  Further, the data transmission method provided in Embodiment 3 of the present invention may further include:
305、 若未查找到对应的隧道标识， 则确定存在未被使用的安全隧道。 其中， 基站在根据设置的对应关系查找不到对应的隧道标识的情况下， 确定当前存在的未被使用的安全隧道。 在本发明中， 所谓未被使用的安全隧 道是没有用于传输数据包的安全隧道， 即此上行或者下行安全隧道没有被赋 予数据包优先级属性。  305. If the corresponding tunnel identifier is not found, determine that there is a secure tunnel that is not used. The base station determines the currently existing unused security tunnel if the corresponding tunnel identifier is not found according to the set correspondence. In the present invention, the so-called unused secure tunnel is a secure tunnel for transmitting data packets, i.e., the uplink or downlink secure tunnel is not assigned a packet priority attribute.
306、 通过未被使用的安全隧道向安全网关传输上行数据包， 建立未被使 用的安全隧道的隧道标识和优先级值之间的对应关系。  306. The uplink data packet is transmitted to the security gateway by using the unused security tunnel, and the correspondence between the tunnel identifier and the priority value of the unused security tunnel is established.
在本发明实施例中， 步骤 301 建立了未被使用的安全隧道， 则本发明实 施例在执行步骤 305 时可以确定未被使用的安全隧道。 另外， 基站还建立确 定的未被使用的安全隧道的隧道标识和上述优先级值之间的对应关系， 以便 于后续根据该对应关系查找对应的隧道标识。  In the embodiment of the present invention, step 301 establishes a security tunnel that is not used. In the embodiment of the present invention, when the step 305 is performed, the unused security tunnel may be determined. In addition, the base station also establishes a correspondence between the tunnel identifier of the determined unused security tunnel and the priority value, so as to subsequently search for the corresponding tunnel identifier according to the correspondence.
进一步的， 本发明实施例提供的数据包传输方法还包括：  Further, the data packet transmission method provided by the embodiment of the present invention further includes:
307、 若未查找到对应的隧道标识， 并确定不存在未被使用的安全隧道， 则向安全网关发送密钥交换请求消息， 接收安全网关返回的密钥交换响应消 息， 以与安全网关建立新的安全隧道， 通过新的安全隧道向安全网关传输上 行数据包， 建立新的安全隧道的隧道标识和优先级值之间的对应关系。  307. If the corresponding tunnel identifier is not found, and it is determined that there is no unused security tunnel, send a key exchange request message to the security gateway, and receive a key exchange response message returned by the security gateway to establish a new with the security gateway. The secure tunnel transmits the uplink data packet to the security gateway through the new secure tunnel, and establishes a correspondence between the tunnel identifier and the priority value of the new secure tunnel.
其中， 基站在未查找对应的隧道标识， 并且确定不存在未被使用的安全 隧道的情况下， 例如初始建立的未被使用的安全隧道被用于传输其它优先级 值的数据了， 则基站向安全网关发送密钥交换请求消息， 接收安全网关返回 的密钥交换响应消息， 和安全网关建立新的安全隧道。 在新的安全隧道建立 完成后， 通过新的安全隧道向安全网关传输上行数据包， 并建立新的安全隧 道的隧道标识和优先级值之间的对应关系。 Wherein, when the base station does not find the corresponding tunnel identifier and determines that there is no unused security tunnel, for example, the initially established unused security tunnel is used to transmit data of other priority values, the base station The security gateway sends a key exchange request message, receives a key exchange response message returned by the security gateway, and establishes a new secure tunnel with the security gateway. Established in a new secure tunnel After the completion, the uplink packet is transmitted to the security gateway through the new secure tunnel, and the correspondence between the tunnel identifier and the priority value of the new secure tunnel is established.
其中， 安全网关在接收到基站通过安全隧道传输的上行数据包之后， 可 以获取上行数据包的优先级值， 并建立优先级值和接收到该数据包的安全隧 道的隧道标识之间的对应关系， 然后转发该上行数据包。  After receiving the uplink data packet transmitted by the base station through the secure tunnel, the security gateway may obtain the priority value of the uplink data packet, and establish a correspondence between the priority value and the tunnel identifier of the security tunnel that receives the data packet. And then forward the upstream packet.
在本发明实施例中， 建立新的安全隧道的隧道标识和优先级值之间的对 应关系， 或建立未被使用的安全隧道的隧道标识和优先级值之间的对应关系 的步骤可以采用密钥交换消息中携带数据包优先级来实现。 例如， 上述实施 例 2中的 201、 202步骤所示；或者采用基站和安全网关本地独立设置的方法， 如实施例 2 中的 201，、 202，步骤所示， 当然这两种方法都是以获取上行数据 包的优先级值为前提的。  In the embodiment of the present invention, the step of establishing a correspondence between the tunnel identifier and the priority value of the new security tunnel, or establishing the correspondence between the tunnel identifier and the priority value of the unused security tunnel may be adopted. The key exchange message carries the packet priority to implement. For example, the steps 201 and 202 in the foregoing Embodiment 2 are shown; or the method in which the base station and the security gateway are independently set locally, as shown in steps 201 and 202 in Embodiment 2, of course, the two methods are The priority value of the uplink packet is obtained.
在本发明实施例中， 通过在未查找到对应的隧道标识， 则确定存在未被 使用的安全隧道， 通过未被使用的安全隧道传输数据包， 并建立优先级值和 未被使用的安全隧道的隧道标识之间的对应关系， 使得基站和安全网关在建 立了安全隧道之后， 可以不用建立优先级值和新建立的安全隧道的隧道标识 之间的对应关系， 而是等到在传输数据包时， 确定存在未被使用的安全隧道 时， 建立优先级值和未被使用的安全隧道的隧道标识之间的对应关系。 同时， 安全网关在通过安全隧道接收到上行数据包之后， 获取上行数据包的优先级 值， 建立接收到数据包的安全隧道的隧道标识和优先级值之间的对应关系。 参见图 4, 图 4是本发明实施例四提供的数据包传输方法的流程图。  In the embodiment of the present invention, by not finding the corresponding tunnel identifier, it is determined that there is an unused security tunnel, the data packet is transmitted through the unused secure tunnel, and the priority value and the unused security tunnel are established. Correspondence between the tunnel identifiers, so that the base station and the security gateway do not need to establish a correspondence between the priority value and the tunnel identifier of the newly established security tunnel after establishing the security tunnel, but wait until the data packet is transmitted. And determining the correspondence between the priority value and the tunnel identifier of the unused security tunnel when there is an unused security tunnel. At the same time, after receiving the uplink data packet through the secure tunnel, the security gateway obtains the priority value of the uplink data packet, and establishes a correspondence between the tunnel identifier of the security tunnel that receives the data packet and the priority value. Referring to FIG. 4, FIG. 4 is a flowchart of a data packet transmission method according to Embodiment 4 of the present invention.
本发明实施例四提供的数据包传输方法包括：  The data packet transmission method provided in Embodiment 4 of the present invention includes:
401、 接收携带优先级值的无线承载建立请求或初始上下文建立请求。 具体的， 在建立用户设备承载过程中， 基站可以接收到移动性管理实体 发送的无线承载建立请求或初始上下文建立请求， 其中携带用户优先级、 业 务优先级和服务质量等级标识（ Quantity of Service Class Identifier, QCI ) 。  401. Receive a radio bearer setup request or an initial context setup request that carries a priority value. Specifically, in the process of establishing a user equipment bearer, the base station may receive a radio bearer setup request or an initial context setup request sent by the mobility management entity, where the user priority, the service priority, and the service quality level identifier are carried (Quantity of Service Class) Identifier, QCI).
402、 向安全网关发送携带优先级值的通知消息。  402. Send a notification message carrying a priority value to the security gateway.
具体的， 基站向安全网关发送通知（Notify )消息， 其中携带上述优先级 403、 接收安全网关发送的携带优先级值的密钥交换请求消息， 向安全网 关返回密钥交换响应消息， 以与安全网关建立至少一条安全隧道。 Specifically, the base station sends a notification (Notify) message to the security gateway, where the priority is carried. 403. Receive a key exchange request message that carries a priority value sent by the security gateway, and return a key exchange response message to the security gateway to establish at least one secure tunnel with the security gateway.
具体的， 安全网关在接收到该通知消息后， 向基站发送携带优先级值的 密钥交换请求消息， 基站向安全网关返回密钥交换响应消息， 和安全网关建 立至少一条安全隧道， 其中包括上行安全隧道和下行安全隧道。  Specifically, after receiving the notification message, the security gateway sends a key exchange request message carrying a priority value to the base station, and the base station returns a key exchange response message to the security gateway, and the security gateway establishes at least one security tunnel, including the uplink. Secure tunnel and downlink security tunnel.
在本发明实施例中， 基站触发安全网关建立安全隧道。 本发明实施例还 可以由基站直接开始执行建立安全隧道的过程。 例如， 基站在获取与服务质 量等级标识对应的优先级值后， 向安全网关发送密钥交换请求消息， 可选地， 此密钥交换请求消息可以携带优先级值， 如上述步骤 201 所示； 或者此密钥 交换请求消息并不携带优先级值， 如上述步骤 201，所示。 基站接收返回的密 钥交换响应消息， 和安全网关之间建立至少一条安全隧道。  In the embodiment of the present invention, the base station triggers the security gateway to establish a secure tunnel. The embodiment of the present invention may also directly start the process of establishing a secure tunnel by the base station. For example, after the base station obtains the priority value corresponding to the QoS level identifier, the base station sends a key exchange request message to the security gateway. Optionally, the key exchange request message may carry a priority value, as shown in step 201 above. Or the key exchange request message does not carry a priority value, as shown in step 201 above. The base station receives the returned key exchange response message and establishes at least one secure tunnel with the security gateway.
404、 建立优先级值和至少一条安全隧道的隧道标识之间的对应关系。 其中， 上述对应关系可以是如表 1所示， 通过例如步骤 202的方式实现； 或者这种对应关系如表 2或 3所示， 通过步骤 202，实现。  404. Establish a correspondence between a priority value and a tunnel identifier of at least one security tunnel. The corresponding relationship may be implemented by, for example, step 202 as shown in Table 1, or the corresponding relationship is as shown in Table 2 or 3, and is implemented by step 202.
405、 获得需要传输的上行数据包的优先级值。  405. Obtain a priority value of an uplink data packet that needs to be transmitted.
406、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识。  406. Search for a correspondence between the set priority value and the tunnel identifier according to the priority value, where each priority value corresponds to at least one tunnel identifier.
407、 若查找到对应的隧道标识 , 则通过查找到的隧道标识对应的安全隧 道向安全网关传输上行数据包。  407. If the corresponding tunnel identifier is found, the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
其中，步骤 405-407的执行过程和上述实施例中步骤 101-103的执行过程 类似， 详情参见上述实施例的描述， 在此不再重复。  The execution process of the steps 405-407 is similar to the execution process of the steps 101-103 in the foregoing embodiment. For details, refer to the description of the foregoing embodiment, which is not repeated here.
进一步的， 本发明实施例在接收到携带优先级值的无线承载建立请求或 初始上下文建立请求， 可以查找该优先级值对应的隧道标识， 若未查找到对 应的隧道标识， 则向安全网关发送密钥交换请求消息， 接收返回的密钥交换 响应消息， 以与安全网关建立至少一条安全隧道。 基站在与安全网关建立至 少一条安全隧道后， 建立所述优先级值与所述至少一条安全隧道的隧道标识 之间的对应关系。 若查找到对应的隧道标识， 则通过查找到的隧道标识对应 的安全隧道传输上行数据包。  Further, in the embodiment of the present invention, after receiving the radio bearer setup request or the initial context setup request carrying the priority value, the tunnel identifier corresponding to the priority value may be searched, and if the corresponding tunnel identifier is not found, the security gateway is sent to the security gateway. The key exchange request message receives the returned key exchange response message to establish at least one secure tunnel with the security gateway. After the base station establishes at least one security tunnel with the security gateway, the base station establishes a correspondence between the priority value and the tunnel identifier of the at least one security tunnel. If the corresponding tunnel identifier is found, the uplink data packet is transmitted through the secure tunnel corresponding to the found tunnel identifier.
进一步的， 本发明实施例在接收到携带优先级值的无线承载建立请求或 初始上下文建立请求， 查找该优先级值对应的隧道标识， 若未查找到对应的 隧道标识， 则确定存在未被使用的安全隧道， 通过未被使用的安全隧道向所 述安全网关传输上行数据包。 基站在确定存在未被使用的安全隧道后， 建立 Further, the embodiment of the present invention receives the radio bearer setup request or the initial context setup request that carries the priority value, and searches for the tunnel identifier corresponding to the priority value, if no corresponding The tunnel identifier determines that there is an unused secure tunnel, and transmits an uplink packet to the security gateway through the unused secure tunnel. After the base station determines that there is an unused security tunnel, it establishes
参见图 5 ,图 5是本发明实施例提供的数据包传输方法中基站建立优先级 值和至少一条安全隧道的隧道标识之间的对应关系的方法流程图。 Referring to FIG. 5, FIG. 5 is a flowchart of a method for establishing a correspondence between a base station establishing a priority value and a tunnel identifier of at least one security tunnel in a data packet transmission method according to an embodiment of the present invention.
进一步的， 在本发明实施例四提供的数据包传输方法中， 无线承载建立 请求或初始上下文建立请求中携带用户优先级或业务优先级或核心网是否具 有和固网互通能力的信息， 优先级值具体可以为差异化业务点码， 基站执行 建立优先级值和至少一条安全隧道的隧道标识之间的对应关系的过程可以包 括：  Further, in the data packet transmission method provided by the fourth embodiment of the present invention, the radio bearer setup request or the initial context setup request carries information such as user priority or service priority or whether the core network has the capability of interworking with the fixed network, and the priority is The value may specifically be a differentiated service point code, and the process of the base station performing the correspondence between the establishment of the priority value and the tunnel identifier of the at least one security tunnel may include:
501、 将用户优先级或业务优先级或核心网是否具有和固网互通能力的信 息填充到差异化业务点码的字段中， 将填充后的差异化业务点码作为优先级 值。  501. Fill the user priority or service priority or the core network with the information of the fixed network interworking capability into the field of the differentiated service point code, and use the padded differentiated service point code as the priority value.
在本发明实施例中， 优先级值为差异化业务点码， 差异化业务点码中包 括差异化业务点码值以及其它空闲的字段， 该差异化业务点码值可以占 4 比 特。 基站可以将用户优先级或业务优先级或核心网是否具有和固网互通能力 的信息填充到差异化业务点码的字段中， 将填充后的差异化业务点码作为优 先级值。 其中， 用户优先级例如可以为金、 银、 铜等级别。 业务优先级例如 可以为语音业务或非语音业务等。  In the embodiment of the present invention, the priority value is a differentiated service point code, and the differentiated service point code includes a differentiated service point code value and other idle fields, and the differentiated service point code value may occupy 4 bits. The base station may fill the user priority or the service priority or the core network with the information of the fixed network interworking capability into the field of the differentiated service point code, and use the padded differentiated service point code as the priority value. The user priority may be, for example, a level of gold, silver, or copper. The service priority may be, for example, a voice service or a non-voice service.
502、 建立填充后的差异化业务点码和隧道标识之间的对应关系。  502. Establish a correspondence between the padded differentiated service point code and the tunnel identifier.
具体的， 基站建立填充后的差异化业务点码和隧道标识之间的对应关系。 进一步的， 本发明实施例四提供的数据包传输方法在建立优先级值和隧 道标识之间的对应关系后， 还将隧道标识、 上行数据包的优先级值之间的对 应关系通过 S1建立消息向移动性管理实体发送， 以便于移动性管理实体将该 对应关系发送给分组数据网络网关， 分组数据网络网关将该对应关系发送给 策略计费规则功能（ Policy And Charging Rule Function, PCRF )设备， PCRF 设备将该对应关系以及聚合的服务质量（ Quantity of Service, QoS )要求发送 给宽带策略控制架构（ Broadband Policy Control Framework, BPCF )设备， 以 便于固网中的 BPCF设备根据 QoS对每条安全隧道进行 QoS的控制 。 在本发明实施例中， 基站将优先级值、 以及优先级值和隧道标识之间的 对应关系向移动性管理实体发送， 可以使得固网设备， 例如 BRAS设备可以 结合优先级值中的用户优先级或业务优先级对数据包进行调度， 例如在网络 拥堵时， 优先保证用户优先级高的用户的数据包。 另外， 固网中的 BPCF设 备根据 QoS对每条安全隧道进行 QoS 的控制， 可以实现用户设备的全网的 QoS控制。 参见图 6, 图 6是本发明实施例五提供的数据包传输方法的流程图。 Specifically, the base station establishes a correspondence between the padded differentiated service point code and the tunnel identifier. Further, after the data packet transmission method provided in the fourth embodiment of the present invention establishes the correspondence between the priority value and the tunnel identifier, the correspondence between the tunnel identifier and the priority value of the uplink data packet is established through S1. Sending to the mobility management entity, so that the mobility management entity sends the correspondence to the packet data network gateway, and the packet data network gateway sends the correspondence to the Policy and Charging Rule Function (PCRF) device. The PCRF device sends the corresponding relationship and the aggregated Quality of Service (QoS) requirements to the Broadband Policy Control Framework (BPCF) device, so that the BPCF device in the fixed network can secure each tunnel according to QoS. Perform QoS control. In the embodiment of the present invention, the base station sends the priority value, and the correspondence between the priority value and the tunnel identifier to the mobility management entity, so that the fixed network device, for example, the BRAS device, can combine the priority of the user in the priority value. The level or service priority schedules the data packet, for example, when the network is congested, the data packet of the user with high priority is preferentially guaranteed. In addition, the BPCF device in the fixed network controls the QoS of each security tunnel according to the QoS, and can implement QoS control of the entire network of the user equipment. Referring to FIG. 6, FIG. 6 is a flowchart of a data packet transmission method according to Embodiment 5 of the present invention.
本发明实施例五提供的数据包传输方法包括：  The data packet transmission method provided in Embodiment 5 of the present invention includes:
601、 接收安全网关通过安全隧道发送的下行数据包。  601. Receive a downlink data packet sent by the security gateway through the secure tunnel.
在本发明实施例中， 基站和安全网关之间可以在基站上电时预先建立一 条安全隧道。 基站可以接收安全网关通过安全隧道发送的下行数据包。  In the embodiment of the present invention, a secure tunnel may be established in advance between the base station and the security gateway when the base station is powered on. The base station can receive the downlink data packet sent by the security gateway through the secure tunnel.
602、获取下行数据包中内层 IP包的优先级值以及外层 IP包的优先级值。 具体的，基站获取下行数据包中内层 IP包的优先级值以及外层 IP包的优 先级值。  602. Obtain a priority value of an inner layer IP packet in the downlink data packet and a priority value of the outer layer IP packet. Specifically, the base station acquires a priority value of an inner layer IP packet in the downlink data packet and a priority value of the outer layer IP packet.
在本发明实施例中， 下行数据包在传输过程中外层 IP包的优先级值可能 发生改变， 而内层 IP包的优先级值是保持不变的。  In the embodiment of the present invention, the priority value of the outer IP packet may change during the transmission of the downlink data packet, and the priority value of the inner IP packet remains unchanged.
603、 建立安全隧道的隧道标识和内层 IP包的优先级值之间的对应关系， 以及建立安全隧道的隧道标识和外层 IP包的优先级值之间的对应关系。  603. Establish a correspondence between a tunnel identifier of the security tunnel and a priority value of the inner layer IP packet, and a correspondence between the tunnel identifier of the security tunnel and the priority value of the outer IP packet.
基站在建立上述对应关系完成后， 可以转发该下行数据包， 然后获得需 要转发的上行数据包。  After completing the foregoing correspondence, the base station may forward the downlink data packet, and then obtain an uplink data packet that needs to be forwarded.
604、 获得需要传输的上行数据包的优先级值。  604. Obtain a priority value of an uplink data packet that needs to be transmitted.
605、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识。  605. Search for a correspondence between the set priority value and the tunnel identifier according to the priority value, where each priority value corresponds to at least one tunnel identifier.
其中， 本发明实施例中步骤 604-605 的执行过程和上述实施例中的步骤 101-102类似， 在此不再重复描述。  The execution process of the steps 604-605 in the embodiment of the present invention is similar to the steps 101-102 in the foregoing embodiment, and the description is not repeated here.
