WO2013063783A1 - 一种数据安全通道的处理方法及设备 - Google Patents

一种数据安全通道的处理方法及设备 Download PDF

Info

Publication number
WO2013063783A1
WO2013063783A1 PCT/CN2011/081738 CN2011081738W WO2013063783A1 WO 2013063783 A1 WO2013063783 A1 WO 2013063783A1 CN 2011081738 W CN2011081738 W CN 2011081738W WO 2013063783 A1 WO2013063783 A1 WO 2013063783A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
user equipment
trusted
authentication
trusted relationship
Prior art date
Application number
PCT/CN2011/081738
Other languages
English (en)
French (fr)
Inventor
李欢
时书锋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to JP2014539203A priority Critical patent/JP5922785B2/ja
Priority to EP11874986.0A priority patent/EP2763357B1/en
Priority to PCT/CN2011/081738 priority patent/WO2013063783A1/zh
Priority to CN201180002592.5A priority patent/CN103201986B/zh
Publication of WO2013063783A1 publication Critical patent/WO2013063783A1/zh
Priority to US14/269,965 priority patent/US9800563B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/64—Hybrid switching systems
    • H04L12/6418—Hybrid transport
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • Embodiments of the present invention relate to the field of communications technologies, and, more particularly, to a method and a device for processing a data secure channel. Background technique
  • the S2c interface uses the DSMIPv6 (Mobile IPv6 Support for Dual Stack Hosts) protocol, which can be used for trusted non-3GPP access networks, non-trusted non-3GPP access networks, and 3GPP access networks to access EPS networks.
  • DSMIPv6 Mobile IPv6 Support for Dual Stack Hosts
  • the UE accesses the EPC from the non-3GPP access network through the S2c interface
  • the UE establishes an SA with the P ⁇ -GW (Packet Data Network Gateway, also called the PGW).
  • PGW Packet Data Network Gateway
  • the PDN-GW When the UE accesses the EPC through the S2c interface, the PDN-GW transmits the authentication and authentication request and the response message through the S6b interface with the AAA (Authentication Authorization Account ing) server, thereby making the PDN- The GW completes the authentication and authentication of the UE, and obtains information such as mobility parameters and subscription data from the AAA server.
  • the P-GW and the AAA server also pass through the AAA proxy.
  • the 3GPP defines that after establishing the DSMIPv6 tunnel between the UE and the PDN-GW, the UE establishes a SA with the PDN-GW to protect the DSMIPv6 signaling.
  • P ⁇ -GW may initiate establishment of a sub-security association Chi Id SA with the UE (Chi ld Secur ty As so ia t ion, sub-security alliance) protects the data plane; but when the UE accesses the EPC from the non-trusted non-3GPP access network, the UE and the non-3GPP access gateway ePDG
  • An IPSec secure channel is established between the evo lved PDG and the evolved packet data gateway to protect the data packets between the UE and the P ⁇ -GW through the IPSec secure channel. That is, when the UE accesses the EPS in a trusted manner from the non-3GPP network, the Child SA can be established on the S2c tunnel to protect the integrity and confidentiality of the data plane; and access from the non-3GPP network in an untrusted manner. At the same time, data integrity protection and confidentiality protection will be provided by the IPSec secure channel between the UE and the ePDG. When the UE accesses the EPC from the 3GPP access network through the S2c interface, the UE and the P ⁇ -GW will pass the 3GPP.
  • the P ⁇ _GW needs to distinguish whether the access scenario is a trusted non-3GPP access network access, a non-trusted non-3GPP access network access, or a 3GPP access network access. Complete the process of establishing or updating different data security channels.
  • the SA may be established first between the UE and the P ⁇ _GW. This is to save the SA establishment time when switching to the non-3GPP access network.
  • the SAs between the UE and the P ⁇ -GW may not be released immediately, but may remain for a period of time until the SA timeout is automatically released.
  • the SA may already exist, but the SA is established before.
  • the P ⁇ -GW obtains the trusted relationship of the access network at the time, that is, the information that the access network is trusted or non-trusted, the 3GPP access or the 3GPP access is not necessarily the current access network.
  • the trusted relationship is consistent. Therefore, the data security channel needs to be established or updated according to the switched access scenario.
  • the P ⁇ -GW needs to distinguish the access scenario. Complete the establishment or update of different ways of data security channels. However, the PDN-GW cannot determine the current UE access mode, and it cannot correctly establish or update the data security channel. Summary of the invention
  • the embodiment of the invention provides a method and a device for processing a tunnel data security channel, which can ensure that the S2c tunnel data security channel is correctly established or updated.
  • a method for processing a tunnel data secure channel including: receiving an access side The authentication request for determining the trusted relationship of the user equipment access; when the S6b interface session of the user equipment exists, sending a message containing the trusted relationship information to the packet data gateway, so that the packet data gateway according to the trusted relationship information Establish or update the S2 c tunnel data security channel.
  • a method for processing a tunnel data security channel including: receiving a packet data network connection establishment request of a user equipment, when an S6b interface session of the user equipment exists or is secure with the user equipment.
  • the authentication request message is sent to the authentication device, and the authentication response message sent by the authentication device is received, where the authentication response message includes the trusted relationship information accessed by the user equipment, according to the trusted Relationship information, establish or update the S2c tunnel data security channel.
  • an authentication and authentication device including: a receiving unit, configured to receive an authentication authentication request of an access side; an authentication unit, configured to authenticate the authentication authentication request, and determine a user equipment a trusted relationship of the access, when the S6b session of the user equipment exists, the notification sending unit sends a message including the trusted relationship information to the packet data gateway, and the sending unit is configured to send a message to the packet data gateway, The message includes the trusted relationship information.
  • a gateway device including: a receiving unit, configured to receive a packet data network connection establishment request of the user equipment, and receive an authentication response message sent by the authentication and authentication device, where the authentication response message includes a trusted relationship information that is accessed by the user equipment, and an acknowledgment unit, configured to: when the receiving unit receives the packet data network connection establishment request, confirm that if the S6b session of the user equipment exists or is related to the user equipment If there is a security association, the sending unit sends an authentication request message to the authentication device; the sending unit is configured to send the authentication request message to the authentication device, and the establishing unit is configured to use, according to the trusted relationship, Information, establish or update the S2c tunnel data security channel.
  • the authentication authentication device when the UE accesses the EPC from the S 2 c interface, the authentication authentication device sends a message including the trusted relationship information accessed by the user equipment, or includes the trusted relationship of the user equipment access in the authentication response message. Information, the gateway device establishes or updates a data security channel according to the trusted relationship information contained in the message, and ensures that a correct data security channel is established.
  • Figure 1 is a block diagram of a system that uses the S 2c interface to access an EPS network in a non-roaming scenario specified by the 3GPP.
  • FIG. 2 is a processing method of a data secure channel for a non-3GPP access network to access an EPS network by using an S2c interface according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a process for processing a data security channel of a trusted non-3GPP access network using an S2c interface to access an EPS network according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a process of a method for processing a data security channel of an untrusted non-3GPP access network using an S2c interface to access an EPS network according to an embodiment of the present invention.
  • 5 is a non-trusted non-3GPP access network using an S2c interface according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of a method for accessing a data security channel of an EPS network by using an S2c interface according to another embodiment of the present invention.
  • FIG. 7 is a schematic flowchart of a process of a method for processing a data security channel of a trusted non-3GPP access network using an S2c interface to access an EPS network according to another embodiment of the present invention.
  • FIG. 8 is a schematic flowchart of a process of a method for processing a data security channel of an untrusted non-3GPP access network using an S2c interface to access an EPS network according to another embodiment of the present invention.
  • FIG. 9 is a schematic flowchart of a process of a method for processing a data security channel of a 3GPP access network using an S2c interface to access an EPS network according to another embodiment of the present invention.
  • FIG. 10 is a schematic flowchart of a process of a method for processing a data security channel of a 3GPP access network using an S2c interface to access an EPS network according to still another embodiment of the present invention.
  • FIG. 11 is a schematic flowchart of a process for processing a data security channel of a 3GPP access network using an S2c interface to access an EPS network according to still another embodiment of the present invention.
  • FIG. 12 is a block diagram of an authentication authentication device in accordance with one embodiment of the present invention.
  • FIG. 13 is a block diagram of a gateway device in accordance with another embodiment of the present invention.
  • FIG. 14 is a block diagram of a gateway device in accordance with yet another embodiment of the present invention.
  • Figure 1 is a system architecture diagram of the 3GPP-defined S2c interface for accessing an EPS network. Embodiments of the present invention are applicable to the EPS network architecture shown in FIG.
  • the S2c interface can be used for non-3GPP access networks and 3GPP networks for accessing EPS networks.
  • the UE will connect directly to the P ⁇ -GW through the non-3GPP access network; and for the non-trusted non-3GPP access network, the UE needs the evolved packet data gateway ePDG that is trusted by the home network. , and then connect to the P ⁇ -GW network element.
  • the UE is connected to the P ⁇ _GW network element through the S_GW (Serving Gat eway).
  • the P ⁇ -GW When the UE accesses the EPC from the S2c interface through the P ⁇ _GW, if the EPC is accessed by the trusted non-3GPP access network, the P ⁇ -GW needs to initiate the establishment of the sub-security association ch ild SA to protect the data plane; The UE accesses the EPC from the non-trusted non-3GPP access network, and the P ⁇ _GW establishes a DSMIPv6 secure channel through the IPSec channel between the UE and the ePDG to perform integrity protection and confidentiality protection on the data; if it is accessed by the 3GPP When the network accesses the EPC, the UE and the P ⁇ -GW will provide data security protection through the 3GPP's own authentication and encryption mechanism.
  • the P ⁇ -GW needs to know whether the current UE is accessed from a trusted non-3GPP access network, a non-trusted non-3GPP access network, or a 3GPP access network. This is the correct establishment or update of S2c.
  • the premise of the tunnel data security channel In particular, when the UE accesses the EPC through the S2c interface after switching between the trusted non-3GPP access network, the 3GPP access network, and the non-trusted non-3GPP access network, the P ⁇ -GW needs to distinguish the access scenario to complete. The establishment or update of the correct data security channel.
  • the authentication authentication device determines the trusted relationship of the UE access, and sends the trusted access device to the P ⁇ -GW.
  • the relationship indication message, or the authentication response message sent to the PDN-GW includes an indication that the UE accesses the trusted relationship, and the P ⁇ -GW establishes or updates the data security channel according to the trusted relationship of the UE access indicated in the message. , to ensure the establishment of the correct data security channel.
  • the authentication authentication device in the embodiment of the present invention is exemplified by an AAA server. In other implementations, other devices such as an HSS (Home Subscribing Server) may be used as the authentication and authentication device in the embodiment. .
  • 2 is a processing method of a data security channel for accessing an EPS network by using an S2c interface according to an embodiment of the present invention.
  • Determining, by the authentication device, the trusted relationship of the user equipment access sending a message including the user equipment access trusted relationship indication to the P ⁇ -GW, and the P ⁇ -GW according to the trusted relationship of the user access indicated in the message, Establish or update a data security channel to ensure that the correct data security channel is established.
  • 201. Receive an authentication authentication request on the access side.
  • the AAA server receives the authentication request of the access side, and applies for authentication of the accessed UE. Because the UE accesses the EPC in different ways, when the UE accesses from the trusted non-3GPP access network, the access side here refers to the trusted non-3GPP access network, and when the UE is connected from the non-trusted non-3GPP access network On entry, the access side here refers to a non-trusted non-3GPP access network or ePDG.
  • the AAA server determines whether the user equipment access is trusted or untrusted according to the parameters carried in the authentication authentication request of the access side, and the parameters include one or more of the following: an access network identifier ANID, a visited network Identifies the Visi ted Ne twork Ident I ty (this flag is only required in the roaming scenario), the access type, and the security mechanism used in the access network.
  • the AAA server determines whether the S6b interface session of the UE already exists, that is, whether the session context of the S6b interface of the UE exists.
  • the session context includes the session identifier Ses s on ID and the user equipment identifier. If an S6b interface session exists, the P__GW has applied to the AAA server for authentication of the UE. This UE access should be a handover scenario.
  • the AAA server sends a message to the P-GW, which includes information indicating that the UE accesses the trusted relationship, that is, whether the UE access is a trusted non-3GPP access or a non-trusted non-3GPP access.
  • the P ⁇ -GW establishes or updates the S2c tunnel data security channel according to the received trusted relationship of the UE access.
  • the S6b interface session of the existing UE when receiving the authentication authentication request of the access side, if the S6b interface session of the existing UE exists, sending a message including the UE accessing the trusted relationship information to the P ⁇ -GW, so that the P ⁇ -GW The S2c tunnel data security channel can be established or updated correctly.
  • FIG. 3 is a schematic flowchart of a method for processing a data security channel of a trusted non-3GPP access network using an S2c interface to access an EPS network according to an embodiment of the present invention.
  • the UE sends an EAP-RSP authentication request message to the trusted non-3GPP access network.
  • the trusted non-3GPP access network sends an authentication authentication request to the AAA server, where the authentication authentication request includes an access network identifier ANID, an access type, and may also include parameters such as a security mechanism used in the access network. In the roaming scenario, this authentication request is to be accessed through the AAA server proxy.
  • the network forwards to the AAA server, and the authentication authentication request also includes the visited network identifier, that is, the Verified Network Identity.
  • the AAA server determines whether the UE access is a trusted access or a non-trusted access according to the parameters in the received request, and is determined to be a trusted access, that is, the UE is accessed by the trusted non-3GPP access network.
  • the parameters include one or more of the following: an access network identifier ANID, a visited network identifier, a Social Network Identity (which is required only in a roaming scenario), an access type, and a security mechanism used in the access network. Wait.
  • the AAA server sends an authentication authentication response message to the trusted non-3GPP access network, where the trusted access result is included.
  • the trusted non-3GPP access network sends an EAP-REQ authentication response message to the UE, including the trusted access result.
  • the AAA server determines whether the S6b interface session of the UE exists, that is, whether the session context of the S6b interface of the UE exists.
  • the session context includes the session identifier and the user equipment identifier. If there is an S6b interface session, the original P ⁇ -GW has applied for an authentication request for the UE to the AAA server.
  • the current access should be a handover scenario.
  • the AAA server sends a trusted relationship to the P ⁇ -GW, that is, the AAA server sends a trusted relationship message to the P ⁇ -GW, including the trusted relationship cell, and the value is “trusted” or “untrusted”.
  • the indication is "trusted", indicating that it is currently trusted access.
  • the P ⁇ -GW may initiate a Chi ld SA establishment process with the UE at any time. If a Chi ld SA establishment request initiated by the UE is received, the request is accepted to establish a Chi ld SA.
  • the AAA server receives the authentication authentication request sent by the trusted non-3GPP access network, and determines that the user equipment access is trusted access. If the S6b interface session of the UE already exists, the AAA server may The P-GW sends a trusted relationship message. That is to say, step 305 is performed after step 302, and there is no strict sequence of execution with steps 303, 304. Similarly, after receiving the trusted relationship message, the P-GW can initiate the Chi ld SA establishment process with the UE at any time, that is, step 306 can be performed at any time after step 305, and 303. 304 does not have a strict sequence of execution. Steps 301 through 304 are performed in the order shown in the schematic flow chart.
  • the embodiment of the present invention determines that the trusted relationship accessed by the user equipment is trusted access, and when the S6b interface session of the UE exists, Sending a message including the UE accessing the trusted relationship information to the P ⁇ -GW, so that the PDN-GW can distinguish the access scenario and complete the establishment or update of the correct data security channel.
  • FIG. 4 is a schematic flow chart of a process of a method for processing a data security channel of an untrusted non-3GPP access network using an S2c interface to access an EPS network according to an embodiment of the present invention.
  • the UE sends an EAP-RSP authentication request message to the non-trusted non-3GPP access network.
  • the non-trusted non-3GPP access network sends an authentication authentication request to the AAA server, where the authentication authentication request includes an access network identifier AN ID, an access type, and may include a security mechanism parameter used in the access network.
  • the authentication authentication request submitted by the access network needs to be forwarded to the AAA server through the AAA server proxy, and the request includes the visited network identifier, that is, the Virtual Network Identity.
  • the AAA server determines, according to the parameters in the authentication request, whether the user equipment access is trusted or untrusted, and is determined to be non-trusted access, that is, the UE is accessed by the non-trusted non-3GPP access network.
  • the parameters include one or more of the following: an access network identifier ANID, a visited network identifier, a Social Network Identity (which is required only in a roaming scenario), an access type, and a security mechanism used in the access network. Wait.
  • the AAA server sends an authentication authentication response message to the non-trusted non-3GPP access network, where the non-trusted access result is included.
  • the non-trusted non-3GPP access network sends an EAP-REQ authentication response message to the UE, where the non-trusted access result is included.
  • the AAA server determines whether the S6b interface session of the UE exists, that is, whether the session context of the S6b interface of the UE exists.
  • the session context includes the session identifier and the user equipment identifier. If there is an S6b interface session, the original P ⁇ -GW has applied for an authentication request for the UE to the AAA server.
  • the current access should be a handover scenario.
  • the AAA server sends a trusted relationship message to the P-GW, including the trusted relationship cell, and the value is "trusted” or "non-trusted”. The indication is "non-trusted", indicating that the current is non-trustable. Letter access.
  • the P ⁇ -GW After receiving the message indicating that the UE accesses the untrusted access, the P ⁇ -GW does not initiate the Chi ld SA establishment process, and if it receives the Chi ld SA establishment request sent by the UE, it rejects.
  • the rejection may be as follows:
  • the cause value in No tify Pay 1 oad in the response message of the Ch i 1 d SA setup request indicates "N0-ADDITI0NAL-SAS", or "NO.Chi ld.SAS", or other reasons A value indicating that the establishment of the Ch i 1 d SA is no longer received.
  • the ⁇ -GW initiates a process of deleting the Ch i 1 d SA.
  • the AAA server receives the authentication request sent by the non-trusted non-3GPP access network, and determines that the current UE access is an untrusted access. If the S6b interface session of the UE already exists, A trusted relationship message is sent to the PDN-GW. That is to say, step 405 is executed after step 402, and there is no strict sequence of execution with steps 403 and 404. Steps 401 through 404 are performed in the order shown in the schematic flow chart.
  • the embodiment of the present invention determines that the trusted relationship accessed by the UE is an untrusted access, and when the S6b interface session related to the UE exists, Sending a message including the UE accessing the trusted relationship information to the P ⁇ -GW, so that the PDN-GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • FIG. 5 is a schematic flowchart of a process of a non-trusted non-3GPP access network using a S2c interface to access a data security channel of an EPS network according to an embodiment of the present invention.
  • the UE sends an IKE authentication request to the evolved packet data gateway ePDG, requesting to establish an IPSec tunnel between the UE and the ePDG.
  • the ePDG sends an authentication request to the AAA server.
  • the authentication request includes an access network identifier, an ANID, and an access type, and may also include a security mechanism parameter used in the access network.
  • the authentication authentication request is forwarded by the AAA server proxy, and the request includes the visited network identifier, that is, Visited Network Identity.
  • the AAA server determines whether the UE access is a trusted access or an untrusted access according to the parameter in the authentication request, and determines that the UE is accessed by the non-trusted non-3GPP access network.
  • the parameters include one or more of the following: an access network identifier ANID, a visited network identifier (which is required only in a roaming scenario), an access type, and a security mechanism used in the access network.
  • the AAA server sends an authentication authentication response message to the ePDG.
  • the ePDG sends an IKE authentication response message to the UE.
  • the AAA server determines whether the S6b interface session of the UE exists, that is, whether the session context of the S6b interface of the UE exists.
  • the session context includes the session identifier, the session ID, and the user equipment identifier. If there is an S6b interface session, the original PDN-GW has applied for an authentication request for the UE to the AAA server.
  • the current access should be a handover scenario.
  • the AAA server sends a trusted relationship message to the P-GW, including the trusted relationship cell, and the value is "trusted” or "non-trusted”. The indication is "non-trusted", indicating that the current is non-trustable. Letter access.
  • the Child SA After the P ⁇ -GW receives the message indicating that the UE accesses the untrusted access, the Child SA is no longer initiated.
  • the establishment process if receiving the Chi ld SA establishment request sent by the UE, rejects.
  • the rejection may be as follows:
  • the cause value in No tify Pay 1 oad in the response message of the Ch i 1 d SA setup request indicates "N0-ADDITI0NAL-SAS", or "NO.Chi ld.SAS", or other reasons A value indicating that the establishment of the Ch i 1 d SA is no longer received. If there is already a Ch i 1 d SA between the P ⁇ -GW and the UE, the ⁇ -GW initiates the process of deleting the Chi Id SA.
  • the AAA server receives the authentication authentication request sent by the egress packet data gateway ePDG, and determines that the UE access is an untrusted access. If the S6b interface session of the UE already exists, the AAA server may send the P6-interface session to the PDN-GW. Trusted relationship message. That is to say, step 505 is performed after step 502, and there is no strict sequence of execution with steps 503, 504. Steps 501 through 504 are performed in the order shown in the schematic flow chart.
  • the embodiment of the present invention determines that the trusted relationship accessed by the UE is an untrusted access, and when the existing S6b interface session of the UE exists, the sending includes the UE The information of the trusted relationship information is sent to the PDN-GW, so that the P ⁇ -GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • FIG. 6 is a flowchart of a method for accessing a data security channel of an EPS network by using an S2c interface according to another embodiment of the present invention.
  • the P ⁇ -GW receives the packet data network connection establishment request, sends an authentication request to the authentication device, and establishes or updates the S2c tunnel data security channel according to the trusted relationship of the current access indicated in the response message of the authentication device.
  • the received packet data network connection establishment request is a binding update Binding Update message sent by the UE; when the UE accesses the EPC from the 3GPP access network by the S2c interface
  • the received packet data network connection establishment request is a session establishment message sent by the MME (Mobi Management Management Network Element), and the session establishment message is a packet sent by the mobility management network element to the user equipment. Sent after the data network connection request.
  • the P ⁇ -GW determines whether there is already an S6b session for accessing the UE, that is, whether the session context of the S6b interface of the UE exists.
  • the session context includes the session identifier Ses s ion ID and the user equipment identifier.
  • the PDN-GW determines whether a security association is established with the UE, that is, whether the security context exists in the UE, and the security context includes the security parameter index SPI and the UE identifier. in case When the S6b interface session of the UE exists or the SA is established with the UE, the P-GW has applied to the AAA server for authentication of the UE. At this time, the PDN-GW Send an authentication request to the AAA server.
  • the P ⁇ -GW establishes or updates the S2c tunnel data security channel according to the received trusted relationship of the user equipment access.
  • the authentication request message is sent to the authentication authentication.
  • the device establishes or updates the S2c tunnel data security channel according to the trusted relationship of the user equipment access indicated in the response message of the authentication device.
  • FIG. 7 is a schematic flowchart of a method for processing a data security channel of a trusted non-3GPP access network using an S2c interface to access an EPS network according to another embodiment of the present invention.
  • the UE sends a binding update request B ind ing Upda t e message to the PDN-GW, so that the PDN-GW binds the local address of the UE and the home address, and establishes a data connection between the UE and the P ⁇ -GW.
  • the PDN-GW determines whether the binding update request message
  • the S6b session of the UE that is, whether the session context of the S6b interface of the UE exists, the session context includes the session identifier Se s s on ID and the user equipment identifier.
  • P ⁇ -GW determines whether a security association is established with the UE, that is, whether the UE has a security context, and the security context includes a security parameter index SP I and a UE identifier. If the S6b interface session of the UE exists, or if an SA is established with the UE, the P-GW has applied to the AAA server for authentication of the UE. In this case, P The ⁇ -GW sends an authentication request to the AAA server.
  • the authentication request message includes a UE identifier and a network identifier.
  • the network identifier includes one or more of the following information: an access network identifier, a security mechanism used in the access network, and an access type. If it is a roaming scenario, the network identifier of the visited network is also included.
  • the AAA server determines, according to the configured policy, whether the user equipment access is a trusted access, and sends an authentication response message to the P ⁇ -GW, where the message includes a trusted relationship cell, and the value is “trusted” or “Non-trusted” or "3GPP", indicating that the user equipment access is a trusted non-3GPP access or non-trusted non-3GPP access or 3GPP access, where the value is "trusted” and the indication is trusted.
  • 3GPP access
  • the AAA server determines whether the user equipment access is trusted access.
  • the method includes: the policy includes a correspondence between the network identifier and the trusted relationship, and the AAA server determines the user equipment according to the network identifier in the authentication request message, and queries the configured policy. Trusted relationship of access. If the policy needs to determine the trusted relationship according to the access network identifier, and the authentication request message does not include the access network identifier, but the access type is included, the AAA server may also construct the access network identifier according to the access type.
  • the specific method is: the access type is generally an integer type representation, such as 0 for WLAN and 2001 for HRPD.
  • the AAA server knows the specific access type description corresponding to the integer of the access type according to the access type, and uses a string to represent the prefix of the access network identifier.
  • the access network prefix is "WLAN”.
  • HRPD "such a string, the access network identifier may have no additional string other than the prefix, or the AAA server itself determines the generation rule.
  • the determining method may be implemented in the following manner:
  • the policy includes a record corresponding to the trusted relationship and the network identifier, and the configured policy data table is configured. If the trusted relationship corresponding to the network identifier is trusted access, the current UE access is determined as Trusted access, the trusted relationship is non-trusted access, and the current UE access is determined to be untrusted access.
  • the P_GW sends a Binding Update Confirm message to the UE.
  • the P ⁇ -GW may initiate a Chi ld SA establishment process with the UE at any time. If the Chi ld SA establishment request initiated by the UE is received, the request is accepted to establish a Chi ld SA.
  • the PDN-GW when the UE accesses the EPC network from the trusted non-3GPP access network through the S2c interface, when the PDN-GW receives the Bind ing Upda te message of the UE, if
  • the P ⁇ -GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • FIG. 8 is a schematic flowchart of a method for processing a data security channel of an untrusted non-3GPP access network using an S2c interface to access an EPS network according to another embodiment of the present invention.
  • the method of 7 corresponds, and thus a detailed description thereof will be appropriately omitted.
  • the UE sends a Binding Update Request Binding Upda te message to the P ⁇ _GW, so that the PDN-GW binds the local address of the UE and the home address, and establishes a data connection between the UE and the P ⁇ -GW. 802.
  • the P-GW determines whether the S6b session of the UE already exists or has established a security association with the UE. If the S6b interface session of the UE exists or the SA is established with the UE, the P-GW has applied to the AAA server for authentication of the UE. In this case, P ⁇ - The GW sends an authentication request message to the AAA server.
  • the authentication request message includes a UE identifier, and also includes a network identifier.
  • the network identifier includes one or more of the following information: an access network identifier, a security mechanism used in the access network, and an access type. If it is a roaming scenario, the network identifier of the visited network is also included.
  • the AAA server determines, according to the configured policy, whether the user equipment access is a trusted access, and sends an authentication response message to the P ⁇ -GW, where the message includes a trusted relationship cell, and the value is “trusted” or “ Non-trusted "or” 3GPP", indicating that the current access is a trusted non-3GPP access or non-trusted non-3GPP access or 3GPP access, where the value is "non-trusted” and the indication is non-trusted. 3GPP access. After receiving the message indicating that the user equipment accesses the untrusted access, the P ⁇ -GW does not initiate the Chi ld SA establishment process, and rejects the Chi ld SA establishment request sent by the UE.
  • the way to reject can be:
  • the reason value in Not ify Payload in the response message of the Chi ld SA setup request indicates "N0-ADDITI0NAL-SAS", or "NO.Chi ld.SAS", or other reason value, indicating no Then receive the establishment of Chi ld SA. If there is already a Chi ld SA between the PDN-GW and the UE, the P ⁇ -GW initiates the process of deleting Ch i 1 d S A .
  • the GW-GW sends a Binding Update Confirm message to the UE.
  • the P ⁇ -GW when the UE accesses the EPC network from the non-trusted non-3GPP access network through the S2c interface, when the P ⁇ -GW receives the binding update request B i nd i ng Upda te message of the UE, When the S6b interface session of the UE exists or the SA is established with the UE, the authentication request message is sent to the authentication device, and the user equipment access trusted according to the authentication response message of the authentication device is trusted. Relationship, here is the non-trusted access, establish or update the S2c tunnel data security channel. Therefore, the P ⁇ -GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • FIG. 9 is a schematic flowchart of a method for processing a data security channel of a 3GPP access network using an S2c interface to access an EPS network according to another embodiment of the present invention.
  • the UE sends a P ⁇ (Packet Data Network) connection request to the MME.
  • P ⁇ Packet Data Network
  • the MME sends a session establishment request to the P ⁇ -GW to establish a P ⁇ connection for the UE.
  • the session establishment request includes a UE identifier, a P type, a wireless access type, and the like.
  • the P ⁇ type indicates the type of the IP address assigned to the UE by the PDN connection, such as IPv4, IPv6, or IPv4v6.
  • the radio access type indication is 3GPP access at this time, such as E-UTRAN, UTRAN, and the like. If it is switching scenes, then A handover indication is also included in the request message.
  • the P-GW determines whether the S6b session of the UE already exists, that is, whether the session context of the S6b interface of the UE exists.
  • the session context includes the session identifier Ses s ion ID and the user equipment. logo. Or determining whether a security association is established with the UE, that is, whether the UE has a security context, and the security context includes a security parameter index SPI and a UE identifier. If the S6b interface session of the UE exists, or if an SA is established with the UE, the P-GW has applied to the AAA server for authentication of the UE. In this case, P ⁇ - The GW sends an authentication request to the AAA server.
  • the authentication request message includes a UE identifier, and includes a network identifier.
  • the network identifier includes one or more of the following information: an access network identifier and a wireless access type.
  • the AAA server determines, according to the configured policy, whether the user equipment access is a trusted access, and sends an authentication response message to the P-GW, where the message includes a trusted relationship cell, and the value is “trusted” or
  • Non-trusted or “3GPP” indicates that the user equipment access is a trusted non-3GPP access or a non-trusted non-3GPP access or 3GPP access, where the value is "3GPP", indicating 3GPP access.
  • the GW After receiving the message indicating that the current access is a 3GPP access, the GW does not initiate the Chi ld SA establishment process, and rejects the Chi ld SA establishment request sent by the UE.
  • the way to reject can be:
  • the reason value in Not ify Payload in the response message of the Chi ld SA setup request indicates "N0-ADDITI0NAL-SAS", or "NO.Chi ld.SAS", or other reason value, indicating no Then receive the establishment of Chi ld SA. If there is already a Chi ld SA between the PDN-GW and the UE, the P ⁇ -GW initiates the process of deleting the Chi ld SA.
  • the AAA server determines whether the user equipment access is trusted access.
  • the method includes: the policy includes a correspondence between the network identifier and the trusted relationship, and the AAA server determines the user equipment according to the network identifier in the authentication request message, and queries the configured policy. Trusted relationship of access. If the policy needs to determine the trusted relationship according to the access network identifier, and the authentication request message does not include the access network identifier, but the wireless access type is included, the AAA server may also construct the access network identifier according to the wireless access type. .
  • the specific method is as follows:
  • the radio access type is generally an integer type representation, such as 3 for WLAN and 6 for E-UTRAN.
  • the AAA server learns the specific access type description corresponding to the integer of the wireless access type according to the type of the wireless access, and uses a string to represent the prefix of the access network identifier.
  • the access network identifier prefix is a string such as "WLAN” or "E-UTRAN".
  • the access network identifier may have no additional string other than the prefix, or the AAA server may determine the generation rule.
  • the determining method can be implemented as follows:
  • the policy includes a trusted relationship corresponding to the network identifier. Recording, querying the configured policy data table, if the trusted relationship corresponding to the network identifier is trusted access, determining that the user equipment access is trusted access, and the trusted relationship is non-trusted access, determining that the user equipment is connected.
  • the incoming communication is an untrusted access, and the trusted relationship is determined to be 3GPP access for the 3GPP access.
  • the P ⁇ -GW sends a session establishment confirmation message to the MME.
  • ⁇ E sends a response message to the UE for the P ⁇ connection request.
  • the ⁇ E when the UE accesses the EPC network through the 3GPP access network through the S2c interface, the ⁇ E sends a session establishment request message to the P ⁇ -GW according to the P ⁇ connection request of the UE, if the existing S6b interface session of the UE exists. Or, when a security association is established with the UE, the P-GW sends an authentication request message to the authentication device, and according to the trusted relationship of the user equipment access indicated in the response message of the authentication device, The 3GPP access, establish or update the S2c tunnel data security channel. Therefore, the P ⁇ -GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • FIG. 10 is a schematic flowchart of a process for processing a data security channel of a 3GPP access network using an S2c interface to access an EPS network according to still another embodiment of the present invention.
  • the P ⁇ -GW receives the packet data network connection establishment request, determines the trusted relationship of the user equipment access according to the information in the setup request message, and establishes or updates the S2c tunnel data security channel.
  • the UE sends a P ⁇ connection request to ⁇ E.
  • the MME sends a session establishment request to the P-GW to establish a PDN connection for the UE.
  • the session establishment request includes information such as a UE identifier, a P type, and a wireless access type.
  • the radio access type indication is 3GPP access at this time, such as E-UTRAN, UTRAN, and the like.
  • the P ⁇ type indicates the type of IP address assigned to the UE by this PDN connection, such as IPv4, IPv6, or IPv4v6. If it is a handover scenario, a handover indication is also included in the request message.
  • the P-GW determines whether the S6b session of the UE already exists, that is, whether the session context of the S6b interface of the UE exists.
  • the session context includes the session identifier Se ss ion ID and the user equipment identifier.
  • the PDN-GW determines whether a security association is established with the UE, that is, whether the security context exists in the UE, and the security context includes the security parameter index SPI and the UE identifier. If the existing S6b interface session of the UE exists or an established SA is established with the UE, the original P ⁇ -GW has applied to the AAA server for authentication authentication for the UE.
  • P ⁇ - The GW determines the trusted relationship of the user equipment access according to the wireless access type information in the session establishment request, and determines that the 3GPP access is at this time.
  • ? ⁇ _0 ⁇ no longer initiates (3 ⁇ 41 ⁇ SA establishment process, if it receives the Chi ld SA establishment request sent by the UE, it rejects.
  • the rejection may be: No ti fy in the response message of the Ch i ld SA establishment request
  • the cause value in Payl oad indicates "N0-ADDITI0NAL-SAS", Or "N0_Ch i ld_SAS", or other reason value, means that the establishment of the Chi Id SA is no longer received. If there is already a Chi Id SA between the PDN-GW and the UE, the J ⁇ J PDN-GW initiates the process of deleting the Chi Id SA.
  • the P ⁇ -GW sends a session establishment confirmation message to the MME.
  • ⁇ E sends a response message to the UE for the P ⁇ connection request.
