WO2013037273A1

WO2013037273A1 - User equipment capability processing method and system

Info

Publication number: WO2013037273A1
Application number: PCT/CN2012/081004
Authority: WO
Inventors: 周星月; 朱春晖
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-09-13
Filing date: 2012-09-05
Publication date: 2013-03-21
Also published as: CN103002429A; CN103002429B

Abstract

A user equipment capability processing method comprises: during the establishment of an Internet key exchange protocol tunnel between a terminal and an evolved packet data gateway, the evolved packet data gateway provides an authentication authorization accounting (AAA) server with capability information stating whether the terminal has the Internet key exchange protocol redirection function.

Description

Method and system for processing user equipment capabilities

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method and system for processing user equipment capabilities.

Background technique

The Evolved Packet System (EPS) in the 3rd Generation Partnership Project (3GPP) is evolved by the Evolved Universal Terrestrial Radio Access Network (Evolved Universal Terrestrial Radio Access Network). Referred to as E-UTRAN, Mobility Management Entity (MME), Serving Gateway (S-GW), Packet Data Network Gateway (P-GW or PDN) GW), Home Subscriber Server (HSS), Policy and Charging Rules Function (PCRF) entity and other supporting nodes.

As shown in Figure 1, the EPS system supports interworking with non-3GPP systems. The interworking with non-3GPP systems is implemented through the S2a/S2b/S2c interface, and the anchor point between the 3GPP and non-3GPP systems is the P-GW. Non-3GPP systems are classified into trusted non-3GPP IP access and untrusted non-3GPP IP access. The trusted non-3GPP IP access can be directly connected to the P-GW through the S2a interface; the untrusted non-3GPP IP access needs to be connected to the PDN GW through an Evolved Packet Data Gateway (ePDG), ePDG and PDN GW. The interface between S2b and S2c provides user plane-related control and mobility support between the UE and the P-GW. The supported mobility management protocol is Mobile IPv6 Support for Dual Stack Hosts and Routers, referred to as DSMIPv6).

In FIG. 1, the MME mobility management unit is responsible for control planes such as mobility management, non-access stratum signaling processing, and user mobility management context management; and the S-GW is an access gateway device connected to the E-UTRAN. Forwarding data between E-UTRAN and P-GW, and responsible for buffering paging waiting data; P-GW is EPS and packet data network (Packet Data Network, referred to as A border gateway for PDN), responsible for PDN access and forwarding data between EPS and PDN; PCRF is a policy and charging rule function entity that receives the interface Rx and the carrier network protocol (Internet Protocol, referred to as IP) The service network is connected to obtain the service information. In addition, it is connected to the gateway device in the network through the Gx/Gxa/Gxc interface, and is responsible for initiating the establishment of the IP bearer and ensuring the quality of service (QoS) of the service data. And charge control.

The UE needs to select an appropriate ePDG by connecting to the EPS system through the untrusted access system. The current technology UE selects an ePDG that is located close to the access system where the UE is located. The 3GPP AAA server may be based on the UE's IP address or the access network system. The information is selected by the UE, which is performed by the UE and the ePDG to establish an IKEv2 security association to establish an IPSec tunnel for authentication and authorization. The UE and the ePDG are required to support the IKEv2 redirection mechanism defined by the IETF (Redirect Mechanism for the IKEv2 in RFC5685). This mechanism can be used to redirect the IKEv2 server in the IKE SA INIT, IKE AUTH process or after the IKEv2 session is established. In the 3GPP scenario, the ePDG can be used to initiate the UE redirection to another ePDG. The current problem is that the 3GPP AAA server does not know whether the UE has the capability of IKEv2 redirection (this capability of the UE is not mandatory). If the 3GPP AAA server finds that the ePDG closer to the UE will notify the current ePDG, If the current ePDG notifies the UE that does not support the IKEv2 redirection, the UE will not be able to identify the content of the message or even report the error. If the current ePDG ignores the redirection indication of the 3GPP AAA, the authentication and authorization process cannot be completed. An error occurred in establishing the authentication and authorization process for the entire IKEv2 tunnel. Summary of the invention

The technical problem to be solved by the present invention is to provide a method and system for performing an evolved packet data gateway redirection decision, and solving the authentication authorization caused by the AAA server selecting a new ePDG for capability information without the Internet key exchange protocol redirection function. Process error problem.