在本发明实施例中， 基站通过查找到的隧道标识对应的安全隧道向安全 网关传输所述上行数据包的步骤（上述步骤 103 )具体可以包括： 606、根据隧道标识和内层 IP包的优先级值之间的对应关系，以及隧道标 识和外层 IP包的优先级值之间的对应关系，以及上行数据包的内层 IP包的优 先级值查找到上行数据包的外层 IP包的优先级值和对应的隧道标识。 In the embodiment of the present invention, the step of the base station transmitting the uplink data packet to the security gateway by using the tunnel tunnel corresponding to the discovered tunnel identifier (the foregoing step 103) may specifically include: 606. According to the correspondence between the tunnel identifier and the priority value of the inner IP packet, and the correspondence between the tunnel identifier and the priority value of the outer IP packet, and the priority of the inner IP packet of the uplink data packet. The value finds the priority value of the outer IP packet of the uplink packet and the corresponding tunnel identifier.
具体的， 基站首先根据上行数据包的内层 IP包的优先级值查找隧道标识 和内层 IP包的优先级值之间的对应关系， 获得隧道标识， 进而根据之前查找 到的隧道标识查找安全隧道的隧道标识和外层 IP包的优先级值之间的对应关 系， 获得外层 IP包的优先级值。  Specifically, the base station first searches for the correspondence between the tunnel identifier and the priority value of the inner layer IP packet according to the priority value of the inner IP packet of the uplink data packet, obtains the tunnel identifier, and searches for the security according to the previously found tunnel identifier. The correspondence between the tunnel identifier of the tunnel and the priority value of the outer IP packet obtains the priority value of the outer IP packet.
607、 将上行数据包的外层 IP包的优先级值作为上行数据包的优先级值。 在本发明实施例中， 基站将上行数据包的外层 IP包的优先级值作为上行 数据包的优先级值。 具体的， 基站可以将上行数据包的外层 IP包的优先级值 更新为查找到的优先级值。  607. Use a priority value of an outer IP packet of the uplink data packet as a priority value of the uplink data packet. In the embodiment of the present invention, the base station uses the priority value of the outer IP packet of the uplink data packet as the priority value of the uplink data packet. Specifically, the base station may update the priority value of the outer IP packet of the uplink data packet to the found priority value.
608、 将上行数据包通过查找到的隧道标识对应的安全隧道向安全网关传 输。  608. The uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
在本发明实施例中， 由于外层 IP包的数据包优先级决定了数据包在固网 的处理优先级， 因此基站将查找到的上行数据包的外层 IP包的优先级值作为 上行数据包的优先级值，可以保证对于相同业务的下行数据包在固网设备 (例 如 BRAS )的传输拥有和上行数据包相同的优先级，从而在固网设备做到同一 业务上下行的对称。 参见图 7, 图 7是本发明实施例六提供的数据包传输方法的流程图。  In the embodiment of the present invention, since the data packet priority of the outer IP packet determines the processing priority of the data packet in the fixed network, the base station uses the priority value of the outer IP packet of the found uplink data packet as the uplink data. The priority value of the packet can ensure that the downlink data packet of the same service has the same priority as the uplink data packet in the transmission of the fixed network device (for example, BRAS), so that the fixed network device performs the downlink symmetry of the same service. Referring to FIG. 7, FIG. 7 is a flowchart of a data packet transmission method according to Embodiment 6 of the present invention.
本发明实施例提供的数据包传输方法包括：  The data packet transmission method provided by the embodiment of the present invention includes:
701、 接收安全网关通过安全隧道发送的下行数据包。  701. Receive a downlink data packet sent by the security gateway through the secure tunnel.
在本发明实施例中， 基站和安全网关之间可以在基站上电时预先建立一 条安全隧道。 基站可以接收安全网关通过安全隧道发送的下行数据包。  In the embodiment of the present invention, a secure tunnel may be established in advance between the base station and the security gateway when the base station is powered on. The base station can receive the downlink data packet sent by the security gateway through the secure tunnel.
702、 获取下行数据包的优先级值， 建立所述安全隧道的隧道标识和优先 级值之间的对应关系。  702. Obtain a priority value of the downlink data packet, and establish a correspondence between the tunnel identifier and the priority value of the security tunnel.
具体的， 基站可以获取首次通过某条安全隧道接收到的下行数据包， 并 获取下行数据包的优先级值， 建立优先级值和所述安全隧道的隧道标识之间 的对应关系。  Specifically, the base station may obtain the downlink data packet received by the first time through a certain security tunnel, obtain the priority value of the downlink data packet, and establish a correspondence between the priority value and the tunnel identifier of the security tunnel.
703、 转发下行数据包。 具体的， 基站可以向用户设备转发下行数据包。 703. Forward the downlink data packet. Specifically, the base station may forward the downlink data packet to the user equipment.
704、 获得需要传输的上行数据包的优先级值。  704. Obtain a priority value of an uplink data packet that needs to be transmitted.
705、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识。  705. Search for a correspondence between the set priority value and the tunnel identifier according to the priority value, where each priority value corresponds to at least one tunnel identifier.
706、 若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧 道向安全网关传输上行数据包。  706. If the corresponding tunnel identifier is found, the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
其中，步骤 704-706的执行过程和上述实施例中步骤 101-103的执行过程 类似， 详情参见上述实施例的描述， 在此不再重复。 以上从基站一侧描述了本发明实施例提供的数据包传输方法， 下面从安 全网关一侧来描述本发明实施例提供的数据包传输方法。  The execution process of the steps 704-706 is similar to the execution process of the steps 101-103 in the foregoing embodiment. For details, refer to the description of the foregoing embodiment, which is not repeated here. The data packet transmission method provided by the embodiment of the present invention is described above from the base station side. The data packet transmission method provided by the embodiment of the present invention is described below from the security gateway side.
参见图 8, 图 8是本发明实施例七提供的数据包传输方法的流程图。  Referring to FIG. 8, FIG. 8 is a flowchart of a data packet transmission method according to Embodiment 7 of the present invention.
本发明实施例提供的数据包传输方法包括：  The data packet transmission method provided by the embodiment of the present invention includes:
801、 获得需要传输的下行数据包的优先级值。  801. Obtain a priority value of a downlink data packet that needs to be transmitted.
在本发明实施例中， 安全网关可以接收核心网 （例如分组数据网络网关， 基站网关等）发送的下行数据包。 下行数据包中携带优先级值。  In the embodiment of the present invention, the security gateway may receive downlink data packets sent by the core network (for example, a packet data network gateway, a base station gateway, etc.). The downstream packet carries a priority value.
其中， 安全网关可以将下行数据包的互联网协议 IP包的优先级值作为下 行数据包的优先级值。  The security gateway may use the priority value of the Internet Protocol IP packet of the downlink data packet as the priority value of the downlink data packet.
802、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识。  802. Search for a correspondence between the set priority value and the tunnel identifier according to the priority value, where each priority value corresponds to at least one tunnel identifier.
具体的， 安全网关根据获取的优先级值查找设置的优先级值和隧道标识 之间的对应关系。 其中， 该对应关系中不同的隧道标识分别对应不同的优先 级值， 每个优先级值对应至少一个隧道标识， 该对应关系可以在建立安全隧 道时预先建立， 或者在有下行数据包传输需求时指定一个未使用的安全隧道 标识和优先级值的对应关系。  Specifically, the security gateway searches for the correspondence between the set priority value and the tunnel identifier according to the obtained priority value. The different tunnel identifiers in the corresponding relationship respectively correspond to different priority values, and each priority value corresponds to at least one tunnel identifier, which may be established in advance when establishing a secure tunnel, or when there is a downlink data transmission requirement. Specifies the correspondence between an unused security tunnel ID and a priority value.
803、 若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧 道向基站传输下行数据包。  803. If the corresponding tunnel identifier is found, the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
其中， 安全网关通过安全隧道传输下行数据包时， 在下行数据包的包头 封装中标识该隧道标识。 在本发明实施例提供的数据包传输方法中， 安全网关根据下行数据包的 优先级值获取对应的安全隧道的隧道标识， 由于每个优先级值对应至少一个 隧道标识， 则安全网关可以将数据包优先级不同的下行数据包通过多个安全 隧道进行传输， 进而使得基站在接收到数据包后， 对每个安全隧道接收到的 数据包单独进行抗重放处理， 因而减少了被接收端认为是重放数据包的数量， 进而可以降低丟包的概率。 参见图 9, 图 9是本发明实施例八提供的数据包传输方法的流程图。 When the security gateway transmits the downlink data packet through the secure tunnel, the tunnel identifier is identified in the header encapsulation of the downlink data packet. In the data packet transmission method provided by the embodiment of the present invention, the security gateway acquires the tunnel identifier of the corresponding security tunnel according to the priority value of the downlink data packet. Since each priority value corresponds to at least one tunnel identifier, the security gateway may The downlink data packets with different packet priorities are transmitted through multiple secure tunnels, so that after receiving the data packets, the base station separately performs anti-replay processing on the data packets received by each secure tunnel, thereby reducing the considered by the receiving end. It is the number of replayed packets, which in turn reduces the probability of packet loss. Referring to FIG. 9, FIG. 9 is a flowchart of a data packet transmission method according to Embodiment 8 of the present invention.
本发明实施例提供的数据包传输方法包括：  The data packet transmission method provided by the embodiment of the present invention includes:
901、 接收基站通过安全隧道发送的上行数据包。  901. Receive an uplink data packet sent by a base station through a secure tunnel.
具体的， 基站和安全网关之间可以在基站上电时预先建立至少一条安全 隧道， 安全网关先接收到基站通过安全隧道发送的上行数据包。  Specifically, the base station and the security gateway may pre-establish at least one secure tunnel when the base station is powered on, and the security gateway first receives the uplink data packet sent by the base station through the secure tunnel.
902、 获取上行数据包的优先级值， 建立安全隧道的隧道标识和优先级值 之间的 3†应关系。  902. Obtain a priority value of the uplink data packet, and establish a relationship between the tunnel identifier of the security tunnel and the priority value.
其中， 上行数据包中携带优先级值。 在本发明实施例中， 优先级值可以 为 DSCP值。 安全网关建立安全隧道的隧道标识和该优先级值之间的对应关 系。  The uplink data packet carries a priority value. In the embodiment of the present invention, the priority value may be a DSCP value. The security gateway establishes a correspondence between the tunnel identifier of the security tunnel and the priority value.
具体的， 安全网关建立安全隧道的隧道标识和优先级值之间的如表 1 所 示的对应关系包括： 安全网关建立安全隧道的上行隧道标识和优先级值之间 对应关系。  Specifically, the correspondence between the tunnel identifier and the priority value of the security tunnel that establishes the security tunnel is as shown in Table 1. The correspondence between the uplink tunnel identifier and the priority value of the security tunnel is established by the security gateway.
另外， 安全网关建立的关系示意如表 1所示， 也可以如表 3所示。 其建 立的方法和逻辑和步骤 201、 202类似； 也可以采用类似 20 Γ, 202，的方法。 其 区别只在于在本实施例中密钥交换请求是由安全网关而不是基站发起的， 密 钥响应消息是由基站发送的。  In addition, the relationship established by the security gateway is shown in Table 1, and can also be shown in Table 3. The method and logic it creates are similar to steps 201 and 202; methods similar to 20 Γ, 202 can also be used. The only difference is that in this embodiment, the key exchange request is initiated by the security gateway instead of the base station, and the key response message is sent by the base station.
903、 转发上行数据包。  903. Forward the uplink data packet.
具体的， 安全网关将该数据包转发到基站网关或分组数据网络网关。 其 中， 安全网关转发上行数据包和建立上述对应关系之间是没有先后顺序的。 安全网关在转发上下数据包之后， 可以接收到用户设备的下行数据包， 则安 全设备开始执行步骤 904。 904、 获得需要传输的下行数据包的优先级值。 Specifically, the security gateway forwards the data packet to the base station gateway or the packet data network gateway. There is no order between the security gateway forwarding the uplink data packet and establishing the foregoing correspondence relationship. After the security gateway forwards the upper and lower data packets, it can receive the downlink data packet of the user equipment, and the security device begins to perform step 904. 904. Obtain a priority value of a downlink data packet that needs to be transmitted.
905、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识。  905. Search for a correspondence between the set priority value and the tunnel identifier according to the priority value, where each priority value corresponds to at least one tunnel identifier.
906、 若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧 道向基站传输所述下行数据包。  906. If the corresponding tunnel identifier is found, the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
其中，步骤 904-906的执行过程和上述实施例八中的步骤 801-803的执行 过程类似， 在此不再重复描述。  The execution process of the steps 904-906 is similar to the execution process of the steps 801-803 in the above embodiment 8, and the description is not repeated here.
以上给出了一种安全网关预先建立安全隧道的标识和优先级值之间的对 应关系的实施例， 下面再给出另外的实施例。 参见图 10, 图 10是本发明实施例九提供的数据包传输方法的流程图。 本发明实施例提供的数据包传输方法包括：  An embodiment in which the security gateway pre-establishes the correspondence between the identity and the priority value of the secure tunnel is given above, and further embodiments are given below. Referring to FIG. 10, FIG. 10 is a flowchart of a data packet transmission method according to Embodiment 9 of the present invention. The data packet transmission method provided by the embodiment of the present invention includes:
1001、 接收基站发送的携带优先级值的密钥交换请求消息， 返回密钥交 换响应消息， 以与基站建立至少一条安全隧道。  1001. Receive a key exchange request message that carries a priority value sent by the base station, and return a key exchange response message to establish at least one secure tunnel with the base station.
具体的 , 安全网关接收基站发送的携带优先级值的密钥交换请求消息 , 返回密钥交换响应消息， 和基站之间建立至少一条安全隧道。  Specifically, the security gateway receives the key exchange request message that carries the priority value sent by the base station, returns a key exchange response message, and establishes at least one secure tunnel with the base station.
1002、 建立优先级值和至少一条安全隧道的隧道标识之间的对应关系。 具体的， 安全网关在建立安全隧道完成后， 建立优先级值和至少一条安 全隧道的隧道标识之间的对应关系。  1002. Establish a correspondence between a priority value and a tunnel identifier of at least one secure tunnel. Specifically, after the security tunnel is established, the security gateway establishes a correspondence between the priority value and the tunnel identifier of at least one security tunnel.
另外， 安全网关建立的关系示意如表 1所示， 也可以如表 3所示。 其建 立的方法和逻辑和步骤 201、 202类似； 也可以采用类似 20 Γ, 202，的方法。 其 区别只在于在本实施例中密钥交换请求是由安全网关而不是基站发起的， 密 钥响应消息是由基站发送的。  In addition, the relationship established by the security gateway is shown in Table 1, and can also be shown in Table 3. The method and logic it creates are similar to steps 201 and 202; methods similar to 20 Γ, 202 can also be used. The only difference is that in this embodiment, the key exchange request is initiated by the security gateway instead of the base station, and the key response message is sent by the base station.
1003、 获得需要传输的下行数据包的优先级值。  1003. Obtain a priority value of a downlink data packet that needs to be transmitted.
1004、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至少一个隧道标识。  1004. Search, according to the priority value, a correspondence between the set priority value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier.
1005、 若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全 隧道向基站传输所述下行数据包。  1005. If the corresponding tunnel identifier is found, the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
其中，步骤 1003-1005的执行过程和上述实施例八中的步骤 801-803的执 行过程类似， 在此不再重复描述。 进一步的， 本发明实施例提供的数据包传输方法还可以包括：The execution process of the steps 1003-1005 is similar to the execution process of the steps 801-803 in the foregoing embodiment 8. The description is not repeated here. Further, the data packet transmission method provided by the embodiment of the present invention may further include:
1006、 若未查找到对应的隧道标识， 则向基站发送密钥交换请求消息。 具体的， 安全网关在未查找到对应的隧道标识的情况下， 向安全网关发 送密钥交换请求消息， 用于建立新的安全隧道。 1006. If the corresponding tunnel identifier is not found, send a key exchange request message to the base station. Specifically, the security gateway sends a key exchange request message to the security gateway to establish a new secure tunnel if the corresponding tunnel identifier is not found.
1007、 接收基站返回的密钥交换响应消息， 以与基站建立新的安全隧道， 建立新的安全隧道的隧道标识和优先级值之间的对应关系。  1007. Receive a key exchange response message returned by the base station, to establish a new security tunnel with the base station, and establish a correspondence between the tunnel identifier and the priority value of the new security tunnel.
其中， 建立的安全隧道包括上行安全隧道和下行安全隧道。 安全网关建 立新的安全隧道的隧道标识和优先级值之间的对应关系。 其中， 建立的对应 关系中包括安全隧道的上行隧道标识和优先级值之间的对应关系以及下行隧 道标识和优先级值之间的对应关系。  The established security tunnel includes an uplink security tunnel and a downlink security tunnel. The security gateway establishes the correspondence between the tunnel ID and the priority value of the new security tunnel. The corresponding relationship between the uplink tunnel identifier and the priority value of the security tunnel and the correspondence between the downlink tunnel identifier and the priority value are included.
1008、 通过新的安全隧道向基站传输下行数据包。  1008. Transmit downlink data packets to the base station by using a new secure tunnel.
具体的， 安全网关通过新建立的安全隧道向基站传输下行数据包， 在本发明实施例提供的数据包传输方法中， 基站和安全网关之间建立与 数据包的优先级值对应的安全隧道。 安全网关根据下行数据包的优先级值获 取对应的安全隧道的隧道标识， 由于每个优先级值对应至少一个隧道标识， 则安全网关可以将下行数据包通过多个安全隧道进行传输， 进而使得基站在 接收到数据包后， 对每个安全隧道接收到的数据包单独进行抗重放处理， 因 而减少了重放数据包的数量， 进而可以降低丟包的概率。  Specifically, the security gateway transmits the downlink data packet to the base station by using the newly established security tunnel. In the data packet transmission method provided by the embodiment of the present invention, a secure tunnel corresponding to the priority value of the data packet is established between the base station and the security gateway. The security gateway obtains the tunnel identifier of the corresponding security tunnel according to the priority value of the downlink data packet. Since each priority value corresponds to at least one tunnel identifier, the security gateway can transmit the downlink data packet through multiple secure tunnels, thereby enabling the base station to After receiving the data packet, the data packet received by each secure tunnel is separately subjected to anti-replay processing, thereby reducing the number of playback data packets, thereby reducing the probability of packet loss.
安全网关在未查找到对应的隧道标识的情况下， 建立新的安全隧道并建 立新的安全隧道的隧道标识和优先级值之间的对应关系， 以便于后续接收到 相同优先级值的下行数据包后， 根据该对应关系获取隧道标识， 并通过隧道 标识对应的安全隧道传输下行数据包。 进行传输， 不同的优先级值可以对应不同的业务， 因而本发明实施例可以将 不同的业务通过多条隧道进行传输。 参见图 11 , 图 11是本发明实施例十提供的数据包传输方法的流程图。 本发明实施例提供的数据包传输方法包括：  The security gateway establishes a new security tunnel and establishes a correspondence between the tunnel identifier and the priority value of the new security tunnel, so that subsequent downlink data with the same priority value is received. After the packet is obtained, the tunnel identifier is obtained according to the corresponding relationship, and the downlink data packet is transmitted through the corresponding secure tunnel of the tunnel identifier. For the transmission, the different priority values may correspond to different services. Therefore, the embodiments of the present invention may transmit different services through multiple tunnels. Referring to FIG. 11, FIG. 11 is a flowchart of a data packet transmission method according to Embodiment 10 of the present invention. The data packet transmission method provided by the embodiment of the present invention includes:
1101、 接收基站发送的通知消息， 通知消息中携带优先级值。 具体的， 安全网关可以在建立用户设备的承载过程中， 接收到基站发送 的通知消息， 该通知消息用于触发安全网关建立安全隧道。 1101. Receive a notification message sent by the base station, where the notification message carries a priority value. Specifically, the security gateway may receive a notification message sent by the base station during the bearer process of establishing the user equipment, where the notification message is used to trigger the security gateway to establish a secure tunnel.
1102、 向基站发送携带优先级值的密钥交换请求消息， 接收返回的密钥 交换响应消息， 和基站建立至少一条安全隧道。  1102. Send a key exchange request message carrying a priority value to the base station, receive the returned key exchange response message, and establish at least one secure tunnel with the base station.
具体的， 安全网关和基站之间开始建立安全隧道。 安全网关和基站之间 建立至少一条安全隧道。  Specifically, a secure tunnel is established between the security gateway and the base station. At least one secure tunnel is established between the security gateway and the base station.
1103、 建立优先级值和至少一条安全隧道的隧道标识之间的对应关系。 在建立安全隧道完成后， 安全网关建立优先级值和至少一条安全隧道的 隧道标识之间的对应关系。  1103. Establish a correspondence between a priority value and a tunnel identifier of at least one security tunnel. After the security tunnel is established, the security gateway establishes a correspondence between the priority value and the tunnel identifier of at least one security tunnel.
1104、 获得需要传输的下行数据包的优先级值。  1104. Obtain a priority value of a downlink data packet that needs to be transmitted.
1105、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至少一个隧道标识。  1105. Search for a correspondence between the set priority value and the tunnel identifier according to the priority value, where each priority value corresponds to at least one tunnel identifier.
1106、 若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全 隧道向基站传输下行数据包。  1106. If the corresponding tunnel identifier is found, the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
其中，步骤 1104-1106的执行过程和上述实施例八中的步骤 801-803的执 行过程类似， 在此不再重复描述。  The execution process of the steps 1104-1106 is similar to the execution process of the steps 801-803 in the foregoing embodiment 8. The description is not repeated here.
进一步的， 本发明实施例提供的数据包传输方法还可以包括：  Further, the data packet transmission method provided by the embodiment of the present invention may further include:
1107、 若未查找到对应的隧道标识， 则确定存在未被使用的安全隧道。 具体的， 安全网关在根据设置的对应关系查找不到对应的隧道标识的情 况下， 确定存在未被使用的安全隧道。 在本发明中， 所谓未被使用的安全隧 道是从来没有用于传输数据包的安全隧道， 即此上行或者下行安全隧道没有 被赋予数据包优先级属性。  1107. If the corresponding tunnel identifier is not found, it is determined that there is a secure tunnel that is not used. Specifically, the security gateway determines that there is an unused security tunnel when the corresponding tunnel identifier is not found according to the set correspondence. In the present invention, the so-called unused secure tunnel is a secure tunnel that has never been used to transmit data packets, i.e., this upstream or downstream secure tunnel is not given a packet priority attribute.
1108、 通过未被使用的安全隧道向基站传输下行数据包， 建立未被使用 的安全隧道的隧道标识和所述优先级值之间的对应关系。  1108. Transmit a downlink data packet to the base station by using the unused security tunnel, and establish a correspondence between the tunnel identifier of the unused security tunnel and the priority value.
在本发明实施例中， 基站在上电时， 和安全网关建立一条或者多条未被 则通过未被使用的安全隧道向基站发送下行数据包。 另外， 安全网关还建立 查找到的未被使用的安全隧道的隧道标识和上述优先级值之间的对应关系， 以便于后续根据该对应关系查找对应的隧道标识。  In the embodiment of the present invention, when the base station is powered on, the security gateway establishes one or more secure tunnels that are not used, and then send the downlink data packet to the base station. In addition, the security gateway also establishes a correspondence between the tunnel identifier of the unused security tunnel and the priority value, so as to find the corresponding tunnel identifier according to the correspondence.
进一步的， 本发明实施例提供的数据包传输方法还可以包括： 1109、 若未查找到对应的隧道标识， 且确定不存在未被使用的安全隧道， 向基站发送密钥交换请求消息， 接收基站返回的密钥交换响应消息， 以与基 站建立新的安全隧道， 通过新的安全隧道向基站传输下行数据包， 建立新的 安全隧道的隧道标识和优先级值之间的对应关系。 Further, the data packet transmission method provided by the embodiment of the present invention may further include: 1109. If the corresponding tunnel identifier is not found, and it is determined that there is no unused security tunnel, send a key exchange request message to the base station, and receive a key exchange response message returned by the base station to establish a new secure tunnel with the base station. The downlink data packet is transmitted to the base station through the new secure tunnel, and the correspondence between the tunnel identifier and the priority value of the new secure tunnel is established.
其中， 安全网关在未查找到未被使用的隧道的情况下， 例如初始建立的 未被使用的隧道被用于传输其它优先级值的数据了， 则安全网关向基站发送 密钥交换请求消息， 接收基站返回的密钥交换响应消息， 以与基站建立新的 安全隧道。 在新的安全隧道建立完成后， 通过新的安全隧道向基站传输下行 数据包， 并建立新的安全隧道的隧道标识和优先级值之间的对应关系。  If the security gateway does not find the unused tunnel, for example, the initially established unused tunnel is used to transmit data of other priority values, the security gateway sends a key exchange request message to the base station. Receiving a key exchange response message returned by the base station to establish a new secure tunnel with the base station. After the new security tunnel is established, the downlink packet is transmitted to the base station through the new secure tunnel, and the correspondence between the tunnel identifier and the priority value of the new security tunnel is established.
在本发明实施例中， 通过在未查找到对应的隧道标识， 则确定存在未被 使用的安全隧道， 通过未被使用的安全隧道传输数据包， 并建立优先级值和 未被使用的安全隧道的隧道标识之间的对应关系， 使得基站和安全网关在建 立了安全隧道之后， 可以不用建立优先级值和新建立的安全隧道的隧道标识 之间的对应关系， 而是等到在传输数据包时， 确定存在未被使用的安全隧道 时， 建立优先级值和未被使用的安全隧道的隧道标识之间的对应关系。  In the embodiment of the present invention, by not finding the corresponding tunnel identifier, it is determined that there is an unused security tunnel, the data packet is transmitted through the unused secure tunnel, and the priority value and the unused security tunnel are established. Correspondence between the tunnel identifiers, so that the base station and the security gateway do not need to establish a correspondence between the priority value and the tunnel identifier of the newly established security tunnel after establishing the security tunnel, but wait until the data packet is transmitted. And determining the correspondence between the priority value and the tunnel identifier of the unused security tunnel when there is an unused security tunnel.
同时， 基站在接收到安全网关通过安全隧道传输的下行数据包之后， 可 以获取下行数据包的优先级值， 并建立优先级值和接收到该数据包的安全隧 道的隧道标识之间的对应关系， 然后转发该下行数据包。  At the same time, after receiving the downlink data packet transmitted by the security gateway through the secure tunnel, the base station can obtain the priority value of the downlink data packet, and establish a correspondence between the priority value and the tunnel identifier of the security tunnel that receives the data packet. And then forward the downstream packet.
在本发明实施例提供的数据包传输方法中， 安全网关可以在查找到隧道 标识后， 将查找到的隧道标识和优先级值之间的对应关系向宽带策略控制架 构设备发送， 以便于宽带策略控制架构设备向 BPCF设备发送给对应关系。 参见图 12, 图 12是本发明实施例十一提供的数据包传输方法的流程图。 本发明实施例提供的数据包传输方法包括：  In the data packet transmission method provided by the embodiment of the present invention, after the tunnel identifier is found, the security gateway may send the correspondence between the found tunnel identifier and the priority value to the broadband policy control architecture device, so as to facilitate the broadband policy. The control architecture device sends the correspondence to the BPCF device. Referring to FIG. 12, FIG. 12 is a flowchart of a data packet transmission method according to Embodiment 11 of the present invention. The data packet transmission method provided by the embodiment of the present invention includes:
1201、 接收基站通过安全隧道发送的上行数据包。  1201. Receive an uplink data packet sent by a base station through a secure tunnel.
在本发明实施例中， 基站和安全网关之间可以在基站上电时预先建立一 条安全隧道。 安全网关可以接收基站通过安全隧道发送的上行数据包。 具体的，基站获取上行数据包中内层 IP包的优先级值以及外层 IP包的优 先级值。 在本发明实施例中， 上行数据包在传输过程中外层 IP包的优先级值可能 发生改变， 而内层 IP包的优先级值是保持不变的。 In the embodiment of the present invention, a secure tunnel may be established in advance between the base station and the security gateway when the base station is powered on. The security gateway can receive uplink data packets sent by the base station through the secure tunnel. Specifically, the base station acquires a priority value of an inner layer IP packet in the uplink data packet and a priority value of the outer layer IP packet. In the embodiment of the present invention, the priority value of the outer IP packet may change during the transmission of the uplink data packet, and the priority value of the inner IP packet remains unchanged.
1203、建立安全隧道的隧道标识和内层 IP包的优先级值之间的对应关系， 以及建立安全隧道的隧道标识和外层 IP包的优先级值之间的对应关系。  1203. The correspondence between the tunnel identifier of the security tunnel and the priority value of the inner IP packet, and the correspondence between the tunnel identifier of the secure tunnel and the priority value of the outer IP packet.
基站在建立上述对应关系完成后， 可以转发该下行数据包， 并获得需要 转发的下行数据包。  After completing the foregoing correspondence, the base station may forward the downlink data packet and obtain a downlink data packet that needs to be forwarded.
1204、 获得需要传输的下行数据包的优先级值。  1204. Obtain a priority value of a downlink data packet that needs to be transmitted.
1205、 根据优先级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至少一个隧道标识。  1205. Search, according to the priority value, a correspondence between the set priority value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier.
其中，本发明实施例中步骤 1204-1205的执行过程和上述实施例中的步骤 801-802类似， 在此不再重复描述。  The execution process of the steps 1204-1205 in the embodiment of the present invention is similar to the steps 801-802 in the foregoing embodiment, and the description is not repeated here.
在本发明实施例中， 安全网关通过查找到的隧道标识对应的安全隧道向 安全网关传输下行数据包的步骤（上述步骤 803 )具体可以包括：  In the embodiment of the present invention, the step of the security gateway transmitting the downlink data packet to the security gateway by the security tunnel corresponding to the discovered tunnel identifier (the foregoing step 803) may specifically include:
1206、 根据隧道标识和内层 IP包的优先级值之间的对应关系、 以及安全 隧道的隧道标识和外层 IP包的优先级值之间的对应关系， 以及下行数据包的 内层 IP包的优先级值查找到下行数据包的外层 IP包的优先级值和对应的隧道 标识。  1206. Corresponding relationship between the tunnel identifier and the priority value of the inner IP packet, and the correspondence between the tunnel identifier of the security tunnel and the priority value of the outer IP packet, and the inner IP packet of the downlink data packet. The priority value finds the priority value of the outer IP packet of the downlink packet and the corresponding tunnel identifier.
具体的， 安全网关首先根据下行数据包的内层 IP包的优先级值查找隧道 标识和内层 IP包的优先级值之间的对应关， 获得隧道标识， 进而根据之前查 找到的隧道标识查找安全隧道的隧道标识和外层 IP包的优先级值之间的对应 关系， 获得下行数据包的外层 IP包的优先级值。  Specifically, the security gateway first searches for the correspondence between the tunnel identifier and the priority value of the inner layer IP packet according to the priority value of the inner IP packet of the downlink data packet, obtains the tunnel identifier, and further searches according to the previously found tunnel identifier. The correspondence between the tunnel identifier of the security tunnel and the priority value of the outer IP packet obtains the priority value of the outer IP packet of the downlink data packet.
1207、将下行数据包的外层 IP包的优先级值作为上行数据包的优先级值。 在本发明实施例中， 基站将下行数据包的外层 IP包的优先级值作为下行 数据包的优先级值。 具体的， 基站可以将下行数据包的外层 IP包的优先级值 更新为查找到的优先级值。  1207. The priority value of the outer IP packet of the downlink data packet is used as the priority value of the uplink data packet. In the embodiment of the present invention, the base station uses the priority value of the outer IP packet of the downlink data packet as the priority value of the downlink data packet. Specifically, the base station may update the priority value of the outer IP packet of the downlink data packet to the found priority value.
1208、 将下行数据包通过查找到的隧道标识对应的安全隧道向基站传输。 在本发明实施例中， 由于外层 IP包的数据包优先级决定了数据在固网的 处理优先级， 因此安全网关将查找到的下行数据包的外层 IP包的优先级值作 为下行数据包的优先级值， 可以保证对于相同业务的下行数据包在固网设备 (例如 BRAS )的传输拥有和上行数据包相同的优先级，从而在固网设备做到 同一业务上下行传输的对称。 为更详细的理解本发明实施例， 下面给出本发明实施例提供的数据包传 输方法的具体应用场景。 1208. The downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier. In the embodiment of the present invention, since the data packet priority of the outer IP packet determines the processing priority of the data in the fixed network, the security gateway uses the priority value of the outer IP packet of the found downlink data packet as the downlink data. The priority value of the packet can guarantee that the downlink data packet for the same service is in the fixed network device. The transmission (e.g., BRAS) has the same priority as the upstream packet, so that the fixed network device performs the symmetry of the downlink transmission on the same service. For a more detailed understanding of the embodiments of the present invention, a specific application scenario of the data packet transmission method provided by the embodiment of the present invention is given below.
参见图 13 , 图 13是本发明实施例提供的数据包传输方法的应用场景图。 本发明实施例提供的数据包传输方法包括：  Referring to FIG. 13, FIG. 13 is an application scenario diagram of a data packet transmission method according to an embodiment of the present invention. The data packet transmission method provided by the embodiment of the present invention includes:
510、基站接收携带 QCI以及用户优先级或业务优先级的初始上下文建立 请求。  510. The base station receives an initial context setup request that carries the QCI and the user priority or service priority.
在本发明实施例中， 基站在建立用户设备的承载的过程中接收到初始上 下文建立请求， 用于建立初始上下文。其中， 初始上下文建立请求中携带 QCI 以及用户优先级或业务优先级， 本发明实施例中以用户优先级为例来说明。  In the embodiment of the present invention, the base station receives an initial context establishment request for establishing an initial context in the process of establishing a bearer of the user equipment. The initial context establishment request carries the QCI and the user priority or the service priority. The user priority is taken as an example in the embodiment of the present invention.
此外， 本发明实施例中基站在上电时， 已经和安全网关之间建立了一条 未被使用的安全隧道， 该安全隧道的隧道标识为 1A和 1B。 其中， 1A为安全 隧道的上行隧道标识， 1B为安全隧道的下行隧道标识。  In addition, in the embodiment of the present invention, when the base station is powered on, an unused security tunnel is established with the security gateway, and the tunnel identifiers of the security tunnel are 1A and 1B. 1A is the uplink tunnel identifier of the security tunnel, and 1B is the downlink tunnel identifier of the security tunnel.
在本发明实施例中， 隧道标识具体可以为安全隧道的安全参数索引 ( Security Parameter Index, SPI ) 。  In the embodiment of the present invention, the tunnel identifier may be specifically a Security Parameter Index (SPI) of the security tunnel.
511、 基站获取优先级值。  511. The base station acquires a priority value.
其中， 基站根据网络（固网和核心网 ) 间映射策略获取与 QCI对应的差 异化业务点码， 然后将用户优先级或业务优先级填充到转换差异化业务点码 的预留字段中， 将填充后的差异化业务点码作为优先级值。  The base station obtains the differentiated service point code corresponding to the QCI according to the mapping policy between the network (the fixed network and the core network), and then fills the user priority or the service priority into the reserved field of the converted differentiated service point code, and The populated differentiated service point code is used as the priority value.
在本发明实施例中， 需要填充的信息以用户优先级为例来说明， QCI对 应的差异化业务点码为 1 , 用户优先级为金牌， 标记为 1 , 则基站获得的差异 化业务点码具体可以为：  In the embodiment of the present invention, the information to be filled is illustrated by taking the user priority as an example. The differentiated service point code corresponding to the QCI is 1, and the user priority is the gold medal, and the flag is 1, and the differentiated service point code obtained by the base station is obtained. Specifically, it can be:
0 1 2 3 4 5 6 7  0 1 2 3 4 5 6 7
+ + + + + + + + +  + + + + + + + + +
1 0 1 0 0 0 1 I CU I  1 0 1 0 0 0 1 I CU I
+ + + + + + + + +  + + + + + + + + +
其中， 0-1位标识用户优先级， 01标识金牌用户， 10标识 4艮牌用户， 11 标识铜牌用户。 2-5位标识差异化业务点码值， 0001标识差异化业务点码为 1。  Among them, 0-1 digits identify user priority, 01 identifies gold medal users, 10 identifies 4 plaque users, and 11 identifies bronze users. The 2-5 digits identify the differentiated service point code value, and the 0001 identifier differentiates the service point code to 1.
需要说明的是， 优先级值中的 CU字段也可以填充业务优先级。 例如， 1 标识是具有 interworking保证的 , 而 0标识是不具有 interworking保证的。 S 12、 基站向安全网关发送携带优先级值的通知消息。 It should be noted that the CU field in the priority value can also fill the service priority. For example, a 1 flag is an interworking guarantee, and a 0 flag is not an interworking guarantee. S12. The base station sends a notification message carrying a priority value to the security gateway.
513、 安全网关向基站发送携带优先级值的密钥交换请求消息。  513. The security gateway sends a key exchange request message carrying a priority value to the base station.
514、 基站向安全网关发送密钥交换响应消息， 建立安全隧道。  514. The base station sends a key exchange response message to the security gateway to establish a secure tunnel.
其中， 基站向安全网关发送密钥交换响应消息后， 基站和安全网关之间 的安全隧道建立完成， 建立的安全隧道的隧道标识为 2A、 2B。 其中， 2A为 上行安全隧道的标识， 2B为下行安全隧道的标识。  After the base station sends a key exchange response message to the security gateway, the establishment of the secure tunnel between the base station and the security gateway is completed, and the tunnel identifier of the established security tunnel is 2A and 2B. 2A is the identifier of the uplink security tunnel, and 2B is the identifier of the downlink security tunnel.
515、 基站建立隧道标识和优先级值之间的对应关系。  515. The base station establishes a correspondence between the tunnel identifier and the priority value.
在本发明实施例中， 基站中隧道标识和优先级值之间的对应关系可以如 表 4所示。  In the embodiment of the present invention, the correspondence between the tunnel identifier and the priority value in the base station may be as shown in Table 4.
Figure imgf000025_0001
Figure imgf000025_0001
表 4  Table 4
其中， 上表中还存一条未被使用的安全隧道， 该安全隧道的隧道标识为 1A/1B。  The above table also contains an unused security tunnel. The tunnel ID of the security tunnel is 1A/1B.
S16、 基站将上述对应关系向移动性管理实体发送。  S16. The base station sends the foregoing correspondence to the mobility management entity.
具体的， 基站将上述对应关系通过 S1建立消息向移动性管理实体发送。 移动性管理实体将该 S1建立消息向分组数据网络网关（ Packed Data Network Gateway, PDNGW )发送。 PDN GW通过 Gx接口发送给 PCRF。 PCRF通过 S9*接口将隧道标识和聚合的 QoS要求发送给 BPCF, BPCF将隧道标识和聚 合的传给固网中的 BRAS, BRAS在接收到隧道标识和承载的 QCI之间的对 应关系以及聚合的 QoS要求之后， 直接根据隧道标识对安全隧道中的数据包 进行处理， 而不管 BRAS接收到的 IP数据包外层 IP包的 DSCP值是否改变， 都不会影响 BRAS对 IP数据包的处理。 BRAS可以根据聚合的 QoS要求对每 个安全隧道传输的数据包做 QoS的控制。  Specifically, the base station sends the foregoing correspondence to the mobility management entity by using an S1 setup message. The mobility management entity sends the S1 setup message to a Packed Data Network Gateway (PDNGW). The PDN GW is sent to the PCRF through the Gx interface. The PCRF sends the tunnel identification and the QoS requirements of the aggregation to the BPCF through the S9* interface. The BPCF transmits the tunnel identifier and the aggregation to the BRAS in the fixed network. The BRAS receives the correspondence between the tunnel identifier and the bearer QCI and the aggregation. After the QoS requirement, the data packet in the security tunnel is directly processed according to the tunnel identifier, and whether the DSCP value of the outer IP packet of the IP data packet received by the BRAS changes, the BRAS does not affect the processing of the IP data packet. The BRAS can control the QoS of each secure tunneled packet according to the aggregated QoS requirements.
