WO2012149783A1

WO2012149783A1 - Method, device, and user equipment applicable in accessing mobile network

Info

Publication number: WO2012149783A1
Application number: PCT/CN2011/080377
Authority: WO
Inventors: 王珊珊; 郑磊斌
Original assignee: 华为技术有限公司
Priority date: 2011-09-29
Filing date: 2011-09-29
Publication date: 2012-11-08
Also published as: CN102388639A; CN102388639B

Abstract

Provided in embodiments of the present invention are a method, system, and user equipment applicable in accessing a mobile network. The device comprises: a receiver module applicable in receiving an EAP success response message from an authentication server, a transmitter module applicable in transmitting to an access server the EAP success response message and an internet protocol (IP) address allocated to the user equipment. The embodiments of the present invention are capable of utilizing the device applicable in accessing the mobile network to transmit to the access server the EAP success response message returned by the authentication server together with the IP address allocated to the user equipment. Because the process utilizes a basic function supported by the access server, modifications to the access server can be reduced, thereby facilitating access to the mobile network.

Description

Method and apparatus for accessing a mobile network and user equipment

Embodiments of the present invention relate to the field of communications technologies, and, more particularly, to a method and apparatus for accessing a mobile network and user equipment. Background technique

In order to support a better user experience and compatible with multiple access technologies, the evolved mobile network can simultaneously support 3GPP (The 3rd Generation Project Partnership) access technology and non-3GPP access technologies, such as WiFi. (Wireless Fidelity, Wireless Compatibility), WLAN (Wireless Local Area Networks), CDMA (Code Division Multiple Access), etc.

WLAN AViFi can access the 3GPP network access packet service in the trusted access mode. In the trusted access mode, the UE (User Equipment) supports basic WLAN/WiFi access and EAP access authentication, and BRAS (Broadband Remote Access Server) with WLAN/WiFi access network. EAP authentication is performed between the access server) and 3GPP AAA ( Authority, Authentication and Accounting, authentication, authorization, and accounting). In addition, the WLAN access network needs to support the GTP (General Packet Radio Service Tunnel Protocol) / PMIP (Proxy Mobile IP Proxy Mobile IP) tunnel, so that the WLAN access network can directly communicate with the PGW (Packet Data Network). Gateway, Packet Data Gateway) communicates.

In the trusted access mode, the BRAS needs to be modified to support various functions involved in the trusted access mode, such as GTP/PMIP interface and EAP function. However, it may not be possible to support these features by simply upgrading the BRAS, and may even need to replace the BRAS. Summary of the invention

The embodiments of the present invention provide a method and apparatus for accessing a mobile network and a user equipment, which can reduce the modification of the access server, thereby facilitating access to the mobile network.

In one aspect, an apparatus for accessing a mobile network is provided, including: a receiving module, configured to receive an EAP success response message from an authentication server; and a sending module, configured to send the EAP success response message to the access server, and The Internet Protocol IP address assigned by the user device. In another aspect, an apparatus for accessing a mobile network is provided, including: a receiving module, configured to: after the EAP authentication to the user equipment succeeds, receive an EAP success response message from the gateway device and serve the user The IP address assigned by the device; and the sending module, configured to send the EAP success response message to the user equipment, where the receiving module further receives an IP connection establishment request message sent by the user equipment after receiving the EAP success response message, where After the receiving module receives the IP connection establishment request message, the sending module sends an IP connection setup response message to the user equipment, where the IP connection setup response message carries the IP address, so that the user equipment accesses the IP address according to the IP address. mobile network.

In another aspect, a user equipment is provided, including: a sending module, configured to send an EAP authentication message to an access server, to complete EAP authentication with the authentication server, and a receiving module, Receiving an EAP success response message from the access server, where the sending module sends an IP connection establishment request message to the access server before the EAP authentication succeeds, after the receiving module receives the EAP success response message, The sending module sends a new IP connection establishment request message to the access server to obtain an IP address configured by the gateway device for the user equipment, and the receiving module further receives an IP connection establishment response message from the access server, where the IP connection establishment response is The message carries the IP address.

In another aspect, a method for accessing a mobile network is provided, including: receiving an EAP success response message from an authentication server; transmitting the EAP success response message and an IP address assigned to the user equipment to the access server So that the access server forwards the EAP success response message to the user equipment, and after the user equipment obtains the IP address from the access server, accesses the mobile network according to the IP address.

In another aspect, a method for accessing a mobile network is provided, including: receiving an EAP success response message from a gateway device and an IP address assigned by the gateway device to the user equipment; sending the EAP to the user equipment Receiving an IP connection establishment request message sent by the user equipment after receiving the EAP success response message; after receiving the IP connection establishment request message, sending an IP connection establishment response message to the user equipment, the IP connection The setup response message carries the IP address, so that the user equipment accesses the mobile network according to the IP address.

In another aspect, a method for accessing a mobile network is provided, including: sending an EAP authentication message to an access server to complete EAP authentication with a user equipment with the authentication server; Sending an IP connection establishment request message to the access server before the authentication succeeds, after receiving the EAP success response message from the access server, The access server sends a new IP connection establishment request message to obtain an IP address configured by the gateway device for the user equipment. The IP connection establishment response message is received from the access server, and the IP connection establishment response message carries the IP address.

The embodiment of the present invention can use the foregoing apparatus for accessing the mobile network to send the EAP success response message returned by the authentication server to the access server together with the IP address allocated for the user equipment. Since the basic functions already supported by the access server are utilized in the above process, the modification of the access server can be reduced, thereby making it easier to access the mobile network. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work.

1 is a schematic diagram of an architecture of a system in accordance with one embodiment of the present invention.

2 is a schematic block diagram of an apparatus for accessing a mobile network, in accordance with one embodiment of the present invention.

3 is a schematic block diagram of an apparatus for accessing a mobile network, in accordance with one embodiment of the present invention.

4 is a schematic block diagram of an apparatus for accessing a mobile network, in accordance with one embodiment of the present invention.

Figure 5 is a schematic block diagram of an apparatus for accessing a mobile network, in accordance with one embodiment of the present invention.

Figure 6 is a schematic block diagram of an apparatus for accessing a mobile network, in accordance with one embodiment of the present invention.

FIG. 7 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.

Figure 8 is a schematic flow diagram of a method for accessing a mobile network, in accordance with one embodiment of the present invention.