  • the ⁇ E when the UE accesses the EPC network by the 3GPP access network through the S2c interface, the ⁇ E sends a session establishment request message to the P ⁇ -GW according to the P ⁇ connection request of the UE, and the P ⁇ -GW determines that the UE already exists. If the S6b interface session is established with the security association with the UE, the trusted relationship of the user equipment access is determined according to the information in the session establishment request message, where the 3GPP access is used to establish or update the S2c tunnel data security channel. . Therefore, the P ⁇ -GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • the P ⁇ -GW receives the security association establishment request of the UE, sends an authentication authentication request message to the authentication device, and establishes or updates the S2c according to the trusted relationship of the user equipment access indicated in the response message of the authentication device. Tunnel data security channel.
  • the UE sends a P ⁇ connection request to ⁇ E.
  • the MME sends a session establishment request to the P_GW, and establishes a PDN connection for the UE.
  • the session establishment request includes the UE identity, P type, and wireless access type.
  • the P ⁇ type indicates the type of the IP address assigned to the UE by the PDN connection, such as IPv4, IPv6, or IPv4v6.
  • the radio access type indication is 3GPP access at this time, such as E-UTRAN, UTRAN, and the like. If it is a handover scenario, a handover indication is also included in the request message.
  • the P_GW sends a session establishment confirmation message to the MME.
  • the MME sends a response message of the P ⁇ connection request to the UE.
  • the UE sends a security association establishment request to the PDN-GW to establish between the UE and the PDN-GW.
  • the SA of the DSMIPv6, the security association establishment request may specifically establish a request message for an SA, such as an IKE authentication request, including an APN (Aces s Po int Name) information.
  • an SA such as an IKE authentication request, including an APN (Aces s Po int Name) information.
  • the P ⁇ _GW sends an authentication authentication request message to the AAA server, and registers the APN and the P ⁇ _GW information, where the request message includes the UE identifier.
  • the network identifier may also be included, and the network identifier includes one or more of the following information: an access network identifier, and a wireless access type.
  • the AAA server determines, according to the configured policy, a trusted relationship of the user equipment access, and sends the trusted relationship.
  • Authentication authentication response message to P ⁇ -GW including trusted relationship cells, with a value of "trusted” or “non-trusted” or “3GPP” or “UNKNOWN", indicated as “3GPP” or “UNKNOWN”, the value "3GPP” indicates that the current 3GPP access, and the value "UNKNOWN” indicates that the AAA server cannot give the trusted relationship of the user equipment access.
  • the P ⁇ -GW receives the message indicating that the trusted relationship is "UNKNOWN”, it determines, according to the wireless access type information in the session establishment request received in step 1102, the trusted relationship of the user equipment access, which is 3GPP. Access.
  • the PDN-GW receives the message that the AAA sends the user equipment to access the 3GPP access, or receives the message indicating that the trusted relationship of the user equipment is "UNKNOWN", and then determines that the user equipment access is the 3GPP access.
  • the Chi ld SA establishment process is no longer initiated, and if the Chi ld SA establishment request sent by the UE is received, it is rejected.
  • the way to reject may be:
  • the reason value in Not i fy Payl oad in the response message of the Chi ld SA setup request indicates "N0-ADDITI0NAL-SAS", or "N0_Ch i ld_SAS", or other reason value, indicating no longer Receive the establishment of Chi Id SA. If there is already a Chi Id SA between the PDN-GW and the UE, the J ⁇ J PDN-GW initiates the process of deleting the Chi Id SA.
  • the AAA server determines whether the user equipment access is trusted access.
  • the method includes: the policy includes a correspondence between the network identifier and the trusted relationship, and the AAA server determines the user equipment according to the network identifier in the authentication request message, and queries the configured policy. Trusted relationship of access. If the policy needs to determine the trusted relationship according to the access network identifier, and the authentication request message does not include the access network identifier, but the wireless access type is included, the AAA server may also construct the access network identifier according to the wireless access type. .
  • the specific method is as follows:
  • the radio access type is generally an integer type representation, such as 3 for WLAN and 6 for E-UTRAN.
  • the AAA server learns the specific access type description corresponding to the integer of the wireless access type according to the type of the wireless access, and uses a string to represent the prefix of the access network identifier.
  • the access network identifier prefix is a string such as "WLAN” or "E-UTRAN".
  • the access network identifier may have no additional string other than the prefix, or the AAA server may determine the generation rule.
  • the determining method may be implemented as follows:
  • the policy includes a record corresponding to the trusted relationship and the network identifier, and the configured policy data table is configured. If the trusted relationship corresponding to the network identifier is a trusted access, the user equipment access is determined to be acceptable. The access is trusted. If the trusted relationship is non-trusted access, the user equipment access is determined to be non-trusted access. If the trusted relationship is 3GPP access, the 3GPP access is determined. If the corresponding record is not found, return "UNKNOWN. " , indicating that the trusted relationship of the user equipment access cannot be determined.
  • the P ⁇ -GW sends a security association setup response message to the UE, where the IP address allocated by the P ⁇ -GW to the UE is included.
  • the P ⁇ -GW receives the security association establishment request of the UE, and then sends an authentication authentication request message to the authentication authentication device, and according to the authentication.
  • the trusted relationship of the user equipment access indicated in the response message of the authentication device, where the indication is 3GPP access or cannot be determined, and the S2c tunnel data security channel is established or updated. Therefore, the P ⁇ -GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • FIG. 12 is a block diagram of an authentication authentication device in accordance with one embodiment of the present invention.
  • a non-limiting example of the authentication authentication device 120 of FIG. 12 is the home subscriber server/authentication authentication and accounting server device shown in FIG. 3-5, FIG. 7-9, and includes a receiving unit 1201 and an authentication unit. 1202 and transmitting unit 1203.
  • the receiving unit 1201 is configured to receive an authentication authentication request of the access side.
  • the authentication unit 1202 is configured to authenticate the received authentication request and determine a trusted relationship of the user equipment access.
  • the notification transmitting unit transmits a message containing the trusted relationship indication information to the P ⁇ -GW.
  • the sending unit 1203 is configured to send a message including the trusted relationship indication information to the P ⁇ -GW.
  • the embodiment of the present invention When receiving the authentication authentication request of the access side, the embodiment of the present invention confirms the trusted relationship of the user equipment access, and if the existing S6b interface session of the UE exists, the information about the user equipment access trusted relationship is sent.
  • the message to P ⁇ -GW enables P ⁇ -GW to correctly establish and update the S2c tunnel data security channel.
  • the receiving unit 1201 receives the authentication authentication request sent by the access side.
  • the receiving unit receives the authentication authentication request of the access side, and applies for authentication authentication for the current access.
  • the access side here refers to the trusted non-3GPP access network, when the UE accesses from the non-trusted non-3GPP access network.
  • the access side here refers to a non-trusted non-3GPP access network or ePDG.
  • the authentication unit 1202 determines whether the current user equipment access is trusted access or non-trusted access according to the parameter carried in the received authentication request, and the parameter includes one or more of the following: ANID, the visited network identifier Visi ted Ne twork Ident i ty (this identifier is only required in the roaming scenario), the access type, the security mechanism used in the access network, and so on.
  • the authentication unit determines whether the user equipment access is a trusted access according to the configured policy, and the policy includes the correspondence between the access network identifier (the network identifier that needs to be visited in the roaming scenario) and the trusted relationship.
  • the determining method may be: determining, according to the access network identifier in the authentication authentication request message (the network identifier that needs to be visited in the roaming scenario), querying the configured policy to determine the trusted relationship of the user equipment access. If the access network identifier is not included in the authentication request message, the access network identifier needs to be constructed according to the access type identifier.
  • the access type is generally an integer type representation, such as 0 for WLAN and 2001 for HRPD.
  • the access network prefix is a string such as "WLAN" or "HRPD”.
  • the authentication unit 1202 searches the table for the specific access type description corresponding to the integer of the access type according to the access type, and uses a string to indicate The prefix of the access network identifier.
  • the access network identifier may have no additional string other than the prefix, or the generation rule is determined by the authentication device itself.
  • the method for determining the method may be as follows: Query the configured policy data table, and find a trusted relationship corresponding to the access network identifier (the network identifier that needs to be visited in the roaming scenario), and determine the current connection if the trusted relationship is trusted access.
  • the incoming access is a trusted access, and the trusted relationship is an untrusted access, and the current access is determined to be an untrusted access.
  • the authentication unit determines whether the S6b session of the access UE already exists, that is, whether the UE is already available.
  • the session context of the S6b interface exists.
  • the session context includes the session ID and the user ID. If the S6b interface session of the UE exists, it indicates that the original P ⁇ -GW has applied for authentication authentication for the UE to the authentication device. At this time, the authentication unit notifies the sending unit to send a message to the PDN-GW, which includes information indicating that the user equipment accesses the trusted relationship, that is, whether the user equipment access is a trusted non-3GPP access or a non-trusted non-3GPP access. .
  • the sending unit 1203 sends a message to the P ⁇ -GW, including the trusted relationship cell, and the value is “trusted” or “non-trusted”, “trusted” is represented as trusted access, and “untrusted” is represented. For non-trusted access.
  • the P ⁇ -GW establishes or updates the S2c tunnel data security channel according to the received trusted relationship of the user equipment access.
  • the authentication unit determines the trusted relationship of the user equipment access.
  • the sending unit sends The message including the user equipment accessing the trusted relationship information is sent to the P ⁇ -GW, so that the P ⁇ -GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • FIG. 13 is a block diagram of a gateway device in accordance with another embodiment of the present invention.
  • a non-limiting example of the gateway device 1 30 of FIG. 13 is a packet data gateway shown in FIG. 3-5, FIG. 7-11, including a receiving unit 1 301, a acknowledgment unit 1 302, a transmitting unit 1 303, and an establishing unit. 1 304.
  • the receiving unit 1 301 receives the packet data network connection establishment request of the user equipment, and receives the authentication response message sent by the authentication device, where the authentication response message includes the trusted relationship information accessed by the user equipment; the acknowledgment unit 1 302 receives at the receiving unit.
  • the notification sending unit sends an authentication request message to the authentication device; the sending unit 1303 Right
  • the certificate device sends the authentication request message; the establishing unit 1304 establishes or updates the S2c tunnel data security channel according to the trusted relationship information in the authentication response message.
  • the gateway device when the gateway device receives the packet data network connection establishment request, the gateway device sends an authentication request message to the authentication device, and establishes or updates according to the trusted relationship of the user equipment access indicated in the authentication response message of the authentication device. S2c tunnel data security channel.
  • the receiving unit 1301 receives a packet data network connection establishment request of the user equipment.
  • the received packet data network connection establishment request is a binding update Binding Upda te message sent by the UE; when the UE accesses the EPC from the 3GPP access network by the S2c interface
  • the received packet data network connection establishment request is a session establishment message sent by the user E, and the session establishment message is sent after the mobility management network element receives the packet data network connection request sent by the user equipment.
  • the acknowledgment unit 1302 confirms whether the S6b session of the UE is currently present, that is, whether the session context of the S6b interface of the UE exists.
  • the session context includes the session identifier Ses s ion ID and the user equipment identifier.
  • the acknowledgment unit confirms whether a security association is established with the UE, that is, whether the UE has a security context, and the security context includes a security parameter index SPI and a UE identifier. If the existing S6b interface session of the UE exists or an established SA is established with the UE, the original gateway device has applied for authentication authentication for the UE to the authentication device. At this time, the notification transmitting unit 1303 transmits an authentication request to the authentication authentication device.
  • the receiving unit 1301 receives the authentication response message returned by the authentication device, where the message includes information indicating the current trusted relationship, that is, the current access is a trusted non-3GPP access, a non-trusted non-3GPP access, or a 3GPP access. .
  • the specific manner is that the message includes a trusted relationship cell, and the value is "trusted” or “non-trusted” or "3GPP", indicating that the current access is a trusted 3GPP access or an untrusted 3GPP access or a 3GPP access.
  • the establishing unit 1304 establishes or updates the S2c tunnel data security channel according to the trusted relationship of the user equipment access indicated in the received response message.
  • the establishing unit may initiate a Chi ld SA establishment procedure with the UE at any time. If the Chi ld SA establishment request initiated by the UE is received, the request is accepted to establish a Chi ld SA.
  • the Chi ld SA establishment process is not initiated, and if the Chi ld SA establishment request sent by the UE is received, the refusal is performed.
  • the way to reject can be:
  • the reason value in Not ify Payload in the response message of the Chi ld SA setup request indicates "N0-ADDITI0NAL-SAS", or "NO.Chi ld.SAS", or other reason value, indicating no Reconnect Receive the establishment of Chi ld SA. If there is already a Chi ld SA between the gateway device and the UE, the establishing unit initiates a process of deleting the Chi ld SA.
  • the gateway device of the embodiment of the present invention receives the packet data network connection establishment request, if the existing S6b interface session of the UE exists or an existing security association is established with the UE, the gateway device sends an authentication request to the authentication authentication.
  • the device establishes or updates the S2c tunnel data security channel according to the trusted relationship of the user equipment access indicated in the response message of the authentication device, so that the UE establishes or updates the S2c correctly when the UE accesses the EPS network through the S2c interface. Tunnel data security channel.
  • FIG. 14 is a block diagram of a gateway device in accordance with yet another embodiment of the present invention.
  • a non-limiting example of the gateway device 140 of FIG. 14 is the packet data gateway shown in FIGS. 10 and 11, and includes a receiving unit 1401, a confirming unit 1402, and an establishing unit 1403.
  • the receiving unit 1401 receives a packet data network connection establishment request of the user equipment.
  • the acknowledgment unit 1402 confirms that if there is an S6b session of the user equipment or a security association with the user equipment, the current unit 1 determines the current access type information according to the request. Trusted relationship of user equipment access.
  • the establishing unit 1403 establishes or updates a data security channel of the S2c tunnel according to the trusted relationship of the user equipment access determined by the confirming unit.
  • the receiving unit 1401 receives the packet data network connection establishment request of the user equipment, where the packet data network connection establishment request is a session establishment message sent by the E, and the session establishment message is a packet data network connection request sent by the mobility management network element to the user equipment. After sending.
  • the session establishment request includes information such as a UE identifier, a P type, and a wireless access type.
  • the radio access type indication is 3GPP access at this time, such as E_UTRAN, UTRAN, and the like.
  • the P ⁇ type indicates the type of IP address assigned to the UE by this P ⁇ connection, such as IPv4, IPv6, or IPv4v6. If the scenario is switched, a handover indication is also included in the request message.
  • the acknowledgment unit 1402 confirms whether the S6b session of the UE already exists, that is, whether the session context of the S6b interface of the UE exists, and the session context includes the session identifier Ses s ion ID and the user equipment identifier. Or the acknowledgment unit 1402 confirms whether a security association is established with the UE, that is, whether the UE has a security context, and the security context includes a security parameter index SPI and a UE identifier. If the S6b interface session of the UE exists or the SA is established with the UE, the original gateway device has applied for authentication authentication for the UE to the authentication device. At this time, the confirming unit determines the trusted relationship of the current user equipment access according to the wireless access type information in the packet data network connection establishment request received by the receiving unit, and determines that the 3GPP access is at this time.
  • the establishing unit 1403 establishes or according to the trusted relationship of the user equipment access determined by the confirming unit. Update the S2c tunnel data security channel. If the user equipment access is a 3GPP access, the establishing unit does not initiate the Chi ld SA establishment process, and if it receives the Chi ld SA establishment request sent by the UE, it rejects.
  • the way to reject may be:
  • the reason value in Not ify Payload in the response message of the Chi ld SA setup request indicates "N0-ADDITI0NAL-SAS", or "NO.Chi ld.SAS", or other reason value, indicating no Then receive the establishment of Chi ld SA. If there is already a Chi ld SA between the gateway device and the UE, the establishing unit initiates a process of deleting the Chi ld SA.
  • the ⁇ E when the UE accesses the EPC network by the 3GPP access network through the S2c interface, the ⁇ E sends a session establishment request message to the gateway device according to the P ⁇ connection request of the UE, and the gateway device confirms whether the S6b interface session of the UE already exists. Or the security association is established with the UE. If an S6b interface session is established or an SA is established with the UE, the trusted relationship of the user equipment access is determined according to the information in the session establishment request message.
  • the 3GPP access establishes or updates the S2c tunnel data security channel. Therefore, the P ⁇ -GW can distinguish the access scenario and complete the establishment or update of the data security channel.
  • a communication system in accordance with an embodiment of the present invention may include the authentication authentication device 120 and/or the gateway device 130 described above.
  • the communication system may also include the authentication authentication device 120 and/or the gateway device 140 described above.
  • the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, for clarity of hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division, and may be implemented in actual implementation.
  • multiple units or components may be combined or integrated into another system, or some features may be omitted or not implemented.
  • the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise.
  • the components displayed for the unit may or may not be physical units, ie may be located in one place, or may be distributed over multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software function unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention may contribute to the prior art or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例提供一种隧道数据安全通道的处理方法和设备，其中方法包括：接收接入侧的鉴权认证请求，确定用户设备接入的可信关系；当已有该用户设备的S6b接口会话存在时，向分组数据网关发送包含所述用户设备接入可信关系信息的消息，以便所述分组数据网关根据所述可信关系信息建立或更新S2c隧道数据安全通道。本发明实施例在用户设备通过S2c接口接入EPS网络时，当接收到接入侧的鉴权认证请求时，如果已有接入的用户设备的S6b接口会话存在，则发送包含用户设备接入可信关系信息的消息给分组数据网关，从而使分组数据网关能够获得用户设备通过S2c接口接入EPS网络时的可信关系，保障正确的建立或更新S2c隧道数据安全通道。