在本发明实施例中， H(e)NB 和 SeGW之间的安全隧道的更新， 包括安全 隧道的创建、删除、更新（例如由于 Ipsec生命期结束导致的隧道信息的更新 ) 导致上述对应关系发生更新， 则将更新的对应关系通过 S1建立消息向移动性 管理实体发送。 517、 基站接收用户设备的上行数据包。 In the embodiment of the present invention, the update of the security tunnel between the H(e)NB and the SeGW includes the creation, deletion, and update of the security tunnel (for example, the update of the tunnel information due to the end of the Ipsec lifetime), causing the foregoing relationship to occur. Update, the updated correspondence is sent to the mobility management entity through the S1 setup message. 517. The base station receives an uplink data packet of the user equipment.
具体的， 基站接收用户设备发送的上行 IP数据包。  Specifically, the base station receives an uplink IP data packet sent by the user equipment.
518、 基站获取上行数据包的优先级值。  518. The base station acquires a priority value of the uplink data packet.
在本发明实施例中，上行数据包的内层 IP包的优先级值和外层 IP包的优 先级值是相同的。 基站可以获取上行数据包的内层 IP包的优先级值， 也可以 获取上行数据包的外层 IP包的优先级值。  In the embodiment of the present invention, the priority value of the inner layer IP packet of the uplink data packet and the priority value of the outer layer IP packet are the same. The base station can obtain the priority value of the inner IP packet of the uplink data packet, and can also obtain the priority value of the outer IP packet of the uplink data packet.
在本发明实施例中， 该上行数据包的优先级值具体为 0001。  In the embodiment of the present invention, the priority value of the uplink data packet is specifically 0001.
519、基站根据获取的优先级值查询设置的优先级值和隧道标识之间的对 应关系。  519. The base station queries, according to the obtained priority value, a correspondence relationship between the set priority value and the tunnel identifier.
具体的， 基站根据步骤 S18 中获取的优先级值查询上^十应关系， 获取 对应的隧道标识。在本发明实施例中，基站根据 0001查找到对应的隧道标识， 具体为 2A/2B。  Specifically, the base station queries the upper ten relationship according to the priority value obtained in step S18, and obtains the corresponding tunnel identifier. In the embodiment of the present invention, the base station searches for a corresponding tunnel identifier according to 0001, which is specifically 2A/2B.
520、 基站通过 2A对应的上行安全隧道向安全网关发送该上行数据包。 具体的， 基站通过 2A对应的上行安全隧道向安全网关发送该上行数据 包， 安全网关通过 2A对应的安全隧道接收基站发送的上行数据包。  520. The base station sends the uplink data packet to the security gateway by using an uplink secure tunnel corresponding to the 2A. Specifically, the base station sends the uplink data packet to the security gateway by using the uplink secure tunnel corresponding to the 2A, and the security gateway receives the uplink data packet sent by the base station by using the secure tunnel corresponding to the 2A.
在本发明实施例中， 由于优先级值中包含了用户优先级， 固网中的设备， 例如 BRAS在遇到拥塞时， 优先处理金牌用户的数据包。  In the embodiment of the present invention, since the priority value includes the user priority, devices in the fixed network, such as the BRAS, preferentially process the data packets of the gold medal user when encountering congestion.
521、 安全网关获取上行数据包的优先级值， 建立接收到上行数据包的安 全隧道的隧道标识和上行数据包的优先级值之间的对应关系。  521. The security gateway obtains a priority value of the uplink data packet, and establishes a correspondence between a tunnel identifier of the security tunnel that receives the uplink data packet and a priority value of the uplink data packet.
具体的， 安全网关在首次接收某条安全隧道发送的上行数据包之后， 获 取上行数据包的优先级值 0001 以及安全隧道的隧道标识 2A, 然后建立安全 隧道的上下行隧道标识 2A、 2B和优先级值之间的对应关系。 此外， 在基站和 安全网关之间的安全隧道发生更新时， 上述优先级值和需要更新的隧道标识 之间的对应关系应该继承到新的安全隧道。  Specifically, after receiving the uplink data packet sent by a certain security tunnel for the first time, the security gateway obtains the priority value 0001 of the uplink data packet and the tunnel identifier 2A of the security tunnel, and then establishes the uplink and downlink tunnel identifiers 2A, 2B and priority of the security tunnel. The correspondence between the level values. In addition, when the security tunnel between the base station and the security gateway is updated, the correspondence between the priority value and the tunnel identifier to be updated should be inherited to the new secure tunnel.
在本发明实施例中， 安全网关中隧道标识和优先级值之间的对应关系可 以如表 5所示。  In the embodiment of the present invention, the correspondence between the tunnel identifier and the priority value in the security gateway may be as shown in Table 5.
Figure imgf000026_0001
表 5
Figure imgf000026_0001
table 5
S22、 安全网关转发该上行数据包。  S22. The security gateway forwards the uplink data packet.
其中， 安全网关可以向核心网 （例如基站网关、 分组数据网络网关）转 发该上行数据包。  The security gateway may forward the uplink data packet to a core network (for example, a base station gateway, a packet data network gateway).
S23、 安全网关向 PCRF发送上述对应关系。  S23. The security gateway sends the foregoing correspondence to the PCRF.
具体的， 安全网关 SeGW上保存的对应关系通过 S16接口发送 /同步给 PCRF。 PCRF将上述关系转化成 QCI值和隧道标识之间的对应关系并保存。 其中， PCRF上保存有移动运营商和固网运营商之间协商好的优先级值和 QCI 值的对应关系。  Specifically, the corresponding relationship saved on the security gateway SeGW is sent/synchronized to the PCRF through the S16 interface. The PCRF converts the above relationship into a correspondence between the QCI value and the tunnel identifier and saves it. The PCRF stores the correspondence between the priority value and the QCI value negotiated between the mobile operator and the fixed network operator.
此外，在用户设备发起承载建立的过程， PCRF将承载的 QoS要求（ QCI, ARP, 带宽等 )进行汇聚， 变成家庭基站粒度的 QoS需求。 PCRF在对 SeGW 发送的对应关系进行转换后， 通过 S9*接口将包括隧道标识和承载的 QCI之 间的对应关系以及聚合的 QoS要求发送给 BPCF , BPCF将该对应关系以及 QoS要求发送给 BRAS。 BRAS在接收到隧道标识和承载的 QCI之间的对应 关系以及聚合的 QoS要求之后， 直接根据隧道标识对安全隧道中的数据包进 行处理， 而不管 BRAS接收到的 IP数据包外层 IP包的 DSCP值是否改变，都 不会影响 BRAS对 IP数据包的处理。 BRAS可以根据聚合的 QoS要求对每个 安全隧道传输的数据包做 QoS的控制。  In addition, in the process of the bearer establishment initiated by the user equipment, the PCRF aggregates the QoS requirements (QCI, ARP, bandwidth, etc.) of the bearer to become the QoS requirement of the granularity of the home base station. After converting the correspondence sent by the SeGW, the PCRF sends the correspondence between the tunnel identifier and the carried QCI and the aggregated QoS request to the BPCF through the S9* interface, and the BPCF sends the correspondence and the QoS requirement to the BRAS. After receiving the correspondence between the tunnel identifier and the carried QCI and the aggregated QoS requirements, the BRAS directly processes the data packet in the security tunnel according to the tunnel identifier, regardless of the outer IP packet of the IP data packet received by the BRAS. Whether the DSCP value changes will not affect the BRAS's processing of IP packets. The BRAS can control the QoS of each secure tunneled packet according to the aggregated QoS requirements.
在本发明实施例中， H(e)NB 和 SeGW之间的安全隧道的更新， 包括安全 隧道的创建、删除、更新（例如由于 Ipsec生命期结束导致的隧道信息的更新 ) 导致上述对应关系发生更新， 则安全网关将更新的对应关系向 PCRF发送， 以便于实现固网的 QoS保障。  In the embodiment of the present invention, the update of the security tunnel between the H(e)NB and the SeGW includes the creation, deletion, and update of the security tunnel (for example, the update of the tunnel information due to the end of the Ipsec lifetime), causing the foregoing relationship to occur. After the update, the security gateway sends the updated correspondence to the PCRF to facilitate the QoS guarantee of the fixed network.
524、 安全网关接收下行数据包， 获取下行数据包的优先级值。  524. The security gateway receives the downlink data packet, and obtains a priority value of the downlink data packet.
具体的， 安全网关可以接收用户设备的下行数据包， 获取下行数据包的 优先级值。 在本发明实施例中， 用户设备的下行数据包的优先级值和上行数 据包的优先级值相等， 均为 0001。  Specifically, the security gateway can receive the downlink data packet of the user equipment, and obtain the priority value of the downlink data packet. In the embodiment of the present invention, the priority value of the downlink data packet of the user equipment is equal to the priority value of the uplink data packet, and all are 0001.
525、 安全网关根据获取的下行数据包的优先级值查找上述对应关系， 获 得对应的隧道标识。  525. The security gateway searches for the corresponding relationship according to the obtained priority value of the downlink data packet, and obtains a corresponding tunnel identifier.
具体的， 安全网关根据 0001查找到对应的隧道标识为 2B。  Specifically, the security gateway finds that the corresponding tunnel identifier is 2B according to 0001.
526、 安全网关通过 2B对应的安全隧道向基站发送该下行数据包。 基站在接收到安全网关发送的下行数据包之后， 向用户设备转发该下行 数据包。 526. The security gateway sends the downlink data packet to the base station by using a secure tunnel corresponding to the 2B. After receiving the downlink data packet sent by the security gateway, the base station forwards the downlink data packet to the user equipment.
在本发明实施例提供的数据包传输方法中， BRAS接收到的对应关系中的 优先级值中还包括用户优先级或业务优先级， 可以使得 BRAS根据不同的隧 道标识区分不同等级用户或不同等级业务对应的 IP数据包， 进而对不同安全 隧道中的安全数据包执行不同的处理， 例如发生网络拥塞时， 优先转发金牌 用户的数据包或优先转发具有 Interworking保证的数据包。  In the data packet transmission method provided by the embodiment of the present invention, the priority value in the correspondence relationship received by the BRAS further includes a user priority or a service priority, which may enable the BRAS to distinguish different levels of users or different levels according to different tunnel identifiers. The IP packets corresponding to the service perform different processing on the security packets in different security tunnels. For example, when network congestion occurs, the data packets of the gold card users are preferentially forwarded or the packets with Interworking guarantee are preferentially forwarded.
以上对本发明实施例提供的数据包传输方法进行了详细介绍。 本发明实 施例还提供和上述方法对应的基站和安全网关。 参见图 14, 图 14是本发明实施例十二提供的基站的结构示意图。  The data packet transmission method provided by the embodiment of the present invention is described in detail above. Embodiments of the present invention also provide a base station and a security gateway corresponding to the above methods. Referring to FIG. 14, FIG. 14 is a schematic structural diagram of a base station according to Embodiment 12 of the present invention.
本发明实施例提供的基站， 包括：  The base station provided by the embodiment of the present invention includes:
第一优先级获取单元 11 , 用于获得需要传输的上行数据包的优先级值； 第一对应关系查找单元 12,用于根据第一优先级获取单元 11获得的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The first priority obtaining unit 11 is configured to obtain a priority value of the uplink data packet that needs to be transmitted. The first correspondence relationship searching unit 12 is configured to search for the priority of the priority value according to the priority value obtained by the first priority acquiring unit 11. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
上行数据发送单元 13 ,用于在第一对应关系查找单元 12查找到对应的隧 道标识时， 通过查找到的隧道标识对应的安全隧道向安全网关传输所述上行 数据包。  The uplink data sending unit 13 is configured to: when the first correspondence search unit 12 finds the corresponding tunnel identifier, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
本发明实施例提供的基站可以使用在前述对应的方法实施例一中， 详情 参见上述实施例一的描述， 在此不再重复。  The base station provided by the embodiment of the present invention can be used in the foregoing first embodiment of the method. For details, refer to the description of the first embodiment, which is not repeated here.
在本发明实施例提供的基站根据上行数据包的优先级值获取对应的安全 隧道的隧道标识， 由于每个优先级值对应至少一个隧道标识， 则基站可以将 上行数据包通过多个安全隧道进行传输， 进而使得安全网关在接收到数据包 后， 对每个安全隧道接收到的数据包单独进行抗重放处理， 因而减少了重放 数据包的数量， 进而可以降低丟包的概率。  The base station provided by the embodiment of the present invention obtains the tunnel identifier of the corresponding security tunnel according to the priority value of the uplink data packet. Since each priority value corresponds to at least one tunnel identifier, the base station may perform the uplink data packet through multiple secure tunnels. The transmission, after receiving the data packet, separately performs anti-replay processing on the data packets received by each security tunnel, thereby reducing the number of playback data packets, thereby reducing the probability of packet loss.
进一步的， 本发明实施例提供的基站还可以包括：  Further, the base station provided by the embodiment of the present invention may further include:
第二隧道建立单元 14,用于在所述第一优先级获取单元 11获得需要传输 的上行数据包的优先级值之前， 在上电时向安全网关发送至少两次密钥交换 请求消息， 接收返回的密钥交换响应消息， 以与安全网关建立至少两条安全 隧道。 The second tunnel establishing unit 14 is configured to send at least two key exchanges to the security gateway at the time of power-on before the first priority acquiring unit 11 obtains the priority value of the uplink data packet to be transmitted. The request message receives the returned key exchange response message to establish at least two secure tunnels with the security gateway.
关于该基站的其他结构和功能可以参见上述的方法实施例。  For other structures and functions of the base station, reference may be made to the above method embodiments.
参见图 15 , 图 15是本发明实施例十三提供的基站的结构示意图。  Referring to FIG. 15, FIG. 15 is a schematic structural diagram of a base station according to Embodiment 13 of the present invention.
本发明实施例提供的基站， 包括：  The base station provided by the embodiment of the present invention includes:
第一隧道建立单元 21 ,用于在第一优先级获取单元 23获得需要传输的上 行数据包的优先级值之前， 在上电时向安全网关发送携带所述优先级值的密 钥交换请求消息， 接收返回的密钥交换响应消息， 以与安全网关建立至少一 条安全隧道； 或者  The first tunnel establishing unit 21 is configured to send a key exchange request message carrying the priority value to the security gateway at the time of power-on before the first priority acquiring unit 23 obtains the priority value of the uplink data packet to be transmitted. Receiving a returned key exchange response message to establish at least one secure tunnel with the security gateway; or
接收携带服务质量等级标识的无线承载建立请求或初始上下文建立请 求， 获取与所述服务质量等级标识对应的优先级值， 向所述安全网关发送携 带所述优先级值或服务质量等级标识的通知消息， 接收安全网关发送的携带 所述优先级值的密钥交换请求消息， 向所述安全网关返回密钥交换响应消息， 以与安全网关建立至少一条安全隧道； 或者  Receiving a radio bearer setup request or an initial context setup request that carries the quality of service level identifier, obtaining a priority value corresponding to the quality of service level identifier, and transmitting, to the security gateway, a notification that carries the priority value or the quality of service level identifier Receiving, by the security gateway, a key exchange request message carrying the priority value, and returning a key exchange response message to the security gateway to establish at least one secure tunnel with the security gateway; or
接收携带服务质量等级标识的无线承载建立请求或初始上下文建立请 求， 获取与所述服务质量等级标识对应的优先级值， 向安全网关发送携带所 述优先级值或服务质量等级标识的密钥交换请求消息， 接收返回的密钥交换 响应消息， 以与安全网关建立至少一条安全隧道；  Receiving a radio bearer setup request or an initial context setup request that carries a quality of service level identifier, obtaining a priority value corresponding to the quality of service level identifier, and sending a key exchange carrying the priority value or the quality of service level identifier to the security gateway. Receiving a message, receiving a returned key exchange response message, to establish at least one secure tunnel with the security gateway;
第一对应关系建立单元 22,用于建立第一优先级获取单元 23获得的优先 级值和第一隧道建立单元建立的 21至少一条安全隧道的隧道标识之间的对应 关系；  The first correspondence establishing unit 22 is configured to establish a correspondence between the priority value obtained by the first priority acquiring unit 23 and the tunnel identifier of the at least one security tunnel established by the first tunnel establishing unit;
第一优先级获取单元 23 , 用于获得需要传输的上行数据包的优先级值； 第一对应关系查找单元 24,用于根据第一优先级获取单元 23获取的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The first priority obtaining unit 23 is configured to obtain a priority value of the uplink data packet to be transmitted, and the first correspondence relationship searching unit 24 is configured to search for the priority of the setting according to the priority value acquired by the first priority acquiring unit 23 a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
上行数据发送单元 25 , 用于在查找到对应的隧道标识时， 则通过查找到 的隧道标识对应的安全隧道向安全网关传输上行数据包。  The uplink data sending unit 25 is configured to: when the corresponding tunnel identifier is found, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
本发明实施例提供的基站可以在前述对应的方法实施例四中， 详情参见 上述实施例的描述。 参见图 16, 图 16是本发明实施例十四提供的基站的结构示意图。 The base station provided by the embodiment of the present invention may be in the foregoing method embodiment 4 of the corresponding method. For details, refer to the description of the foregoing embodiment. Referring to FIG. 16, FIG. 16 is a schematic structural diagram of a base station according to Embodiment 14 of the present invention.
本发明实施例提供的基站， 包括：  The base station provided by the embodiment of the present invention includes:
第一优先级获取单元 31 , 用于获得需要传输的上行数据包的优先级值； 第一对应关系查找单元 32,用于根据第一优先级获取单元 31获得的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The first priority obtaining unit 31 is configured to obtain a priority value of the uplink data packet to be transmitted; the first correspondence relationship searching unit 32 is configured to search for the priority of the priority value according to the priority value obtained by the first priority acquiring unit 31. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
上行数据发送单元 33 , 用于在查找到对应的隧道标识时， 则通过查找到 的隧道标识对应的安全隧道向安全网关传输上述上行数据包。  The uplink data sending unit 33 is configured to: when the corresponding tunnel identifier is found, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
第三隧道建立单元 34, 用于在未查找到对应的隧道标识， 则向所述安全 网关发送密钥交换请求消息， 接收所述安全网关返回的密钥交换响应消息， 以与安全网关建立新的安全隧道；  The third tunnel establishing unit 34 is configured to send a key exchange request message to the security gateway after receiving the corresponding tunnel identifier, and receive a key exchange response message returned by the security gateway to establish a new with the security gateway. Safe tunnel
所述上行数据发送单元 33还用于通过第三隧道建立单元 34建立的新的 安全隧道向所述安全网关传输所述上行数据包；  The uplink data sending unit 33 is further configured to transmit the uplink data packet to the security gateway by using a new secure tunnel established by the third tunnel establishing unit 34;
第二对应关系建立单元 35 ,用于建立第三隧道建立单元 34建立的新的安 的隧道标识和第一优先 本发明实施例提供的基站可以在前述对应的方法实施例二中， 详情参见 上述实施例的描述。 参见图 17, 图 17是本发明实施例十五提供的基站的结构示意图。  The second correspondence relationship establishing unit 35 is configured to establish a new tunnel identifier and the first priority established by the third tunnel establishing unit 34. The base station provided by the embodiment of the present invention may be in the foregoing corresponding method embodiment 2. Description of the embodiments. Referring to FIG. 17, FIG. 17 is a schematic structural diagram of a base station according to Embodiment 15 of the present invention.
本发明实施例提供的基站， 包括：  The base station provided by the embodiment of the present invention includes:
第一优先级获取单元 41 , 用于获得需要传输的上行数据包的优先级值； 第一对应关系查找单元 42,用于根据第一优先级获取单元 41获取的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The first priority obtaining unit 41 is configured to obtain a priority value of the uplink data packet to be transmitted; the first correspondence relationship searching unit 42 is configured to search for the priority of the setting according to the priority value acquired by the first priority acquiring unit 41. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
上行数据发送单元 43 , 用于在查找到对应的隧道标识时， 则通过查找到 的隧道标识对应的安全隧道向安全网关传输所述上行数据包。  The uplink data sending unit 43 is configured to: when the corresponding tunnel identifier is found, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the discovered tunnel identifier.
隧道判断单元 44, 用于在未查找到对应的隧道标识时， 确定存在未被使 用的安全隧道； 所述上行数据发送单元 43还用于在隧道判断单元 44确定存在未被使用 的安全隧道时， 通过该未被使用的安全隧道向所述安全网关传输上行数据包； 第三对应关系建立单元 45 ,用于建立隧道判断单元 44确定的未被使用的 安全隧道的隧道标识和第一优先级获取单元 41获得的优先级值之间的对应关 系。 The tunnel judging unit 44 is configured to determine that there is a secure tunnel that is not used when the corresponding tunnel identifier is not found; The uplink data sending unit 43 is further configured to: when the tunnel determining unit 44 determines that there is a secure tunnel that is not used, transmit the uplink data packet to the security gateway by using the unused secure tunnel; the third correspondence relationship establishing unit 45 And a correspondence between the tunnel identifier of the unused security tunnel determined by the tunnel judging unit 44 and the priority value obtained by the first priority acquiring unit 41.