9 is a schematic flow diagram of a method for accessing a mobile network, in accordance with one embodiment of the present invention.

FIG. 10 is a schematic flowchart of a method for accessing a mobile network according to an embodiment of the present invention. 11 is a schematic flow chart of a process of accessing a mobile network according to an embodiment of the present invention. FIG. 12 is a schematic flowchart of a process of accessing a mobile network according to an embodiment of the present invention. 13 is a schematic diagram of a system architecture for accessing a mobile network, in accordance with one embodiment of the present invention. 14 is a schematic diagram of a system architecture for accessing a mobile network, in accordance with one embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without making creative labor are within the scope of the present invention.

The technical solution of the present invention can be applied to various communication systems, such as: Global System of Mobile Communication (GSM), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access ( WCDMA, Wideband Code Division Multiple Access), General Packet Radio Service (GPRS), Long Term Evolution (LTE), LTE-Advanced (LTE-Advanced), etc. The embodiment of the present invention is described by using a WLAN/WiFi access 3GPP SAE (System Architecture Evolution) network as an example, but the embodiment of the present invention is not limited thereto, and is applicable to other non-3GPP networks according to the embodiment of the present invention. (eg, CDMA, etc.) access to the 3GPP network access packet service scenario.

The UE may also be referred to as a mobile terminal, a mobile user equipment, or the like. The UE may be a mobile terminal, such as a mobile phone (or "cellular" phone) and a computer with a mobile terminal, for example, a portable, pocket-sized, handheld, computer-integrated or in-vehicle mobile device that is connected to the wireless device. Network exchange language and / or data.

1 is a schematic architectural diagram of a system 10 in accordance with one embodiment of the present invention. System 10 includes: UE 11, AP (Access Point, Wireless Access Point) 12, access server 13, gateway device 14, and authentication server 15. The UE 11 accesses the WLAN WiFi through the AP 12, the AP 12 is connected to the access server 13, the access server 13 is connected to the gateway device 14, and the gateway device 14 is connected to the authentication server 15.

2 is a schematic block diagram of an apparatus 100 for accessing a mobile network, in accordance with one embodiment of the present invention. An example of the apparatus 100 of FIG. 2 is a gateway device 14 in the system of FIG. 1, for example, an AGW (Access Gateway) or a PGW, including: a receiving module 110 and transmitting Module 120.

The receiving module 110 receives an EAP (Extensible Authentication Protocol) success response message from the authentication server. The sending module 120 sends the EAP success response message and the IP address assigned to the UE to the access server, so that the access server forwards the EAP success response message to the UE, and the UE obtains the IP from the access server. After the address, the mobile network is accessed according to the IP address.

According to an embodiment of the present invention, the foregoing authentication server may be a 3GPP AAA server/HSS (Home Subscriber Server), and the foregoing access server may be a BRAS in WLAN/WiFi or other non-3GPP networks capable of performing similar functions. Access the server or gateway device.

The embodiment of the present invention can use the gateway device to participate in the EAP authentication process for the user equipment, and use the gateway device to send the EAP success response message returned by the authentication server to the access server together with the IP address allocated for the user equipment. Since the basic functions already supported by the access server are utilized in the above process, the modification of the access server can be reduced, thereby making it easier to access the mobile network.

According to the embodiment of the present invention, when performing the EAP authentication, the receiving module 110 receives the EAP authentication message sent by the UE from the access server, and the sending module 120 sends the EAP authentication message to the authentication server, so that the UE and the authentication The EAP authentication of the UE is completed between the servers, and after the EAP authentication of the user equipment by the authentication server is successful, the receiving module 110 receives the EAP success response message from the authentication server.

For example, the foregoing EAP authentication message may be an EAP authentication response message. When the UE performs authentication or accesses the packet service, the UE may send a message for triggering EAP authentication to the BRAS. After receiving the message, the BRAS may send an EAP Authentication Request message to the UE. After receiving the EAP authentication request message, the UE may send the foregoing EAP authentication response message to the BRAS.

According to an embodiment of the present invention, the receiving module 110 receives the encapsulation from the access server at the first

EAP authentication message in the RADIUS (Remote Authentication Dial In User Service) protocol or its upgraded version of the Diameter protocol. The sending module 120 sends an EAP authentication message encapsulated in the first RADIUS/Diameter protocol packet to the authentication server, and sends an IP address and an EAP successful response encapsulated in the second RADIUS/Diameter protocol packet to the access server. Message. The UE accesses the packet service network through the above tunnelless mode, and the service experience is consistent with the 3GPP access technology. For example, because the BRAS supports the RADIUS/Diameter function, the above-mentioned gateway device (for example, PGW or AGW) and the BRAS can communicate with each other through the RADIUS/Diameter protocol. After the EAP authentication succeeds, the gateway device may also encapsulate the IP address and the EAP success response message in a RADIUS/Diameter protocol packet and send the packet to the BRAS. According to the embodiment of the present invention, the gateway device participates in the EAP authentication process between the BRAS and the authentication server, and only utilizes the RADIUS/Diameter function supported by the BRAS, and does not need to implement the interface with the authentication server and the EAP message identification function on the BRAS. So can you reduce the BRAS? The creation makes it easier to access mobile networks.

FIG. 3 is a schematic block diagram of an apparatus 200 for accessing a mobile network, in accordance with one embodiment of the present invention. An example of a device 200 is a gateway device 14, such as a PGW, in the system 10 of FIG. The receiving module 210 and the transmitting module 220 of Fig. 3 are similar to those of 110 and 120 of Fig. 2, and thus detailed descriptions are omitted as appropriate herein.

In addition to the receiving module 210 and the transmitting module 220, the apparatus 200 also includes an allocation module 230. The allocating module 230 allocates an IP address to the UE according to the pre-configured access point name (APN, Access Point Name) or the access point name included in the subscription data of the UE. The receiving module 210 receives the contract data of the UE from the authentication server while receiving the EAP success response message from the authentication server.

For example, the gateway device (e.g., PGW) may also be responsible for assigning an IP address to the UE. The foregoing APN may be pre-configured by the network side or may be obtained from the subscription data of the UE. The present invention is not limited thereto, and the APN may be acquired by other means. In addition, the foregoing authentication server may send the EAP success response message, the subscription data, and the APN encapsulated in the RADIUS/Diameter protocol message to the PGW, so that the PGW allocates an IP address to the UE according to the APN.