Description

一种数据安全通道的处理方法及设备 技术领域
本发明实施例涉及通信技术领域， 并且更具体地， 涉及数据安全通道的 处理方法及设备。 背景技术
随着移动宽带时代的到来， 用户需要随时随地的使用宽带接入服务， 这 对移动通信网络提出了更高的要求， 如更高的传输速率、 更小的时延和更高 的系统容量等。为了保持 3GPP网络的优势， 3GPP标准组织于 2004年底启动 了 SAE ( System Architecture Evolution, 系统架构演进）计划的研究和标 准化工作， 定义了一个新的移动通信网络框架， 称为演进的分组系统 EPS (Evolved Packet System, 演进的分组系统）。 随着核心网融合统一的趋势， 3GPP在 EPS系统中的核心网 EPC (Evolved Packet Core, 演进的分组系统 的核心部分） 中也提供了非 3GPP接入网络接入的可能， 如 WLAN、 Wimax等 接入 EPC。
S2c接口采用 DSMIPv6 (Mobile IPv6 Support for Dual Stack Hosts, 双栈主机的移动 IPv6支持）协议， 可用于可信非 3GPP接入网络、 非可信非 3GPP接入网络、 3GPP接入网络接入 EPS网络。 UE (User Equipment, 用户 设备 )从非 3GPP接入网络通过 S2c接口接入 EPC时， UE与 P匪- GW ( Packet Data Network Gateway, 分组数据网关， 也可筒称为 PGW )之间将建立 SA ( Security Association, 安全联盟）保护 DSMIPv6信令。 当 UE通过 S2c 接口接入 EPC的时候， PDN-GW通过与 AAA ( Authentication Authorization Account ing , 鉴权认证和计费 )服务器之间 S6b接口上传递鉴权和认证请求 以及响应消息， 从而使得 PDN-GW完成对 UE的鉴权和认证， 从 AAA服务器中 获得移动性参数、 签约数据等信息， 当然， 在漫游场景下 P匪 -GW与 AAA服 务器之间还要经过 AAA代理。
当 UE从 S2c接口由可信非 3GPP接入网络接入 EPC时， 3GPP定义了在 UE与 PDN-GW之间建立 DSMIPv6隧道之后， UE与 PDN-GW之间建立安全联盟 SA保护 DSMIPv6信令， P匪 -GW可以与 UE之间发起建立子安全联盟 Chi Id SA ( Chi ld Secur i ty As soc ia t ion , 子安全联盟）对数据面进行保护； 但当 UE 从非可信非 3GPP接入网络接入 EPC的时候， UE与非 3GPP接入网关 ePDG
( evo lved PDG ,演进分组数据网关）之间会建立 IPSec安全通道，通过 IPSec 安全通道对 UE与 P匪 -GW之间的数据包进行安全保护。 即， 当 UE从非 3GPP 网络以可信方式接入 EPS的时候， S2c隧道上可以建立 Chi l d SA对数据面的 完整性和机密性进行保护； 从非 3GPP 网络以非可信方式接入的时候， 将由 UE与 ePDG之间的 IPSec安全通道提供数据的完整性保护和机密性保护； 而 当 UE通过 S2c接口从 3GPP接入网络接入 EPC时， UE与 P匪 -GW之间将通过 3GPP 自身的鉴权加密机制提供数据安全保护。 所以， UE通过 S2c接口接入 EPC的时候， P匪 _GW需要区分接入场景是可信非 3GPP接入网络接入、 非可 信非 3GPP接入网络接入或 3GPP接入网络接入， 完成不同的数据安全通道的 建立或更新过程。
在 UE从 3GPP接入网络接入 EPC的时候， 可以先建立 UE与 P匪 _GW之间 的安全联盟 SA,这是为了之后切换到非 3GPP接入网络接入时，节约 SA建立 的时间。而 UE从非 3GPP接入网络切换到 3GPP接入网络的时候， UE与 P匪 -GW 之间的安全联盟 SA也可以不立即释放， 而是保留一段时间至 SA超时自动释 放。 在这样的情况下， UE在可信非 3GPP接入网络、 非可信非 3GPP接入网络 以及 3GPP接入网络之间切换并通过 S2c接口接入 EPC时， SA可能已经存在， 但之前建立 SA时 P匪 -GW获得的当时的接入网络的可信关系， 即当时的接入 网络是可信或非可信非 3GPP接入还是 3GPP接入的信息并不一定与现在的接 入网络的可信关系一致， 因此， 需要根据切换后的接入场景建立或更新数据 安全通道。
如上所述，UE在可信非 3GPP接入网络、 3GPP接入网络以及非可信非 3GPP 接入网络之间切换通过 S2c接口接入 EPC的时候， P匪 -GW需要区分接入场景， 以完成不同方式的数据安全通道的建立或更新。 但 PDN-GW并不能够判断当 前 UE接入方式， 也就无法正确的建立或更新数据安全通道。 发明内容
本发明实施例提供了一种隧道数据安全通道的处理方法和设备， 能够保 障正确的建立或更新 S2c隧道数据安全通道。
一方面， 提供了一种隧道数据安全通道的处理方法， 包括： 接收接入侧 的鉴权认证请求， 确定用户设备接入的可信关系； 当该用户设备的 S6b接口 会话存在时， 向分组数据网关发送包含可信关系信息的消息， 以便分组数据 网关根据该可信关系信息建立或更新 S2 c隧道数据安全通道。
另一方面， 提供了一种隧道数据安全通道的处理方法， 包括： 接收用户 设备的分组数据网连接建立请求， 当所述用户设备的 S6b接口会话存在或者 与所述用户设备之间已有安全联盟时， 发送认证请求消息到鉴权认证设备， 接收所述鉴权认证设备发送的认证响应消息， 所述认证响应消息中包括所述 用户设备接入的可信关系信息， 根据所述可信关系信息， 建立或更新 S2c隧 道数据安全通道。
另一方面， 提供了一种鉴权认证设备， 包括： 接收单元， 用于接收接入 侧的鉴权认证请求； 鉴权单元， 用于对所述鉴权认证请求进行鉴权， 确定用 户设备接入的可信关系， 当所述用户设备的 S6b会话存在时， 通知发送单元 向分组数据网关发送包含所述可信关系信息的消息； 发送单元， 用于向所述 分组数据网关发送消息， 所述消息中包含所述可信关系信息。
另一方面， 提供了一种网关设备， 包括： 接收单元， 用于接收用户设备 的分组数据网连接建立请求， 以及用于接收鉴权认证设备发送的认证响应消 息， 所述认证响应消息中包括该用户设备接入的可信关系信息； 确认单元， 用于当所述接收单元接收到所述分组数据网连接建立请求时， 确认若存在所 述用户设备的 S6b会话或者与所述用户设备之间已有安全联盟， 则通知发送 单元向鉴权认证设备发送认证请求消息； 发送单元， 用于向所述鉴权认证设 备发送所述认证请求消息； 建立单元， 用于根据所述可信关系信息， 建立或 更新 S2c隧道数据安全通道。
本发明实施例在 UE从 S 2 c接口接入 EPC时， 由鉴权认证设备发送包含 用户设备接入的可信关系信息的消息， 或在认证响应消息中包含用户设备接 入的可信关系信息， 网关设备根据消息中包含的可信关系信息， 建立或更新 数据安全通道， 保障建立正确的数据安全通道。 附图说明
为了更清楚地说明本发明实施例的技术方案， 下面将对实施例或现有技 术描述中所需要使用的附图作筒单地介绍， 显而易见地， 下面描述中的附图 仅仅是本发明的一些实施例， 对于本领域普通技术人员来讲， 在不付出创造 性劳动的前提下， 还可以根据这些附图获得其他的附图。
图 1是 3GPP规定的非漫游场景下采用 S 2c接口接入 EPS网络的系统架 构图。
图 2是根据本发明一个实施例的非 3GPP接入网络采用 S2c接口接入 EPS 网络的数据安全通道的处理方法。
图 3是本发明一个实施例的可信非 3GPP接入网络采用 S2c接口接入 EPS 网络的数据安全通道的处理方法的过程的示意流程图。
图 4是本发明一个实施例的非可信非 3GPP接入网络采用 S2 c接口接入 EPS网络的数据安全通道的处理方法的过程的示意流程图。
图 5是本发明一个实施例的非可信非 3GPP接入网络采用 S2 c接口接入
EPS网络的数据安全通道的处理方法的过程的示意流程图。
图 6是根据本发明另一个实施例的采用 S2c接口接入 EPS网络的数据安 全通道的处理方法。
图 7是本发明另一个实施例的可信非 3GPP接入网络采用 S2 c接口接入 EPS网络的数据安全通道的处理方法的过程的示意流程图。
图 8是本发明另一个实施例的非可信非 3GPP接入网络采用 S2 c接口接 入 EPS网络的数据安全通道的处理方法的过程的示意流程图。
图 9是本发明另一个实施例的 3GPP接入网络采用 S 2c接口接入 EPS网 络的数据安全通道的处理方法的过程的示意流程图。
图 1 0是本发明又一个实施例的 3GPP接入网络采用 S2c接口接入 EPS网 络的数据安全通道的处理方法的过程的示意流程图。
图 1 1是本发明又一个实施例的 3GPP接入网络采用 S2c接口接入 EPS网 络的数据安全通道的处理方法的过程的示意流程图。
图 12是根据本发明一个实施例的鉴权认证设备的框图。
图 1 3是根据本发明另一个实施例的网关设备的框图。
图 14是根据本发明又一个实施例的网关设备的框图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行 清楚、 完整地描述， 显然， 所描述的实施例是本发明一部分实施例， 而不是 全部的实施例。 基于本发明中的实施例， 本领域普通技术人员在没有作出创 造性劳动前提下所获得的所有其他实施例， 都属于本发明保护的范围。
图 1是 3GPP规定的采用 S2c接口接入 EPS网络的系统架构图。 本发明 实施例可应用于图 1所示的 EPS网络架构。
如图 1所示， S2c接口可以用于非 3GPP接入网络、 3GPP网络接入 EPS 网络。 对于可信非 3GPP接入网络， UE将直接通过非 3GPP接入网络连接到 P匪 -GW; 而对于非可信非 3GPP接入网络， UE则需要通过归属网络可信任的 演进分组数据网关 ePDG , 再连接到 P匪 -GW网元上。对于 3GPP接入网络， UE 则通过 S_GW ( Serv ing Ga t eway , 服务网关）连接到 P匪 _GW网元上。
当 UE从 S2c接口通过 P匪 _GW接入 EPC时， 如果是由可信非 3GPP接入 网络接入 EPC的， P匪 -GW需要发起建立子安全联盟 ch i l d SA对数据面进行 保护； 如果 UE是从非可信非 3GPP接入网络接入 EPC的， P匪 _GW通过 UE与 ePDG之间的 IPSec通道建立 DSMIPv6安全通道对数据进行完整性保护和机密 性保护；如果是由 3GPP接入网络接入 EPC的， UE与 P匪 -GW之间将通过 3GPP 自身的鉴权加密机制提供数据安全保护。
由上述描述可以看到， P匪 -GW需要知道当前 UE是从可信非 3GPP接入网 络、 非可信非 3GPP接入网络还是 3GPP接入网络接入的， 这是正确的建立或 更新 S2c隧道数据安全通道的前提。尤其是 UE在可信非 3GPP接入网络、 3GPP 接入网络以及非可信非 3GPP接入网络之间切换后通过 S2c接口接入 EPC的 时候， P匪 -GW需要区分接入场景，以完成正确的数据安全通道的建立或更新。
本发明实施例在图 1所述的网络架构上，在 UE从 S2c接口接入 EPC时， 由鉴权认证设备确定 UE接入的可信关系， 给 P匪 -GW发送包含 UE接入可信 关系指示的消息，或在发给 PDN-GW的认证响应消息中包含 UE接入可信关系 的指示， P匪 -GW根据消息中指示的 UE接入的可信关系， 建立或更新数据安 全通道， 保证建立正确的数据安全通道。 发明实施例中的鉴权认证设备均以 AAA服务器来举例说明，具体实施时也可能是 HSS ( Home Sub s cr i ber Se rver , 归属用户服务器）等其他设备作为实施例中的鉴权认证设备。
图 2是本发明一个实施例的采用 S2c接口接入 EPS网络的数据安全通道 的处理方法。 由鉴权认证设备确定用户设备接入的可信关系， 发送包含用户 设备接入可信关系指示的消息给 P匪 -GW, P匪 -GW根据消息中指示的用户接 入的可信关系， 建立或更新数据安全通道， 保证建立正确的数据安全通道。 201 , 接收接入侧的鉴权认证请求。
UE从 S2c接口接入 EPC网络时， AAA服务器会接收到接入侧的鉴权认证 请求， 申请对接入的 UE进行鉴权认证。 因为 UE接入 EPC的方式不同， 当 UE 从可信非 3GPP接入网络接入时， 此处的接入侧指可信非 3GPP接入网络， 当 UE从非可信非 3GPP接入网络接入时，此处的接入侧是指非可信非 3GPP接入 网络或 ePDG。
202 , 确定用户设备接入的可信关系。
AAA服务器根据接入侧鉴权认证请求中携带的参数判断用户设备接入为 可信接入还是非可信接入， 参数包括以下的一种或几种： 接入网标识 ANID , 拜访地网络标识 Vi s i ted Ne twork Ident i ty (该标识仅在漫游场景下需要）， 接入类型， 接入网络内使用的安全机制等。
203 , 当该用户设备的 S6b接口会话存在时， 向分组数据网关发送包含 可信关系信息的消息， 以便分组数据网关根据该可信关系信息建立或更新 S2c隧道数据安全通道。
AAA服务器判断是否已经存在该 UE的 S6b接口会话， 即是否已有该 UE 的 S6b接口的会话上下文存在， 会话上下文包括会话标识 Ses s i on ID和用 户设备标识。 若已存在 S6b接口会话， 则说明 P匪 _GW已经向 AAA服务器申 请过针对该 UE的鉴权认证， 本次 UE接入应该是切换场景。 此时， AAA服务 器发送消息给 P匪- GW, 其中包含指示该 UE接入可信关系的信息， 即该 UE 接入是可信非 3GPP接入还是非可信非 3GPP接入。 P匪 -GW根据接收到的 UE 接入的可信关系， 建立或更新 S2c隧道数据安全通道。
本发明实施例在收到接入侧的鉴权认证请求时， 如果已有 UE的 S6b接 口会话存在， 则发送包含 UE接入可信关系信息的消息给 P匪- GW, 使 P匪 -GW 可以正确建立或更新 S2c隧道数据安全通道。
下面结合具体例子， 更加详细地描述本发明的实施例。 图 3是根据本发 明一个实施例的可信非 3GPP接入网络采用 S2c接口接入 EPS网络的数据安 全通道的处理方法的示意流程图。
301 , UE发送 EAP-RSP鉴权请求消息到可信非 3GPP接入网络。
302 , 可信非 3GPP接入网络发送鉴权认证请求到 AAA服务器， 鉴权认证 请求中包括接入网标识 ANID ,接入类型，还可能包括接入网络内使用的安全 机制等参数。 在漫游场景下， 此鉴权认证请求要通过 AAA服务器代理从接入 网络转发给 AAA服务器， 而且鉴权认证请求中还包括拜访地网络标识， 即 Vi s i ted Network Ident i ty。