进一步的， 本发明实施例提供的基站还可以包括：  Further, the base station provided by the embodiment of the present invention may further include:
隧道判断单元 44, 用于在未查找到对应的隧道标识时， 确定不存在未被 使用的安全隧道；  The tunnel judging unit 44 is configured to determine that there is no unused security tunnel when the corresponding tunnel identifier is not found;
第四隧道建立单元 46,用于在隧道判断单元 44确定不存在未被使用的安 全隧道时， 向所述安全网关发送密钥交换请求消息， 接收所述安全网关返回 的密钥交换响应消息， 以与安全网关建立新的安全隧道， 通过所述新的安全 隧道向所述安全网关传输所述上行数据包；  The fourth tunnel establishing unit 46 is configured to: when the tunnel determining unit 44 determines that there is no unused secure tunnel, send a key exchange request message to the security gateway, and receive a key exchange response message returned by the security gateway, Establishing a new secure tunnel with the security gateway, and transmitting the uplink data packet to the security gateway by using the new secure tunnel;
第三对应关系建立单元 45还用于建立第四隧道建立单元 46建立的新的 安全隧道的隧道标识和第一优先级获取单元 41获取的优先级值之间的对应关 系。  The third correspondence establishing unit 45 is further configured to establish a correspondence between the tunnel identifier of the new security tunnel established by the fourth tunnel establishing unit 46 and the priority value acquired by the first priority acquiring unit 41.
本发明实施例提供的基站可以在前述对应的方法实施例三中， 详情参见 上述实施例的描述。 参见图 18, 图 18是本发明实施例十六提供的基站的结构示意图。  The base station provided by the embodiment of the present invention may be in the foregoing third embodiment of the method. For details, refer to the description of the foregoing embodiment. Referring to FIG. 18, FIG. 18 is a schematic structural diagram of a base station according to Embodiment 16 of the present invention.
本发明实施例提供的基站， 包括：  The base station provided by the embodiment of the present invention includes:
第一优先级获取单元 51 , 用于获得需要传输的上行数据包的优先级值； 第一对应关系查找单元 52,用于根据第一优先级获取单元 51获取的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The first priority obtaining unit 51 is configured to obtain a priority value of the uplink data packet to be transmitted; the first correspondence relationship searching unit 52 is configured to search for the priority of the setting according to the priority value acquired by the first priority acquiring unit 51. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
上行数据发送单元 53 , 用于在查找到对应的隧道标识时， 则通过查找到 的隧道标识对应的安全隧道向安全网关传输所述上行数据包。  The uplink data sending unit 53 is configured to: when the corresponding tunnel identifier is found, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the discovered tunnel identifier.
第一接收单元 54,用于在第一优先级获取单元 51获得需要传输的上行数 据包的优先级值之前， 接收安全网关通过安全隧道发送的下行数据包；  The first receiving unit 54 is configured to receive, after the first priority acquiring unit 51 obtains the priority value of the uplink data packet to be transmitted, the downlink data packet sent by the security gateway through the secure tunnel;
上述第一优先级获取单元 51还用于获取第一接收单元 54接收的下行数 据包的优先级值； 第四对应关系建立单元 55 ,用于建立第一优先级获取单元 51获取的优先 级值和安全隧道的隧道标识之间的对应关系； The first priority obtaining unit 51 is further configured to acquire a priority value of the downlink data packet received by the first receiving unit 54; The fourth correspondence establishing unit 55 is configured to establish a correspondence between the priority value acquired by the first priority acquiring unit 51 and the tunnel identifier of the security tunnel;
第一转发单元 56, 用于转发第一接收单元 54接收的下行数据包。  The first forwarding unit 56 is configured to forward the downlink data packet received by the first receiving unit 54.
本发明实施例提供的基站可以在前述对应的方法实施例六中， 详情参见 上述实施例的描述。 以上对本发明实施例提供的基站进行了详细介绍， 本发明实施例还提供 相应的安全网关实施例。  The base station provided by the embodiment of the present invention may be in the foregoing corresponding method embodiment 6. For details, refer to the description of the foregoing embodiment. The base station provided by the embodiment of the present invention is described in detail above. The embodiment of the present invention further provides a corresponding security gateway embodiment.
参见图 19, 图 19是本发明实施例十七提供的安全网关的结构示意图。 本发明实施例提供的安全网关包括：  Referring to FIG. 19, FIG. 19 is a schematic structural diagram of a security gateway according to Embodiment 17 of the present invention. The security gateway provided by the embodiment of the present invention includes:
第二优先级获取单元 61 , 用于获得需要传输的下行数据包的优先级值； 第二对应关系查找单元 62,用于根据第二优先级获取单元 61获得的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The second priority obtaining unit 61 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 62 is configured to search for the priority of the priority value according to the priority value obtained by the second priority acquiring unit 61. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
下行数据发送单元 63 ,用于在第二对应关系查找单元 62查找到对应的隧 道标识时， 则通过查找到的隧道标识对应的安全隧道向基站传输所述下行数 据包。  The downlink data sending unit 63 is configured to: when the second correspondence search unit 62 finds the corresponding tunnel identifier, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
进一步的， 本发明实施例提供的安全网关还可以包括：  Further, the security gateway provided by the embodiment of the present invention may further include:
第五隧道建立单元 64,用于在所述第二优先级获取单元 61获得需要传输 的下行数据包的优先级值之前， 接收基站发送的携带优先级值的密钥交换请 求消息， 返回密钥交换响应消息， 以与基站建立至少一条安全隧道；  The fifth tunnel establishing unit 64 is configured to receive a key exchange request message carrying a priority value sent by the base station, and return a key before the second priority acquiring unit 61 obtains the priority value of the downlink data packet to be transmitted. Exchanging a response message to establish at least one secure tunnel with the base station;
第五对应关系建立单元 65 ,用于建立第二优先级获取单元 61获取的优先 级值和第五隧道建立单元 64建立的至少一条安全隧道的隧道标识之间的对应 关系。  The fifth correspondence establishing unit 65 is configured to establish a correspondence between the priority value acquired by the second priority acquiring unit 61 and the tunnel identifier of the at least one security tunnel established by the fifth tunnel establishing unit 64.
本发明实施例提供的安全网关可以使用在前述对应的方法实施例七中， 详情参见方法实施例的描述。  The security gateway provided by the embodiment of the present invention may be used in the foregoing corresponding method embodiment 7. For details, refer to the description of the method embodiment.
在本发明实施例提供安全网关根据下行数据包的优先级值获取对应的安 全隧道的隧道标识， 由于每个优先级值对应至少一个隧道标识， 则安全网关 可以将下行数据包通过多个安全隧道进行传输， 进而使得基站在接收到数据 包后， 对每个安全隧道接收到的数据包单独进行抗重放处理， 因而减少了重 放数据包的数量， 进而可以降低丟包的概率。 In the embodiment of the present invention, the security gateway obtains the tunnel identifier of the corresponding security tunnel according to the priority value of the downlink data packet. Since each priority value corresponds to at least one tunnel identifier, the security gateway may pass the downlink data packet through multiple security tunnels. Transmitting, so that the base station receives the data After the packet, the data packets received by each secure tunnel are separately subjected to anti-replay processing, thereby reducing the number of playback packets, thereby reducing the probability of packet loss.
进一步地， 对于以上所有实施例所述的安全隧道和优先级值之间的对应 关系， 当安全隧道所对应的安全关联的生命期到达最大而发生安全关联更新 的时候， 上述的安全隧道和数据包优先级的对应关系应该继承到新的安全隧 道也就是新的安全关联中。例如 SPI=1A对应的数据包优先级是 2,当 SPI=1A 对应的安全关联发生因为生命期的刷新的更新时， 新的安全关联标识也发生 更新是 SPI=1C,那 SPI=1C所对应的优先级值也应该等于 2。这个过程不需要 协商， 不需要信令交互， 是在相关节点上的一个自然的属性继承的过程。 参见图 20, 图 20是本发明实施例十八提供的安全网关的结构示意图。 本发明实施例提供的安全网关包括：  Further, for the correspondence between the security tunnel and the priority value described in all the foregoing embodiments, when the lifetime of the security association corresponding to the security tunnel reaches the maximum and the security association update occurs, the foregoing security tunnel and data The correspondence of packet priorities should be inherited to the new security tunnel, which is the new security association. For example, the priority of the packet corresponding to SPI=1A is 2. When the security association corresponding to SPI=1A occurs due to the refresh of the lifetime update, the new security association identifier is also updated to be SPI=1C, which corresponds to SPI=1C. The priority value should also be equal to 2. This process does not require negotiation, does not require signaling interaction, and is a natural attribute inheritance process on the relevant node. Referring to FIG. 20, FIG. 20 is a schematic structural diagram of a security gateway according to Embodiment 18 of the present invention. The security gateway provided by the embodiment of the present invention includes:
第二优先级获取单元 71 , 用于获得需要传输的下行数据包的优先级值； 第二对应关系查找单元 72,用于根据第二优先级获取单元 71获取的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The second priority obtaining unit 71 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 72 is configured to search for the priority of the setting according to the priority value acquired by the second priority acquiring unit 71. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
下行数据发送单元 73 , 用于在查找到对应的隧道标识时， 则通过查找到 的隧道标识对应的安全隧道向基站传输所述下行数据包。  The downlink data sending unit 73 is configured to: when the corresponding tunnel identifier is found, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
第一通知消息接收单元 74,用于在所述第二优先级获取单元 71获得需要 传输的下行数据包的优先级值之前， 接收基站网关发送的通知消息， 所述通 知消息中携带优先级值；  The first notification message receiving unit 74 is configured to receive, after the second priority acquiring unit 71 obtains the priority value of the downlink data packet to be transmitted, the notification message sent by the base station gateway, where the notification message carries the priority value. ;
第六隧道建立单元 75,用于向基站发送携带第一通知消息接收单元 74接 收到的所述优先级值的密钥交换请求消息， 接收返回的密钥交换响应消息， 以与基站建立至少一条安全隧道；  The sixth tunnel establishing unit 75 is configured to send a key exchange request message carrying the priority value received by the first notification message receiving unit 74 to the base station, and receive the returned key exchange response message to establish at least one with the base station. Safety tunnel
第六对应关系建立单元 76,用于建立所述第二优先级获取单元 71获取的 优先级值和第六隧道建立单元 75建立的至少一条安全隧道的隧道标识之间的 对应关系。  The sixth correspondence establishing unit 76 is configured to establish a correspondence between the priority value acquired by the second priority acquiring unit 71 and the tunnel identifier of the at least one security tunnel established by the sixth tunnel establishing unit 75.
本发明实施例提供的安全网关可以使用在前述对应的方法实施例十中， 详情参见上述方法实施例的描述， 在此不再重复。 参见图 21 , 图 21是本发明实施例十九提供的安全网关的结构示意图。 本发明实施例提供的安全网关包括： The security gateway provided by the embodiment of the present invention may be used in the foregoing corresponding method embodiment 10. For details, refer to the description of the foregoing method embodiment, which is not repeated here. Referring to FIG. 21, FIG. 21 is a schematic structural diagram of a security gateway according to Embodiment 19 of the present invention. The security gateway provided by the embodiment of the present invention includes:
第二优先级获取单元 81 , 用于获得需要传输的下行数据包的优先级值； 第二对应关系查找单元 82,用于根据第二优先级获取单元 81获取的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The second priority obtaining unit 81 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 82 is configured to search for the priority of the setting according to the priority value acquired by the second priority acquiring unit 81. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
下行数据发送单元 83 , 用于在查找到对应的隧道标识时， 则通过查找到 的隧道标识对应的安全隧道向基站传输所述下行数据包。  The downlink data sending unit 83 is configured to: when the corresponding tunnel identifier is found, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
第二通知消息接收单元 84,用于在所述第二优先级获取单元 81获得需要 传输的下行数据包的优先级值之前， 接收基站网关发送的通知消息， 所述通 知消息中携带服务质量等级标识；  The second notification message receiving unit 84 is configured to: before the second priority acquiring unit 81 obtains the priority value of the downlink data packet to be transmitted, receive a notification message sent by the base station gateway, where the notification message carries a quality of service level Identification
第七隧道建立单元 85 , 用于向基站发送携带上述第二通知消息接收单元 84接收的服务质量等级标识的密钥交换请求消息， 接收返回的密钥交换响应 消息， 以与基站建立至少一条安全隧道；  The seventh tunnel establishing unit 85 is configured to send, to the base station, a key exchange request message carrying the quality of service level identifier received by the second notification message receiving unit 84, and receive the returned key exchange response message to establish at least one security with the base station. Tunnel
第七对应关系建立单元 86, 用于获取与服务质量等级标识对应的优先级 值， 建立所述优先级值和第七隧道建立单元 85建立的至少一条安全隧道的隧 道标识之间的对应关系。  The seventh correspondence establishing unit 86 is configured to obtain a priority value corresponding to the QoS level identifier, and establish a correspondence between the priority value and a tunnel identifier of at least one security tunnel established by the seventh tunnel establishing unit 85.
本发明实施例提供的安全网关可以使用在前述对应的方法实施例十中， 详情参见上述方法实施例的描述， 在此不再重复。 参见图 22, 图 22是本发明实施例二十提供的安全网关的结构示意图。 本发明实施例提供的安全网关包括：  The security gateway provided by the embodiment of the present invention may be used in the foregoing corresponding method embodiment 10. For details, refer to the description of the foregoing method embodiment, which is not repeated here. Referring to FIG. 22, FIG. 22 is a schematic structural diagram of a security gateway according to Embodiment 20 of the present invention. The security gateway provided by the embodiment of the present invention includes:
第二优先级获取单元 91 , 用于获得需要传输的下行数据包的优先级值； 第二对应关系查找单元 92,用于根据第二优先级获取单元 91获取的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  The second priority obtaining unit 91 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 92 is configured to search for the priority of the setting according to the priority value acquired by the second priority acquiring unit 91. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
下行数据发送单元 93 , 用于在查找到对应的隧道标识时， 则通过查找到 的隧道标识对应的安全隧道向基站传输所述下行数据包。  The downlink data sending unit 93 is configured to: when the corresponding tunnel identifier is found, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
进一步的， 本发明实施例提供的安全网关还可以包括： 第八隧道建立单元 94,用于在第二对应关系查找单元 92没有查找到对应 的隧道标识时， 向基站发送密钥交换请求消息， 接收所述基站返回的密钥交 换响应消息， 以与基站建立新的安全隧道； Further, the security gateway provided by the embodiment of the present invention may further include: The eighth tunnel establishing unit 94 is configured to: when the second correspondence search unit 92 does not find the corresponding tunnel identifier, send a key exchange request message to the base station, and receive a key exchange response message returned by the base station, to Establish a new secure tunnel;
所述下行数据发送单元 93还用于通过第八隧道建立单元 94建立的新的 安全隧道向所述基站传输所述下行数据包；  The downlink data sending unit 93 is further configured to transmit the downlink data packet to the base station by using a new secure tunnel established by the eighth tunnel establishing unit 94;
第八对应关系建立单元 95 ,用于建立第八隧道建立单元 94建立的新的安 全隧道的隧道标识和第二优先级获取单元 91 获取的优先级值之间的对应关 系。  The eighth correspondence establishing unit 95 is configured to establish a correspondence between the tunnel identifier of the new security tunnel established by the eighth tunnel establishing unit 94 and the priority value acquired by the second priority acquiring unit 91.
本发明实施例提供的安全网关可以使用在前述对应的方法实施例十中， 详情参见上述方法实施例的描述， 在此不再重复。 参见图 23 , 图 23是本发明实施例二十一提供的安全网关的结构示意图。 本发明实施例提供的安全网关包括：  The security gateway provided by the embodiment of the present invention may be used in the foregoing corresponding method embodiment 10. For details, refer to the description of the foregoing method embodiment, which is not repeated here. Referring to FIG. 23, FIG. 23 is a schematic structural diagram of a security gateway according to Embodiment 21 of the present invention. The security gateway provided by the embodiment of the present invention includes:
第二优先级获取单元 110, 用于获得需要传输的下行数据包的优先级值； 第二对应关系查找单元 120,用于根据第二优先级获取单元 110获取的优 先级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应 至少一个隧道标识；  The second priority acquiring unit 110 is configured to obtain a priority value of the downlink data packet to be transmitted, and the second correspondence relationship searching unit 120 is configured to search for the priority of the setting according to the priority value acquired by the second priority acquiring unit 110. a correspondence between the value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
下行数据发送单元 130, 用于在查找到对应的隧道标识时， 则通过查找到 的隧道标识对应的安全隧道向基站传输所述下行数据包。  The downlink data sending unit 130 is configured to: when the corresponding tunnel identifier is found, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
第二接收单元 140,用于在第二优先级获取单元 110获得需要传输的下行 数据包的优先级值之前， 接收基站通过安全隧道发送的上行数据包；  The second receiving unit 140 is configured to receive an uplink data packet sent by the base station through the secure tunnel before the second priority acquiring unit 110 obtains the priority value of the downlink data packet to be transmitted.
所述第二优先级获取单元 110,还用于获取第二接收单元 140接收的上行 数据包的优先级值；  The second priority acquiring unit 110 is further configured to acquire a priority value of the uplink data packet received by the second receiving unit 140.
第九对应关系建立单元 150,用于建立第二优先级获取单元 110获取的优 先级值和所述安全隧道的隧道标识之间的对应关系；  The ninth correspondence establishing unit 150 is configured to establish a correspondence between the priority value obtained by the second priority acquiring unit 110 and the tunnel identifier of the security tunnel;
第二转发单元 160, 用于转发所述上行数据包。  The second forwarding unit 160 is configured to forward the uplink data packet.
本发明实施例提供的安全网关可以使用在前述对应的方法实施例十一 中， 详情参见上述方法实施例的描述， 在此不再重复。  The security gateway provided by the embodiment of the present invention may be used in the foregoing corresponding method embodiment XI. For details, refer to the description of the foregoing method embodiment, which is not repeated here.
需要说明的是， 上述基站和安全网关中各单元之间的信息交互、 执行过 程等内容， 由于与本发明方法实施例基于同一构思， 具体内容可参见本发明 方法实施例中的叙述， 此处不再赘述。 It should be noted that the information exchange, the execution process, and the like between the units in the foregoing base station and the security gateway are based on the same concept as the method embodiment of the present invention, and the specific content can be referred to the present invention. The description in the method embodiment is not described here.
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流 程， 是可以通过计算机程序来指令相关的硬件来完成， 的程序可存储于计算 机可读取存储介质中， 该程序在执行时， 可包括如上述各方法的实施例的流 程。其中， 的存储介质可为磁碟、光盘、只读存储记忆体（Read-Only Memory, ROM )或随机存储记忆体（Random Access Memory, RAM )等。  A person skilled in the art can understand that all or part of the processes in the above embodiments are implemented by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. The flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).
以上对本发明实施例提供的数据包传输方法和相关设备进行了详细介 绍， 对于本领域的一般技术人员， 依据本发明实施例的思想， 在具体实施方 式及应用范围上均会有改变之处， 本说明书内容不应理解为对本发明的限制。  The data packet transmission method and the related device provided by the embodiment of the present invention are described in detail above. For those skilled in the art, according to the idea of the embodiment of the present invention, there are changes in the specific implementation manner and application scope. The contents of this specification are not to be construed as limiting the invention.