Optionally, as another embodiment, the apparatus 200 further includes: a configuration module 240. The configuration module 240 configures a VPN (Virtual Private Network) tunnel between the device 200 and the access server to exchange data with the access server through the VPN tunnel.

For example, the PGW can configure a VPN tunnel between the PGW and the BRAS according to the IP address, for example, a GRE (Generic Route Encapsulation) tunnel, after the IP address is assigned to the UE. Since the BRAS also supports the VPN tunnel function, the PGW and the BRAS can perform user plane data communication through the VPN tunnel. For example, the PGW selects the VPN tunnel according to the IP address of the UE to send downlink data to the BRAS. According to an embodiment of the present invention, when implementing access to a mobile network, it is only necessary to perform a function pair supported by the BRAS. The BRAS is configured without adding new features.

The embodiment of the present invention can use the gateway device to participate in the authentication process of the user equipment, and use the gateway device to send the success response message returned by the authentication server to the access server together with the IP address allocated for the user equipment. In addition, you can use the VPN tunnel function of the access server to perform data communication on the user plane. Since only the basic functions supported by the access server are utilized in the above process, the modification of the access server can be reduced, thereby making it easier to access the mobile network.

4 is a schematic block diagram of an apparatus 300 for accessing a mobile network, in accordance with one embodiment of the present invention. An example of a device 300 is a gateway device 14, such as an AGW, in the system 10 of FIG. 1, including a receiving module 310 and a transmitting module 320. 310 and 320 of Fig. 4 are similar to 110 and 120 of Fig. 2, and thus detailed descriptions are omitted as appropriate herein.

In addition to the receiving module 310 and the transmitting module 320, the apparatus 300 further includes an acquisition module 330. The obtaining module 330 obtains an IP address assigned to the UE from an independent packet data gateway (e.g., PGW) after receiving the EAP success response message from the authentication server.

According to an embodiment of the present invention, the obtaining module 330 acquires an IP address allocated for the UE from the packet data gateway according to an access point name or a pre-configured access point name included in the subscription data of the UE, where the receiving module is at 310. Receiving the EAP success response message from the authentication server, receiving the subscription data of the UE from the authentication server.

For example, the AGW may carry the APN in the GTP/PMIP tunnel request message sent to the PGW, and the PGW allocates an IP address to the UE according to the APN, and carries the PGW to the UE in the GTP/PMIP tunnel response message returned to the AGW. IP address. In addition, the above APN can be pre-configured by the network side. Optionally, the APN may also be obtained from the subscription data of the UE. The present invention is not limited thereto, and the above APN may be acquired by other means. The authentication server can send the EAP success response message, the subscription data, and the APN package to the AGW in the R ADIUS/Diameter protocol message.

Optionally, as another embodiment, the apparatus 300 further includes: a configuration module 340, an establishing module 360, and a binding module 350.

The configuration module 340 configures a VPN tunnel between the device 300 and the access server. The setup module 360 establishes a GTP/PMIP tunnel with the packet data gateway described above. The binding module 350 binds the GTP/PMIP tunnel and the VPN tunnel to exchange data between the access server and the score group gateway through the bound GTP/PMIP tunnel and the VPN tunnel. For example, the AGW may configure, by the configuration module 340, the VPN tunnel (for example, a GRE tunnel) between the AGW and the BRAS according to the IP address after the obtaining module 330 obtains the IP address from the PGW, and may establish a GTP/between the PGW. PMIP tunnel. In addition, the AGW can establish a mapping relationship between the VPN tunnel and the GTP PMIP tunnel to bind the VPN tunnel and the GTP/PMIP tunnel. Since the BRAS also supports the VPN tunnel function, the AGW and the BRAS can perform user plane data communication through the VPN tunnel. For example, after receiving the downlink data sent by the PGW from the GTP PMIP tunnel, the AGW according to the VPN tunnel and the GTP/PMIP tunnel. The mapping relationship between the VPN tunnels is selected to send downlink data to the BRAS. In addition, after receiving the uplink data sent by the BRAS from the VPN tunnel, the AGW selects the GTP tunnel to send uplink data to the PGW according to the mapping relationship between the VPN tunnel and the GTP/PMIP tunnel.

The embodiment of the present invention can use the gateway device to participate in the EAP authentication process for the user equipment, and use the gateway device to send the EAP success response message returned by the authentication server to the access server together with the IP address allocated for the user equipment. In addition, you can use the VPN tunnel function of the access server to perform data communication on the user plane. Since only the basic functions supported by the access server are utilized in the above process, the modification of the access server can be reduced, thereby making it easier to access the mobile network.

Figure 5 is a schematic block diagram of an apparatus 400 for accessing a mobile network, in accordance with one embodiment of the present invention. An example of a device 400 is the access server 13, such as the BRAS, in the system 10 of FIG. The apparatus 400 includes: a receiving module 410 and a transmitting module 420.

The receiving module 410 receives an EAP Success Response message from the gateway device and an IP address assigned to the UE. The sending module 420 sends the EAP success response message to the user equipment, where the receiving module 410 further receives an IP connection setup request message sent by the user equipment after receiving the EAP success response message, and the sending module 420 further receives the message in the receiving module 410. After the IP connection establishment request message, the IP connection establishment response message is sent to the user equipment, and the IP connection establishment response message carries the IP address, so that the user equipment accesses the mobile network according to the IP address.

According to an embodiment of the present invention, when performing the EAP authentication, the receiving module 410 is connected from the UE. Receiving an EAP authentication message, and the sending module 420 sends the UI authentication message to the gateway device, so that the gateway device forwards the UI authentication message to the authentication server, and completes the UI authentication between the UE and the authentication server. And after the authentication of the user equipment is successful, the receiving module 410 receives the success response message and the IP address assigned to the user equipment from the gateway device.

For example, the foregoing EAP authentication message may be an EAP authentication response message. For example, the UE sends a message triggering EAP authentication to the BRAS when performing authentication or accessing the PS service. After receiving the message, the BRAS sends an EAP authentication request message to the UE, and the UE sends an EAP to the BRAS after receiving the EAP authentication request message. Authentication response message.

According to the embodiment of the present invention, the receiving module 410 receives an EAP success response message and an IP address encapsulated in the first RADIUS/Diameter protocol, and the sending module 420 sends the encapsulated in the first RADIUS/Diameter to the gateway device. EAP authentication message in the protocol packet.