AAA服务器根据接收到的请求中的参数判断 UE接入为可信接入还是非 可信接入， 此处确定为可信接入， 即 UE由可信非 3GPP接入网络接入。 参数 包括以下的一种或几种：接入网标识 ANID,拜访地网络标识 Vi s i ted Network Ident i ty (该标识仅在漫游场景下需要）， 接入类型， 接入网络内使用的安 全机制等。
303 , AAA服务器发送鉴权认证响应消息给可信非 3GPP接入网络， 其中 包括上述可信接入结果。
304 ,可信非 3GPP接入网络发送 EAP-REQ鉴权响应消息给 UE,其中包括 可信接入结果。
305 , AAA服务器判断是否已经存在该 UE的 S6b接口会话， 即是否已有 该 UE的 S6b接口的会话上下文存在， 会话上下文包括会话标识 Ses s ion ID 和用户设备标识。 若已有 S6b接口会话， 则说明原来 P匪 -GW已经向 AAA服 务器申请过针对该 UE的鉴权认证请求，本次接入应该是切换场景。 AAA服务 器发送可信关系给 P匪- GW, 即 AAA服务器发送可信关系消息到 P匪- GW, 其 中包括可信关系信元， 取值为 "可信" 或 "非可信"， 此时指示为 "可信"， 表示当前为可信接入。
306 , P匪 -GW接收到可信关系消息指示为可信接入后， 在任意时间可发 起与 UE间的 Chi ld SA建立过程。 若接收到 UE发起的 Chi ld SA建立请求， 则接受请求， 建立 Chi ld SA。
在实际实现过程中， AAA服务器接收到可信非 3GPP接入网络发送的鉴权 认证请求， 判断本次用户设备接入为可信接入， 如果已经存在该 UE 的 S6b 接口会话， 即可向 P匪 -GW发送可信关系消息。 也就是说， 步骤 305在步骤 302之后执行就可以，与步骤 303、 304并没有严格的先后执行顺序。同样的， P匪 -GW接收到可信关系消息指示为可信接入后， 可以在任意时间发起与 UE 间的 Chi ld SA建立过程， 即步骤 306可在步骤 305之后任意时间执行， 与 303、 304也没有严格的先后执行顺序。 而步骤 301至 304则按照示意流程图 中的先后顺序执行。
本发明实施例在收到可信非 3GPP接入网络的鉴权认证请求时， 确定用 户设备接入的可信关系为可信接入， 当已有该 UE的 S6b接口会话存在时， 发送包含 UE接入可信关系信息的消息给 P匪 -GW,使 PDN-GW可以区分接入场 景， 完成正确的数据安全通道的建立或更新。
图 4是根据本发明一个实施例的非可信非 3GPP接入网络采用 S2c接口 接入 EPS网络的数据安全通道的处理方法的过程的示意流程图。
401 , UE发送 EAP-RSP鉴权请求消息到非可信非 3GPP接入网络。
402 , 非可信非 3GPP接入网络发送鉴权认证请求到 AAA服务器， 鉴权认 证请求中包括接入网标识 AN ID、接入类型，还可能包括接入网络内使用的安 全机制参数等。 在漫游场景下， 接入网络提交的鉴权认证请求需要通过 AAA 服务器代理转发给 AAA 服务器， 且上述请求中包括拜访地网络标识， 即 Vi s i ted Network Ident i ty。
AAA服务器根据鉴权认证请求中的参数判断本次用户设备接入为可信接 入还是非可信接入， 确定为非可信接入， 即 UE由非可信非 3GPP接入网络接 入。参数包括以下的一种或几种：接入网标识 ANID,拜访地网络标识 Vi s i ted Network Ident i ty (该标识仅在漫游场景下需要）， 接入类型， 接入网络内 使用的安全机制等。
403 , AAA服务器发送鉴权认证响应消息给非可信非 3GPP接入网络， 其 中包括上述非可信接入结果。
404 ,非可信非 3GPP接入网络发送 EAP-REQ鉴权响应消息给 UE ,其中包 括上述非可信接入结果。
405 , AAA服务器判断是否已经存在该 UE的 S6b接口会话， 即是否已有 该 UE的 S6b接口的会话上下文存在， 会话上下文包括会话标识 Ses s ion ID 和用户设备标识。 若已有 S6b接口会话， 则说明原来 P匪 -GW已经向 AAA服 务器申请过针对该 UE的鉴权认证请求，本次接入应该是切换场景。 AAA服务 器发送可信关系消息到 P匪 -GW, 其中包括可信关系信元， 取值为 "可信"或 "非可信"， 此时指示为 "非可信"， 表示当前为非可信接入。
P匪 -GW接收到指示 UE接入为非可信接入的消息后， 不再发起 Chi ld SA 建立过程， 若接收到 UE发送的 Chi ld SA建立请求， 则拒绝。 拒绝的方式可 以为： 在 Ch i 1 d SA建立请求的响应消息中的 No t i f y Pay 1 oad中的原因值指 示 "N0-ADDITI0NAL-SAS" ，或 "NO.Chi ld.SAS" ，或其它原因值, 表示不再 接收 Ch i 1 d S A的建立。如果 P匪 -GW与 UE之间已经有 Ch i 1 d S A存在，则 Ρ匪 -GW 发起删除 Ch i 1 d S A的过程。 在实际实现过程中， AAA服务器接收到非可信非 3GPP接入网络发送的鉴 权认证请求， 判断本次 UE接入为非可信接入， 如果已经存在该 UE的 S6b接 口会话， 即可向 PDN-GW发送可信关系消息。 也就是说， 步骤 405在步骤 402 之后执行就可以， 与步骤 403、 404并没有严格的先后执行顺序。 而步骤 401 至 404则按照示意流程图中的先后顺序执行。
本发明实施例在收到非可信非 3GPP接入网络的鉴权认证请求时， 确定 UE接入的可信关系为非可信接入，当已有该 UE相关的 S6b接口会话存在时， 发送包含 UE接入可信关系信息的消息给 P匪 -GW,使 PDN-GW可以区分接入场 景， 完成数据安全通道的建立或更新。
图 5是根据本发明一个实施例的非可信非 3GPP接入网络采用 S2c接口 接入 EPS网络的数据安全通道的处理的过程的示意流程图。
501, UE发送 IKE鉴权请求到演进分组数据网关 ePDG, 请求建立 UE与 ePDG之间的 IPSec隧道。
502, ePDG发送鉴权认证请求到 AAA服务器， 鉴权认证请求中包括接入 网标识 ANID,接入类型， 还可能包括接入网络内使用的安全机制参数等。 漫 游场景下此鉴权认证请求通过 AAA服务器代理转发，且上述请求中包括拜访 地网络标识， 即 Visited Network Identity。
AAA服务器根据鉴权请求中的参数判断 UE接入为可信接入还是非可信 接入， 确定为非可信接入， 即 UE由非可信非 3GPP接入网络接入。 参数包括 以下的一种或几种： 接入网标识 ANID, 拜访地网络标识 Visited Network Identity (该标识仅在漫游场景下需要）， 接入类型， 接入网络内使用的安 全机制等。
503, AAA服务器发送鉴权认证响应消息给 ePDG。
504, ePDG发送 IKE鉴权响应消息给 UE。
505, AAA服务器判断是否已经存在该 UE的 S6b接口会话， 即是否已有 该 UE的 S6b接口的会话上下文存在， 会话上下文包括会话标识 Session ID 和用户设备标识。 若已有 S6b接口会话， 则说明原来 PDN-GW已经向 AAA服 务器申请过针对该 UE的鉴权认证请求，本次接入应该是切换场景。 AAA服务 器发送可信关系消息到 P匪 -GW, 其中包括可信关系信元， 取值为 "可信"或 "非可信"， 此时指示为 "非可信"， 表示当前为非可信接入。
P匪 -GW接收到指示 UE接入为非可信接入的消息后， 不再发起 Child SA 建立过程， 若接收到 UE发送的 Chi ld SA建立请求， 则拒绝。 拒绝的方式可 以为： 在 Ch i 1 d SA建立请求的响应消息中的 No t i f y Pay 1 oad中的原因值指 示 "N0-ADDITI0NAL-SAS" ，或 "NO.Chi ld.SAS" ，或其它原因值, 表示不再 接收 Ch i 1 d S A的建立。如果 P匪 -GW与 UE之间已经有 Ch i 1 d S A存在，则 Ρ匪 -GW 发起删除 Chi Id SA的过程。
在实际实现过程中， AAA服务器接收到演进分组数据网关 ePDG发送的鉴 权认证请求， 判断 UE接入为非可信接入， 如果已经存在该 UE的 S6b接口会 话， 即可向 PDN-GW发送可信关系消息。 也就是说， 步骤 505在步骤 502之 后执行就可以， 与步骤 503、 504 并没有严格的先后执行顺序。 而步骤 501 至 504则按照示意流程图中的先后顺序执行。
本发明实施例在收到演进分组数据网关 ePDG的鉴权认证请求时， 确定 UE接入的可信关系为非可信接入， 当已有该 UE的 S6b接口会话存在时， 发 送包含 UE接入可信关系信息的消息给 PDN-GW ,使 P匪 -GW可以区分接入场景， 完成数据安全通道的建立或更新。
图 6是根据本发明另一个实施例的采用 S2c接口接入 EPS网络的数据安 全通道的处理方法。 P匪 -GW接收分组数据网连接建立请求，发送认证请求给 鉴权认证设备， 根据鉴权认证设备的响应消息中指示的当前接入的可信关 系， 建立或更新 S2c隧道数据安全通道。
601 , 接收用户设备的分组数据网连接建立请求。
当 UE从非 3GPP接入网络由 S2c接口接入 EPC时， 所接收的分组数据网 连接建立请求是 UE发送的绑定更新 Binding Update消息； 当 UE从 3GPP接 入网络由 S2c接口接入 EPC 时， 所接收的分组数据网连接建立请求是 MME ( Mobi l i ty Management Ent i ty, 移动性管理网元）发送的会话建立消息， 该会话建立消息是移动性管理网元接收到用户设备发送的分组数据网连接 请求后发送的。
602 , 当该用户设备的 S6b接口会话存在或者与该用户设备之间已有安 全联盟时， 发送认证请求消息到鉴权认证设备。
P匪 -GW判断是否已经存在接入 UE的 S6b会话， 即是否已有该 UE的 S6b 接口的会话上下文存在， 会话上下文包括会话标识 Ses s ion ID和用户设备 标识。 或者 PDN-GW判断是否与该 UE之间已有安全联盟建立， 即此 UE是否 已有安全上下文存在， 安全上下文包括安全参数索引 SPI和 UE标识。 如果 已有该 UE的 S6b接口会话存在， 或者与该 UE之间已有安全联盟建立时， 则 说明原来 P匪 -GW已经向 AAA服务器申请过针对该 UE的鉴权认证， 此时， PDN-GW发送认证请求给 AAA服务器。
603 , 接收鉴权认证设备发送的认证响应消息， 认证响应消息中包括该 用户设备接入的可信关系信息，根据可信关系信息建立或更新 S2c隧道数据 安全通道。
接收 AAA服务器返回的认证响应消息， 其中包含指示用户设备接入可信 关系的信息， 即用户设备接入是可信非 3GPP接入、 非可信非 3GPP接入还是 3GPP接入。 P匪 -GW根据接收到的用户设备接入的可信关系，建立或更新 S2 c 隧道数据安全通道。
本发明实施例在收到用户设备的分组数据网连接建立请求时，如果已有 该 UE的 S6b接口会话存在或者与该 UE之间已有安全联盟建立时， 则发送认 证请求消息给鉴权认证设备， 并根据鉴权认证设备的响应消息中所指示的用 户设备接入的可信关系， 建立或更新 S2c隧道数据安全通道。
下面结合具体例子， 更加详细地描述本发明的另一个实施例。 图 7是根 据本发明另一个实施例的可信非 3GPP接入网络采用 S2c接口接入 EPS网络 的数据安全通道的处理方法的示意流程图。
701 , UE发送绑定更新请求 B ind ing Upda t e消息到 PDN-GW,使得 PDN-GW 将 UE的本地地址和家乡地址绑定， 建立 UE与 P匪 -GW之间的数据连接。
702 , PDN-GW接收到绑定更新请求消息后， P匪 -GW判断是否已经存在该
UE的 S6b会话， 即是否已有该 UE的 S6b接口的会话上下文存在， 会话上下 文包括会话标识 Se s s i on ID和用户设备标识。或者 P匪 -GW判断是否与该 UE 之间已有安全联盟建立， 即此 UE是否已有安全上下文存在， 安全上下文包 括安全参数索引 SP I和 UE标识。 如果已有该 UE的 S6b接口会话存在， 或者 与该 UE之间已有安全联盟建立时， 则说明原来 P匪 -GW已经向 AAA服务器申 请过针对该 UE的鉴权认证， 此时， 则 P匪 -GW发送认证请求给 AAA服务器。 认证请求消息中包括 UE标识， 还包括网络标识。 网络标识包括如下信息的 一种或几种： 接入网标识、 接入网络内使用的安全机制、 接入类型， 如果是 漫游场景， 还包括拜访地网络标识。
703 , AAA服务器根据配置的策略判定用户设备接入是否为可信接入，并 发送认证响应消息到 P匪- GW, 消息中包括可信关系信元， 取值为 "可信"或 "非可信"或" 3GPP" ,指示用户设备接入为可信非 3GPP接入或非可信非 3GPP 接入或 3GPP接入， 此处取值为 "可信"， 指示为可信非 3GPP接入。
AAA服务器判定用户设备接入是否为可信接入的方法可以为： 在策略中 包括网络标识与可信关系的对应关系， AAA服务器根据认证请求消息中的网 络标识， 查询配置的策略确定用户设备接入的可信关系。 若策略中需要根据 接入网标识进行可信关系的判断， 而认证请求消息中不包括接入网标识， 但 包含接入类型时， AAA服务器也可以根据接入类型构造接入网标识。 具体方 法为：接入类型一般是整数类型的表示方法，如 0表示 WLAN, 2001表示 HRPD 等。 因此， AAA服务器根据接入类型， 查表得知接入类型的整数对应的具体 接入类型描述， 用字符串表示， 作为接入网标识的前缀， 接入网前缀即为 "WLAN" , "HRPD"这样的字符串， 接入网标识除前缀之外的附加字符串可以 没有， 或者由 AAA服务器自己决定生成规则。
判定方法可以采用如下方式实现： 策略中包含可信关系与网络标识对应 的记录， 查询配置的策略数据表， 如与网络标识对应的可信关系为可信接入 则判定本次 UE接入为可信接入， 可信关系为非可信接入则判定本次 UE接入为 非可信接入。
704 , P匪 _GW发送绑定更新确认消息给 UE。
705 , P匪 -GW接收到 AAA服务器指示用户设备接入为可信接入的认证响 应信息后， 在任意时间可发起与 UE间的 Chi ld SA建立过程。 若接收到 UE 发起的 Chi ld SA建立请求， 则接受请求， 建立 Chi ld SA。
本发明实施例在 UE通过 S2c接口从可信非 3GPP接入网络接入 EPC网络 时， PDN-GW收到 UE的绑定更新请求 Bind ing Upda te消息时， 如果已有该