In order to solve the above technical problem, the present invention provides a method for processing user equipment capabilities, wherein, in the process of creating an Internet Key Exchange Protocol tunnel between a terminal and an evolved packet data gateway, the evolved packet data gateway will The capability information of the terminal having the Internet Key Exchange Protocol redirection function is notified to the authentication authorization accounting server, that is, the AAA server.

Preferably, the above method may also have the following features: The AAA server determines, according to the capability information, whether to reselect an evolved packet data gateway for the terminal.

Preferably, the above method may also have the following features:

Determining, by the AAA server, whether to reselect the evolved packet data gateway for the terminal according to the capability information includes:

When the capability information indicates that the terminal has an Internet Key Exchange Protocol redirection function, the AAA server selects an evolved packet data gateway closest to the terminal for the terminal and performs an authentication process, which is selected by the authentication process. The identifier of the evolved packet data gateway is notified to the terminal;

When the capability information indicates that the terminal does not have the Internet Key Exchange Protocol redirection function, the AAA server directly performs an authentication process.

Preferably, the above method may also have the following features:

The terminal notifies the evolved packet data gateway of capability information of whether the terminal has an Internet Key Exchange Protocol redirection function in a network key exchange security association initialization procedure with the evolved packet data gateway.

Preferably, the above method may also have the following features:

The manner in which the evolved packet data gateway notifies the AAA server whether the terminal has the capability information of the Internet Key Exchange Protocol redirection function is one of the following modes:

When the redirection capability identifier is sent in the extended authentication protocol response message sent to the AAA server, the terminal has the Internet key exchange protocol redirection function. When the redirection capability identifier is not carried, the terminal does not have the Internet key exchange protocol redirection. Features;

The extended authentication protocol response message sent to the AAA server carries a redirection capability, and the different values of the redirection capability identifier indicate that the terminal has or does not have the Internet Key Exchange Protocol redirection function.

In order to solve the above technical problem, the present invention further provides a system for processing a user equipment capability, including a terminal, an evolved packet data gateway, and an authentication and authorization accounting server, that is, an AAA server, where the evolved packet data gateway includes an Internet secret. Key exchange redirection function module,

The Internet key exchange redirection function module is configured to: whether the terminal has an Intel The capability information of the network key exchange protocol redirection function is notified to the authentication function module. The AAA server includes an authentication function module. The authentication function module is configured to: determine, according to the capability information, whether to reselect an evolved packet data gateway for the terminal.

Preferably, the above system may also have the following characteristics:

The authentication function module is further configured to: determine that the capability information indicates that the terminal has an Internet Key Exchange Protocol redirection function, select an evolved packet data gateway that is closest to the terminal for the terminal, and perform an authentication process, The authentication process notifies the selected identifier of the evolved packet data gateway to the terminal; and when the capability information indicates that the terminal does not have the Internet Key Exchange Protocol redirection function, the authentication process is directly executed.

Preferably, the above system may also have the following characteristics:

The terminal is configured to: notify the evolved packet data gateway of the capability information of whether the terminal has the Internet Key Exchange Protocol redirection function in the network key exchange security association initialization procedure with the evolved packet data gateway.

In order to solve the above technical problem, the present invention further provides an evolved packet data gateway, including an Internet key exchange redirection function module, where the Internet key exchange redirection function module is configured to: The capability information of the Internet Key Exchange Protocol Redirection function is notified to the Authentication Authorization Accounting Server.

In order to solve the above technical problem, the present invention further provides an authentication and authorization accounting server, wherein the authentication and authorization accounting server includes an authentication function module; and the authentication function module is configured to: according to a terminal learned from an evolved packet data gateway. Whether the capability information of the Internet Key Exchange Protocol redirection function determines whether to reselect the evolved packet data gateway for the terminal; and when the capability information indicates that the terminal has the Internet Key Exchange Protocol redirection function, the terminal is Selecting an evolving packet data gateway that is closest to the terminal and performing an authentication process, notifying, by the authentication process, an identifier of the selected evolved packet data gateway to the terminal; determining that the capability information indicates that the terminal does not have an Internet key exchange When the protocol redirection function is performed, the authentication process is directly executed.