According to an embodiment of the present invention, if the receiving module 410 receives the IP connection establishment request message from the user equipment before the EAP authentication succeeds, the EAP authentication succeeds and the receiving module 410 receives the new IP connection from the user equipment again. After the request message is established, the sending module 420 sends an IP connection setup response message to the user equipment, where the IP connection setup response message carries the IP address.

The above-mentioned EAP success response message and the above-mentioned IP address can be sent to the BRAS by the gateway device in the RADIUS/Diameter protocol packet, and the BRAS obtains the IP address, for example, decapsulating the RADIUS/Diameter protocol packet. The embodiment according to the present invention is not limited thereto. For example, the above EAP success response message and the above IP address may also be sent in separate messages. According to the present invention, only the RADIUS/Diameter function supported by the BRAS is used to communicate with the authentication server through the gateway device, and the EAP authentication can be realized without implementing the interface with the authentication server and the EAP message identification function on the BRAS, thereby reducing the BRAS transformation. , making it easier to access mobile networks.

According to an embodiment of the present invention, the above IP connection establishment request message may be DHCP (Dynamic) Host Configuration Protocol, request message, the above IP connection setup response message may be a DHCP response message.

In addition, for the data card type UE, when the UE accesses the packet service, the DHCP request message may be sent before the EAP authentication process is completed. In this case, in order to ensure successful acquisition of the IP address assigned to the UE, the EAP authentication may be performed. After completion, or after the gateway device configures an IP address for the UE and sends it to the BRAS, the UE sends an IP connection establishment request message to the BRAS again.

In the embodiment of the present invention, when accessing the mobile network, the access server may receive an IP address sent together with the EAP success response message from the gateway device participating in the EAP authentication. Since the basic functions already supported by the access server are utilized in the above process, the modification of the access server can be reduced, thereby making it easier to access the mobile network.

Figure 6 is a schematic block diagram of an apparatus 500 for accessing a mobile network, in accordance with one embodiment of the present invention. An example of the device 500 is the access server 13, for example, the BRAS in the system 10 of FIG. 1, comprising: a receiving module 510, a transmitting module 520, and a configuration module 530. 510 and 520 of Fig. 6 are similar to 410 and 420 of Fig. 5, and thus detailed descriptions are omitted as appropriate herein.

The configuration module 530 configures a VPN tunnel between the device 500 and the gateway device to exchange data with the gateway device through the VPN tunnel. For example, the BRAS can statically configure a VPN tunnel (eg, a GRE tunnel) between the BRAS and the gateway device through the configuration module 530. Since the BRAS itself supports the VPN tunnel function, the BRAS and the gateway device can perform user plane data communication through the VPN tunnel. For example, the BRAS can select the VPN tunnel according to the user's domain information ( Domain ) according to the statically configured VPN routing table ( For example, a GRE tunnel) encapsulates and forwards upstream data.

In the embodiment of the present invention, when accessing the mobile network, the access server may use the supported functions to receive the IP address sent from the gateway device along with the EAP success response message, and use the VPN tunnel function to perform data communication on the user plane. Since the basic functions already supported by the access server are utilized in the above process, the modification of the access server can be reduced, thereby making it easier to access the mobile network.

FIG. 7 is a schematic structural diagram of a user equipment UE 600 according to an embodiment of the present invention. The UE 600 includes: a receiving module 610 and a transmitting module 620. The UE 600 is an example of the UE 11 in the system 10 of Fig. 1, for example, a data card type UE.

The sending module 610 sends an EAP authentication message to the access server, so as to be associated with the authentication server. EAP authentication for the UE is completed.

The receiving module 610 receives an EAP success response message from the access server, where the sending module 620 sends an IP connection establishment request message to the access server before the EAP authentication succeeds, after the receiving module 610 receives the EAP success response message. The sending module 620 sends a new IP connection establishment request message to the access server to obtain an IP address configured by the gateway device for the user equipment, and the receiving module 610 further receives an IP connection establishment response message from the access server, where the IP connection is The establishment response message carries the IP address. The EAP success response message and the foregoing IP address may be sent by the gateway device to the BRAS in a RADIUS/Diameter protocol message, and the BRAS may extract the IP address from the RADIUS/Diameter protocol message by decapsulating the BRAS.

According to an embodiment of the present invention, the foregoing IP connection establishment request message may be a DHCP request message, and the IP connection establishment response message may be a DHCP response message.

In addition, for the data card type UE, when the UE accesses the packet service, the DHCP request message may be sent before the EAP authentication process is completed. In this case, in order to ensure successful acquisition of the IP address assigned to the UE, the EAP authentication may be performed. After completion, or after the gateway device configures an IP address for the UE and sends it to the BRAS, the UE sends a DHCP request message to the BRAS again.

The embodiment of the present invention can utilize the gateway device to participate in the EAP authentication process for the user equipment, and publicly utilize the basic functions of the access server, thereby reducing the modification of the access server. In addition, according to the embodiment of the present invention, the UE sends an IP connection setup request message to the access server again after the EAP authentication is completed, to ensure successful acquisition of the allocated IP address.

FIG. 8 is a schematic flow diagram of a method 700 for accessing a mobile network, in accordance with one embodiment of the present invention. The method 700 of Figure 8 can be performed by the gateway device of Figures 2, 3 and 4.

710. Receive an EAP success response message from the authentication server.

720. Send the EAP success response message and an IP address allocated to the UE to the access server, so that the access server forwards the EAP success response message to the UE, and after the UE obtains the IP address from the access server, Accessing the mobile network according to the IP address.

The embodiment of the present invention can use the gateway device to participate in the EAP authentication process for the user equipment, and use the gateway device to send the EAP success response message returned by the authentication server to the access server together with the IP address allocated for the user equipment. Since the basic functions already supported by the access server are utilized in the above process, the modification of the access server can be reduced, thereby making it easier to access the mobile network. According to the embodiment of the present invention, when performing the EAP authentication, the EAP authentication message sent by the UE is received from the access server, and the EAP authentication message is sent to the authentication server, so that the UE and the authentication server complete the pair. The EAP authentication of the UE, and after the EAP authentication of the user equipment by the authentication server is successful, the EAP success response message is received from the authentication server.

According to another embodiment of the present invention, the method 700 further includes: after the EAP authentication to the UE is successful, receiving an EAP success response message from the authentication server; according to the pre-configured access point name or the subscription included in the subscription data of the UE The in-point name assigns the IP address to the UE, and the subscription data of the UE is received from the authentication server while receiving the EAP success response message from the authentication server.