UE的 S6b接口会话存在或者与该 UE之间已有安全联盟建立时， 则发送认证 请求消息给鉴权认证设备， 并根据鉴权认证设备的响应消息中指示的用户设 备接入的可信关系， 此处为可信接入， 建立或更新 S2c隧道数据安全通道。 从而使 P匪 -GW可以区分接入场景， 完成数据安全通道的建立或更新。
图 8是根据本发明另一个实施例的非可信非 3GPP接入网络采用 S2c接 口接入 EPS网络的数据安全通道的处理方法的示意流程图。 图 8的方法与图
7的方法相对应， 因此适当省略部分详细描述。
801 , UE发送绑定更新请求 Bind ing Upda te消息到 P匪 _GW,使得 PDN-GW 将 UE的本地地址和家乡地址绑定， 建立 UE与 P匪 -GW之间的数据连接。 802 , P匪 -GW接收到绑定更新请求消息后， P匪 -GW判断是否已经存在该 UE的 S6b会话或者与该 UE之间已有安全联盟建立。 如果已有该 UE的 S6b 接口会话存在或者与该 UE之间已有安全联盟建立时， 则说明原来 P匪 -GW已 经向 AAA服务器申请过针对该 UE的鉴权认证， 此时， P匪 -GW发送认证请求 消息到 AAA服务器。 认证请求消息中包括 UE标识， 还包括网络标识。 网络 标识包括如下信息的一种或几种：接入网标识、接入网络内使用的安全机制、 接入类型， 如果是漫游场景， 还包括拜访地网络标识。
803 , AAA服务器根据配置的策略判定该用户设备接入是否为可信接入， 并发送认证响应消息到 P匪- GW, 消息中包括可信关系信元， 取值为 "可信" 或 "非可信"或 "3GPP" , 指示当前接入为可信非 3GPP接入或非可信非 3GPP 接入或 3GPP接入，此处取值为 "非可信"，指示为非可信非 3GPP接入。 P匪 -GW 接收到指示用户设备接入为非可信接入的消息后， 不再发起 Chi ld SA建立 过程， 若接收到 UE发送的 Chi ld SA建立请求， 则拒绝。 拒绝的方式可以为： 在 Chi ld SA 建立请求的响应消息中的 Not ify Payload 中的原因值指示 "N0-ADDITI0NAL-SAS" ，或 "NO.Chi ld.SAS" ，或其它原因值, 表示不再接 收 Chi ld SA的建立。如果 PDN-GW与 UE之间已经有 Chi ld SA存在，则 P匪 -GW 发起删除 Ch i 1 d S A的过程。
804 , Ρ匪 -GW发送绑定更新确认消息给 UE。
本发明实施例在 UE通过 S2c接口从非可信非 3GPP接入网络接入 EPC网 络时， P匪 -GW收到 UE的绑定更新请求 B i nd i ng Upda t e消息时， 如果已有该 UE的 S6b接口会话存在或者与该 UE之间已有安全联盟建立时， 则发送认证 请求消息给鉴权认证设备， 并根据鉴权认证设备的认证响应消息中指示的用 户设备接入的可信关系， 此处为非可信接入， 建立或更新 S2c隧道数据安全 通道。 从而使 P匪 -GW可以区分接入场景， 完成数据安全通道的建立或更新。
图 9是根据本发明另一个实施例的 3GPP接入网络采用 S2c接口接入 EPS 网络的数据安全通道的处理的方法的示意流程图。
901 , UE发送 P匪（Packet Data Network ,分组数据网）连接请求给 MME。
902 , MME发送会话建立请求给 P匪- GW, 为该 UE建立 P匪连接。 会话建 立请求中包括 UE标识， P匪类型， 无线接入类型等。 其中 P匪类型指示本 PDN连接为 UE分配的 IP地址的类型， 如 IPv4、 IPv6、 或 IPv4v6。 无线接入 类型指示此时为 3GPP接入， 如 E-UTRAN、 UTRAN等。 如果是切换场景， 则在 请求消息中还包括切换指示。
903 , P匪 -GW接收到会话建立请求消息后， 判断是否已经存在该 UE 的 S6b会话， 即是否已有该 UE的 S6b接口的会话上下文存在，会话上下文包括 会话标识 Ses s ion ID和用户设备标识。 或者判断是否与该 UE之间已有安全 联盟建立， 即此 UE是否已有安全上下文存在， 安全上下文包括安全参数索 引 SPI和 UE标识。 如果已有该 UE的 S6b接口会话存在， 或者与该 UE之间 已有安全联盟建立时， 则说明原来 P匪 -GW已经向 AAA服务器申请过针对该 UE的鉴权认证， 此时， P匪 -GW发送认证请求给 AAA服务器。 认证请求消息 中包括 UE标识， 还包括网络标识， 网络标识包括如下信息的一种或几种： 接入网标识、 无线接入类型。
904 , AAA服务器根据配置的策略判定用户设备接入是否为可信接入，并 发送认证响应消息到 P匪- GW, 消息中包括可信关系信元， 取值为 "可信"或
"非可信"或" 3GPP" ,指示用户设备接入为可信非 3GPP接入或非可信非 3GPP 接入或 3GPP接入， 此处取值为 " 3GPP" , 指示为 3GPP接入。 P匪 -GW接收到 指示当前接入为 3GPP接入的消息后， 不再发起 Chi ld SA建立过程， 若接收 到 UE发送的 Chi ld SA建立请求， 则拒绝。 拒绝的方式可以为： 在 Chi ld SA 建立请求的响应 消 息 中 的 Not ify Payload 中 的原 因值指示 "N0-ADDITI0NAL-SAS" ，或 "NO.Chi ld.SAS" ，或其它原因值, 表示不再接 收 Chi ld SA的建立。如果 PDN-GW与 UE之间已经有 Chi ld SA存在，则 P匪 -GW 发起删除 Chi ld SA的过程。
AAA服务器判定用户设备接入是否为可信接入的方法可以为： 在策略中 包括网络标识与可信关系的对应关系， AAA服务器根据认证请求消息中的网 络标识， 查询配置的策略确定用户设备接入的可信关系。 若策略中需要根据 接入网标识进行可信关系的判断， 而认证请求消息中不包括接入网标识， 但 包含无线接入类型时， AAA服务器也可以根据无线接入类型构造接入网标识。 具体方法为： 无线接入类型一般是整数类型的表示方法， 如 3表示 WLAN, 6 表示 E-UTRAN等。 因此， AAA服务器根据无线接入类型， 查表得知无线接入 类型的整数对应的具体接入类型描述， 用字符串表示， 作为接入网标识的前 缀。 接入网标识前缀即为 "WLAN" , "E-UTRAN" 这样的字符串， 接入网标识 除前缀之外的附加字符串可以没有， 或者由 AAA服务器自己决定生成规则。
判定方法可以采用如下方式实现： 策略中包含可信关系与网络标识对应 的记录， 查询配置的策略数据表， 如与网络标识对应的可信关系为可信接入 则判定用户设备接入为可信接入， 可信关系为非可信接入则判定用户设备接 入为非可信接入， 可信关系为 3GPP接入则判定为 3GPP接入。
905 , P匪 -GW发送会话建立确认消息给 MME。
906 , 匪 E给 UE发送 P匪连接请求的响应消息。
本发明实施例在 UE通过 S2c接口由 3GPP接入网络接入 EPC网络时，匪 E 根据 UE的 P匪连接请求发送会话建立请求消息给 P匪 -GW, 如果已有该 UE 的 S6b接口会话存在或者与该 UE之间已有安全联盟建立时， 则 P匪 -GW发送 认证请求消息给鉴权认证设备， 并根据鉴权认证设备的响应消息中指示的用 户设备接入的可信关系， 此处为 3GPP接入， 建立或更新 S2c隧道数据安全 通道。 从而使 P匪 -GW可以区分接入场景， 完成数据安全通道的建立或更新。
图 10是本发明又一个实施例的 3GPP接入网络采用 S2c接口接入 EPS网 络的数据安全通道的处理方法的过程的示意流程图。 P匪 -GW接收分组数据网 连接建立请求， 根据建立请求消息中的信息判断用户设备接入的可信关系， 建立或更新 S2c隧道数据安全通道。
1001 , UE发送 P匪连接请求给匪 E。
1002 , MME发送会话建立请求给 P匪- GW, 为此 UE建立 PDN连接。 会话 建立请求中包括 UE标识， P匪类型， 无线接入类型等信息。 无线接入类型指 示此时为 3GPP接入， 如 E-UTRAN、 UTRAN等。 P匪类型指示本 PDN连接为 UE 分配的 IP地址的类型， 如 IPv4、 IPv6、 或 IPv4v6。 如果是切换场景， 则在 请求消息中还包括切换指示。
P匪 -GW判断是否已经存在该 UE的 S6b会话， 即是否已有该 UE的 S6b 接口的会话上下文存在， 会话上下文包括会话标识 Se s s ion ID和用户设备 标识。 或者 PDN-GW判断是否与该 UE之间已有安全联盟建立， 即此 UE是否 已有安全上下文存在， 安全上下文包括安全参数索引 SPI和 UE标识。 如果 已有该 UE的 S6b接口会话存在或者与该 UE之间已有安全联盟建立时， 则说 明原来 P匪- GW已经向 AAA服务器申请过针对该 UE的鉴权认证，此时， P匪 -GW 根据会话建立请求中的无线接入类型信息判定用户设备接入的可信关系，确 定此时为 3GPP接入。 ？匪_0¥不再发起（¾1 ^ SA建立过程， 若接收到 UE发 送的 Chi ld SA建立请求， 则拒绝。 拒绝的方式可以为： 在 Ch i ld SA建立请 求的响应消息中的 No t i fy Payl oad中的原因值指示 "N0-ADDITI0NAL-SAS" , 或 "N0_Ch i ld_SAS" ，或其它原因值， 表示不再接收 Chi Id SA的建立。 如果 PDN-GW与 UE之间已经有 Chi Id SA存在， J^J PDN-GW发起删除 Chi Id SA的过 程。
1003 , P匪 -GW发送会话建立确认消息给 MME。
1004 , 匪 E给 UE发送 P匪连接请求的响应消息。
本发明实施例在 UE通过 S2c接口由 3GPP接入网络接入 EPC网络时，匪 E 根据 UE的 P匪连接请求发送会话建立请求消息给 P匪 -GW, P匪 -GW判断若已 经存在该 UE的 S6b接口会话或者与该 UE之间已有安全联盟建立， 则根据会 话建立请求消息中的信息确定用户设备接入的可信关系，此处为 3GPP接入， 建立或更新 S2c隧道数据安全通道。 从而使 P匪 -GW可以区分接入场景， 完 成数据安全通道的建立或更新。
图 11是本发明又一个实施例的 3GPP接入网络采用 S2c接口接入 EPS网 络的数据安全通道的处理方法的过程的示意流程图。 P匪 -GW接收到 UE的安 全联盟建立请求， 发送鉴权认证请求消息给鉴权认证设备， 并根据鉴权认证 设备的响应消息中指示的用户设备接入的可信关系， 建立或更新 S2c隧道数 据安全通道。
1101 , UE发送 P匪连接请求给匪 E。
1102 , MME发送会话建立请求给 P匪 _GW, 为此 UE建立 PDN连接。 会话 建立请求中包括 UE标识， P匪类型， 无线接入类型等。 其中 P匪类型指示本 PDN连接为 UE分配的 IP地址的类型， 如 IPv4、 IPv6、 或 IPv4v6。 无线接入 类型指示此时为 3GPP接入， 如 E-UTRAN、 UTRAN等。 如果是切换场景， 则在 请求消息中还包括切换指示。
1103 , P匪 _GW发送会话建立确认消息给 MME。
1104 , MME给 UE发送 P匪连接请求的响应消息。
1105 , UE发送安全联盟建立请求给 PDN-GW在 UE和 PDN-GW之间建立
DSMIPv6的的 SA, 此安全联盟建立请求具体可以为 IKE鉴权请求等安全联盟 建立请求消息， 其中包括 APN ( Acces s Po int Name , 接入点名称）信息。
1106 , P匪 _GW发送鉴权认证请求消息到 AAA服务器，注册 APN和 P匪 _GW 信息， 上述请求消息中包括 UE标识。 还可以包括网络标识， 网络标识包括 如下信息的一种或几种： 接入网标识、 无线接入类型。
1107 , AAA服务器根据配置的策略判定用户设备接入的可信关系， 发送 鉴权认证响应消息到 P匪 -GW,其中包括可信关系信元，取值为 "可信 "或"非 可信" 或 " 3GPP" 或 "UNKNOWN" , 此时指示为 " 3GPP" 或 "UNKNOWN" , 取值 为 " 3GPP" 表示当前为 3GPP接入， 取值为 "UNKNOWN" 表示 AAA服务器无法 给出该用户设备接入的可信关系。当 P匪 -GW收到指示可信关系为 "UNKNOWN" 的消息后， 根据步骤 1102 中收到的会话建立请求中的无线接入类型信息判 定用户设备接入的可信关系， 此时为 3GPP接入。
PDN-GW接收到 AAA发送的指示用户设备接入为 3GPP接入的消息， 或接 收到指示用户设备接入的可信关系为 "UNKNOWN" 的消息后自行判定该用户 设备接入为 3GPP接入， 则不再发起 Chi ld SA建立过程， 若接收到 UE发送 的 Chi ld SA建立请求， 则拒绝。 拒绝的方式可以为： 在 Chi l d SA建立请求 的响应消息中的 Not i fy Payl oad 中的原因值指示 "N0-ADDITI0NAL-SAS" , 或 "N0_Ch i ld_SAS" ，或其它原因值， 表示不再接收 Chi Id SA的建立。 如果 PDN-GW与 UE之间已经有 Chi Id SA存在， J^J PDN-GW发起删除 Chi Id SA的过 程。
AAA服务器判定用户设备接入是否为可信接入的方法可以为： 在策略中 包括网络标识与可信关系的对应关系， AAA服务器根据认证请求消息中的网 络标识， 查询配置的策略确定用户设备接入的可信关系。 若策略中需要根据 接入网标识进行可信关系的判断， 而认证请求消息中不包括接入网标识， 但 包含无线接入类型时， AAA服务器也可以根据无线接入类型构造接入网标识。 具体方法为： 无线接入类型一般是整数类型的表示方法， 如 3表示 WLAN , 6 表示 E-UTRAN等。 因此， AAA服务器根据无线接入类型， 查表得知无线接入 类型的整数对应的具体接入类型描述， 用字符串表示， 作为接入网标识的前 缀。 接入网标识前缀即为 "WLAN" , "E-UTRAN" 这样的字符串， 接入网标识 除前缀之外的附加字符串可以没有， 或者由 AAA服务器自己决定生成规则。
判定方法可以采用如下方式实现： 策略中包含可信关系与网络标识对应 的记录， 查询配置的策略数据表， 如与网络标识对应的可信关系为可信接入 则判定用户设备接入为可信接入， 可信关系为非可信接入则判定用户设备接 入为非可信接入， 可信关系为 3GPP接入则判定为 3GPP接入， 如果查找不到 相应记录则返回 "UNKNOWN" , 表明无法判断用户设备接入的可信关系。