In this solution, the capability information of the terminal having the Internet Key Exchange Protocol redirection function is notified to the 3GPP AAA server, and the 3GPP AAA server determines, according to the capability information, whether to reselect the evolved packet data gateway for the terminal, that is, the 3GPP AAA server. Only for this ability The terminal selects a new ePDG, which can solve the problem that the AAA server selects a new ePDG for the authentication authorization process error problem for the capability information without the Internet Key Exchange Protocol redirection function. BRIEF abstract

1 is a schematic diagram of an interworking architecture between an EPS system and a non-3GPP system in the related art; FIG. 2 is a schematic diagram of a method for processing user equipment capabilities;

3 is a flowchart of a method for processing user equipment capabilities in a specific embodiment; FIG. 4 is a specific flowchart of a WLAN as an access system in the first embodiment;

FIG. 5 is a flowchart of a method for processing a user equipment capability in a second embodiment; FIG. 6 is a specific flowchart of a WLAN as an access system in the second embodiment. Preferred embodiment of the invention

The system for processing the user equipment capability includes a terminal, an ePDG, and an authentication and authorization accounting server, that is, an AAA server, where the ePDG includes an Internet key exchange redirection function module.

The Internet key exchange redirection function module is configured to notify the authentication function module whether the terminal has the capability information of the Internet key exchange protocol redirection function after receiving the Internet key exchange authentication request sent by the terminal.

The AAA server includes an authentication function module. The authentication function module is configured to determine, according to the capability information, whether to reselect the ePDG for the terminal. Specifically, the authentication function module determines that the capability information indicates that the terminal has an Internet Key Exchange Protocol redirection function, selects an ePDG that is closest to the terminal for the terminal, and performs an authentication process, and selects through an authentication process. The identifier of the ePDG is notified to the terminal; and when the capability information indicates that the terminal does not have the Internet Key Exchange Protocol redirection function, the authentication process is directly executed.

The terminal is configured to notify the ePDG of the capability information of whether the terminal has the Internet Key Exchange Protocol redirection function in the network key exchange security association initialization procedure with the ePDG.

An evolved packet data gateway, including an internet key exchange redirection function module, Medium,

The Internet key exchange redirection function module is configured to: notify the authentication authorization charging server whether the terminal has capability information of the Internet Key Exchange Protocol redirection function.

An authentication and authorization accounting server, where the authentication and authorization accounting server includes an authentication function module;

The authentication function module is configured to: determine, according to capability information of the terminal that is obtained by the evolving packet data gateway, whether the terminal has the Internet Key Exchange Protocol redirection function, whether to reselect the evolved packet data gateway for the terminal; wherein, the capability information is determined When the terminal has the Internet Key Exchange Protocol redirection function, the terminal selects an evolving packet data gateway that is closest to the terminal and performs an authentication process, and notifies the identifier of the selected evolving packet data gateway to the identifier through the authentication process. And determining, by the terminal, that the capability information indicates that the terminal does not have an Internet Key Exchange Protocol redirection function, directly performing an authentication process.

As shown in FIG. 2, the method applied to the foregoing system includes: in an Internet Key Exchange Protocol tunnel process between a terminal and an ePDG, an ePDG that receives an Internet Key Exchange Authentication Request sent by a terminal whether the terminal has The capability information of the Internet Key Exchange Protocol Redirection function is notified to the AAA server.

The AAA server determines, according to the capability information, whether to reselect the ePDG for the terminal. Specifically, the AAA server determines, according to the capability information, whether to reselect the ePDG finger for the terminal:

When the capability information indicates that the terminal has the Internet Key Exchange Protocol redirection function, the AAA server selects an ePDG that is closest to the terminal for the terminal and performs an authentication process, and the selected ePDG identifier is determined by the authentication process. Notifying to the terminal;

The terminal notifies the ePDG of the capability information of whether the terminal has the Internet Key Exchange Protocol redirection function in the network key exchange security association initialization procedure with the ePDG.