According to another embodiment of the present invention, the method 700 further includes: transmitting the EAP success response message and an IP address assigned to the UE to the access server, so that the access server forwards the EAP success response message to the UE, and After acquiring the IP address from the access server, the UE accesses the mobile network according to the IP address.

According to another embodiment of the present invention, the method 700 further includes: configuring a VPN tunnel with the access server to interact with the access server through the VPN tunnel.

According to another embodiment of the present invention, the method 700 further includes: obtaining the IP address assigned to the UE from the packet data gateway after receiving the EAP Success Response message from the authentication server.

According to an embodiment of the present invention, when the IP address assigned to the UE is obtained from the packet data gateway, the access point name included in the subscription data of the UE or the pre-configured access point name is obtained from the packet data gateway. An IP address assigned to the UE, wherein the UE's subscription data is received from the authentication server while receiving the EAP Success Response message from the authentication server.

According to another embodiment of the present invention, the method 700 further includes: configuring a VPN tunnel with the access server; establishing a GTP/PMIP tunnel with the packet data gateway; binding the GTP/PMIP tunnel and the VPN tunnel, so that Data is exchanged between the access server and the score group gateway by the bound GTP/PMIP tunnel and the VPN tunnel.

In 710, the EAP authentication message encapsulated in the first RADIUS/Diameter protocol packet is received from the access server, and the EAP authentication message encapsulated in the first RADIUS/Diameter protocol packet is sent to the authentication server.

In 720, an IP address and an EAP success response message encapsulated in the second RADIUS/Diameter protocol packet are sent to the access server. 9 is a schematic flow diagram of a method 800 for accessing a mobile network, in accordance with one embodiment of the present invention. The method 800 of Figure 9 can be performed by the access server of Figures 5 and 6, for example, by the BRAS.

810. Receive an EAP success response message from the gateway device and an IP address assigned by the gateway device to the UE.

820. Send the EAP success response message to the UE.

830. Receive an IP connection setup request message sent by the UE after receiving the EAP success response message.

840. After receiving the IP connection setup request message, send an IP connection setup response message to the user equipment, where the IP connection setup response message carries the IP address, so that the user equipment accesses the mobile network according to the IP address.

According to an embodiment of the present invention, when EAP authentication is performed, an EAP authentication message is received from the UE, and the EAP authentication message is sent to the gateway device, so that the gateway device forwards the EAP authentication message to the authentication server, and causes the UE to The authentication server completes the EAP authentication for the UE, and after the authentication server succeeds in EAP authentication to the user equipment, receives an EAP success response message from the gateway device and an IP address assigned by the gateway device to the user equipment.

According to an embodiment of the present invention, the method further comprises: if the IP connection establishment request message is received from the UE before the EAP authentication succeeds, then in 840, the EAP authentication is successful and a new one is received from the user equipment again. After the IP connection setup request message, the IP connection setup response message is sent to the user equipment.

According to another embodiment of the present invention, the method 800 further includes: configuring a VPN tunnel with the gateway device to interact with the gateway device through the VPN tunnel.

In 810, the EAP success response message encapsulated in the first RADIUS/Diameter protocol packet and the IP address are received from the gateway device.

According to an embodiment of the present invention, when the EAP authentication message is sent to the gateway device, the EAP authentication message encapsulated in the first RADIUS/Diameter protocol is sent to the gateway device. FIG. 10 is a schematic flowchart of a method for accessing a mobile network according to an embodiment of the present invention. The method 900 of FIG. 10 can be performed by the UE of FIG.

910. Send an EAP authentication message to the access server, so as to complete EAP authentication for the UE with the authentication server.

920. If an IP connection establishment request message is sent to the access server before the EAP authentication succeeds, after receiving the EAP success response message from the access server, send a new IP connection establishment request to the access server again. The message is obtained by obtaining the IP address configured by the gateway device for the user device.

930. Receive an IP connection setup response message from the access server, where the IP connection establishment response message carries the IP address.

According to an embodiment of the present invention, the foregoing EAP success response message and the foregoing IP address may be encapsulated in a RADIUS/Diameter protocol message by the gateway device and sent to the BRAS, and may be decapsulated by the BRAS from the RADIUS/Diameter protocol message. Extract the IP address.

The embodiment of the present invention can utilize the gateway device to participate in the EAP authentication process for the user equipment, and publicly utilize the basic functions of the access server, thereby reducing the modification of the access server. In addition, according to the embodiment of the present invention, the UE sends an IP connection establishment request message to the access server again after the EAP authentication is completed, to ensure successful acquisition of the allocated IP address.

11 is a schematic flow chart of a process of accessing a mobile network according to an embodiment of the present invention. The process of Figure 11 is an example of the method of Figures 8, 9, and 10, wherein the WLAN WiFi accesses the 3GPP SAE (System Architecture Evolution) network in a trusted access method.

1010. The UE sends a message for triggering EAP authentication. For example, when the UE performs authentication or accesses the packet service, the AP sends an EAPOL-start message to the AC (Access Controller, Wireless Controller) / BRAS to trigger the EAP authentication process.

1015. After receiving the message triggering EAP authentication, the BRAS sends an EAP authentication request message to the UE. For example, after receiving the EAPOL-start message, the BRAS sends an EAP request/Identity message to the UE to request the UE's ID (identity, Identity).

1020. The UE sends an EAP authentication response message to the BRAS, for example, an EAP Response/Identity message carrying a NAK network access identifier for identifying the identity of the UE, a Network Access Identifier, and a NAI including the UE ID (IMSI (International Mobile) Subscriber Identification Number, information and domain information, for example, NAI1 = 0<IMSI>@ wlan.mnc.mcc.3gppnetwork.org.

1025. The BRAS encapsulates the EAP authentication response message into a RADIUS Diameter protocol packet, and sends the RADIUS/Diameter protocol packet to the corresponding PGW. For example, in order to implement the routing of the signaling, the BRAS configures the PGW as the next hop route of the RADIUS/Diameter protocol packet.

1030. The PGW forwards the RADIUS/Diameter protocol packet encapsulating the EAP authentication response message to the 3GPP AAA Server/HSS according to the NAI.

1035, UE, BRAS and 3GPP AAA Server HSS perform EAP-SIM/AKA process. The EAP-SIM/AKA process is similar to the conventional EAP-SIM/AKA process and will not be described here.