Claims

权利 要求 书 Claim
1、 一种数据包传输方法， 其特征在于， 包括：  A data packet transmission method, comprising:
获得需要传输的上行数据包的优先级值；  Obtain a priority value of an upstream packet that needs to be transmitted;
根据所述优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识；  And determining, according to the priority value, a correspondence between the set priority value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧道向 安全网关传输所述上行数据包。  If the corresponding tunnel identifier is found, the uplink data packet is transmitted to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
2、 根据权利要求 1所述的方法， 其特征在于， 在所述获得需要传输的上 行数据包的优先级值之前， 还包括：  2. The method according to claim 1, wherein before the obtaining the priority value of the uplink data packet to be transmitted, the method further comprises:
在基站上电时向安全网关发送携带所述优先级值的密钥交换请求消息， 接收返回的密钥交换响应消息， 以与所述安全网关建立至少一条安全隧道， 并建立数据包优先级值和所述至少一条安全隧道的隧道标识之间的对应关 系； 或者  Sending, by the base station, a key exchange request message carrying the priority value to the security gateway, and receiving the returned key exchange response message, to establish at least one secure tunnel with the security gateway, and establishing a data packet priority value. Corresponding relationship with the tunnel identifier of the at least one secure tunnel; or
接收携带优先级值的无线承载建立请求或初始上下文建立请求， 向所述 安全网关发送携带所述优先级值的通知消息， 接收安全网关发送的携带所述 优先级值的密钥交换请求消息， 向所述安全网关返回密钥交换响应消息， 以 与所述安全网关建立至少一条安全隧道， 并建立数据包优先级值和所述至少 一个安全隧道的隧道标识之间的对应关系； 或者  Receiving a radio bearer setup request or an initial context setup request carrying a priority value, sending a notification message carrying the priority value to the security gateway, and receiving a key exchange request message that is sent by the security gateway and carrying the priority value, Returning a key exchange response message to the security gateway to establish at least one secure tunnel with the security gateway, and establishing a correspondence between a data packet priority value and a tunnel identifier of the at least one secure tunnel; or
接收携带优先级值的无线承载建立请求或初始上下文建立请求， 向安全 网关发送携带所述优先级值的密钥交换请求消息， 接收返回的密钥交换响应 消息， 以与所述安全网关建立至少一条安全隧道， 并建立数据包优先级值和 所述至少一条安全隧道的隧道标识之间的^应关系。  Receiving a radio bearer setup request or an initial context setup request carrying a priority value, sending a key exchange request message carrying the priority value to the security gateway, and receiving a returned key exchange response message to establish at least the security gateway with the security gateway A secure tunnel and establishing a relationship between the packet priority value and the tunnel identifier of the at least one secure tunnel.
3、 根据权利要求 1所述的方法， 其特征在于， 在所述获得需要传输的上 行数据包的优先级值之前， 还包括：  The method according to claim 1, wherein before the obtaining the priority value of the uplink data packet to be transmitted, the method further includes:
接收携带优先级值的无线承载建立请求或初始上下文建立请求， 查找所 述优先级值对应的隧道标识， 若未查找到对应的隧道标识， 则向安全网关发 送密钥交换请求消息， 接收返回的密钥交换响应消息， 以与所述安全网关建 立至少一条安全隧道， 建立所述优先级值与所述至少一条安全隧道的隧道标 识之间的对应关系； 或者 接收携带优先级值的无线承载建立请求或初始上下文建立请求， 查找所 述优先级值对应的隧道标识， 若未查找到对应的隧道标识， 则确定存在未被 使用的安全隧道， 通过所述未被使用的安全隧道向所述安全网关传输上行数 Receiving a radio bearer setup request or an initial context setup request carrying a priority value, and searching for a tunnel identifier corresponding to the priority value. If the corresponding tunnel identifier is not found, sending a key exchange request message to the security gateway, and receiving the returned The key exchange response message is configured to establish at least one security tunnel with the security gateway, and establish a correspondence between the priority value and a tunnel identifier of the at least one security tunnel; or Receiving a radio bearer setup request or an initial context setup request carrying a priority value, and searching for a tunnel identifier corresponding to the priority value. If the corresponding tunnel identifier is not found, determining that there is an unused tunnel is not used. The used secure tunnel transmits the number of uplinks to the security gateway
4、 根据权利要求 1所述的方法， 其特征在于， 在所述获得需要传输的上 行数据包的优先级值之前， 还包括： The method according to claim 1, wherein before the obtaining the priority value of the uplink data packet to be transmitted, the method further includes:
在基站上电时向安全网关发送至少两次密钥交换请求消息， 接收返回的 密钥交换响应消息， 以与所述安全网关建立至少两条安全隧道。  The base station sends at least two key exchange request messages to the security gateway when the base station is powered on, and receives the returned key exchange response message to establish at least two security tunnels with the security gateway.
5、 根据权利要求 1所述的方法， 其特征在于， 还包括：  5. The method according to claim 1, further comprising:
若未查找到对应的隧道标识， 则向所述安全网关发送密钥交换请求消息； 接收所述安全网关返回的密钥交换响应消息， 以与所述安全网关建立新 的安全隧道， 并建立所述新的安全隧道的隧道标识和所述优先级值之间的对 应关系；  And if the corresponding tunnel identifier is not found, sending a key exchange request message to the security gateway; receiving a key exchange response message returned by the security gateway, to establish a new security tunnel with the security gateway, and establishing a Determining a correspondence between a tunnel identifier of the new security tunnel and the priority value;
通过所述新的安全隧道向所述安全网关传输所述上行数据包。  Transmitting the uplink data packet to the security gateway by using the new secure tunnel.
6、 根据权利要求 1所述的方法， 其特征在于， 还包括：  6. The method according to claim 1, further comprising:
若未查找到对应的隧道标识， 则确定存在未被使用的安全隧道； 通过所述未被使用的安全隧道向所述安全网关传输所述上行数据包， 并 建立所述未被使用的安全隧道的隧道标识和所述优先级值之间的对应关系。  If the corresponding tunnel identifier is not found, determining that there is an unused security tunnel; transmitting the uplink data packet to the security gateway by using the unused secure tunnel, and establishing the unused security tunnel Correspondence between the tunnel identifier and the priority value.
7、 根据权利要求 6所述的方法， 其特征在于， 还包括：  7. The method according to claim 6, further comprising:
若未查找到对应的隧道标识， 并确定不存在未被使用的安全隧道， 则向 所述安全网关发送密钥交换请求消息， 接收所述安全网关返回的密钥交换响 应消息， 以与所述安全网关建立新的安全隧道， 通过所述新的安全隧道向所 述安全网关传输所述上行数据包， 建立所述新的安全隧道的隧道标识和所述 优先级值之间的对应关系。  If the corresponding tunnel identifier is not found, and it is determined that there is no unused security tunnel, send a key exchange request message to the security gateway, and receive a key exchange response message returned by the security gateway, The security gateway establishes a new security tunnel, and transmits the uplink data packet to the security gateway by using the new security tunnel, and establishes a correspondence between the tunnel identifier of the new security tunnel and the priority value.
8、 根据权利要求 2所述的方法， 其特征在于， 所述无线承载建立请求或 初始上下文建立请求中携带用户优先级或业务优先级或核心网是否具有和固 网互通能力的信息， 所述优先级值为差异化业务点码；  The method according to claim 2, wherein the radio bearer setup request or the initial context setup request carries information about a user priority or a service priority or whether the core network has a fixed network interworking capability, The priority value is a differentiated service point code;
所述建立优先级值和至少一条安全隧道的隧道标识之间的对应关系， 包 括： 将所述用户优先级或所述业务优先级或核心网是否具有和固网互通能力 的信息填充到所述差异化业务点码的字段中； The correspondence between the establishment of the priority value and the tunnel identifier of the at least one security tunnel includes: Filling in the field of the user priority or the service priority or the core network with the fixed network interworking capability into the field of the differentiated service point code;
建立填充后的差异化业务点码和所述隧道标识之间的对应关系。  Establish a correspondence between the padded differentiated service point code and the tunnel identifier.
9、 根据权利要求 8所述的方法， 其特征在于， 所述方法还包括： 将所述隧道标识和优先级值之间的对应关系向移动性管理实体发送， 以 便于所述移动性管理实体将隧道标识和优先级值之间的对应关系向 BPCF设 备发送。  The method according to claim 8, wherein the method further comprises: transmitting a correspondence between the tunnel identifier and a priority value to a mobility management entity, to facilitate the mobility management entity. The correspondence between the tunnel identifier and the priority value is sent to the BPCF device.
10、 根据权利要求 1 所述的方法， 其特征在于， 在获得需要传输的上行 数据包的优先级值之前， 还包括：  The method according to claim 1, wherein before obtaining the priority value of the uplink data packet to be transmitted, the method further includes:
接收安全网关通过安全隧道发送的下行数据包；  Receiving a downlink data packet sent by the security gateway through the secure tunnel;
获取所述下行数据包中内层 IP包的优先级值以及外层 IP包的优先级值； 建立所述安全隧道的隧道标识和内层 IP包的优先级值之间的对应关系， 以及建立所述安全隧道的隧道标识和外层 IP包的优先级值之间的对应关系； 所述通过查找到的隧道标识对应的安全隧道向安全网关传输所述上行数 据包， 包括：  Obtaining a priority value of the inner layer IP packet in the downlink data packet and a priority value of the outer layer IP packet; establishing a correspondence between the tunnel identifier of the security tunnel and a priority value of the inner layer IP packet, and establishing Corresponding relationship between the tunnel identifier of the security tunnel and the priority value of the outer IP packet; the transmitting, by the secure tunnel corresponding to the discovered tunnel identifier, the uplink data packet to the security gateway, including:
根据所述隧道标识和内层 IP包的优先级值之间的对应关系， 以及所述隧 道标识和外层 IP包的优先级值之间的对应关系， 以及所述上行数据包的内层 IP包的优先级值查找到所述上行数据包的外层 IP包的优先级值和对应的隧道 标识；  Corresponding relationship between the tunnel identifier and the priority value of the inner layer IP packet, and a correspondence between the tunnel identifier and the priority value of the outer layer IP packet, and an inner layer IP of the uplink data packet The priority value of the packet finds the priority value of the outer IP packet of the uplink data packet and the corresponding tunnel identifier;
将所述上行数据包的外层 IP包的优先级值作为所述上行数据包的优先级 值；  Setting a priority value of an outer IP packet of the uplink data packet as a priority value of the uplink data packet;
将所述上行数据包通过查找到的隧道标识对应的安全隧道向安全网关传 输。  And transmitting the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
11、 根据权利要求 1 所述的方法， 其特征在于， 在所述获得需要传输的 上行数据包的优先级值之前， 还包括  The method according to claim 1, wherein before the obtaining the priority value of the uplink data packet to be transmitted, the method further includes
接收安全网关通过安全隧道发送的下行数据包；  Receiving a downlink data packet sent by the security gateway through the secure tunnel;
获取所述下行数据包的优先级值， 建立所述安全隧道的隧道标识和所述 优先级值之间的对应关系；  Obtaining a priority value of the downlink data packet, and establishing a correspondence between the tunnel identifier of the security tunnel and the priority value;
转发所述下行数据包。  Forwarding the downlink data packet.
12、 根据权利要求 1到 11任一项所述的方法， 其特征在于： 所述优先级值为数据包的差异化业务点码或无线承载的服务质量等级标 识。 12. A method according to any one of claims 1 to 11, characterized in that: The priority value is a differentiated service point code of the data packet or a quality of service level identifier of the radio bearer.
13、 一种数据包传输方法， 其特征在于， 包括：  13. A data packet transmission method, comprising:
获得需要传输的下行数据包的优先级值；  Obtain a priority value of a downlink packet that needs to be transmitted;
根据所述优先级值查找设置的优先级值和隧道标识之间的对应关系， 每 个优先级值对应至少一个隧道标识；  And determining, according to the priority value, a correspondence between the set priority value and the tunnel identifier, where each priority value corresponds to at least one tunnel identifier;
若查找到对应的隧道标识， 则通过查找到的隧道标识对应的安全隧道向 基站传输所述下行数据包。  If the corresponding tunnel identifier is found, the downlink data packet is transmitted to the base station by using the secure tunnel corresponding to the found tunnel identifier.
14、 根据权利要求 13所述的方法， 其特征在于， 在所述获得需要传输的 下行数据包的优先级值之前， 还包括：  The method according to claim 13, wherein before the obtaining the priority value of the downlink data packet to be transmitted, the method further includes:
接收基站发送的携带所述优先级值的密钥交换请求消息， 返回密钥交换 响应消息， 以与所述基站建立至少一条安全隧道；  Receiving, by the base station, a key exchange request message carrying the priority value, and returning a key exchange response message, to establish at least one secure tunnel with the base station;
建立所述优先级值和至少一条安全隧道的隧道标识之间的对应关系。 A correspondence between the priority value and a tunnel identifier of at least one secure tunnel is established.
15、 根据权利要求 13所述的方法， 其特征在于， 在所述获得需要传输的 下行数据包的优先级值之前， 还包括： The method according to claim 13, wherein before the obtaining the priority value of the downlink data packet to be transmitted, the method further includes:
接收基站网关发送的通知消息， 所述通知消息中携带优先级值； 向基站发送携带所述优先级值的密钥交换请求消息， 接收返回的密钥交 换响应消息， 以与所述基站建立至少一条安全隧道；  Receiving a notification message sent by the base station gateway, where the notification message carries a priority value; sending a key exchange request message carrying the priority value to the base station, and receiving the returned key exchange response message, to establish at least the base station with the base station a safe tunnel;
建立所述优先级值和至少一条安全隧道的隧道标识之间的对应关系。 A correspondence between the priority value and a tunnel identifier of at least one secure tunnel is established.
16、 根据权利要求 13所述的方法， 其特征在于， 还包括： 16. The method according to claim 13, further comprising:
若未查找到对应的隧道标识， 则向所述基站发送密钥交换请求消息； 接收所述基站返回的密钥交换响应消息， 以与所述基站建立新的安全隧 道， 建立所述新的安全隧道的上下行隧道标识和所述优先级值之间的对应关 系；  And if the corresponding tunnel identifier is not found, sending a key exchange request message to the base station; receiving a key exchange response message returned by the base station, to establish a new security tunnel with the base station, and establishing the new security Corresponding relationship between the uplink and downlink tunnel identifier of the tunnel and the priority value;
通过所述新的安全隧道向所述基站传输所述下行数据包。  Transmitting the downlink data packet to the base station by using the new secure tunnel.
17、 根据权利要求 13所述的方法， 其特征在于， 还包括：  17. The method according to claim 13, further comprising:
若未查找到对应的隧道标识， 则确定存在未被使用的安全隧道； 通过所述未被使用的安全隧道向所述基站传输所述下行数据包， 建立所 述未被使用的安全隧道的隧道标识和所述优先级值之间的对应关系。  If the corresponding tunnel identifier is not found, it is determined that there is an unused security tunnel; the downlink data packet is transmitted to the base station by using the unused secure tunnel, and the tunnel of the unused secure tunnel is established. A correspondence between the identifier and the priority value.
18、 根据权利要求 17所述的方法， 其特征在于， 还包括： 若未查找到对应的隧道标识， 确定不存在未被使用的安全隧道， 向所述 基站发送密钥交换请求消息， 接收所述基站返回的密钥交换响应消息， 以与 所述基站建立新的安全隧道， 通过所述新的安全隧道向所述基站传输所述下 行数据包， 建立所述新的安全隧道的隧道标识和所述优先级值之间的对应关 系。 The method according to claim 17, further comprising: If the corresponding tunnel identifier is not found, determining that there is no unused security tunnel, sending a key exchange request message to the base station, and receiving a key exchange response message returned by the base station, to establish a new The security tunnel transmits the downlink data packet to the base station by using the new secure tunnel, and establishes a correspondence between the tunnel identifier of the new security tunnel and the priority value.
19、 根据权利要求 13所述的方法， 其特征在于， 还包括：  The method according to claim 13, further comprising:
将所述查找到的隧道标识和所述对应关系向宽带策略控制架构设备发 送。  And transmitting the found tunnel identifier and the corresponding relationship to the broadband policy control architecture device.
20、 根据权利要求 13所述的方法， 其特征在于， 在所述获得需要传输的 下行数据包的优先级值之前， 还包括：  The method according to claim 13, wherein before the obtaining the priority value of the downlink data packet to be transmitted, the method further includes:
接收基站通过安全隧道发送的上行数据包；  Receiving an uplink data packet sent by the base station through the secure tunnel;
获取所述上行数据包中内层 IP包的优先级值以及外层 IP包的优先级值； 建立所述安全隧道的隧道标识和内层 IP包的优先级值之间的对应关系， 以及建立所述安全隧道的隧道标识和外层 IP包的优先级值之间的对应关系； 所述通过查找到的隧道标识对应的安全隧道向基站传输所述下行数据 包， 包括：  Obtaining a priority value of the inner layer IP packet in the uplink data packet and a priority value of the outer layer IP packet; establishing a correspondence between the tunnel identifier of the security tunnel and a priority value of the inner layer IP packet, and establishing Corresponding relationship between the tunnel identifier of the security tunnel and the priority value of the outer IP packet; the transmitting, by the secure tunnel corresponding to the discovered tunnel identifier, the downlink data packet to the base station, including:
根据所述隧道标识和内层 IP包的优先级值之间的对应关系、 以及所述安 全隧道的隧道标识和外层 IP包的优先级值之间的对应关系、 以及所述下行数 据包的内层 IP包的优先级值查找到所述下行数据包的外层 IP包的优先级值和 对应的隧道标识；  Corresponding relationship between the tunnel identifier and the priority value of the inner layer IP packet, and the correspondence between the tunnel identifier of the security tunnel and the priority value of the outer IP packet, and the downlink data packet The priority value of the inner layer IP packet finds the priority value of the outer IP packet of the downlink data packet and the corresponding tunnel identifier;
将所述下行数据包的外层 IP包的优先级值作为所述下行数据包的优先级 值；  Setting a priority value of an outer IP packet of the downlink data packet as a priority value of the downlink data packet;
将所述下行数据包通过查找到的隧道标识对应的安全隧道向基站传输。 And transmitting the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
21、 根据权利要求 13所述的方法， 其特征在于， 在所述获得需要传输的 下行数据包的优先级值之前， 还包括 The method according to claim 13, wherein before the obtaining the priority value of the downlink data packet to be transmitted, the method further includes
接收基站通过安全隧道发送的上行数据包；  Receiving an uplink data packet sent by the base station through the secure tunnel;
获取所述上行数据包的优先级值， 建立所述优先级值和所述安全隧道的 隧道标识之间的对应关系；  Obtaining a priority value of the uplink data packet, and establishing a correspondence between the priority value and a tunnel identifier of the security tunnel;
转发所述上行数据包。  Forwarding the upstream packet.
22、 根据权利要求 13-21任一项所述的方法， 其特征在于： 所述优先级值为数据包的差异化业务点码或无线承载的服务质量等级标 识。 22. A method according to any of claims 13-21, characterized in that: The priority value is a differentiated service point code of the data packet or a quality of service level identifier of the radio bearer.
23、 一种基站， 其特征在于， 包括：  A base station, comprising:
第一优先级获取单元， 用于获得需要传输的上行数据包的优先级值； 第一对应关系查找单元， 用于根据所述第一优先级获取单元获得的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  a first priority acquiring unit, configured to obtain a priority value of an uplink data packet to be transmitted; a first correspondence relationship searching unit, configured to search for a priority value set according to a priority value obtained by the first priority acquiring unit Corresponding relationship between the tunnel identifier and each of the tunnel identifiers, each priority value corresponding to at least one tunnel identifier;
上行数据发送单元， 用于在所述第一对应关系查找单元查找到对应的隧 道标识时， 通过查找到的隧道标识对应的安全隧道向安全网关传输所述上行 数据包。  The uplink data sending unit is configured to: when the first correspondence search unit finds the corresponding tunnel identifier, transmit the uplink data packet to the security gateway by using the secure tunnel corresponding to the found tunnel identifier.
24、 根据权利要求 23所述的基站， 其特征在于， 还包括：  The base station according to claim 23, further comprising:
第一隧道建立单元， 用于在所述第一优先级获取单元获得需要传输的上 行数据包的优先级值之前， 在上电时向安全网关发送携带所述优先级值的密 钥交换请求消息， 接收返回的密钥交换响应消息， 以与所述安全网关建立至 少一条安全隧道； 或者  a first tunnel establishing unit, configured to send, after the first priority acquiring unit obtains a priority value of the uplink data packet to be transmitted, a key exchange request message carrying the priority value to the security gateway at power-on Receiving a returned key exchange response message to establish at least one secure tunnel with the security gateway; or
接收携带优先级值的无线承载建立请求或初始上下文建立请求， 向所述 安全网关发送携带所述优先级值的通知消息， 接收安全网关发送的携带所述 优先级值的密钥交换请求消息， 向所述安全网关返回密钥交换响应消息， 以 与所述安全网关建立至少一条安全隧道； 或者  Receiving a radio bearer setup request or an initial context setup request carrying a priority value, sending a notification message carrying the priority value to the security gateway, and receiving a key exchange request message that is sent by the security gateway and carrying the priority value, Returning a key exchange response message to the security gateway to establish at least one secure tunnel with the security gateway; or
接收携带优先级值的无线承载建立请求或初始上下文建立请求， 向安全 网关发送携带所述优先级值的密钥交换请求消息， 接收返回的密钥交换响应 消息， 以与所述安全网关建立至少一条安全隧道；  Receiving a radio bearer setup request or an initial context setup request carrying a priority value, sending a key exchange request message carrying the priority value to the security gateway, and receiving a returned key exchange response message to establish at least the security gateway with the security gateway a safe tunnel;
第一对应关系建立单元， 用于建立所述第一优先级获取单元获得的优先 级值和所述第一隧道建立单元建立的至少一条安全隧道的隧道标识之间的对 应关系。  And a first correspondence establishing unit, configured to establish a correspondence between a priority value obtained by the first priority acquiring unit and a tunnel identifier of at least one security tunnel established by the first tunnel establishing unit.
25、 根据权利要求 23所述的基站， 其特征在于， 还包括：  The base station according to claim 23, further comprising:
第二隧道建立单元， 用于在所述第一优先级获取单元获得需要传输的上 行数据包的优先级值之前， 在上电时向安全网关发送至少两次密钥交换请求 消息， 接收返回的密钥交换响应消息， 以与所述安全网关建立至少两条安全 隧道。 a second tunnel establishing unit, configured to send at least two key exchange request messages to the security gateway at the time of power-on, before the first priority acquiring unit obtains the priority value of the uplink data packet to be transmitted, and receive the returned The key exchange response message is to establish at least two secure tunnels with the security gateway.
26、 根据权利要求 23所述的基站， 其特征在于， 还包括： The base station according to claim 23, further comprising:
第三隧道建立单元， 用于在未查找到对应的隧道标识， 则向所述安全网 关发送密钥交换请求消息， 接收所述安全网关返回的密钥交换响应消息， 以 与所述安全网关建立新的安全隧道；  a third tunnel establishing unit, configured to send a key exchange request message to the security gateway after receiving the corresponding tunnel identifier, and receive a key exchange response message returned by the security gateway, to establish with the security gateway New safe tunnel;
所述上行数据发送单元， 还用于通过所述第三隧道建立单元建立的新的 安全隧道向所述安全网关传输所述上行数据包；  The uplink data sending unit is further configured to transmit the uplink data packet to the security gateway by using a new secure tunnel established by the third tunnel establishing unit;
第二对应关系建立单元， 用于建立所述第三隧道建立单元建立的新的安 全隧道的隧道标识和所述第一优先级获取单元获得的优先级值之间的对应关 系。  And a second correspondence establishing unit, configured to establish a correspondence between a tunnel identifier of the new security tunnel established by the third tunnel establishing unit and a priority value obtained by the first priority acquiring unit.
27、 根据权利要求 23所述的基站， 其特征在于， 还包括：  The base station according to claim 23, further comprising:
隧道判断单元， 用于在未查找到对应的隧道标识时， 确定存在未被使用 的安全隧道；  a tunnel judging unit, configured to determine that there is an unused security tunnel when the corresponding tunnel identifier is not found;
所述上行数据发送单元， 还用于在所述隧道判断单元确定存在未被使用 的安全隧道时， 通过所述未被使用的安全隧道向所述安全网关传输所述上行 数据包；  The uplink data sending unit is further configured to: when the tunnel determining unit determines that there is an unused secure tunnel, transmit the uplink data packet to the security gateway by using the unused secure tunnel;
第三对应关系建立单元， 用于建立所述隧道判断单元确定的未被使用的 安全隧道的隧道标识和所述第一优先级获取单元获得的优先级值之间的对应 关系。  And a third correspondence establishing unit, configured to establish a correspondence between a tunnel identifier of the unused security tunnel determined by the tunnel determining unit and a priority value obtained by the first priority acquiring unit.
28、 根据权利要求 27所述的基站， 其特征在于， 还包括：  The base station according to claim 27, further comprising:
隧道判断单元， 用于在未查找到对应的隧道标识时， 确定不存在未被使 用的安全隧道； 全隧道时， 向所述安全网关发送密钥交换请求消息， 接收所述安全网关返回 的密钥交换响应消息， 以与所述安全网关建立新的安全隧道， 通过所述新的 安全隧道向所述安全网关传输所述上行数据包；  The tunnel judging unit is configured to: when the corresponding tunnel identifier is not found, determine that there is no unused security tunnel; when the tunnel is full, send a key exchange request message to the security gateway, and receive the secret returned by the security gateway. Key exchange response message, to establish a new security tunnel with the security gateway, and transmit the uplink data packet to the security gateway by using the new secure tunnel;
所述第三对应关系建立单元， 还用于建立所述新的安全隧道的隧道标识 和所述优先级值之间的对应关系。  The third correspondence establishing unit is further configured to establish a correspondence between the tunnel identifier of the new security tunnel and the priority value.
29、 根据权利要求 23所述的基站， 其特征在于， 还包括  29. The base station according to claim 23, further comprising
第一接收单元， 用于在所述第一优先级获取单元获得需要传输的上行数 据包的优先级值之前， 接收安全网关通过安全隧道发送的下行数据包； 所述第一优先级获取单元， 还用于获取所述第一接收单元接收的下行数 据包的优先级值； a first receiving unit, configured to receive, after the first priority acquiring unit obtains a priority value of an uplink data packet to be transmitted, a downlink data packet that is sent by the security gateway through the secure tunnel; The first priority acquiring unit is further configured to acquire a priority value of the downlink data packet received by the first receiving unit;
第四对应关系建立单元， 用于建立所述第一优先级获取单元获取的优先 级值和所述安全隧道的隧道标识之间的对应关系；  a fourth correspondence establishing unit, configured to establish a correspondence between a priority value obtained by the first priority acquiring unit and a tunnel identifier of the security tunnel;
第一转发单元， 用于转发所述第一接收单元接收的下行数据包。  The first forwarding unit is configured to forward the downlink data packet received by the first receiving unit.
30、 一种安全网关， 其特征在于， 包括：  30. A security gateway, comprising:
第二优先级获取单元， 用于获得需要传输的下行数据包的优先级值； 第二对应关系查找单元， 用于根据所述第二优先级获取单元获得的优先 级值查找设置的优先级值和隧道标识之间的对应关系， 每个优先级值对应至 少一个隧道标识；  a second priority acquiring unit, configured to obtain a priority value of the downlink data packet to be transmitted; a second correspondence relationship searching unit, configured to search for the priority value set according to the priority value obtained by the second priority acquiring unit Corresponding relationship between the tunnel identifier and each of the tunnel identifiers, each priority value corresponding to at least one tunnel identifier;
下行数据发送单元， 用于在所述第二对应关系查找单元查找到对应的隧 道标识时， 通过查找到的隧道标识对应的安全隧道向基站传输所述下行数据 包。  And a downlink data sending unit, configured to: when the second corresponding relationship searching unit finds the corresponding tunnel identifier, transmit the downlink data packet to the base station by using the secure tunnel corresponding to the found tunnel identifier.
31、 根据权利要求 30所述的安全网关， 其特征在于，  31. The security gateway of claim 30, wherein:
第五隧道建立单元， 用于在所述第二优先级获取单元获得需要传输的下 行数据包的优先级值之前， 接收基站发送的携带所述优先级值的密钥交换请 求消息， 返回密钥交换响应消息， 以与所述基站建立至少一条安全隧道； 第五对应关系建立单元， 用于建立所述第二优先级获取单元获取的优先 级值和所述第五隧道建立单元建立的至少一条安全隧道的隧道标识之间的对 应关系。  a fifth tunnel establishing unit, configured to receive, after the second priority acquiring unit obtains a priority value of the downlink data packet to be transmitted, a key exchange request message that is sent by the base station and carries the priority value, and returns a key Exchanging a response message to establish at least one security tunnel with the base station; a fifth correspondence establishing unit, configured to establish a priority value obtained by the second priority acquiring unit and at least one established by the fifth tunnel establishing unit Correspondence between tunnel identifiers of security tunnels.
32、 根据权利要求 30所述的安全网关， 其特征在于， 还包括： 第一通知消息接收单元， 用于在所述第二优先级获取单元获得需要传输 的下行数据包的优先级值之前， 接收基站网关发送的通知消息， 所述通知消 息中携带优先级值；  The security gateway according to claim 30, further comprising: a first notification message receiving unit, configured to: before the second priority acquiring unit obtains a priority value of a downlink data packet to be transmitted, Receiving a notification message sent by the base station gateway, where the notification message carries a priority value;
第六隧道建立单元， 用于向基站发送携带第一通知消息接收单元接收到 的所述优先级值的密钥交换请求消息， 接收返回的密钥交换响应消息， 以与 所述基站建立至少一条安全隧道；  a sixth tunnel establishing unit, configured to send, to the base station, a key exchange request message that carries the priority value received by the first notification message receiving unit, and receive the returned key exchange response message to establish at least one with the base station Safety tunnel
第六对应关系建立单元， 用于建立所述第二优先级获取单元获取的优先 级值和所述第六隧道建立单元建立的至少一条安全隧道的隧道标识之间的对 应关系。 The sixth correspondence establishing unit is configured to establish a correspondence between the priority value obtained by the second priority acquiring unit and the tunnel identifier of the at least one security tunnel established by the sixth tunnel establishing unit.
33、 根据权利要求 30所述的安全网关， 其特征在于， 还包括： 第二通知消息接收单元， 用于在所述第二优先级获取单元获得需要传输 的下行数据包的优先级值之前， 接收基站网关发送的通知消息， 所述通知消 息中携带优先级值； The security gateway according to claim 30, further comprising: a second notification message receiving unit, configured to: before the second priority acquiring unit obtains a priority value of the downlink data packet to be transmitted, Receiving a notification message sent by the base station gateway, where the notification message carries a priority value;
第七隧道建立单元， 用于向基站发送携带所述第二通知消息接收单元接 收的优先级值的密钥交换请求消息， 接收返回的密钥交换响应消息， 以与所 述基站建立至少一条安全隧道；  a seventh tunnel establishing unit, configured to send, to the base station, a key exchange request message carrying a priority value received by the second notification message receiving unit, and receive a returned key exchange response message to establish at least one security with the base station Tunnel
第七对应关系建立单元， 用于建立所述优先级值和所述第七隧道建立单 元建立的至少一条安全隧道的隧道标识之间的对应关系。  And a seventh correspondence establishing unit, configured to establish a correspondence between the priority value and a tunnel identifier of at least one security tunnel established by the seventh tunnel establishing unit.
34、 根据权利要求 30所述的安全网关， 其特征在于， 还包括： 第八隧道建立单元， 用于在所述第二对应关系查找单元没有查找到对应 的隧道标识时， 向所述基站发送密钥交换请求消息， 接收所述基站返回的密 钥交换响应消息， 以与所述基站建立新的安全隧道；  The security gateway according to claim 30, further comprising: an eighth tunnel establishing unit, configured to send, to the base station, when the second correspondence search unit does not find the corresponding tunnel identifier a key exchange request message, receiving a key exchange response message returned by the base station, to establish a new security tunnel with the base station;
所述下行数据发送单元， 还用于通过所述第八隧道建立单元建立的新的 安全隧道向所述基站传输所述下行数据包；  The downlink data sending unit is further configured to transmit the downlink data packet to the base station by using a new secure tunnel established by the eighth tunnel establishing unit;
第八对应关系建立单元， 用于建立所述第八隧道建立单元建立的新的安 全隧道的隧道标识和所述第二优先级获取单元获取的优先级值之间的对应关 系。  The eighth correspondence establishing unit is configured to establish a correspondence between a tunnel identifier of the new security tunnel established by the eighth tunnel establishing unit and a priority value acquired by the second priority acquiring unit.
35、 根据权利要求 30所述的安全网关， 其特征在于， 还包括： 第二接收单元， 用于在第二优先级获取单元获得需要传输的下行数据包 的优先级值之前， 接收基站通过安全隧道发送的上行数据包；  The security gateway according to claim 30, further comprising: a second receiving unit, configured to: before the second priority acquiring unit obtains a priority value of the downlink data packet to be transmitted, the receiving base station passes the security The uplink data packet sent by the tunnel;
所述第二优先级获取单元， 还用于获取所述第二接收单元接收的上行数 据包的优先级值；  The second priority acquiring unit is further configured to acquire a priority value of the uplink data packet received by the second receiving unit;
第九对应关系建立单元， 用于建立所述第二优先级获取单元获取的优先 级值和所述安全隧道的隧道标识之间的对应关系；  a ninth correspondence establishing unit, configured to establish a correspondence between a priority value obtained by the second priority acquiring unit and a tunnel identifier of the security tunnel;
第二转发单元， 用于转发所述上行数据包。  The second forwarding unit is configured to forward the uplink data packet.
PCT/CN2012/072705 2011-03-30 2012-03-21 Data packet transmission method and related apparatus WO2012130068A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201110078843.X 2011-03-30
CN201110078843.XA CN102724713B (en) 2011-03-30 2011-03-30 Method and related device for data packet transmission