The ePDG notifies the AAA server whether the terminal has an Internet Key Exchange Protocol redirection The way of functional capability information is one of the following:

When the redirection capability identifier is carried in the extended authentication protocol response message sent to the AAA server, the terminal has the Internet key exchange protocol redirection function. When the redirection capability identifier is not carried, the terminal does not have the Internet key exchange protocol. Redirection function;

Second, the extended authentication protocol response message sent to the AAA server carries the redirection capability, and the different values of the redirection capability identifier indicate that the terminal has or does not have the Internet Key Exchange Protocol redirection function.

Specific embodiment 1

As shown in FIG. 3, in this embodiment, the UE is connected to the untrusted non-3GPP access system.

In the EPS system, UE and ePDG, in the process of creating an Internet Key Exchange Protocol (IKEv2) tunnel, the ePDG notifies the 3GPP AAA server that the UE has IKEv2 redirection capability information, and the 3GPP AAA server reselects the ePDG according to the UE. The specific process is as follows:

Step 301: The UE is connected to the non-3GPP access system, and optionally performs the authentication authorization of the non-3GPP access. In this process, the 3GPP AAA server may send the related policy information and the subscription information of the operator to the access network.

Step 302: The UE and the ePDG exchange the first pair of messages IKE_SA_INIT to negotiate an encryption algorithm, perform random number exchange, etc., in this process, the UE notifies the IKEv2 redirection capability by the REDIRECT SUPPORTED message (defined by RFC5685) ePDG;

Step 303: The UE performs the interaction of the identity authentication information by using the ePDG and the AAA server. Step 304: The UE sends an Internet Key Exchange Authentication (IKE AUTH) request message including an Extensible Authentication Protocol (EAP) message. The ePDG is configured to respond to the authentication challenge received during the identity authentication interaction, and the UE may further include the identifier information of the access network as the location information in the message;

Step 305: The ePDG sends an EAP-Response response message (with AKA challenge information) to

The 3GPP AAA server, and carries the identifier of the UE with the IKEv2 redirection capability in the message, or the flag position 1 used to indicate the UE capability information;

Steps 306-307: After receiving the response message, the 3GPP AAA server learns that the UE has IKEv2 redirection capability, according to the location information of the current UE, a neighboring ePDG identifier (which may be an IPv4 or IPv6 address of the ePDG, or an FQDN) is included in the authentication response message and sent to the ePDG;

Step 308: The ePDG sends an Internet Key Exchange Authentication (IKE AUTH) response message to the UE through IKEv2. The IKE-AUTH response message includes the redirect indication information and the new ePDG identity information from the 3GPP AAA Server, which may be the IPv4 of the ePDG or IPv6 address, or FQDN;

Step 309: The UE initiates an IKEv2 authentication to the new ePDG according to the redirection indication information to establish an IPSec tunnel.

As shown in FIG. 4, the above-mentioned execution flow is specifically described by using the WLAN system as a special case of the untrusted non-3GPP access system. The WLAN system includes an Access Point (AP) such as a WiFi access point/Access Control Point (AC), a Residential Gateway (RG), and an access broadband access server (Broadband Remote). Access device (abbreviated as BRAS) / Broadband Network Gateway (BNG) and other major equipment network elements. The specific process includes:

Step 401: The user equipment establishes a wireless connection to the WLAN access system, establishes a three-layer connection, and the BRAS/BNG allocates an IP address to the user equipment.

Step 402: The UE performs authentication for non-3GPP access through the WLAN access system. Here, the 3GPP AAA server may send the relevant policy information and subscription information of the operator to the BRAS/BNG, and the 3GPP AAA Server may also The location information of the WLAN access system is obtained at the BNG/BRAS.

Step 403: The UE and the ePDG exchange the first pair of messages IKE_SA_INIT to negotiate an encryption algorithm, perform random number exchange, etc., in this process, the UE notifies the IKEv2 redirection capability by REDIRECT SUPPORTED (defined by RFC5685) ePDG.