1040, the UE receives a request/SIM/notification during the EAP-SIM/AKA process (eg,

In the case of an EAP Request/SIM/Notification message, an EAP authentication response/SIM/notification message (for example, EAP Response/SIM otification) is sent to the BRAS through the AP.

1045, BRAS forwards EAP authentication response / SIM / notification to PGW. For example, the BRAS can encapsulate the EAP authentication response/SIM/notification into a RADIUS/Diameter protocol packet and forward the RADIUS/Diameter protocol packet to the PGW.

1050. The PGW forwards the RADIUS/Diameter protocol packet to the 3GPP AAA Server HSS.

1055. After the EAP authentication succeeds, the 3GPP AAA Server/HSS may send an EAP Success Response (eg, EAP Success) message to the PGW. In addition, the 3GPP AAA Server/HSS may also send the UE's subscription data (eg, user profile) to the PGW. The subscription data of the UE may include the subscription APN of the UE. Optionally, the 3GPP AAA Server HSS may also send the default APN (default APN) pre-configured on the network side to the PGW together with the subscription data of the UE.

1060. The PGW allocates an IP address according to the pre-configured APN or the UE's subscription APN.

1070. The PGW encapsulates the IP address and the EAP success response message in a RADIUS/Diameter message and sends the packet to the BRAS.

1075, the BRAS forwards the EAP success response message to the UE. For example, the BRAS decapsulates the RADIUS/Diameter packet to extract an EAP success response message, and sends an EAP success response message to the UE.

After receiving the EAP success response message, the UE sends a DHCP Request message to the BRAS through the AP.

1085, after receiving the DHCP request message, the BRAS sends a DHCP response to the UE (DHCP). Response) The DHCP response message carries the IP address assigned by the PGW to the UE.

1090. A virtual private network VPN tunnel is configured between the BRAS and the PGW, so that the BRAS and the PGW exchange data (for example, IP packets) through the VPN tunnel.

For example, the BRAS can use the VPN tunnel to send uplink data to the PGW. The VPN routing table can be statically configured on the BRAS, as shown in Table 3. According to the VPN routing table, the BRAS selects a VPN tunnel (for example, a GRE tunnel) to encapsulate and forward the uplink data according to the domain information (Domain) of the UE.

Table 1

For example, the PGW can encapsulate and forward downlink data using a VPN (e.g., GRE P tunnel) tunnel. The mapping between the IP address of the UE and the VPN tunnel can be dynamically maintained on the PGW according to the IP address assigned by the PGW to the UE, as shown in Table 2. For example, the PGW selects a GRE tunnel to transmit data according to the IP address of the UE.

Table 2

FIG. 12 is a schematic flowchart of a process of accessing a mobile network according to an embodiment of the present invention. The process of Figure 12 is an example of the method of Figures 8, 9, and 10. 1110, 1115, 1120, 1135, 1140, 1175, 1180, and 1185 in the process of FIG. 12 are similar to 1010, 1015, 1020, 1035, 1040, 1075, 1080, and 1085 of the process of FIG. 11, respectively, and are appropriately described herein. .

1110. The UE sends a message for triggering EAP authentication.

1115. After receiving the message for triggering EAP authentication, the BRAS sends an EAP authentication request message to the UE.

1120. The UE sends an EAP authentication response message to the BRAS, for example, an EAP Response/Identity message, where the NAI is used to identify the identity of the UE, and the NAI includes the UE ID (IMSI information) and the domain information.

1125. The BRAS encapsulates the EAP authentication response message into a RADIUS Diameter protocol packet, and sends the RADIUS/Diameter protocol packet to the corresponding PGW. For example, to implement routing of the signaling, the BRAS configures the AGW as the next hop route of the RADIUS/Diameter protocol packet. 1130. The AGW forwards the RADIUS/Diameter protocol packet encapsulating the EAP authentication response message to the 3GPP AAA Server/HSS according to the NAI.

1135. The UE, BRAS, and 3GPP AAA Server/HSS perform an EAP-SIM/AKA process.

1140. In the EAP-SIM/AKA process, when the UE receives the EAP request/SIM/notification message, the AP sends an EAP authentication response/SIM/notification message to the BRAS.

1145, BRAS forwards EAP authentication response / SIM / notification to AGW. For example, the BRAS can encapsulate the EAP authentication response/SIM/notification message into a RADIUS Diameter protocol packet, and forward the RADIUS/Diameter protocol message to the AGW.

1150. The AGW forwards the RADIUS/Diameter protocol packet to the 3GPP AAA Server HSS.

1155. After the EAP authentication succeeds, the 3GPP AAA Server/HSS may send an EAP Success Response (eg, EAP Success) message to the AGW. In addition, the 3GPP AAA Server/HSS may also send the UE's subscription data (for example, user profile) to the AGW. The subscription data of the UE may include the subscription APN of the UE. Optionally, the 3GPP AAA Server/HSS may also send the default APN (default APN) pre-configured by the network side to the AGW together with the subscription data of the UE. The 3GPP AAA Server/HSS can send the EAP success response message, the subscription data, and the APN in the RADIUS Diameter protocol packet to the AGW.

1157. The AGW sends a tunnel establishment request message to the 3GPP AAA Server/HSS. For example, when receiving the RADIUS/Diameter protocol packet, the AGW may discover or select the PGW according to the pre-configured APN or the UE subscription APN, and send a GTP/PMIP tunnel establishment request message to the PGW, for example, Create PDP Request message or Proxy. Update (with APN and UE ID) messages.

1160. The PGW allocates an IP address to the UE according to the pre-configured APN or the subscription APN of the UE. 1165. The PGW replies to the AGW with a GTP/PMIP tunnel establishment response message, for example, a Create PDP Response message or a Proxy Update ACK message, to establish a GTP/PMIP tunnel with the AGW. In addition, the GTP/PMIP tunnel setup response message carries an IP address allocated for the UE.

1170. The AGW encapsulates the IP address and the EAP success response message in a RADIUS/Diameter message and sends the packet to the BRAS.

1175. The BRAS forwards the EAP success response message to the UE.

1180. After receiving the EAP success response message, the UE sends a DHCP request message to the BRAS through the AP. After receiving the DHCP request message, the BRAS sends a DHCP response message to the UE, where the DHCP response message carries the IP address allocated by the PGW to the UE.