Publications (1)

Publication Number Publication Date
WO2012130068A1 true WO2012130068A1 (en) 2012-10-04

Family

ID=46929438

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/072705 WO2012130068A1 (en) 2011-03-30 2012-03-21 Data packet transmission method and related apparatus

Country Status (2)

Country Link
CN (1) CN102724713B (en)
WO (1) WO2012130068A1 (en)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104113441B (en) * 2013-04-17 2018-05-18 华为终端有限公司 Business data transmission management method and device
CN104661259A (en) * 2013-11-20 2015-05-27 华为技术有限公司 Transmission treatment method, device and system in wireless backhaul link
CN104954226A (en) * 2015-07-28 2015-09-30 上海斐讯数据通信技术有限公司 SDN-based QoS-supported communication tunnel establishment method and system
EP3373683A4 (en) * 2015-11-30 2018-11-07 Huawei Technologies Co., Ltd. Service data packet processing method and device
CN108260210B (en) 2016-12-29 2022-02-11 华为技术有限公司 Data transmission method, user equipment and wireless access equipment
CN110971533B (en) * 2018-09-30 2023-02-03 京东方科技集团股份有限公司 Method, server apparatus, client apparatus, and medium for data communication
CN110995595B (en) * 2019-12-16 2022-03-11 新华三大数据技术有限公司 Message sending method, device, storage medium and node equipment
CN113872915A (en) * 2020-06-30 2021-12-31 中兴通讯股份有限公司 Information sending method, information receiving method and network terminal

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101064637A (en) * 2006-04-30 2007-10-31 华为技术有限公司 Method for guaranteeing quality of service of operation maintenance data stream
CN101072161A (en) * 2007-07-12 2007-11-14 华为技术有限公司 Method and device for ensuring virtual special net bandwidth and service quality
CN101291276A (en) * 2008-06-18 2008-10-22 中国电信股份有限公司 Tunnel protecting method and system based on services
WO2010118426A2 (en) * 2009-04-10 2010-10-14 Qualcomm Incorporated Qos mapping for relay nodes

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8345604B2 (en) * 2007-06-07 2013-01-01 Qualcomm Incorporated Effectuating establishment of internet protocol security tunnels for utilization in a wireless communication environment

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101064637A (en) * 2006-04-30 2007-10-31 华为技术有限公司 Method for guaranteeing quality of service of operation maintenance data stream
CN101072161A (en) * 2007-07-12 2007-11-14 华为技术有限公司 Method and device for ensuring virtual special net bandwidth and service quality
CN101291276A (en) * 2008-06-18 2008-10-22 中国电信股份有限公司 Tunnel protecting method and system based on services
WO2010118426A2 (en) * 2009-04-10 2010-10-14 Qualcomm Incorporated Qos mapping for relay nodes

Also Published As

Publication number Publication date
CN102724713B (en) 2015-07-22
CN102724713A (en) 2012-10-10

Similar Documents

Publication Publication Date Title
US10666458B2 (en) Method and apparatus for data transmission involving tunneling in wireless communication networks
US10893434B2 (en) UE session management QoS capability negotiation and QoS control realization
WO2012130068A1 (en) Data packet transmission method and related apparatus
US9930123B2 (en) Method and apparatus for initiating and maintaining sessions between endpoints
US20190230681A1 (en) Method, Apparatus, System, Terminal, And Access Network Device For Communication
US9173244B2 (en) Methods for establishing and using public path, M2M communication method, and systems thereof
WO2019033920A1 (en) Method and device enabling network side to identify and control remote user equipment
WO2017201677A1 (en) Data transmission method and device
EP2863683A1 (en) Data flow control method and corresponding apparatus and communications system
WO2018059313A1 (en) Data transmission method and related device
KR101700583B1 (en) Method and equipment for establishing a connection through a virtual private network
WO2013131458A1 (en) Method and device for transmitting ip data packet
WO2014127515A1 (en) Service providing system, method, mobile edge application server and support node
WO2013155981A1 (en) Method and device for data shunting
WO2019196788A1 (en) Communication method and communication apparatus
WO2014075359A1 (en) Bandwidth adjustment method, device and system
EP3518580B1 (en) Data transmission method and apparatus therefor
WO2019154160A1 (en) Communication method and apparatus
CN114374964B (en) Method for realizing 5G user plane function QoS flow based on DPDK
WO2013185288A1 (en) Method, system and device for processing data packet
EP3982598A1 (en) Method and apparatus for sending and receiving message, and communication system
WO2018006249A1 (en) Qos control method in 5g communication system and related device
WO2018171639A1 (en) Wireless communication method, terminal, access network device, and network system
WO2011109992A1 (en) Method, device and system for obtaining information
WO2023184537A1 (en) Data transmission method and apparatus, and communication device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12763117

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12763117

Country of ref document: EP

Kind code of ref document: A1