Step 404: The UE performs the interaction of the identity authentication information by using the ePDG and the AAA server. Step 405: The UE sends an Internet Key Exchange Authentication (IKE AUTH) request message containing an EAP message to the ePDG to the ePDG in response to the authentication challenge received during the identity authentication interaction. Step 406: The ePDG sends an EAP-Response response message (with AKA challenge information) to the 3GPP AAA server, and carries the identifier of the UE with the IKEv2 redirection capability, or the flag position 1 for indicating the UE capability information.

Steps 407-408: After receiving the foregoing response message, the 3GPP AAA server learns that the UE has the IKEv2 redirection capability, and selects a neighboring ePDG identifier according to the location information of the current UE (which may be an IPv4 or IPv6 address of the ePDG, or may be an FQDN). The information is sent to the ePDG in the authentication reply message.

Step 409: The ePDG sends an Internet Key Exchange Authentication (IKE AUTH) response message to the UE through the IKEv2, where the IKE-AUTH response message includes the redirection indication information and the new ePDG identity information received from the 3GPP AAA server.

Step 410: The UE initiates an IKEv2 authentication to the new ePDG to establish an IPSec tunnel.

Specific embodiment 2

As shown in FIG. 5, in this embodiment, the UE connects to the EPS system through the untrusted non-3GPP access system, and the UE and the ePDG notify the 3GPP AAA server of the UE during the creation of the Internet Key Exchange Protocol (IKEv2) tunnel. Without the IKEv2 redirection capability information, the 3GPP AAA server does not reselect the ePDG for the UE. The specific process is as follows:

Step 501: The UE is connected to the non-3GPP access system, and optionally performs the authentication authorization of the non-3GPP access. In this process, the 3GPP AAA server may send the related policy information and the subscription information of the operator to the access network.

Step 502: The UE and the ePDG exchange the first pair of messages IKE_SA_INIT to negotiate an encryption algorithm, perform random number exchange, etc., in this process, the UE not supports the IKEv2 redirection capability by the REDIRECT SUPPORTED message (defined by RFC5685). To ePDG;

Step 503: The UE performs the interaction of the identity authentication information by using the ePDG and the AAA server. Step 504: The UE sends an Extensible Authentication Protocol (Extension Authentication Protocol)

The Internet Key Exchange Authentication (IKE AUTH) request message of the protocol (EAP) message is sent to the ePDG to respond to the authentication challenge received during the identity authentication interaction, and the UE may also include the identification information of the access network as the location information. In the message; Step 505: The ePDG sends an EAP-Response response message (with AKA challenge information) to the 3GPP AAA server, and does not carry the IKEv2 redirection capability identifier of the UE, or the flag position 0 used to indicate the UE capability information.

Steps 506-507: After receiving the foregoing response message, the 3GPP AAA server learns that the UE does not have the IKEv2 redirection capability, and continues the subsequent authentication and authorization;

Step 508: The ePDG sends an Internet Key Exchange Authentication (IKE AUTH) response message to the UE through IKEv2.

Step 509: The UE and the ePDG complete the subsequent IKEv2 authentication process to establish an IPSec tunnel.

As shown in FIG. 6, the WLAN system is used as a special case of a non-trusted non-3GPP access system, and the foregoing execution process is specifically described. The specific processes include:

Step 601: The user equipment establishes a wireless connection to the WLAN access system, establishes a three-layer connection, and the BRAS/BNG allocates an IP address to the user equipment.

Step 602: The UE performs authentication for non-3GPP access through the WLAN access system. Here, the 3GPP AAA server may send the relevant policy information and subscription information of the operator to the BRAS/BNG, and the 3GPP AAA Server may also The location information of the WLAN access system is obtained at the BNG/BRAS.

Step 603: The UE and the ePDG exchange the first pair of messages IKE_SA_INIT to negotiate an encryption algorithm, perform random number exchange, and the like, in this process, the UE notifies the IKEv2 redirection capability by REDIRECT SUPPORTED (defined by RFC5685) ePDG.

Step 604: The UE sends an Internet key exchange authentication including an EAP message to the ePDG.

(IKE AUTH) Requests a message to the ePDG in response to the authentication challenge received during the identity authentication interaction.