1190. A virtual private network VPN tunnel is configured between the BRAS and the PGW, so that the BRAS and the PGW exchange data (for example, IP packets) through the VPN tunnel. In addition, the GGW/PMIP tunnel and the VPN tunnel are bound by the AGW to exchange data between the BRAS and the PDG through the bound GTP/PMIP tunnel and the VPN tunnel.

For example, the BRAS can use the VPN tunnel to send uplink data to the AGW. The VPN routing table can be statically configured on the BRAS, as shown in Table 3. Based on the VPN routing table, the BRAS selects a VPN tunnel (for example, a GRE tunnel) to encapsulate and forward the uplink data according to the domain information (Domain) of the UE.

table 3

For example, the AGW may use a VPN (e.g., GRE tunnel) tunnel to send downlink data to the BRAS, and may use the GTP/PMIP tunnel to send uplink data to the PGW. The AGW can be bound to the VPN tunnel and the GTP/PMIP tunnel. That is, the mapping between the VPN tunnel and the GTP/PMIP tunnel is dynamically maintained on the AGW according to the IP address assigned by the PGW to the UE, as shown in Table 2. The AGW selects a GRE tunnel or a GTP tunnel to transmit the data according to the IP address of the UE included in the data (for example, an IP packet).

Table 4

13 is a schematic diagram of a system architecture for accessing a mobile network, in accordance with one embodiment of the present invention. In the system shown in Figure 13, the UE 1210 accesses the WLAN AViFi through the AP 1220.

The BRAS 1230 of WLAN AViFi is directly connected to the PGW 1240. The BRAS 1230 and the PGW 1240 communicate with each other through the RADIUS Diameter packet, and communicate with the user plane through the VPN tunnel. The PGW 1240 is responsible for assigning an IP address to the UE 1210 and completing the UE's authentication process with the 3GPP AAA 1250/HSS 1260.

14 is a schematic diagram of a system architecture for accessing a mobile network, in accordance with one embodiment of the present invention. In the system shown in FIG. 14, the UE 1310 accesses WLAN/WiFi through the AP 1320, and the AGW 1340 is connected between the BRAS 1330 and the PGW 1370 of the WLAN/WiFi. BRAS 1330 and The signaling plane between the AGWs 1340 communicates through RADIUS Diameter messages. The AGW 1340 communicates with the PGW 1370 through the GTP/PMIP tunnel for the communication plane, communicates with the BRAS 1330 through the VPN tunnel, and dynamically generates the VPN tunnel and the GTP/PMIP tunnel according to the IP address assigned to the UE. Binding relationship. The PGW 1370 is responsible for assigning an IP address to the UE 1310. The AGW 1340 completes the authentication process for the UE 1310 with the 3GPP AAA 1350/HSS 1360.

According to an embodiment of the present invention, the UE provides the 3GPP network through tunnelless access, and the service experience is consistent with the 3GPP access. Secondly, the impact on the BRAS is small according to the embodiment of the present invention, because the VPN tunnel function and the RADIUS/Diameter protocol function related to the embodiment of the present invention are the basic functions of the BRAS, and the 3GPP network can be realized through a simple configuration. Access. In addition, the functions of the 3GPP AAA interface and the EAP message identification according to the embodiments of the present invention need not be implemented on the BRAS, so the impact on the current WLAN WiFi access network is small and easy to implement.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in a combination of electronic hardware or computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that the specific working process of the system, the device and the unit described above can be referred to the corresponding process in the foregoing method embodiments for the convenience and brevity of the description, and details are not described herein again.

In the several embodiments provided herein, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. You can choose some of them according to actual needs or All units are used to achieve the objectives of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions may be stored in a computer readable storage medium, including thousands of instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform all of the methods described in various embodiments of the present invention. Or part of the steps. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or a disk, and the like, which can store program codes. .

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Rights request

1. An apparatus for accessing a mobile network, comprising:

a receiving module, configured to receive an extensible authentication protocol EAP success response message from the authentication server, and a sending module, configured to send the EAP success response message and an Internet Protocol IP address allocated to the user equipment to the access server.

The device according to claim 1, wherein the receiving module is configured to receive an EAP authentication message sent by the user equipment from the access server, where the sending module performs the EAP authentication, the sending module And sending the EAP authentication message to the authentication server, so that the EAP authentication of the user equipment is completed between the user equipment and the authentication server, and the EAP authentication is performed on the user equipment in the authentication server. After the success, the receiving module is configured to receive the EAP success response message from the authentication server.

The device according to claim 1 or 2, further comprising: an allocation module, configured to: according to the pre-configured access point name or the access point name included in the subscription data of the user equipment The user equipment allocates the IP address, wherein the receiving module receives the subscription data of the user equipment from the authentication server while receiving the EAP success response message from the authentication server.

The device according to any one of claims 1 to 3, further comprising: a configuration module, configured to configure a virtual private network VPN tunnel with the access server, to pass the The VPN tunnel exchanges data with the access server.

The device according to claim 1 or 2, further comprising: an obtaining module, configured to acquire, as the user, a packet data gateway after receiving the EAP success response message from the authentication server The IP address assigned by the device.

The device according to claim 5, wherein the acquiring module is configured to use the access point name included in the subscription data of the user equipment or a pre-configured access point name from the packet data gateway. Acquiring an IP address assigned to the user equipment, where the receiving module is configured to receive subscription data of the user equipment from the authentication server while receiving the EAP success response message from the authentication server.

The device according to claim 5 or 6, further comprising:

a configuration module, configured to configure a VPN tunnel with the access server;

Establishing a module, configured to establish a general packet radio service technology tunneling protocol/proxy mobile internet protocol GTP PMIP tunnel with the packet data gateway; a binding module, configured to bind the GTP PMIP tunnel and the VPN tunnel, to pass the bound GTP/PMIP tunnel and the VPN tunnel between the access server and the score group gateway Interactive data.

8. An apparatus for accessing a mobile network, comprising:

a receiving module, configured to receive an EAP success response message from the gateway device and an IP address allocated to the user equipment; and

a sending module, configured to send the EAP success response message to the user equipment, where the receiving module further receives an IP connection establishment request message sent by the user equipment after receiving the EAP success response message, where the sending After the receiving module receives the IP connection establishment request message, the module sends an IP connection setup response message to the user equipment, where the IP connection setup response message carries the IP address, so that the user equipment according to the The IP address is accessed to the mobile network.

The device according to claim 8, wherein, when performing the EAP authentication, the receiving module is configured to receive an EAP authentication message from the user equipment, and the sending module is configured to use the gateway The device sends the EAP authentication message, so that the gateway device forwards the EAP authentication message to the authentication server, and completes EAP authentication to the user equipment between the user equipment and the authentication server, and is in the right After the EAP authentication of the user equipment is successful, the receiving module is configured to receive the EAP success response message and an IP address allocated for the user equipment from the gateway device.

The device according to claim 8 or 9, wherein if the receiving module receives the IP connection establishment request message from the user equipment before the EAP authentication succeeds, the EAP authentication succeeds and After the receiving module receives the new IP connection establishment request message from the user equipment, the sending module is configured to send an IP connection setup response message to the user equipment, where the IP connection setup response message carries the IP address.

The apparatus according to any one of claims 8 to 10, further comprising:

And a configuration module, configured to configure a VPN tunnel with the gateway device, so as to exchange data with the gateway device by using the VPN tunnel.

12. A user equipment, comprising:

a sending module, configured to send an EAP authentication message to the access server, to complete EAP authentication with the user equipment with the authentication server; a receiving module, configured to receive an EAP success response message from the access server, where

If the sending module sends an IP connection establishment request message to the access server before the EAP authentication succeeds, after the receiving module receives the EAP success response message, the sending module again reports to the The access server sends a new IP connection establishment request message to obtain an IP address configured by the gateway device for the user equipment, and the receiving module further receives an IP connection establishment response message, the IP connection establishment response message from the access server. Carrying

IP address.

13. A method for accessing a mobile network, comprising:

Receiving an EAP success response message from the authentication server;

Sending the EAP success response message and an IP address allocated to the user equipment to the access server, so that the access server forwards the EAP success response message to the user equipment, and the user equipment is in the slave device After the server obtains the IP address, the mobile network is accessed according to the IP address.

14. The method of claim 13 wherein:

Receiving, by the user equipment, the sending by the user equipment when performing the EAP authentication.

The EAP authentication message is sent to the authentication server, and the EAP authentication response message is received from the authentication server after the EAP authentication of the user equipment by the authentication server is successful.

The method according to claim 13 or 14, further comprising: allocating the user equipment according to a pre-configured access point name or an access point name included in the subscription data of the user equipment The IP address, wherein the subscription data of the user equipment is received from the authentication server while receiving the EAP success response message from the authentication server.

The method according to any one of claims 13 to 15, further comprising:

A VPN tunnel is established with the access server to exchange data with the access server through the VPN tunnel.

17. The method according to claim 13 or 14, further comprising: obtaining an IP address assigned to the user equipment from a packet data gateway after receiving the EAP success response message from the authentication server .

The method of claim 17, wherein the obtaining, by the packet data gateway, an IP address allocated for the user equipment comprises:

Obtaining an IP address assigned to the user equipment from the packet data gateway according to an access point name included in the subscription data of the user equipment or a pre-configured access point name, where the receiving is received from the authentication server At the same time as the EAP success response message, the subscription data of the user equipment is received from the authentication server.

The method according to claim 17 or 18, further comprising: configuring a VPN tunnel with the access server;

Establishing a GTP/PMIP tunnel with the packet data gateway;

Binding the GTP PMIP tunnel and the VPN tunnel to pass the binding

A GTP/PMIP tunnel and the VPN tunnel exchange data between the access server and the score group gateway.

The method according to any one of claims 14 to 19, wherein the receiving, by the access server, the EAP authentication message sent by the user equipment comprises:

Receiving, by the access server, an EAP authentication message encapsulated in a first remote user dialing authentication system protocol or a diameter protocol packet,

The sending the EAP authentication message to the authentication server includes:

Sending, to the authentication server, the EAP authentication message encapsulated in the first remote user dialing authentication system protocol or the diameter protocol packet,

The sending the EAP success response message and the IP address to the access server includes:

Sending the IP address and the EAP success response message encapsulated in the second remote user dialing authentication system protocol or the diameter protocol to the access server.

A method for accessing a mobile network, comprising:

Receiving an EAP success response message from the gateway device and the gateway device assigning to the user equipment

IP address;

Sending the EAP success response message to the user equipment;

Receiving an IP connection setup request message sent by the user equipment after receiving the EAP success response message;

After receiving the IP connection establishment request message, sending an IP connection setup response message to the user equipment, where the IP connection setup response message carries the IP address, so that the user The device accesses the mobile network according to the IP address.

22. The method according to claim 21, wherein, when performing EAP authentication, receiving an EAP authentication message from the user equipment, and transmitting the EAP authentication message to a gateway device, so that the gateway device The EAP authentication message is forwarded to the authentication server, and the EAP authentication of the user equipment is completed between the user equipment and the authentication server, and after the EAP authentication of the user equipment by the authentication server is successful, the EAP authentication message is received from the gateway device. An EAP success response message and an IP address assigned by the gateway device to the user equipment.

The method according to claim 21 or 22, wherein if the IP connection establishment request message is received from the user equipment before the EAP authentication succeeds, the receiving the IP connection After the request message is established, sending an IP connection setup response message to the user equipment, including:

After the EAP authentication succeeds and the new IP connection setup request message is received again from the user equipment, the IP connection setup response message is sent to the user equipment.

The method according to any one of claims 21 to 24, further comprising:

And configuring a VPN tunnel with the gateway device to exchange data with the gateway device through the VPN tunnel.

The method according to any one of claims 22 to 24, wherein the receiving an EAP success response message from the gateway device and an IP address allocated by the gateway device to the user equipment, including :

Receiving, by the gateway device, the EAP success response message and the IP address encapsulated in a first remote user dialing authentication system protocol or a diameter protocol packet,

The sending the EAP authentication message to the gateway device includes:

And transmitting, to the gateway device, the EAP authentication message encapsulated in the first remote user dialing authentication system protocol or the path protocol.

26. A method for accessing a mobile network, comprising:

Sending an EAP authentication message to the access server to complete EAP authentication with the user equipment with the authentication server;

If the IP connection establishment request message is sent to the access server before the EAP authentication succeeds, after receiving the EAP success response message from the access server, the new IP is sent to the access server again. a connection establishment request message to obtain a gateway device as the user IP address of the device configuration;

And receiving, by the access server, an IP connection setup response message, where the IP connection establishment response message carries the IP address.