1108 , P匪 -GW发送安全联盟建立响应消息到 UE ,其中包括 P匪 -GW给 UE 分配的 IP地址。 本发明实施例在 UE通过 S2c接口由 3GPP接入网络接入 EPC网络时， P匪 -GW接收到 UE的安全联盟建立请求， 则发送鉴权认证请求消息给鉴权认 证设备， 并根据鉴权认证设备的响应消息中指示的用户设备接入的可信关 系， 此处指示为 3GPP接入或无法确定， 建立或更新 S2c隧道数据安全通道。 从而使 P匪 -GW可以区分接入场景， 完成数据安全通道的建立或更新。
图 12是根据本发明一个实施例的鉴权认证设备的框图。 图 12的鉴权认 证设备 120的非限制性例子是图 3-图 5、图 7-图 9中所示的归属用户服务器 /鉴权认证和计费服务器设备， 包括接收单元 1201、鉴权单元 1202和发送单 元 1203。
接收单元 1201用于接收接入侧的鉴权认证请求。鉴权单元 1202用于对 所接收的鉴权认证请求进行鉴权， 确定用户设备接入的可信关系。 当已经存 在该 UE的 S6b会话时，通知发送单元向 P匪 -GW发送包含可信关系指示信息 的消息。发送单元 1203 ,用于向 P匪 -GW发送包含可信关系指示信息的消息。
本发明实施例在收到接入侧的鉴权认证请求时，确认本次用户设备接入 的可信关系， 如果已有该 UE的 S6b接口会话存在则发送包含用户设备接入 可信关系信息的消息给 P匪 -GW, 使 P匪 -GW可以正确建立和更新 S2c隧道数 据安全通道。
接收单元 1201接收接入侧发送的鉴权认证请求。 UE从 S 2 c接口接入 EPC 网络时， 接收单元会接收到接入侧的鉴权认证请求， 申请对本次接入进行鉴 权认证。 因为接入的方式不同， 当 UE从可信非 3GPP接入网络接入时， 此处 的接入侧指可信非 3GPP接入网络， 当 UE从非可信非 3GPP接入网络接入时， 此处的接入侧是指非可信非 3GPP接入网络或 ePDG。
鉴权单元 1202根据所接收的鉴权认证请求中携带的参数判断本次的用 户设备接入为可信接入还是非可信接入， 参数包括以下的一种或几种： 接入 网标识 ANID, 拜访地网络标识 Vi s i ted Ne twork Ident i ty (该标识仅在漫 游场景下需要）， 接入类型， 接入网络内使用的安全机制等。 鉴权单元根据 配置的策略判定用户设备接入是否为可信接入， 策略中包括接入网标识（漫 游场景下还需要拜访地网络标识）与可信关系的对应关系。 判定的方法可以 为： 根据鉴权认证请求消息中的接入网络标识（漫游场景下还需要拜访地网 络标识）， 查询配置的策略确定用户设备接入的可信关系。 若鉴权认证请求 消息中不包括接入网标识， 需要根据接入类型标识构造接入网络标识。 具体 为： 接入类型一般是整数类型的表示方法， 如 0表示 WLAN, 2001表示 HRPD 等。 接入网络前缀即为 "WLAN" , "HRPD" 这样的字符串， 鉴权单元 1202根 据接入类型， 查表得知接入类型的整数对应的具体接入类型描述， 用字符串 表示， 作为接入网络标识的前缀。 接入网络标识除前缀之外的附加字符串可 以没有， 或者生成规则由鉴权认证设备自己决定。
判定方法可以采用如下方式： 查询配置的策略数据表， 找到与接入网络 标识（漫游场景下还需要拜访地网络标识）对应的可信关系， 如可信关系为 可信接入则判定当前接入为可信接入， 可信关系为非可信接入则判定当前接 入为非可信接入。
鉴权单元判断是否已经存在该接入 UE的 S6b会话， 即是否已有该 UE的
S6b接口的会话上下文存在， 会话上下文包括会话标识 Ses s ion ID和用户设 备标识。 如果已有该 UE的 S6b接口会话存在， 则说明原来 P匪 -GW已经向鉴 权认证设备申请过针对该 UE的鉴权认证。 此时， 鉴权单元通知发送单元发 送消息给 PDN-GW,其中包含指示用户设备接入可信关系的信息， 即该用户设 备接入是可信非 3GPP接入还是非可信非 3GPP接入。
发送单元 1203发送消息给 P匪 -GW,其中包括可信关系信元，取值为 "可 信" 或 "非可信"， "可信" 表示为可信接入， "非可信" 表示为非可信接入。 P匪 -GW根据接收到的用户设备接入的可信关系，建立或更新 S2c隧道数据安 全通道。
因此， 本发明实施例在接收单元收到接入侧的鉴权认证请求时， 鉴权单 元确定用户设备接入的可信关系，当已有该用户设备的 S6b接口会话存在时， 发送单元发送包含用户设备接入可信关系信息的消息给 P匪 -GW, 使 P匪 -GW 可以区分接入场景， 完成数据安全通道的建立或更新。
图 1 3是根据本发明另一个实施例的网关设备的框图。 图 1 3的网关设备 1 30的非限制性例子是图 3-图 5、 图 7-图 11所示的分组数据网关， 包括接 收单元 1 301、 确认单元 1 302、 发送单元 1 303和建立单元 1 304。
接收单元 1 301接收用户设备的分组数据网连接建立请求， 以及接收鉴 权认证设备发送的认证响应消息，认证响应消息中包括用户设备接入的可信 关系信息； 确认单元 1 302在接收单元接收到分组数据网连接建立请求时， 确认若存在该用户设备的 S6b会话或者与该用户设备之间已有安全联盟， 则 通知发送单元向鉴权认证设备发送认证请求消息； 发送单元 1 303向鉴权认 证设备发送所述认证请求消息； 建立单元 1304根据认证响应消息中的可信 关系信息， 建立或更新 S2c隧道数据安全通道。
本实施例在网关设备接收到分组数据网连接建立请求时，发送认证请求 消息给鉴权认证设备，根据鉴权认证设备的认证响应消息中指示的用户设备 接入的可信关系， 建立或更新 S2c隧道数据安全通道。
接收单元 1301接收用户设备的分组数据网连接建立请求。 当 UE从非 3GPP接入网络由 S2c接口接入 EPC时，所接收的分组数据网连接建立请求是 UE发送的绑定更新 Binding Upda te消息； 当 UE从 3GPP接入网络由 S2c接 口接入 EPC时， 所接收的分组数据网连接建立请求是匪 E发送的会话建立消 息， 该会话建立消息是移动性管理网元接收到用户设备发送的分组数据网连 接请求后发送的。
确认单元 1302确认是否已经存在本次接入 UE的 S6b会话， 即是否已有 该 UE的 S6b接口的会话上下文存在， 会话上下文包括会话标识 Ses s ion ID 和用户设备标识。 或者确认单元确认是否与该 UE之间已有安全联盟建立， 即此 UE是否已有安全上下文存在， 安全上下文包括安全参数索引 SPI和 UE 标识。如果已有该 UE的 S6b接口会话存在或者与该 UE之间已有安全联盟建 立， 则说明原来网关设备已经向鉴权认证设备申请过针对该 UE的鉴权认证。 此时， 通知发送单元 1303向鉴权认证设备发送认证请求。
接收单元 1301接收鉴权认证设备返回的认证响应消息， 消息中包含指 示当前接入可信关系的信息，即当前接入是可信非 3GPP接入、非可信非 3GPP 接入或 3GPP接入。 具体方式为消息中包括可信关系信元， 取值为 "可信" 或 "非可信" 或 "3GPP" , 指示当前接入为可信 3GPP接入或非可信 3GPP接 入或 3GPP接入。
建立单元 1304根据接收到的响应消息中指示的用户设备接入的可信关 系， 建立或更新 S2c隧道数据安全通道。 当消息中指示该用户设备接入为可 信接入， 则建立单元在任意时间可发起与 UE间的 Chi ld SA建立过程。 若接 收到 UE发起的 Chi ld SA建立请求， 则接受请求， 建立 Chi ld SA。 当消息中 指示该用户设备接入为非可信接入或 3GPP接入， 则不再发起 Chi ld SA建立 过程， 若接收到 UE发送的 Chi ld SA建立请求， 则拒绝。 拒绝的方式可以为： 在 Chi ld SA 建立请求的响应消息中的 Not ify Payload 中的原因值指示 "N0-ADDITI0NAL-SAS" ，或 "NO.Chi ld.SAS" ，或其它原因值, 表示不再接 收 Chi ld SA的建立。 如果网关设备与 UE之间已经有 Chi ld SA存在， 则建 立单元发起删除 Chi ld SA的过程。
因此， 本发明实施例的网关设备在接收到分组数据网连接建立请求时， 如果已有该 UE的 S6b接口会话存在或者与该 UE之间已有安全联盟建立， 则 发送认证请求给鉴权认证设备，根据鉴权认证设备的响应消息中指示的用户 设备接入的可信关系， 建立或更新 S2c隧道数据安全通道， 使得在 UE通过 S2c接口接入 EPS网络时， 保障正确的建立或更新 S2c隧道数据安全通道。
图 14是根据本发明又一个实施例的网关设备的框图。 图 14的网关设备 140的非限制性例子是图 10、图 11所示的分组数据网关，包括接收单元 1401、 确认单元 1402和建立单元 1403。
接收单元 1401 接收用户设备的分组数据网连接建立请求。 确认单元 1402在接收单元接收到分组数据网连接建立请求时，确认若存在该用户设备 的 S6b会话或者与该用户设备之间已有安全联盟， 则根据请求中的无线接入 类型信息确定本次用户设备接入的可信关系。 建立单元 1403根据确认单元 确定的用户设备接入的可信关系， 建立或更新 S2c隧道的数据安全通道。
接收单元 1401接收用户设备的分组数据网连接建立请求， 该分组数据 网连接建立请求是 E发送的会话建立消息， 该会话建立消息是移动性管理 网元接收到用户设备发送的分组数据网连接请求后发送的。会话建立请求中 包括 UE标识， P匪类型， 无线接入类型等信息。 无线接入类型指示此时为 3GPP接入， 如 E_UTRAN、 UTRAN等。 P匪类型指示本 P匪连接为 UE分配的 IP 地址的类型， 如 IPv4、 IPv6、 或 IPv4v6。 如果是切换场景， 则在请求消息 中还包括切换指示。
确认单元 1402确认是否已经存在该 UE的 S6b会话， 即是否已有该 UE 的 S6b接口的会话上下文存在， 会话上下文包括会话标识 Ses s ion ID和用 户设备标识。 或者确认单元 1402确认是否与该 UE之间已有安全联盟建立， 即此 UE是否已有安全上下文存在， 安全上下文包括安全参数索引 SPI和 UE 标识。如果已有该 UE的 S6b接口会话存在或者与该 UE之间已有安全联盟建 立时，说明原来网关设备已经向鉴权认证设备申请过针对该 UE的鉴权认证。 此时，确认单元根据接收单元接收的分组数据网连接建立请求中的无线接入 类型信息判定本次用户设备接入的可信关系， 确定此时为 3GPP接入。
建立单元 1403根据确认单元确定的用户设备接入的可信关系， 建立或 更新 S2c隧道数据安全通道。 该用户设备接入为 3GPP接入， 则建立单元不 再发起 Chi ld SA建立过程， 若接收到 UE发送的 Chi ld SA建立请求， 则拒 绝。 拒绝的方式可以为： 在 Chi ld SA 建立请求的响应消息中的 Not ify Payload中的原因值指示 "N0-ADDITI0NAL-SAS"，或 "NO.Chi ld.SAS"，或其 它原因值， 表示不再接收 Chi ld SA的建立。 如果网关设备与 UE之间已经有 Chi ld SA存在， 则建立单元发起删除 Chi ld SA的过程。
本发明实施例在 UE通过 S2c接口由 3GPP接入网络接入 EPC网络时，匪 E 根据 UE的 P匪连接请求发送会话建立请求消息给网关设备， 网关设备确认 是否已经存在该 UE的 S6b接口会话或者与该 UE之间已有安全联盟建立， 若 已有 S6b接口会话或与该 UE之间已有安全联盟建立， 则根据会话建立请求 消息中的信息确定本次用户设备接入的可信关系， 此处为 3GPP接入， 建立 或更新 S2c隧道数据安全通道。 从而使 P匪 -GW可以区分接入场景， 完成数 据安全通道的建立或更新。
根据本发明实施例的通信系统可包括上述鉴权认证设备 120和 /或网关 设备 130。
根据本发明实施例的通信系统也可包括上述鉴权认证设备 120和 /或网 关设备 140。 本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各 示例的单元及算法步骤， 能够以电子硬件、 计算机软件或者二者的结合来实 现， 为了清楚地说明硬件和软件的可互换性， 在上述说明中已经按照功能一 般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执 行， 取决于技术方案的特定应用和设计约束条件。 专业技术人员可以对每个 特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超 出本发明的范围。
所属领域的技术人员可以清楚地了解到， 为描述的方便和筒洁， 上述描 述的系统、 设备和单元的具体工作过程， 可以参考前述方法实施例中的对应 过程， 在此不再赘述。
在本申请所提供的几个实施例中， 应该理解到， 所揭露的系统、 设备和 方法， 可以通过其它的方式实现。 例如， 以上所描述的设备实施例仅仅是示 意性的， 例如， 所述单元的划分， 仅仅为一种逻辑功能划分， 实际实现时可 以有另外的划分方式， 例如多个单元或组件可以结合或者可以集成到另一个 系统， 或一些特征可以忽略， 或不执行。 另一点， 所显示或讨论的相互之间 的耦合或直接耦合或通信连接可以是通过一些接口，设备或单元的间接耦合 或通信连接， 可以是电性， 机械或其它的形式。 为单元显示的部件可以是或者也可以不是物理单元， 即可以位于一个地方， 或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或 者全部单元来实现本实施例方案的目的。
另外， 在本发明各个实施例中的各功能单元可以集成在一个处理单元 中， 也可以是各个单元单独物理存在， 也可以两个或两个以上单元集成在一 个单元中。 上述集成的单元既可以采用硬件的形式实现， 也可以采用软件功 能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销 售或使用时， 可以存储在一个计算机可读取存储介质中。 基于这样的理解， 本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方 案的全部或部分可以以软件产品的形式体现出来， 该计算机软件产品存储在 一个存储介质中， 包括若干指令用以使得一台计算机设备（可以是个人计算 机， 服务器， 或者网络设备等）执行本发明各个实施例所述方法的全部或部 分步骤。而前述的存储介质包括： U盘、移动硬盘、只读存储器（ ROM, Read-Only Memory ), 随机存取存储器 （RAM, Random Acces s Memory ), 磁碟或者光盘 等各种可以存储程序代码的介质。
以上所述， 仅为本发明的具体实施方式， 但本发明的保护范围并不局限 于此， 任何熟悉本技术领域的技术人员在本发明揭露的技术范围内， 可轻易 想到变化或替换， 都应涵盖在本发明的保护范围之内。 因此， 本发明的保护 范围应所述以权利要求的保护范围为准。