Step 605: The ePDG sends an EAP-Response response message (with AKA challenge information) to the 3GPP AAA server, where the message does not carry the IKEv2 redirection capability identifier of the UE, or the flag position 0 indicating the UE capability information is used;

Step 606-607: After receiving the foregoing response message, the 3GPP AAA server learns that the UE does not have the

The IKEv2 redirection capability continues the subsequent authentication and authorization process.

Step 608: The ePDG sends an Internet Key Exchange Authentication (IKE AUTH) response message to the UE through IKEv2. Step 609: The UE and the ePDG complete the subsequent IKEv2 authentication process to establish an IPSec tunnel. In this solution, the ePDG notifies the capability of the UE to the 3GPP AAA server, and is not limited to the IKEv2 redirection capability of the UE, and may also be whether the UE has the gateway capability. The 3GPP AAA server determines whether to perform the corresponding operation according to the capability of the UE.

It should be noted that the features in the embodiments and the embodiments of the present application may be arbitrarily combined with each other without conflict. It is a matter of course that the invention may be embodied in various other forms and modifications without departing from the spirit and scope of the invention.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be accomplished by a program instructing the associated hardware, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

Industrial Applicability In the present solution, the capability information of the terminal having the Internet Key Exchange Protocol redirection function is notified to the 3GPP AAA server, and the 3GPP AAA server determines, according to the capability information, whether to reselect the evolved packet data gateway for the terminal, that is, The 3GPP AAA server only selects a new ePDG for the terminal with this capability, which can solve the problem of the authentication authorization process error caused by the AAA server selecting the new ePDG for the capability information without the Internet Key Exchange Protocol redirection function.

Claims

Claim

1. A method for processing user equipment capabilities, wherein

In the process of creating an Internet Key Exchange Protocol tunnel between the terminal and the evolved packet data gateway, the evolved packet data gateway notifies the capability information of the Internet key exchange protocol redirection function to the authentication and authorization accounting server, ie, AAA. server.

2. The method of claim 1 wherein

The AAA server determines whether to reselect the evolved packet data gateway for the terminal according to the capability information.

3. The method of claim 2, wherein

4. The method of claim 1, 2 or 3, wherein

5. The method of claim 1, 2 or 3, wherein

When the redirection capability identifier is sent in the extended authentication protocol response message sent to the AAA server, the terminal has the Internet key exchange protocol redirection function. When the redirection capability identifier is not carried, the terminal does not have the Internet key exchange protocol redirection. Features; The redirection capability is carried in the extended authentication protocol response message sent to the AAA server. The different values of the redirection capability identifier indicate that the terminal has or does not have the Internet Key Exchange Protocol redirection function.

A system for processing user equipment capabilities, including a terminal, an evolved packet data gateway, and an authentication and authorization accounting server, that is, an AAA server, wherein the evolved packet data gateway includes an Internet key exchange redirection function module;

The Internet Key Exchange Redirection function module is configured to: notify the AAA server whether the terminal has capability information of the Internet Key Exchange Protocol redirection function.

7. The system of claim 6 wherein

The AAA server includes an authentication function module;

The authentication function module is configured to: determine, according to the capability information, whether to reselect an evolved packet data gateway for the terminal; where, when determining that the capability information indicates that the terminal has an Internet key exchange protocol redirection function, Determining, by the terminal, an evolved packet data gateway that is closest to the terminal, and performing an authentication process, notifying, by the authentication process, an identifier of the selected evolved packet data gateway to the terminal; determining that the capability information indicates that the terminal does not have Internet secret When the key exchange protocol redirection function is performed, the authentication process is directly executed.

8. The system of claim 6 wherein

9. An evolved packet data gateway, comprising an internet key exchange redirection function module, wherein

The authentication function module is configured to: determine, according to capability information of the terminal that is learned by the evolved packet data gateway, whether the terminal has the Internet key exchange protocol redirection function, whether to reselect the terminal An evolved packet data gateway; wherein, when determining that the capability information indicates that the terminal has an Internet Key Exchange Protocol redirection function, selecting an evolved packet data gateway closest to the terminal for the terminal and performing an authentication process, and performing an authentication process Notifying the selected identity of the evolved packet data gateway to the terminal; determining that the capability information indicates that the terminal does not have the Internet Key Exchange Protocol redirection function, directly performing the authentication process.