Claims

权利要求
1、 一种隧道数据安全通道的处理方法， 其特征在于， 包括，
接收接入侧的鉴权认证请求， 确定用户设备接入的可信关系；
当所述用户设备的 S6b接口会话存在时， 向分组数据网关发送包含所述 可信关系信息的消息， 以便所述分组数据网关根据所述可信关系信息建立或 更新 S2c隧道数据安全通道。
2、 如权利要求 1所述的方法， 其特征在于， 所述接入侧为可信非 3GPP 接入网络或非可信非 3GPP接入网络或演进分组数据网关。
3、 如权利要求 1所述的方法， 其特征在于， 当所述用户设备的 S6b接 口会话存在时， 向分组数据网关发送包含所述可信关系信息的消息， 包括： 当所述用户设备的 S6b接口的会话上下文存在时， 向分组数据网关发送包含 所述可信关系信息的消息。
4、 如权利要求 1所述的方法， 其特征在于， 所述向分组数据网关发送 包含所述可信关系信息的消息， 包括： 向分组数据网关发送包含携带可信关 系信元的消息， 所述可信关系信元取值为可信或非可信， 指示所述用户设备 接入为可信接入或非可信接入。
5、 如权利要求 1-4任一所述的方法， 其特征在于， 当所述可信关系信 息指示所述用户设备接入为可信接入， 则所述分组数据网关根据所述可信关 系信息建立或更新 S2c隧道数据安全通道， 包括：
所述分组数据网关发起与所述用户设备之间的子安全联盟 Chi ld SA建 立过程； 或者
接受所述用户设备发起的子安全联盟 Chi ld SA建立请求。
6、 如权利要求 1-4任一所述的方法， 其特征在于， 当所述可信关系信 息指示所述用户设备接入为非可信接入， 则所述分组数据网关根据所述可信 关系信息建立或更新 S2c隧道数据安全通道， 包括：
拒绝所述用户设备发送的子安全联盟 Chi ld SA建立请求； 或者 删除与所述用户设备之间的子安全联盟 Chi ld SA。
7、 如权利要求 6所述的方法， 其特征在于， 所述拒绝用户设备发送的 子安全联盟 Chi Id SA建立请求包括： 在子安全联盟 Chi ld SA建立请求的响 应消息中指示不接受所述用户设备发送的子安全联盟 Chi Id SA建立请求。
8、 如权利要求 1所述的方法， 其特征在于， 所述确定所述用户设备接 入的可信关系， 包括：
根据接收到的所述鉴权认证请求中的参数确定用户设备接入为可信接 入还是非可信接入， 所述参数包括以下的一种或几种： 接入网标识， 拜访地 网络标识， 接入类型， 接入网络内使用的安全机制。
9、 一种隧道数据安全通道的处理方法， 其特征在于， 包括，
接收用户设备的分组数据网连接建立请求， 当所述用户设备的 S6b接口 会话存在或者与所述用户设备之间已有安全联盟时，发送认证请求消息到鉴 权认证设备，
接收所述鉴权认证设备发送的认证响应消息， 所述认证响应消息中包括 所述用户设备接入的可信关系信息，
根据所述可信关系信息， 建立或更新 S2c隧道数据安全通道。
10、 如权利要求 9所述的方法， 其特征在于， 所述接收用户设备的分组 数据网连接建立请求包括：
接收所述用户设备发送的绑定更新请求消息； 或者
接收移动性管理网元发送的会话建立消息， 所述会话建立消息是所述移 动性管理网元收到所述用户设备发送的分组数据网连接请求消息后发送的。
11、 如权利要求 9所述的方法， 其特征在于， 当所述用户设备的 S6b接 口会话存在或者与所述用户设备之间已有安全联盟时，发送认证请求消息到 鉴权认证设备， 包括： 当所述用户设备的 S6b接口的会话上下文存在或者所 述用户设备的安全上下文存在时， 发送认证请求消息到鉴权认证设备。
12、 如权利要求 9所述的方法， 其特征在于， 所述认证响应消息中包括 可信关系信元，所述可信关系信元取值为可信或非可信或 3GPP,指示所述用 户设备接入为可信接入或非可信接入或 3GPP接入。
13、 如权利要求 9-12任一所述的方法， 其特征在于， 当所述可信关系 信息指示所述用户设备接入为可信接入， 所述根据所述可信关系信息建立或 更新 S2c隧道数据安全通道， 包括：
发起与所述用户设备之间的子安全联盟 Chi ld SA建立过程； 或者 接收所述用户设备发起的子安全联盟 Chi ld SA建立请求。
14、 如权利要求 9-12任一所述的方法， 其特征在于， 当所述可信关系 信息指示所述用户设备接入为非可信接入， 所述根据所述可信关系信息建立 或更新 S2c隧道数据安全通道， 包括：
拒绝所述用户设备发送的子安全联盟 Chi ld SA建立请求； 或者 删除与所述用户设备之间的子安全联盟 Chi ld SA。
15、 如权利要求 14所述的方法， 其特征在于， 所述拒绝所述用户设备 发送的子安全联盟 Chi ld SA建立请求包括： 在子安全联盟 Chi ld SA建立请 求的响应消息中指示不接受所述用户设备发送的子安全联盟 Chi ld SA建立 请求。
16、 如权利要求 9-15任一所述的方法， 其特征在于， 所述接收所述鉴 权认证设备发送的认证响应消息之前， 还包括： 所述鉴权认证设备根据配置 的策略确定所述用户设备接入的可信关系。
17、 如权利要求 16所述的方法， 其特征在于， 所述配置的策略包括网 络标识与可信关系的对应关系， 所述网络标识包括接入网标识、 接入网络内 使用的安全机制、 接入类型以及拜访地网络标识中的一种或者多种。
18、 如权利要求 16所述的方法， 其特征在于， 所述配置的策略包括网 络标识与可信关系的对应关系， 所述网络标识包括接入网标识、 无线接入类 型中的一种或者多种。
19、 一种鉴权认证设备， 其特征在于， 包括：
接收单元， 用于接收接入侧的鉴权认证请求；
鉴权单元， 用于对所述鉴权认证请求进行鉴权， 确定用户设备接入的可 信关系， 当所述用户设备的 S6b会话存在时， 通知发送单元向分组数据网关 发送包含所述可信关系信息的消息；
发送单元， 用于向所述分组数据网关发送消息， 所述消息中包含所述可 信关系信息。
20、 如权利要求 19所述的鉴权认证设备， 其特征在于， 所述接入侧为 可信非 3GPP接入网络或非可信非 3GPP接入网络或演进分组数据网关。
21、 如权利要求 19-20任一所述的鉴权认证设备， 其特征在于， 当所述 用户设备的 S6b会话存在时， 鉴权单元通知发送单元向分组数据网关发送包 含所述可信关系信息的消息， 包括： 当所述用户设备的 S6b接口的会话上下 文存在时， 所述鉴权单元通知发送单元向分组数据网关发送包含所述可信关 系信息的消息。
22、 如权利要求 19-21任一所述的鉴权认证设备， 其特征在于， 根据配 置的策略确定所述用户设备接入的可信关系， 具体包括： 鉴权单元根据所述 鉴权认证请求中的信息查询所述配置的策略确定所述可信关系， 所述配置的 策略包括网络标识与可信关系的对应关系， 所述网络标识包括接入网标识、 接入网络内使用的安全机制、接入类型以及拜访地网络标识中的至少一种或 者多种。
23、 如权利要求 19-22任一所述的鉴权认证设备， 其特征在于， 所述消 息中包含所述可信关系信息， 具体包括： 所述消息中包含可信关系信元， 所 述可信关系信元取值为可信或非可信， 指示所述用户设备接入为可信接入或 非可信接入。
24、 一种网关设备， 其特征在于， 包括：
接收单元， 用于接收用户设备的分组数据网连接建立请求， 以及用于接 收鉴权认证设备发送的认证响应消息， 所述认证响应消息中包括所述用户设 备接入的可信关系信息；
确认单元， 用于当所述接收单元接收到所述分组数据网连接建立请求 时，确认若存在所述用户设备的 S6b会话或者与所述用户设备之间已有安全 联盟， 则通知发送单元向鉴权认证设备发送认证请求消息；
所述发送单元， 用于向所述鉴权认证设备发送所述认证请求消息； 建立单元， 用于根据所述可信关系信息， 建立或更新 S2c隧道数据安全 通道。
25、 如权利要求 24所述的网关设备， 其特征在于， 所述接收单元用于 接收用户设备的分组数据网连接建立请求， 包括：
所述接收单元用于接收所述用户设备发送的绑定更新请求消息； 或者用于接收移动性管理网元发送的会话建立消息， 所述会话建立消息 是所述移动性管理网元收到所述用户设备发送的分组数据网连接请求消息 后发送的。
26、 如权利要求 24所述的网关设备， 其特征在于， 所述确认单元用于 确认存在所述用户设备的 S6b会话或者与所述用户设备之间已有安全联盟， 具体包括：
所述确认单元用于确认存在所述用户设备的 S6b接口的会话上下文或者 存在所述用户设备的安全上下文。
27、 如权利要求 24-26任一所述的网关设备， 其特征在于， 所述认证响 应消息中包括可信关系信元用来指示所述用户设备接入的可信关系， 其中可 信关系信元取值为可信指示当前接入为可信 3GPP 网络接入， 取值为非可信 指示当前接入为非可信 3GPP 网络接入， 取值为 3GPP指示当前接入为 3GPP 网络接入。
28、 如权利要求 24-27任一所述的网关设备， 其特征在于， 当所述可信 关系信息指示所述用户设备接入为可信接入， 所述建立单元用于所述根据所 述可信关系信息， 建立或更新 S2c隧道数据安全通道， 包括：，
所述建立单元发起与所述用户设备之间的子安全联盟 Chi ld SA建立过 程； 或者，
接收所述用户设备发起的子安全联盟 Chi ld SA建立请求。
29、 如权利要求 24-27任一所述的网关设备， 其特征在于， 当所述可信 关系信息指示所述用户设备接入为非可信接入或 3GPP接入， 所述建立单元 用于所述根据所述可信关系信息，建立或更新 S2c隧道数据安全通道，包括： 拒绝所述用户设备发送的子安全联盟 Chi ld SA建立请求； 或者 删除与所述用户设备之间的子安全联盟 Chi ld SA。
PCT/CN2011/081738 2011-11-03 2011-11-03 一种数据安全通道的处理方法及设备 WO2013063783A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
JP2014539203A JP5922785B2 (ja) 2011-11-03 2011-11-03 データセキュリティチャネル処理方法およびデバイス
EP11874986.0A EP2763357B1 (en) 2011-11-03 2011-11-03 Data security channel processing method and device
PCT/CN2011/081738 WO2013063783A1 (zh) 2011-11-03 2011-11-03 一种数据安全通道的处理方法及设备
CN201180002592.5A CN103201986B (zh) 2011-11-03 2011-11-03 一种数据安全通道的处理方法及设备
US14/269,965 US9800563B2 (en) 2011-11-03 2014-05-05 Method and device for processing data security channel

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2011/081738 WO2013063783A1 (zh) 2011-11-03 2011-11-03 一种数据安全通道的处理方法及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/269,965 Continuation US9800563B2 (en) 2011-11-03 2014-05-05 Method and device for processing data security channel

Publications (1)

Publication Number Publication Date
WO2013063783A1 true WO2013063783A1 (zh) 2013-05-10

Family

ID=48191214

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/081738 WO2013063783A1 (zh) 2011-11-03 2011-11-03 一种数据安全通道的处理方法及设备

Country Status (5)

Country Link
US (1) US9800563B2 (zh)
EP (1) EP2763357B1 (zh)
JP (1) JP5922785B2 (zh)
CN (1) CN103201986B (zh)
WO (1) WO2013063783A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016101267A1 (zh) * 2014-12-26 2016-06-30 华为技术有限公司 用户设备的非可信无线局域网接入控制方法、设备和系统

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103024737B (zh) * 2011-09-23 2017-08-11 中兴通讯股份有限公司 可信任非3gpp接入网元、接入移动网络及去附着方法
CN104506406B (zh) * 2011-11-03 2018-10-30 华为技术有限公司 一种鉴权认证设备
EP2763357B1 (en) 2011-11-03 2019-03-13 Huawei Technologies Co., Ltd. Data security channel processing method and device
WO2014106318A1 (zh) * 2013-01-04 2014-07-10 华为技术有限公司 选择分组数据网关的方法、装置及系统
KR102279486B1 (ko) * 2014-03-13 2021-07-20 삼성전자 주식회사 무선 통신 시스템에서 연결을 생성하는 방법 및 장치
US9867098B2 (en) * 2014-05-29 2018-01-09 T-Mobile Usa, Inc. Wi-Fi calling using SIP-IMS handset and evolved packet data gateway
CN104184821B (zh) * 2014-08-29 2017-11-28 北京奇虎科技有限公司 基于推送通知的会话及终端应答反馈的方法和装置
US9420463B2 (en) * 2014-09-30 2016-08-16 Sap Se Authorization based on access token
US9807669B1 (en) * 2014-10-24 2017-10-31 Sprint Communications Company L.P. Identifying communication paths based on packet data network gateway status reports
WO2016074748A1 (en) * 2014-11-14 2016-05-19 Nokia Solutions And Networks Oy Location information for untrusted access
FR3039954A1 (fr) * 2015-08-05 2017-02-10 Orange Procede et dispositif d'identification de serveurs d'authentification visite et de domicile
FR3039953A1 (fr) * 2015-08-05 2017-02-10 Orange Procedes et dispositifs d'identification d'un serveur d'authentification
WO2017159970A1 (ko) * 2016-03-17 2017-09-21 엘지전자(주) 무선통신 시스템에서 단말의 보안설정을 수행하기 위한 방법 및 이를 위한 장치
JP6151819B2 (ja) * 2016-04-14 2017-06-21 ▲ホア▼▲ウェイ▼技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． データセキュリティチャネル処理方法およびデバイス
US11096053B2 (en) 2016-11-07 2021-08-17 Lg Electronics Inc. Method for managing session
US20180212916A1 (en) * 2017-01-23 2018-07-26 Marshall Schaffer Systems and methods for verification and mapping of social connections
CN110099382B (zh) 2018-01-30 2020-12-18 华为技术有限公司 一种消息保护方法及装置
US10924480B2 (en) * 2018-02-28 2021-02-16 Cisco Technology, Inc. Extended trust for onboarding
CN112217769B (zh) * 2019-07-11 2023-01-24 奇安信科技集团股份有限公司 基于隧道的数据解密方法、加密方法、装置、设备和介质
GB2586223A (en) * 2019-08-05 2021-02-17 British Telecomm Conditional message routing in a telecommunications network
CN114584341B (zh) * 2022-01-14 2023-06-16 苏州浪潮智能科技有限公司 一种零边界可信任网络架构系统、数据处理方法、装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101106812A (zh) * 2006-07-11 2008-01-16 华为技术有限公司 通信网络及用户设备接入方法
CN101316205A (zh) * 2007-05-28 2008-12-03 华为技术有限公司 触发安全隧道建立方法及其装置
WO2011104149A1 (en) * 2010-02-23 2011-09-01 Alcatel Lucent Transport of multihoming service related information between user equipment and 3gpp evolved packet core

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101431797B (zh) * 2007-05-11 2012-02-01 华为技术有限公司 一种注册处理方法、系统及装置
EP2037652A3 (en) * 2007-06-19 2009-05-27 Panasonic Corporation Methods and apparatuses for detecting whether user equipment resides in a trusted or a non-trusted access network
EP2091204A1 (en) * 2008-02-18 2009-08-19 Panasonic Corporation Home agent discovery upon changing the mobility management scheme
CA2748736C (en) * 2009-01-05 2014-08-12 Nokia Siemens Networks Oy Trustworthiness decision making for access authentication
EP2637285B1 (en) 2010-11-02 2020-04-01 Mitsubishi Electric Corporation Electric power steering power module and electric power steering drive control device employing same
EP2763357B1 (en) 2011-11-03 2019-03-13 Huawei Technologies Co., Ltd. Data security channel processing method and device

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101106812A (zh) * 2006-07-11 2008-01-16 华为技术有限公司 通信网络及用户设备接入方法
CN101316205A (zh) * 2007-05-28 2008-12-03 华为技术有限公司 触发安全隧道建立方法及其装置
WO2011104149A1 (en) * 2010-02-23 2011-09-01 Alcatel Lucent Transport of multihoming service related information between user equipment and 3gpp evolved packet core

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"Technical Specification Group Core Network and Terminals; Evolved Packet System (EPS); 3GPP EPS AAA interfaces (Release 9)", 3GPP TS 29.273 V9.2.0, 31 March 2010 (2010-03-31), XP050402267 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016101267A1 (zh) * 2014-12-26 2016-06-30 华为技术有限公司 用户设备的非可信无线局域网接入控制方法、设备和系统
CN105934918A (zh) * 2014-12-26 2016-09-07 华为技术有限公司 用户设备的非可信无线局域网接入控制方法、设备和系统

Also Published As

Publication number Publication date
US9800563B2 (en) 2017-10-24
US20140245403A1 (en) 2014-08-28
JP2015501605A (ja) 2015-01-15
CN103201986B (zh) 2014-12-10
EP2763357B1 (en) 2019-03-13
EP2763357A4 (en) 2014-10-29
EP2763357A1 (en) 2014-08-06
CN103201986A (zh) 2013-07-10
JP5922785B2 (ja) 2016-05-24

Similar Documents

Publication Publication Date Title
WO2013063783A1 (zh) 一种数据安全通道的处理方法及设备
US20220225263A1 (en) Interworking function using untrusted network
KR101814969B1 (ko) 네트워크에 액세스하는 시스템 및 방법
US8621570B2 (en) Access through non-3GPP access networks
US11503469B2 (en) User authentication method and apparatus
US9503881B2 (en) Method, device, and system for user equipment to access evolved packet core network
WO2008131689A1 (fr) Procédé et système de fourniture d'un service de communication d'urgence et dispositifs correspondants
WO2012167500A1 (zh) 一种隧道数据安全通道的建立方法
WO2018170617A1 (zh) 一种基于非3gpp网络的入网认证方法、相关设备及系统
WO2013016968A1 (zh) 一种接入方法、系统及移动智能接入点
WO2013189217A1 (zh) 分组网关标识信息的更新方法、aaa服务器和分组网关
CN111726228B (zh) 使用互联网密钥交换消息来配置活动性检查
WO2010094244A1 (zh) 一种进行接入认证的方法、装置及系统
WO2012003760A1 (zh) 信息传递方法和系统
EP2317694B1 (en) Method and system and user equipment for protocol configuration option transmission
WO2016155012A1 (zh) 一种无线通信网络中的接入方法、相关装置及系统
WO2009152676A1 (zh) Aaa服务器、p-gw、pcrf、用户设备标识的获取方法和系统
WO2011116713A2 (zh) Mtc终端通过网关与网络通信的方法、设备及系统
WO2009012675A1 (fr) Passerelle de réseau d'accès, terminal, procédé et système pour établir une connexion de données
WO2010069202A1 (zh) 认证协商方法及系统、安全网关、家庭无线接入点
WO2011035667A1 (zh) 实现网间漫游的方法、系统及查询和网络附着方法及系统
WO2018058365A1 (zh) 一种网络接入授权方法、相关设备及系统
WO2013174190A1 (zh) 路由选择方法及功能网元
WO2010139285A1 (zh) 一种信息同步方法及通讯系统以及相关设备
WO2013037273A1 (zh) 一种对用户设备能力进行处理的方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11874986

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2011874986

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2014539203

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE